Deploy Azure Storage Account with Meshery

In this tutorial, you deploy an Azure Storage Account from a Meshery Design. Meshery manages Azure resources through Azure Service Operator (ASO), which represents each Azure resource as a Kubernetes custom resource. You install ASO in your cluster, give it an Azure identity, and then deploy a Storage Account design.

Before you begin

  • Meshery, deployed by following the installation guides, with a Kubernetes cluster connected to it. In Meshery UI, the cluster appears as Connected under Lifecycle → Connections.
  • kubectl, configured for the same cluster.
  • An Azure subscription to create resources in.
  • The Azure CLI, signed in with az login.

1. Create a service principal

ASO signs in to Azure as a service principal. Create one with the Contributor role on your subscription:

az ad sp create-for-rbac -n azure-service-operator --role contributor --scopes /subscriptions/<AZURE_SUBSCRIPTION_ID>

The command prints appId, displayName, password, and tenant. Export them, with your subscription ID, for the next steps:

export AZURE_CLIENT_ID=<appId>
export AZURE_CLIENT_SECRET=<password>
export AZURE_TENANT_ID=<tenant>
export AZURE_SUBSCRIPTION_ID=<subscription-id>

2. Install cert-manager

ASO needs cert-manager for its webhook certificates. Install it, and wait for its Pods to be ready:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.1/cert-manager.yaml
kubectl wait --for=condition=Available deployment --all -n cert-manager --timeout=180s

3. Install Azure Service Operator

  1. Apply the ASO operator manifest:

    kubectl apply --server-side=true -f https://github.com/Azure/azure-service-operator/releases/download/v2.13.0/azureserviceoperator_v2.13.0.yaml

    This manifest installs the operator but no resource CRDs, because its --crd-pattern is empty. Meshery installs the CRDs that your design’s Azure components need when you deploy the design. See Auto-Deployment of CRDs and Operators.

  2. Create the secret ASO reads its Azure identity from. ASO looks for a secret named aso-controller-settings in the azureserviceoperator-system namespace:

    kubectl create secret generic aso-controller-settings \
  --namespace azureserviceoperator-system \
  --from-literal=AZURE_SUBSCRIPTION_ID="$AZURE_SUBSCRIPTION_ID" \
  --from-literal=AZURE_TENANT_ID="$AZURE_TENANT_ID" \
  --from-literal=AZURE_CLIENT_ID="$AZURE_CLIENT_ID" \
  --from-literal=AZURE_CLIENT_SECRET="$AZURE_CLIENT_SECRET"

  3. Confirm that the operator is running:

    kubectl get pods -n azureserviceoperator-system

4. Design and deploy a Storage Account

  1. Open the Meshery Catalog, filter by Azure, and clone the StorageAccount design. Open it in Kanvas.
  2. Open the Storage Account component’s configuration and set:
    • resourceGroupName: an existing resource group in your subscription
    • location: an Azure region, for example eastus
    • accountName: a globally unique name, 3 to 24 lowercase letters and numbers
    • accessTier: Hot or Cool
  3. Click Actions, then Deploy. For what each step of the deployment does, see Deploying a Design.

5. Verify the deployment

In the Azure portal, open your resource group and confirm that the new Storage Account is there. You can also check its status in the cluster:

kubectl get storageaccounts.storage.azure.com --all-namespaces

The READY column shows True once Azure has created the account.

Clean up

Undeploy the design from Meshery. ASO deletes the Storage Account. To remove the service principal, run az ad sp delete --id "$AZURE_CLIENT_ID".

What you learned

  • ASO turns Kubernetes custom resources into Azure resources, using the identity in aso-controller-settings.
  • A catalog design gives you a working starting point that you clone and adjust.

For more about ASO, see the ASO documentation.

Related Reading