# Getting Started with kOps on Azure

**WARNING**: Azure support on kOps is currently in **alpha**, which means that it is in the early stages of development and subject to change, please use with caution.

## Features

* Create, update and delete clusters
* Create, edit and delete instance groups
* Generate Terraform configuration with `--target=terraform` (experimental, requires `AzureTerraform` feature flag)
* ...

## Requirements

* Latest kOps version installed
* kubectl installed
* Azure CLI installed
* Azure account with **Contributor** permissions for the cluster subscription and an existing storage account
* SSH key, both `id_ed25519` and `id_rsa` keys are supported

## Environment Variables

### Enable Azure

Since Azure support is currently in **alpha**, it is feature gated and you will need to set:

```bash
export KOPS_FEATURE_FLAGS="Azure"
```
### Azure-specific

```bash
export AZURE_SUBSCRIPTION_ID=<subscription-id>
```

### kOps-specific

```bash
export KOPS_STATE_STORE=azureblob://<storage-account-name>/<container-name>
```

## Creating a Single Master Cluster

```bash
# Create a cluster in zone northeurope-1
kops create cluster --cloud azure --name my.k8s --zones northeurope-1 --azure-admin-user ubuntu --yes
# Validate the cluster
kops validate cluster --name my.k8s --wait=10m
# Export the kubeconfig file with the cluster admin user (make sure you keep this user safe!)
kops export kubeconfig --name my.k8s --admin
```

## Updating a Cluster

```bash
# Edit the cluster configuration
kops edit cluster --name my.k8s 
# Edit the nodes instance group configuration
kops edit ig --name my.k8s nodes 
# Preview the changes to be applied to the cluster
kops update cluster --name my.k8s 
# Apply the changes to the cluster
kops update cluster --name my.k8s --yes 
# Preview the node that need to be updated
kops rolling-update cluster --name my.k8s 
# Replace the nodes that need to be updated
kops rolling-update cluster --name my.k8s --yes 
```

## Deleting a Cluster

```bash
# Preview the resources to be deleted
kops delete cluster --name my.k8s 
# Delete all the cluster resources
kops delete cluster --name my.k8s --yes 
```

## Managed Identities

kOps assigns a system-assigned managed identity to each VM Scale Set. The control-plane identity is granted the following built-in roles:

* **Contributor** on the cluster resource group, used by cloud-controller-manager, the Azure Disk CSI driver, etcd-manager and kops-controller.
* **Storage Blob Data Contributor** on the state-store storage account, used to read cluster configuration and write etcd backups.

Worker node identities are not granted any role.

## TODO

kOps for Azure currently does not support the following features:

* Azure AD Workload Identity
* Azure Disk volumes
* Azure Load Balancer
* Autoscaling (using Cluster Autoscaler or Karpenter)
* Multi-master clusters
* ...

## Next steps

Now that you have a working kOps cluster, read through the recommendations for [production setups guide](production.md) to learn more about how to configure kOps for production workloads.

## Migrating from earlier alpha versions

Older alpha releases used `azureblob://<container>/...` URLs and read the storage account from `AZURE_STORAGE_ACCOUNT`. To upgrade an existing cluster:

1. `unset AZURE_STORAGE_ACCOUNT` and re-export `KOPS_STATE_STORE` in the new shape.
2. `kops edit cluster` to update `spec.configStore.base` to the updated URL.
3. `kops update cluster --yes` and `kops rolling-update cluster --yes`.
