Preparar a infraestrutura para implantar o Kafka no AKS (Serviço de Kubernetes do Azure)

Definir variáveis de ambiente

• Antes de executar quaisquer comandos da CLI, defina as seguintes variáveis de ambiente a serem usadas em todo este guia com valores que atendam aos seus requisitos:

  export RESOURCE_GROUP_NAME="rg-kafka"  
  export LOCATION="canadacentral"  
  export VNET_NAME="vnet-aks-kafka"  
  export SUBNET_NAME="node-subnet"  
  export AKS_CLUSTER_NAME="aks-kafka-cluster"  
  export AKS_TIER=standard
  export NAT_GATEWAY_NAME="nat-kafka"  
  export ADDRESS_SPACE="10.31.0.0/20"  
  export SUBNET_PREFIX="10.31.0.0/21"  
  export SYSTEM_NODE_COUNT_MIN=3
  export SYSTEM_NODE_COUNT_MAX=6
  export SYSTEM_NODE_VM_SIZE="Standard_D4ds_v5"   
  export KAFKA_NODE_COUNT_MIN=1  
  export KAFKA_NODE_COUNT_MAX=3 
  export KAFKA_NODE_COUNT=1
  export KAFKA_NODE_VM_SIZE="Standard_D16ds_v5"  
  export LOG_ANALYTICS_WORKSPACE_NAME="law-monitoring"  
  export DIAGNOSTIC_SETTINGS_NAME="aks-diagnostic-settings"  
  export ACR_NAME="aksacr123"  
  export ACR_SKU="Premium"  
  export USER_ASSIGNED_IDENTITY_NAME="uami-aks"  
  export KUBERNETES_VERSION="1.30.0"  
  export AAD_ADMIN_GROUP_OBJECT_IDS="<your-admin-group-object-id>"    
  export AAD_TENANT_ID="<your-tenant-id>"  
  export GRAFANA_NAME="grafana-kafka-aks"  
  export PROMETHEUS_WORKSPACE_NAME="prometheus-aks"
  

Implantações de rede pré-cluster

Antes de implantar o cluster do AKS para Kafka, implante os recursos de rede de pré-requisito que dão suporte à implantação do cluster do AKS.

1. Crie um grupo de recursos usando o comando az group create.

   az group create --name $RESOURCE_GROUP_NAME --location $LOCATION
   

2. Criar uma rede virtual usando o comando az network vnet create.

   az network vnet create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name $VNET_NAME \
   --address-prefix $ADDRESS_SPACE \
   --location $LOCATION
   

3. Crie uma sub-rede usando o az network vnet subnet create comando.

   az network vnet subnet create \
   --resource-group $RESOURCE_GROUP_NAME \
   --vnet-name $VNET_NAME \
   --name $SUBNET_NAME \
   --address-prefix $SUBNET_PREFIX
   

4. Crie um IP público para o Gateway nat usando o az network public-ip create comando.

   az network public-ip create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name ${NAT_GATEWAY_NAME}-public-ip \
   --sku Standard \
   --location $LOCATION
   

5. Crie um Gateway nat usando o az network nat gateway create comando.

   az network nat gateway create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name $NAT_GATEWAY_NAME \
   --public-ip-addresses ${NAT_GATEWAY_NAME}-public-ip \
   --location $LOCATION
   

6. Associe o Gateway nat à sub-rede do nó usando o comando az network vnet subnet update.

   az network vnet subnet update \
   --resource-group $RESOURCE_GROUP_NAME \
   --vnet-name $VNET_NAME \
   --name $SUBNET_NAME \
   --nat-gateway $NAT_GATEWAY_NAME
   

Implantações de monitoramento e governança antes do cluster

Antes de implementar o cluster do AKS para Kafka, implemente os recursos necessários de monitoramento e governança que dão suporte à implementação do cluster AKS.

