SSH to Azure's Kubernetes managed master node

Question

I just deployed a managed Kubernetes cluster with Azure Container Service. My deployment includes a single agent machine over the managed cluster and an Azure disk attached to it for persistent storage.

The problem I am facing is that I don't know how to ssh this agent server. I read that you should be able to ssh the master node and connect to the agent from there but as I am using a managed Kubernetes master I can't find the way of doing this.

Any idea? Thank you in advance.

Answer 1

The easiest way is to use the below, this will create a tiny priv pod on the node and access the node using nsenter.

https://github.com/mohatb/kubectl-wls

Answer 2

Basically, you don't even have to create a public IP to that node. Simply add public ssh key to the desired node with Azure CLI:

az vm user update --resource-group <NODE_RG> --name <NODE_NAME> --username azureuser --ssh-key-value ~/.ssh/id_rsa.pub

Then run temporary pod with (Don't forget to switch to the desired namespace in kubernetes config):

kubectl run -it --rm aks-ssh --image=debian

Copy private ssh key to that pod:

kubectl cp ~/.ssh/id_rsa <POD_NAME>:/id_rsa

Finally, connect to the AKS node from pod to private IP:

ssh -i id_rsa azureuser@<NODE_PRIVATE_IP>

In this way, you don't have to pay for Public IP and in addition, this is good from security perspective.

Answer 3

The problem I am facing is that I don't know how to ssh this agent server.

Do you mean you create AKS and can't find master VM?

If I understand it correctly, that is a by design behavior, AKS does not provide direct access (Such as with SSH) to the cluster.

If you want to SSH to the agent node, as a workaround, we can create a public IP address and associate this public IP address to the agent's NIC, then we can SSH to this agent.

Here are my steps:

1.Create Public IP address via Azure portal:

2.Associate the public IP address to the agent VM's NIC:

3.SSH to this VM with this public IP address:

Note:

By default, we can find ssh key when we try to create AKS, like this: