Connect Azure Kubernetes Service (AKS) to Consul Dedicated
HashiCorp Cloud Platform (HCP) Consul is a fully managed Service Mesh as a Service version of Consul. After you deploy an HCP Consul Dedicated server cluster, you can connect the Consul resources in your network to HCP Consul Dedicated to leverage Consul's full feature set including service mesh and service discovery. For Azure, HCP Consul Dedicated supports Consul resources running on Azure Kubernetes Service (AKS) and virtual machine (VM) workloads.
In this tutorial, you will configure your AKS cluster to connect to your HCP Consul cluster. Then, you will deploy HashiCups, a demo application that lets you view and order customized HashiCorp branded coffee, to your AKS cluster to leverage HCP Consul Dedicated's service discovery, service mesh, and ingress capabilities.
Prerequisites
For this tutorial, you will need:
- An HCP HashiCorp Virtual Network (HVN)
- An HCP Consul Dedicated deployment
- An AKS Cluster deployed in the VPC peered with your HVN
- the Azure CLI
- kubectl
- helm
- jq
To ensure that communication between your HCP Consul Dedicated cluster servers and the Consul resources in your AKS cluster is possible, you must complete the steps detailed in either the manual deployment or in the Terraform deployment tutorial. It is also mandatory that your AKS cluster is deployed in the Virtual Network that has been associated with your HVN. Otherwise, there will not be a configured peering connection, and the control plane running on the HCP Consul Dedicated cluster servers will not be able to communicate with the data plane provided by the Consul resources that you will be installing to the AKS cluster.
Configure development host
Consul versions prior to 1.14.0
use a client-based architecture while the latest versions of Consul can support a more lightweight Dataplane architecture. Feel free to explore the Consul Dataplane documentation to learn more.
Select your version of HCP Consul Dedicated to ensure all instructions are relevant to your architecture.
Now that you have deployed HCP Consul Dedicated, you need to retrieve the Consul configuration information. You will use this information to configure the Consul resources on your AKS cluster to securely connect to the HCP Consul Dedicated cluster.
First, login to the Azure Shell on your console.
Kubernetes stores cluster connection information in a special file called kubeconfig
. You can retrieve the Kubernetes configuration settings for your AKS cluster and merge them into your local kubeconfig
file by issuing the following command.
Customize and configure your Consul installation
In this section you will use the HCP Portal to retrieve the Consul configuration information you need to connect your AKS cluster Consul resources to your HCP Consul Dedicated cluster.
Navigate to the Consul resource page in the HCP portal, and then select the Consul cluster you want to connect with your AKS cluster. Set the name of your HCP Consul Dedicated cluster to the DATACENTER
environment variable on your development host.
Within the HCP portal, click the Access Consul dropdown, then select the copy icon for the private address or public address field from the dialog box. The public or private address is now in your clipboard. Set this address to the RETRY_JOIN
environment variable on your development host so that you can reference it later in the tutorial.
From the same Access Consul dropdown in the HCP UI, select Generate admin token and then click copy icon from the dialog box. A global-management root token is now in your clipboard. Set this token to the CONSUL_HTTP_TOKEN
environment variable on your development host so that you can reference it later in the tutorial.
Create a consul
namespace in your Kubernetes cluster. Your Consul secrets and resources will be created in this namespace.
HCP Consul Dedicated is secure by default. This means that your AKS-based Consul resources need to be configured with a secure ACL token to establish secure communication with HCP. Create a Kubernetes secret with your Consul ACL token value.
Set the KUBE_API_URL
environment variable to the API server URL of your AKS cluster.
Note
The following command relies on your cluster matching your current-context name. If you have created an alias for your context, or the current-context name does not match the cluster name for any other reason, you must manually set the KUBE_API_URL
to the API server URL of your AKS cluster. You can use kubectl config view
to view your cluster, and retrieve the API server URL.
Validate that all of your environment variables have been set.
Note
If any of these environment variables are not correctly set, the following script will generate an incomplete Helm values file, and the Consul Helm installation will not succeed.
Warning
The value for the global.name
configuration must be unique for each Kubernetes cluster where Consul clients are installed and configured to join Consul as a shared service, such as HCP Consul Dedicated. You can change the global name through the global.name
value in the Helm chart.
Install Consul on AKS
Generate your customized Consul configuration file.
Validate that the config file is populated correctly.
Deploy Consul
Now that you have customized your values.yaml
file, you can deploy Consul with Helm or the Consul K8S CLI. We recommend you deploy Consul into its own dedicated namespace as shown below. This should only take a few minutes. The Consul pods should appear in the pod list immediately.
Tip
HashiCorp Cloud Platform offers Enterprise features. To interact with these features, you need to install the Enterprise Consul binary for your client agents. Learn more information about Consul Enterprise and the Helm Chart in the Consul Enterprise Helm Chart documentation.
To check the deployment process on the command line you can use kubectl get pods
.
Deploy an example workload
Now that the Consul resources have been deployed on AKS, it is time to deploy an application workload. This tutorial will use the HashiCups demo application, an ingress gateway, and service intentions.
Issue the following command to clone the repository.
Change directory into the example repository.
Issue the following command to deploy the demo application, ingress gateway, and service intentions to your AKS cluster.
Example output:
Access the HashiCups UI
With the resources in place, retrieve the public IP address and port of the ingress gateway.
Verify you have successfully deployed the application by visiting your unique ingress gateway EXTERNAL-IP
in your browser, or use the following curl
command.
Example output:
This validates that Consul service discovery is working, because the services are able to resolve the upstreams. This also validates that Consul service mesh is working, because the intentions that were created are allowing services to interact with one another.
Next steps
In this tutorial, you connected your AKS environment to HCP Consul Dedicated and deployed a demo application. To keep learning about Consul's features, and for step-by-step examples of how to perform common Consul tasks, complete one of the following tutorials.
- Explore the Consul UI
- Review recommend practices for Consul on Kubernetes
- Deploy a metrics pipeline with Prometheus and Grafana
If you encounter any issues, please contact the HCP team at support.hashicorp.com.