1. Crie um workspace do Log Analytics usando o comando az monitor log-analytics workspace create.

   az monitor log-analytics workspace create \
   --resource-group $RESOURCE_GROUP_NAME \
   --workspace-name $LOG_ANALYTICS_WORKSPACE_NAME \
   --location $LOCATION
   

2. Crie um workspace do Azure Monitor para Prometheus usando o comando az monitor account create.

   az monitor account create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name $PROMETHEUS_WORKSPACE_NAME \
   --location $LOCATION
   

3. Crie uma instância do Grafana gerenciada do Azure usando o az grafana create comando.

   az grafana create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name $GRAFANA_NAME \
   --location $LOCATION \
   --api-key Enabled \
   --deterministic-outbound-ip Enabled \
   --public-network-access Enabled \
   --grafana-major-version 11
   

   Observação

   O Grafana Gerenciado do Azure tem redundância de zona disponível em regiões selecionadas. Se sua região de destino tiver redundância de zona, use o --zone-redundancy Enabled argumento.

4. Crie um Registro de Contêiner do Azure usando o comando az acr create.

   az acr create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name $ACR_NAME \
   --sku $ACR_SKU \
   --location $LOCATION \
   --admin-enabled false \
   --zone-redundancy Enabled
   

5. Crie uma identidade gerenciada atribuída pelo usuário usando o comando az identity create.

   az identity create \
   --resource-group $RESOURCE_GROUP_NAME \
   --name $USER_ASSIGNED_IDENTITY_NAME \
   --location $LOCATION
   

6. Atribua permissões RBAC à identidade gerenciada da instância do Grafana usando o az role assignment create comando.

   az role assignment create \
   --assignee $(az grafana show --resource-group $RESOURCE_GROUP_NAME --name $GRAFANA_NAME --query identity.principalId -o tsv) \
   --role "Monitoring Reader" --scope $(az group show --name $RESOURCE_GROUP_NAME --query id -o tsv)
   

Implantação de cluster do AKS

Implante o cluster do AKS com pools de nós dedicados para Kafka por zona de disponibilidade usando a CLI do Azure.

1. Atribua a função de colaborador de rede à identidade gerenciada atribuída pelo usuário para AKS usando o az role assignment create comando.

   az role assignment create \
   --assignee $(az identity show --resource-group $RESOURCE_GROUP_NAME --name $USER_ASSIGNED_IDENTITY_NAME --query principalId -o tsv) \
   --role "Network Contributor" \
   --scope $(az group show --name $RESOURCE_GROUP_NAME --query id -o tsv)
   

2. Crie um cluster do AKS usando o comando az aks create.

   az aks create \
   --name $AKS_CLUSTER_NAME \
   --aad-admin-group-object-ids $AAD_ADMIN_GROUP_OBJECT_IDS \
   --aad-tenant-id $AAD_TENANT_ID \
   --assign-identity $(az identity show --resource-group $RESOURCE_GROUP_NAME --name $USER_ASSIGNED_IDENTITY_NAME --query id -o tsv) \
   --attach-acr $(az acr show --resource-group $RESOURCE_GROUP_NAME --name $ACR_NAME --query id -o tsv) \
   --auto-upgrade-channel patch \
   --enable-aad \
   --enable-addons monitoring \
   --enable-azure-monitor-metrics \
   --enable-cluster-autoscaler \
   --enable-managed-identity \
   --enable-oidc-issuer \
   --enable-workload-identity \
   --kubernetes-version $KUBERNETES_VERSION \
   --load-balancer-sku standard \
   --location $LOCATION \
   --max-count $SYSTEM_NODE_COUNT_MAX \
   --max-pods 110 \
   --min-count $SYSTEM_NODE_COUNT_MIN \
   --network-dataplane cilium \
   --network-plugin azure \
   --network-plugin-mode overlay \
   --network-policy cilium \
   --node-osdisk-type Ephemeral \
   --node-os-upgrade-channel NodeImage \
   --node-vm-size $SYSTEM_NODE_VM_SIZE \
   --nodepool-labels "role=system" \
   --nodepool-name systempool \
   --nodepool-tags "env=production" \
   --os-sku AzureLinux \
   --outbound-type userAssignedNATGateway \
   --pod-cidr 10.244.0.0/16 \
   --resource-group $RESOURCE_GROUP_NAME \
   --tags "env=production" \
   --tier $AKS_TIER \
   --vnet-subnet-id $(az network vnet subnet show --resource-group $RESOURCE_GROUP_NAME --vnet-name $VNET_NAME --name $SUBNET_NAME --query id -o tsv) \
   --workspace-resource-id $(az monitor log-analytics workspace show --resource-group $RESOURCE_GROUP_NAME --workspace-name $LOG_ANALYTICS_WORKSPACE_NAME --query id -o tsv) \
   --zones 1 2 3
   

