• I'm trying to install Sitecore 10 on AKS so I was following the steps in Installation_Guide_for_Production_Deployments_with_Kubernetes_XP10.0.0.pdf

    • Installed azureCli & helm on my local pc
    • az login
    • az account set --subscription "MySubscription"
    • az aks create --resource-group MyResourceGroup --name sc10aks --node-count 1 --enable-addons monitoring --generate-ssh-keys
    • az aks install-cli
    • az aks get-credentials --resource-group MyResourceGroup --name sc10aks
    • kubectl get nodes (Working fine)
    • I managed to create all this files based on the documentation
      • \k8s\ltsc2019\xp1\secrets\sitecore-license.txt
      • \k8s\ltsc2019\xp1\secrets\sitecore-identitycertificate.txt
      • \k8s\ltsc2019\xp1\secrets\tls\global-cm\tls.crt
      • k8s\ltsc2019\xp1\secrets\tls\global-cd\tls.crt
      • k8s\ltsc2019\xp1\secrets\tls\global-id\tls.crt
      • Paste TheCertPassword in sitecore-identitycertificatepassword.txt
    • Put a random generated string on sitecore-telerikencryptionkey.txt, sitecore-identitysecret.txt, sitecorereportingapikey.txt
    • Filled up those with random generated strings as well, this will be the passwords
      • sitecore-adminpassword.txt, sitecore-databasepassword, sitecore-collection-shardmapmanager-database-password, sitecore-core-database-password.txt, sitecore-exm-master-database-password, sitecore-forms-database-password, sitecore-marketing-automation-database-password, sitecore-master-database-password, sitecore-messaging-database-password, sitecore-processing-engine-tasks-database-password, sitecore-processing-tasks-database-password, sitecore-reference-data-database-password, sitecore-reporting-database-password, sitecore-web-database-password
      • helm repo add stable https://kubernetes-charts.storage.googleapis.com/
      • helm install nginx-ingress stable/nginx-ingress --set controller.replicaCount=1 --set controller.nodeSelector."beta\.kubernetes\.io/os"=linux --set defaultBackend.nodeSelector."beta\.kubernetes\.io/os"=linux --set-string controller.config.proxy-body-size=10m --set controller.service.externalTrafficPolicy=Local
      • kubectl apply -k ./secrets/
        • This commands succeeds and print: secret/global-cd-tls created secret/global-cm-tls created secret/global-id-tls created secret/sitecore-admin created secret/sitecore-database created secret/sitecore-identitycertificate created secret/sitecore-identity created secret/sitecore-license created secret/sitecore-reporting created secret/sitecore-solr-xdb created secret/sitecore-solr created secret/sitecore-telerik created
      • kubectl apply -f ./external/
        • This commands succeeds and print: service/mssql created deployment.apps/mssql created service/redis created deployment.apps/redis created service/solr created deployment.apps/solr created
        • My problem is here, it succeeds but I never see it green in azure, there is always this warning sign.
        • Running kubectl get pods -o wide mssql, redis, solr status is always pending azure AKS
        • Because of the previous kubectl apply -f ./init/
  • Running kubectl describe pod is giving me this result: Normal Successfully assigned default/mssql-init-zd49r to aks-nodepool1-34023802-vmss000000 Normal Pulling image "scr.sitecore.com/sxp/sitecore-xp1-mssql-init:10.0.0-ltsc2019" Warning Failed to pull image "scr.sitecore.com/sxp/sitecore-xp1-mssql-init:10.0.0-ltsc2019": rpc error: code = Unknown desc = Error response from daemon: Get https://scr.sitecore.com/v2/: x509: certificate signed by unknown authority Warning Error: ErrImagePull Normal Back-off pulling image "scr.sitecore.com/sxp/sitecore-xp1-mssql-init:10.0.0-ltsc2019" Warning Error: ImagePullBackOff

  • In the logs I can see those errors:

    • Error creating: pods "tunnelfront-67d969bc5f-" is forbidden: error looking up service account kube-system/tunnelfront: serviceaccount "tunnelfront" not found
    • Error creating: pods "coredns-autoscaler-868b684fd4-" is forbidden: error looking up service account kube-system/coredns-autoscaler: serviceaccount "coredns-autoscaler" not found
  • I also tried to have ACR attached to the k8s service but this didn't help either $MYACR="myContainerRegistry" az acr create -n $MYACR -g my_rg_AKS --sku basic az aks create -n sc10aks -g my_rg_AKS --generate-ssh-keys --attach-acr $MYACR

  • I was wondering when if it's going to be used sitecore-database-elastic-pool-name.txt , so I tried one time when it was empty and I tried to install while it contains ElasticPool in the file, but it didn't help, the mssql, redis, solr status is always pending

Sorry for the long question, but you can reproduce the issue just from this steps.

  • 1
    Can you please re run the external services again and see the status of prod. I mean this command kubectl apply -f ./external/ and please check the status of Prod in azure portal My 2 cent would be it's related to prod throttling under the current load and it ended up with tunnelfront and autoscaler not found, can you please recheck the cluster size and also check if the DNS horizontal autoscaling is already enabled or not kubectl get deployment --namespace=kube-system – Jitendra soni Dec 2 '20 at 22:18
  • I also received the "Failed to pull image" message on the mssql init job. Do you found any solution for that issue? – aklein Feb 5 at 10:56


Check my scripts at https://github.com/bplasmeijer/Sitecore-Symposium-2020-Containers-AKS and check 2.CreateAKS.ps1, do you have a windows node on your cluster?

az aks create --resource-group MyResourceGroup --name sc10aks --node-count 1 --enable-addons monitoring --generate-ssh-keys does not create a windows node.



If you are looking to deploy a Sitecore 10 Dev/Non-Prod Instance you might give my "all in one" powershell deployment script a try. Its targeted for XM, I will be creating one for XP as well as time allows, or you could use what I have here as a template and just do it yourself.

Heres the repo:


Your subscription account will need to have "User Access Administrator” rights in order for it to work.

I hope this helps


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.