-
Notifications
You must be signed in to change notification settings - Fork 1.9k
OSDOCS#5126: Using an Azure managed identity as an alternative to a s… #62875
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| // Module included in the following assemblies: | ||
| // | ||
| // * installing/installing_azure/installing-azure-account.adoc | ||
|
|
||
| :_content-type: CONCEPT | ||
| [id="installation-azure-identities_{context}"] | ||
| = Supported identities to access Azure resources | ||
|
|
||
| An {product-title} cluster requires an Azure identity to create and manage Azure resources. As such, you need one of the following types of identities to complete the installation: | ||
|
|
||
| * A service principal | ||
| * A system-assigned managed identity | ||
| * A user-assigned managed identity |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| // Module included in the following assemblies: | ||
| // | ||
| // * installing/installing_azure/installing-azure-account.adoc | ||
|
|
||
| :_content-type: PROCEDURE | ||
| [id="installation-azure-subscription-tenant-id_{context}"] | ||
| = Recording the subscription and tenant IDs | ||
|
|
||
| The installation program requires the subscription and tenant IDs that are associated with your Azure account. You can use the Azure CLI to gather this information. | ||
|
|
||
| .Prerequisites | ||
|
|
||
| * You have installed or updated the link:https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-yum?view=azure-cli-latest[Azure CLI]. | ||
|
|
||
| .Procedure | ||
|
|
||
| . Log in to the Azure CLI by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az login | ||
| ---- | ||
|
|
||
| . Ensure that you are using the right subscription: | ||
|
|
||
| .. View a list of available subscriptions by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az account list --refresh | ||
| ---- | ||
| + | ||
| .Example output | ||
| [source,terminal] | ||
| ---- | ||
| [ | ||
| { | ||
| "cloudName": "AzureCloud", | ||
| "id": "8xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "isDefault": true, | ||
| "name": "Subscription Name 1", | ||
| "state": "Enabled", | ||
| "tenantId": "6xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "user": { | ||
| "name": "you@example.com", | ||
| "type": "user" | ||
| } | ||
| }, | ||
| { | ||
| "cloudName": "AzureCloud", | ||
| "id": "9xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "isDefault": false, | ||
| "name": "Subscription Name 2", | ||
| "state": "Enabled", | ||
| "tenantId": "7xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "user": { | ||
| "name": "you2@example.com", | ||
| "type": "user" | ||
| } | ||
| } | ||
| ] | ||
| ---- | ||
|
|
||
| .. View the details of the active account, and confirm that this is the subscription you want to use, by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az account show | ||
| ---- | ||
| + | ||
| .Example output | ||
| [source,terminal] | ||
| ---- | ||
| { | ||
| "environmentName": "AzureCloud", | ||
| "id": "8xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "isDefault": true, | ||
| "name": "Subscription Name 1", | ||
| "state": "Enabled", | ||
| "tenantId": "6xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "user": { | ||
| "name": "you@example.com", | ||
| "type": "user" | ||
| } | ||
| } | ||
| ---- | ||
|
|
||
| . If you are not using the right subscription: | ||
|
|
||
| .. Change the active subscription by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az account set -s <subscription_id> | ||
| ---- | ||
|
|
||
| .. Verify that you are using the subscription you need by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az account show | ||
| ---- | ||
| + | ||
| .Example output | ||
| [source,terminal] | ||
| ---- | ||
| { | ||
| "environmentName": "AzureCloud", | ||
| "id": "9xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "isDefault": true, | ||
| "name": "Subscription Name 2", | ||
| "state": "Enabled", | ||
| "tenantId": "7xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "user": { | ||
| "name": "you2@example.com", | ||
| "type": "user" | ||
| } | ||
| } | ||
| ---- | ||
|
|
||
| . Record the `id` and `tenantId` parameter values from the output. You require these values to install an {product-title} cluster. |
57 changes: 57 additions & 0 deletions
57
modules/installation-creating-azure-service-principal.adoc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| // Module included in the following assemblies: | ||
| // | ||
| // * installing/installing_azure/installing-azure-account.adoc | ||
|
|
||
| :_content-type: PROCEDURE | ||
| [id="installation-creating-azure-service-principal_{context}"] | ||
| = Creating a service principal | ||
|
|
||
| The installation program requires an Azure identity to complete the installation. You can use a service principal. | ||
|
|
||
| If you are unable to use a service principal, you can use a managed identity. | ||
|
|
||
| .Prerequisites | ||
|
|
||
| * You have installed or updated the link:https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-yum?view=azure-cli-latest[Azure CLI]. | ||
| * You have an Azure subscription ID. | ||
| * If you are not going to assign the the `Contributor` and `User Administrator Access` roles to the service principal, you have created a custom role with the required Azure permissions. | ||
|
|
||
| .Procedure | ||
|
|
||
| . Create the service principal for your account by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az ad sp create-for-rbac --role <role_name> \// <1> | ||
| --name <service_principal> \// <2> | ||
| --scopes /subscriptions/<subscription_id> <3> | ||
| ---- | ||
| <1> Defines the role name. You can use the `Contributor` role, or you can specify a custom role which contains the necessary permissions. | ||
| <2> Defines the service principal name. | ||
| <3> Specifies the subscription ID. | ||
| + | ||
| .Example output | ||
| [source,terminal] | ||
| ---- | ||
| Creating 'Contributor' role assignment under scope '/subscriptions/<subscription_id>' | ||
| The output includes credentials that you must protect. Be sure that you do not | ||
| include these credentials in your code or check the credentials into your source | ||
| control. For more information, see https://aka.ms/azadsp-cli | ||
| { | ||
| "appId": "axxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", | ||
| "displayName": <service_principal>", | ||
| "password": "00000000-0000-0000-0000-000000000000", | ||
| "tenantId": "8xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | ||
| } | ||
| ---- | ||
|
|
||
| . Record the values of the `appId` and `password` parameters from the output. You require these values when installing the cluster. | ||
|
|
||
| . If you applied the `Contributor` role to your service principal, assign the `User Administrator Access` role by running the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ az role assignment create --role "User Access Administrator" \ | ||
| --assignee-object-id $(az ad sp show --id <appId> --query id -o tsv) <1> | ||
| ---- | ||
| <1> Specify the `appId` parameter value for your service principal. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Worth noting that #37275 previously added the service principal req specifically for Azure, but did not add the
azureattribute. As a result, the req appeared in all install use cases using this module. I removed thenutanixattribute, as I incorrectly added it (instead ofazure) when I wrote the Nutanix doc [1] Correcting this oversight now.[1] https://github.com/openshift/openshift-docs/pull/44537/files#diff-aa2bf98d200d7bbc6fbc805b89a39df30e54112c533f035e025e1160cfeeecd9R202