3. Crie um pool de nós adicional por zona de disponibilidade usando um loop for e o comando az aks nodepool add.

   for zone in 1 2 3; do
     az aks nodepool add \
     --cluster-name $AKS_CLUSTER_NAME \
     --enable-cluster-autoscaler \
     --labels app=kafka \
     --max-count $KAFKA_NODE_COUNT_MAX \
     --max-surge 10% \
     --min-count $KAFKA_NODE_COUNT_MIN \
     --node-count $KAFKA_NODE_COUNT \
     --mode User \
     --name "kafka$zone" \
     --node-osdisk-type Ephemeral \
     --node-vm-size $KAFKA_NODE_VM_SIZE \
     --os-sku AzureLinux \
     --resource-group $RESOURCE_GROUP_NAME \
     --vnet-subnet-id $(az network vnet subnet show --resource-group $RESOURCE_GROUP_NAME --vnet-name $VNET_NAME --name $SUBNET_NAME --query id -o tsv) \
     --zones $zone
   done
   

4. Habilite a integração do Azure Managed Prometheus e do Grafana usando o az aks update comando.

   az aks update \
   --name $AKS_CLUSTER_NAME \
   --resource-group $RESOURCE_GROUP_NAME \
   --enable-azure-monitor-metrics \
   --azure-monitor-workspace-resource-id $(az monitor account show --resource-group $RESOURCE_GROUP_NAME --name $PROMETHEUS_WORKSPACE_NAME --query id -o tsv) \
   --grafana-resource-id $(az grafana show --resource-group $RESOURCE_GROUP_NAME --name $GRAFANA_NAME --query id -o tsv)
   

5. Opcional: defina a configuração de diagnóstico para o cluster do AKS usando o az monitor diagnostic-settings create comando.

   az monitor diagnostic-settings create \
   --resource $(az aks show --resource-group $RESOURCE_GROUP_NAME --name $AKS_CLUSTER_NAME --query id -o tsv) \
   --name $DIAGNOSTIC_SETTINGS_NAME \
   --workspace $(az monitor log-analytics workspace show --resource-group $RESOURCE_GROUP_NAME --workspace-name $LOG_ANALYTICS_WORKSPACE_NAME --query id -o tsv) \
   --logs '[{"category": "kube-apiserver", "enabled": true}, {"category": "kube-audit", "enabled": true}, {"category": "kube-audit-admin", "enabled": true}, {"category": "kube-controller-manager", "enabled": true}, {"category": "kube-scheduler", "enabled": true}, {"category": "cluster-autoscaler", "enabled": true}, {"category": "cloud-controller-manager", "enabled": true}, {"category": "guard", "enabled": true}, {"category": "csi-azuredisk-controller", "enabled": true}, {"category": "csi-azurefile-controller", "enabled": true}, {"category": "csi-snapshot-controller", "enabled": true}]' \
   --metrics '[{"category": "AllMetrics", "enabled": true}]'
   

Nesta seção, você implantará um cluster do AKS e oferecerá suporte a recursos de infraestrutura usando o Terraform:

• Um cluster do AKS privado com um pool de nós por zona de disponibilidade usando o AVM (Módulo Verificado do Azure).
• Configurações de rede virtual e sub-rede.
• Gateway NAT para conectividade de saída.
• Registro de Contêiner do Azure com ponto de extremidade privado.
• Identidade gerenciada atribuída pelo usuário para o AKS.
• Espaço de trabalho do Azure Monitor para métricas do Prometheus.
• Painel do Azure Managed Grafana com integração com o Prometheus.
• Pools de nós dedicados para cargas de trabalho do Kafka com rótulos apropriados.
• Driver CSI do Azure Disk para volumes persistentes (habilitado por padrão).

1. Copie o variables.tf para o seu diretório do Terraform.

   variable "azure_subscription_id" {
   type        = string
   description = "The Azure subscription ID to use for the resources."
   
