Use the Template to Deploy an AKS Cluster

On GitHub, go to PaloAltoNetworks/azure-aks and locate the build package in the repository.

Unzip the build package. Edit the files

azuredeploy.json

and

parameters.json

for your own deployment, and save.

Issue the following Azure CLI commands to deploy the template.

az group deployment validate --resource-group RG_NAME 
--template-file azuredeploy.json 
--parameters @parameters.json

az group deployment create --name DEPLOYMENT_NAME 
--resource-group RG_NAME
--template-file azuredeploy.json 
--parameters @parameters.json

Deploy your applications or services on the AKS Cluster.

Annotate your service YAML file so that the type is load balancer, and annotate it as service.beta.kubernetes.io/azure-load-balancer-internal: "true". For example:
  apiVersion: v1
    kind: Service
  metadata:
   name: azure-vote-front
   labels:
     service: "azure-vote-front"
     tier: "stagingapp"
   
annotations:
     service.beta.kubernetes.io/azure-load-balancer-internal: "true"
  spec:
   
type: LoadBalancer
 ports:
 - port: 80
 selector:
  app: azure-vote-front
If you have not done so, create AKS cluster authentication before continuing.
Deploy your service on your AKS cluster.
For example, you can deploy your application through kubectl:
kubectl apply -f myapplication.yaml
For a sample, see: https://github.com/Azure-Samples/azure-voting-app-redis/blob/master/azure-vote-all-in-one-redis.yaml
Use kubectl to get the service IP for the deployed service.
kubectl get services -o wide

In the EXTERNAL-IP column 10.240.0.97 is for the ILB, according to your annotation in Step a. Use the service IP to create a user defined route on Azure.

Create a UDR rule to point your service to the Firewall ILB behind the Application Gateway.

In Azure, go to your inbound spoke resource group, view the route table and add a new route based on the destination service IP. In the following screen, the value in the tov1service

ADDRESS PREFIX

column is the service IP.

Connect the AKS Cluster in Azure Plugin for Panorama

Select

Panorama

Azure

Deployments

to view the monitoring definition you created when you configured the deployment. As shown below, if

Auto Program Routes

is enabled, the firewall routes are programmed for you.



In AKS, tag your Resource Groups. The tags are name/value pairs.

Select
Home
Resource groups
and choose a resource group.
Select
Tags
and define name/value pairs. As shown in the following figure, the tag names must be inboundgrouprg and HubRG:
inboundgrouprg—your spoke resource group name
HubRG—your hub resource group name

The template takes the name of the Spoke resource group as a parameter, and tags the VNet and AKS cluster with the Spoke resource group name so that it can be discovered by the Panorama plugin for Azure.

The templates deploy resources in separate VNets. If you manually deploy the AKS cluster and service in the same VNet as the Spoke firewall set, you must manually create tags for the spoke resource group name.

In Panorama, select

Panorama

Azure

Setup.

On the

General

tab, enable monitoring.

On the

Notify Groups

tab,

Add

a notification group and select the device groups to be notified.



On the

Service Principal

tab,

Add

and

Validate

a service principal.

Use the Service Principal you created for the orchestrated deployment.



On the

AKS Cluster

tab,

Add

an AKS cluster.

Enter the exact name of the AKS cluster.
Enter the API server address. To find the address in Azure, view your AKS service and select Overview.
Upload the AKS credential JSON file (see Create AKS Cluster Authentication).

Fill in the remaining fields and

Add

one or more tags.

If you have service names or tags that are not unique across namespaces, use the label selector to filter both a tag and a namespace so that you get a unique result.



Select

Panorama

Azure

Monitoring Definition

Add a Monitoring definition.

Enter a name and description, and select

AKS Cluster Monitoring

.

Select an

AKS Cluster

and a

Notify Group

, check

Enable

, and click

OK

.

Set Up VNet Peering

Redirect Traffic to a Firewall ILB

Create URL routing rules that redirect web traffic to the appropriate backend pool.
Update the UDR rules for the application gateway subnet to add a route for the service CIDR, with the next hop being the Inbound Firewall Load Balancer from the Spoke firewall resource group.