In this article, we will see how to install and get a WordPress site running on Azure Kubernetes Services,

• WordPress (To host the Website)
• Nginx (For Load balancing )
• Cert Manager ( Create and Issue let’s encrypt Certificates)
• Kubeapps ( Bitnami Packages)

Let’s create a resource group az-pr-uaen-web-rg and create an Azure Kubernetes Cluster in the specified resource group

Choose an appropriate SKU and leave the default autoscale

Leave things default

Choose a security group for Kubernetes Administration

Leave kubenet networking

not using calico or container registry in this scenario.

leave the secret store CSI driver disabled by default

Azure Kubernetes Cluster is created .

Let’s install Microsoft CLI and Chocolatey on the local machine.

Chocolatey Software | Installing Chocolatey

Install Kubernetes Helm using Choco

choco install kubernetes-helm

Install Bitnami repo using helm

helm repo add bitnami https://charts.bitnami.com/bitnami

Download kubectl.exe to run kubectl commands

curl -LO "https://dl.k8s.io/release/v1.24.0/bin/windows/amd64/kubectl.exe"

Download and install kubelogin if you want to authenticate to AKS using Azure AD

Login to aks cluster

az aks get-credentials --resource-group az-pr-uaen-web-rg --name az-aks-azure365pro --admin

if you have multiple subscriptions

az login
Get the subscription ID you are working on 
az account list -o table --all
az account set --subscription e08f63cf-xxxx-44e3-ba41-xxxxxxx
az aks get-credentials --resource-group az-pr-uaen-web-rg --name az-aks-azure365pro --admin
kubectl get namespaces

To list all namespaces

Add Bitnami repo
create kubeapps namespace
Install bitnami kubeapps

helm repo add bitnami https://charts.bitnami.com/bitnami
kubectl create namespace az-kubeapps
helm install kubeapps bitnami/kubeapps -n az-kubeapps

Now kubeapps is installed – We will configure things to access them using an nginx load balancer.

kubectl create serviceaccount kubeapps-operator
kubectl create clusterrolebinding kubeapps-operator --clusterrole=cluster-admin --serviceaccount=default:kubeapps-operator
kubectl get secret $(kubectl get serviceaccount kubeapps-operator -o jsonpath='{.secrets[].name}') -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}'

if you run on Windows 10
‘base64decode}}” is not recognized as an internal or external command, operable program, or batch file.
switch to Powershell

.\kubectl.exe get secret $(.\kubectl.exe get serviceaccount kubeapps-operator -o jsonpath='{.secrets[].name}') -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}'

A secret token has to be generated like below to get inside kubeapps , Copy the token to a safe location

To update helm repo
helm repo update
Install Nginx controller / Please note we are utilizing the native Nginx controller here.

kubectl create namespace az-nginx
helm install az-nginx bitnami/nginx-ingress-controller -n az-nginx

Now Nginx is available with an external IP

kubectl get svc -n az-nginx
kubectl get svc  --all-namespaces

Expose kubeapps at port 80 just to access for now. later we can apply SSL

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: kubeapps
namespace: kubeapps
spec:
ingressClassName: nginx
rules:
– host: kubeapps.azure365pro.com
http:
paths:
– pathType: Prefix
backend:
service:
name: kubeapps
port:
number: 80
path: /

kubectl apply -f .\kubeapps-ingress.yaml –namespace az-kubeapps

Deleting bad ingress rules – For Examples only

kubectl get all,nodes,ing -A -o wide

To list Helm installations

To uninstall Helm installations – For examples only
helm uninstall az-nginx

Choosing to install with Cluster IP as we will use the nginx IP to publish and Expose using lets encrypt SSL .

ingress without SSL – YAML samples

Install cert-manager with InstallCRDs true

issuer.yaml with staging lets encrypt . Once you confirm things are working as expected. you can get the live URL updated.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
# Update with real email
email: info@azure365pro.com
server: https://acme-staging-v02.api.letsencrypt.org/directory
# To use on production , use the following line instead:
#server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: issuer-letsencrypt-staging
solvers:
– http01:
ingress:
class: nginx

Created issuer
Listing Secrets

kubectl apply -f issuer.yaml -n az-cert
kubectl get secrets -n az-cert

cert.yaml for cluster issuer – secret and WordPress should be in the same namespace inorder to work seamlessly.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: az-wp-1
spec:
secretName: virtualpetals-tls
dnsNames:
– www.virtualpetals.com
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer

kubectl apply -f cert.yaml -n az-wp

Applying TLS rules on nginx

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: az-wp
namespace: az-wp
spec:
ingressClassName: nginx
tls:
– hosts:
– www.virtualpetals.com
secretName: virtualpetals-tls
rules:
– host: www.virtualpetals.com
http:
paths:
– path: /
pathType: Prefix
backend:
service:
name: az-wp-1-wordpress
port:
number: 80

kubectl apply -f wp-ingress.yaml -n az-wp

To describe ingress using ing

To check current YAML Config

As we are using a staging issuer, It shows staging. Once we feel SSL is getting assigned and staging getting issued.
We are good to convert to production

Good to know – To list and delete files from a running container

kubectl exec az-wp-1-wordpress-6cb985c596-84j8j -n az-wp -- ls /bitnami/wordpress/wp-content/plugins/really-simple-ssl
kubectl exec az-wp-1-wordpress-6cb985c596-84j8j -n az-wp -- sh -c 'rm -rf /bitnami/wordpress/wp-content/plugins/really-simple-ssl/*'

Getting the production URL live and disabling the staging URL

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
# Update with real email
email: info@azure365pro.com
#server: https://acme-staging-v02.api.letsencrypt.org/directory
# To use on production , use the following line instead:
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: issuer-letsencrypt-production
solvers:
– http01:
ingress:
class: nginx

kubectl apply -f issuer-prod.yaml -n az-cert

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: az-wp-0
namespace: az-wp
spec:
secretName: virtualpetals-tls-pr
dnsNames:
– www.virtualpetals.com
– virtualpetals.com
issuerRef:
name: letsencrypt-production
kind: ClusterIssuer

To increase body size in ingress for bulk uploads for example.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: az-wp
namespace: az-wp
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: 400m
spec:
ingressClassName: nginx
tls:
– hosts:
– www.virtualpetals.com
– virtualpetals.com
secretName: virtualpetals-tls-pr
rules:
– host: “www.virtualpetals.com”
http:
paths:
– path: /
pathType: Prefix
backend:
service:
name: az-wp-1-wordpress
port:
number: 80
– host: “virtualpetals.com”
http:
paths:
– path: /
pathType: Prefix
backend:
service:
name: az-wp-1-wordpress
port:
number: 80

Now website is up using Azure Kubernetes Services.

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: az-wp-1
spec:
secretName: kubeapps.azure365pro.com
dnsNames:
– kubeapps.azure365pro.com
issuerRef:
name: letsencrypt-production
kind: ClusterIssuer

kubectl apply -f cert-prod-kubeapps.yaml -n az-kubeapps

Now you can see Kubeapps is live with SSL / WordPress is live with SSL / Nginx is configured with Cert Manager.