   }
   variable "enable_telemetry" {
   type        = bool
   default     = true
   description = "This variable controls whether or not telemetry is enabled for the module."
   }
   
   variable "kubernetes_cluster_name" {
   type        = string
   default     = "kafka-cluster"
   description = "The name of the Kubernetes cluster."
   }
   
   variable "kubernetes_version" {
   type        = string
   default     = "1.30"
   description = "The version of Kubernetes to use for the cluster."
   }
   
   variable "resource_group_name" {
   type        = string
   description = "The name of the resource group in which to create the resources."
   }
   
   variable "rbac_aad_admin_group_object_ids" {
   type        = list(string)
   description = "The object IDs of the Azure AD groups that should be granted admin access to the Kubernetes cluster."    
   }
   
   variable "location" {
   type        = string
   description = "The location in which to create the resources."
   }
   

2. Examine as variáveis e crie uma kafka.tfvars conforme necessário. Atualize com valores que atendam aos seus requisitos:

   # Replace placeholder values with your actual configuration
   
   azure_subscription_id = "00000000-0000-0000-0000-000000000000" # Replace with your actual subscription ID
   location              = "Canada Central"
   enable_telemetry      = true
   kubernetes_cluster_name = "kafka-aks-cluster"
   kubernetes_version    = "1.30"
   resource_group_name   = "rg-kafka-prod"
   rbac_aad_admin_group_object_ids = [
   "0000-0000-0000-0000", 
   # Add additional admin group object IDs as needed
   ]
   

3. Copie o main.tf para o seu diretório do Terraform.

   terraform {
     required_version = ">= 1.3.0"
     required_providers {
       azurerm = {
         source  = "hashicorp/azurerm"
         version = ">= 4, <5"
       }
     }
   }
   provider "azurerm" {
     features {
       resource_group {
         prevent_deletion_if_contains_resources = false
       }
     }
     subscription_id = var.azure_subscription_id
   }
   module "naming" {
     source  = "Azure/naming/azurerm"
     version = ">= 0.3.0"
   }
   
   resource "azurerm_user_assigned_identity" "this" {
     location            = var.location
     name                = "uami-${var.kubernetes_cluster_name}"
     resource_group_name = var.resource_group_name
   }
   
   data "azurerm_client_config" "current" {}
   
   module "avm-ptn-aks-production" {
     source = "github.com/Azure/terraform-azurerm-avm-ptn-aks-production"
     kubernetes_version  = "1.30"
     enable_telemetry    = var.enable_telemetry 
     name                = var.kubernetes_cluster_name
     resource_group_name = var.resource_group_name
     location = var.location 
     default_node_pool_vm_sku = "Standard_D8ds_v5"
     network = {
       name                = module.avm_res_network_virtualnetwork.name
       resource_group_name = var.resource_group_name
       node_subnet_id      = module.avm_res_network_virtualnetwork.subnets["subnet"].resource_id
       pod_cidr            = "192.168.0.0/16"
     }
     acr = {
       name                          = module.naming.container_registry.name_unique
       subnet_resource_id            = module.avm_res_network_virtualnetwork.subnets["private_link_subnet"].resource_id
       private_dns_zone_resource_ids = [azurerm_private_dns_zone.this.id]
     }
     managed_identities = {
       user_assigned_resource_ids = [
         azurerm_user_assigned_identity.this.id
       ]
     }
     rbac_aad_tenant_id = data.azurerm_client_config.current.tenant_id
     rbac_aad_admin_group_object_ids =  var.rbac_aad_admin_group_object_ids
     rbac_aad_azure_rbac_enabled = true
   
     node_pools = {
       kafka = {
         name                 = "kafka"
         vm_size              = "Standard_D16ds_v5"
         orchestrator_version = "1.30"
         max_count            = 3
         min_count            = 1
         os_sku               = "AzureLinux"
         mode                 = "User"
         os_disk_size_gb      = 128
         labels = {
           "app" = "kafka"
         }
       }
     }
   }
   
   resource "azurerm_private_dns_zone" "this" {
     name                = "privatelink.azurecr.io"
     resource_group_name = var.resource_group_name
   }
   
   resource "azurerm_nat_gateway" "this" {
     location            = var.location
     name                = module.naming.nat_gateway.name_unique
     resource_group_name = var.resource_group_name
   }
   
   resource "azurerm_public_ip" "this" {
     name                = module.naming.public_ip.name_unique
     location            = var.location
     resource_group_name = var.resource_group_name
     allocation_method   = "Static"
     sku                 = "Standard"
   }
   
