AKS Cluster

open Farmer
open Farmer.Builders
open Farmer.ContainerService

let myAks = aks {
    name "aks-cluster"
    service_principal_use_msi
}

let myAks = aks {
    name "k8s-cluster"
    dns_prefix "testaks"
    add_agent_pools [
        agentPool {
            name "linuxPool"
            count 3
        }
    ]
    linux_profile "aksuser" "public-key-here"
    service_principal_use_msi
    network_profile (
        azureCniNetworkProfile {
            service_cidr "10.250.0.0/16"
        }
    )
}

// Create an identity for kubelet (used to connect to container registry)
let kubeletMsi = createUserAssignedIdentity "kubeletIdentity"
// Create an identity for the AKS cluster
let clusterMsi = createUserAssignedIdentity "clusterIdentity"
// Give the AKS cluster's identity rights to assign a the kubelet MSI
let assignMsiRoleNameExpr = ArmExpression.create($"guid(concat(resourceGroup().id, '{clusterMsi.ResourceId.Name.Value}', '{Roles.ManagedIdentityOperator.Id}'))")
let assignMsiRole =
    { Name =
        assignMsiRoleNameExpr.Eval()
        |> ResourceName
        RoleDefinitionId = Roles.ManagedIdentityOperator
        PrincipalId = clusterMsi.PrincipalId
        PrincipalType = PrincipalType.ServicePrincipal
        Scope = ResourceGroup
        Dependencies = Set [ clusterMsi.ResourceId ] }
// Create a container image registry
let myAcr = containerRegistry { name "mycontainerregistry" }
let myAcrResId = (myAcr :> IBuilder).ResourceId
// Assign the AcrPull role on that registry to the identity used for kubelet.
let acrPullRoleNameExpr = ArmExpression.create($"guid(concat(resourceGroup().id, '{kubeletMsi.ResourceId.Name.Value}', '{Roles.AcrPull.Id}'))")
let acrPullRole =
    { Name = acrPullRoleNameExpr.Eval() |> ResourceName
        RoleDefinitionId = Roles.AcrPull
        PrincipalId = kubeletMsi.PrincipalId
        PrincipalType = PrincipalType.ServicePrincipal
        Scope = AssignmentScope.SpecificResource myAcrResId
        Dependencies = Set [ kubeletMsi.ResourceId ] }

// Create the cluster and assign the cluster and kubelet identities.
let myAks = aks {
    name "aks-cluster"
    add_identity clusterMsi
    service_principal_use_msi
    kubelet_identity kubeletMsi
    depends_on clusterMsi
    depends_on myAcr
    depends_on_expression assignMsiRoleNameExpr
    depends_on_expression acrPullRoleNameExpr
}
// A template to deploy the MSI's, role assignemnts, container registry and AKS.
let template =
    arm {
        add_resource kubeletMsi
        add_resource clusterMsi
        add_resource myAcr
        add_resource myAks
        add_resource assignMsiRole
        add_resource acrPullRole
    }