   resource "azurerm_nat_gateway_public_ip_association" "this" {
     nat_gateway_id       = azurerm_nat_gateway.this.id
     public_ip_address_id = azurerm_public_ip.this.id  
   }
   
   module "avm_res_network_virtualnetwork" {
     source  = "Azure/avm-res-network-virtualnetwork/azurerm"
     version = "0.7.1"
   
     address_space       = ["10.31.0.0/16"]
     location            = var.location
     name                = "vnet-aks-lab"
     resource_group_name = var.resource_group_name
     subnets = {
       "subnet" = {
         name             = "nodecidr"
         address_prefixes = ["10.31.0.0/17"]
         nat_gateway = {
           id = azurerm_nat_gateway.this.id
         }
         private_link_service_network_policies_enabled = false
       }
       "private_link_subnet" = {
         name             = "private_link_subnet"
         address_prefixes = ["10.31.129.0/24"]
       }
     }
   }
   
   resource "azurerm_monitor_workspace" "this" {
     name                = "prometheus-aks"
     location            = var.location
     resource_group_name = var.resource_group_name
   }
   
   resource "azurerm_monitor_data_collection_endpoint" "dataCollectionEndpoint" {
     name                = "prom-aks-endpoint"
     location            = var.location
     resource_group_name = var.resource_group_name
     kind                = "Linux"
   }
   
   resource "azurerm_monitor_data_collection_rule" "dataCollectionRule" {
     name      = "prom-aks-dcr"
     location            = var.location
     resource_group_name = var.resource_group_name
     data_collection_endpoint_id = azurerm_monitor_data_collection_endpoint.dataCollectionEndpoint.id
     kind                        = "Linux"
     description = "DCR for Azure Monitor Metrics Profile (Managed Prometheus)"
     destinations {
       monitor_account {
         monitor_account_id = azurerm_monitor_workspace.this.id
         name               = "PrometheusAzMonitorAccount"
       }
     }
     data_flow {
       streams      = ["Microsoft-PrometheusMetrics"]
       destinations = ["PrometheusAzMonitorAccount"]
     }
     data_sources {
       prometheus_forwarder {
         streams = ["Microsoft-PrometheusMetrics"]
         name    = "PrometheusDataSource"
       }
     }
   
   }
   
   resource "azurerm_monitor_data_collection_rule_association" "dataCollectionRuleAssociation" {
     name                    = "prom-aks-dcra"
     target_resource_id      = module.avm-ptn-aks-production.resource_id
     data_collection_rule_id = azurerm_monitor_data_collection_rule.dataCollectionRule.id
     description             = "Association of data collection rule. Deleting this association will break the data collection for this AKS Cluster."
   }
   
   resource "azurerm_dashboard_grafana" "this" {
     name                              = "grafana-kafka-aks"
     location                          = var.location
     resource_group_name               = var.resource_group_name
     api_key_enabled                   = true
     deterministic_outbound_ip_enabled = true
     public_network_access_enabled     = true
     grafana_major_version             = 11
   
     azure_monitor_workspace_integrations {
       resource_id = azurerm_monitor_workspace.this.id
     }
   
     identity {
       type = "SystemAssigned"
     }
   }
   
   data "azurerm_resource_group" "current" {
     name       = var.resource_group_name
     depends_on = [azurerm_dashboard_grafana.this]
   }
   
   resource "azurerm_role_assignment" "grafana_monitoring_reader" {
     scope                            = data.azurerm_resource_group.current.id
     role_definition_name             = "Monitoring Reader"
     principal_id                     = azurerm_dashboard_grafana.this.identity[0].principal_id
     skip_service_principal_aad_check = true
   }
   
   resource "azurerm_kubernetes_cluster_extension" "container_storage" {
     name           = "microsoft-azurecontainerstorage"
     cluster_id     = module.avm-ptn-aks-production.resource_id
     extension_type = "microsoft.azurecontainerstorage"
     configuration_settings = {
       "enable-azure-container-storage" : "azureDisk",
     }
   }
   

4. Inicialize o Terraform usando o terraform init comando.

   terraform init  
   

5. Crie um plano de implantação usando o terraform plan comando.

   terraform plan -var-file="kafka.tfvars"
   

6. Aplique a configuração usando o terraform apply comando.

   terraform apply -var-file="kafka.tfvars"