Skip to content

Commit 094901c

Browse files
PMEds28PMEds28
authored
Merge pull request #112877 from sakthi-vetrivel/aro4-ga
Docs for ARO 4 GA
2 parents 3bcfaa8 + a1497a2 commit 094901c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+1060
-634
lines changed

‎.openpublishing.redirection.json

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,20 @@
11
{
22
"redirections": [
3+
{
4+
"source_path": "articles/openshift/howto-azure-monitor-v4.md",
5+
"redirect_url": "articles/azure-monitor/insights/container-insights-azure-redhat4-setup.md",
6+
"redirect_document_id": false
7+
},
8+
{
9+
"source_path": "articles/openshift/tutorial-scale-cluster.md",
10+
"redirect_url": "articles/openshift/tutorial-connect-cluster.md",
11+
"redirect_document_id": false
12+
},
13+
{
14+
"source_path": "articles/openshift/howto-using-azure-redhat-openshift.md",
15+
"redirect_url": "articles/openshift/tutorial-create-cluster.md",
16+
"redirect_document_id": false
17+
},
318
{
419
"source_path": "articles/virtual-network/create-virtual-network-classic.md",
520
"redirect_url": "/previous-versions/azure/virtual-network/create-virtual-network-classic",

‎articles/azure-monitor/insights/container-insights-azure-redhat-setup.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Azure Monitor for containers supports monitoring Azure Red Hat OpenShift as desc
3333

3434
## Enable for a new cluster using an Azure Resource Manager template
3535

36-
Perform the following steps to deploy an Azure Red Hat OpenShift cluster with monitoring enabled. Before proceeding, review the tutorial [Create an Azure Red Hat OpenShift cluster](../../openshift/tutorial-create-cluster.md#prerequisites) to understand the dependencies that you need to configure so your environment is set up correctly.
36+
Perform the following steps to deploy an Azure Red Hat OpenShift cluster with monitoring enabled. Before proceeding, review the tutorial [Create an Azure Red Hat OpenShift cluster](../../openshift/tutorial-create-cluster.md) to understand the dependencies that you need to configure so your environment is set up correctly.
3737

3838
This method includes two JSON templates. One template specifies the configuration to deploy the cluster with monitoring enabled, and the other contains parameter values that you configure to specify the following:
3939

‎articles/openshift/configure-azure-ad-cli.md

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
---
2+
title: Azure Red Hat OpenShift running OpenShift 4 - Configure Azure Active Directory authentication using the command line
3+
description: Learn how to configure Azure Active Directory authentication for an Azure Red Hat OpenShift cluster running OpenShift 4 using the command line
4+
ms.service: container-service
5+
ms.topic: article
6+
ms.date: 03/12/2020
7+
author: sabbour
8+
ms.author: asabbour
9+
keywords: aro, openshift, az aro, red hat, cli
10+
ms.custom: mvc
11+
#Customer intent: As an operator, I need to configure Azure Active Directory authentication for an Azure Red Hat OpenShift cluster running OpenShift 4
12+
---
13+
14+
# Configure Azure Active Directory authentication for an Azure Red Hat OpenShift 4 cluster (CLI)
15+
16+
If you choose to install and use the CLI locally, this article requires that you are running the Azure CLI version 2.0.75 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest).
17+
18+
Retrieve your cluster-specific URLs that are going to be used to configure the Azure Active Directory application.
19+
20+
Construct the cluster's OAuth callback URL and store it in a variable **oauthCallbackURL**. Make sure to replace **aro-rg** with your resource group's name and **aro-cluster** with your cluster's name.
21+
22+
> [!NOTE]
23+
> The `AAD` section in the OAuth callback URL should match the OAuth identity provider name you'll setup later.
24+
25+
```azurecli-interactive
26+
domain=$(az aro show -g aro-rg -n aro-cluster --query clusterProfile.domain -o tsv)
27+
location=$(az aro show -g aro-rg -n aro-cluster --query location -o tsv)
28+
apiServer=$(az aro show -g aro-rg -n aro-cluster --query apiserverProfile.url -o tsv)
29+
webConsole=$(az aro show -g aro-rg -n aro-cluster --query consoleProfile.url -o tsv)
30+
oauthCallbackURL=https://oauth-openshift.apps.$domain.$location.aroapp.io/oauth2callback/AAD
31+
```
32+
33+
## Create an Azure Active Directory application for authentication
34+
35+
Create an Azure Active Directory application and retrieve the created application identifier. Replace **\<ClientSecret>** with a secure password.
36+
37+
```azurecli-interactive
38+
az ad app create \
39+
--query appId -o tsv \
40+
--display-name aro-auth \
41+
--reply-urls $oauthCallbackURL \
42+
--password '<ClientSecret>'
43+
```
44+
45+
You should get back something like this. Make note of it as this is the **AppId** you'll need in later steps.
46+
47+
```output
48+
6a4cb4b2-f102-4125-b5f5-9ad6689f7224
49+
```
50+
51+
Retrieve the tenant ID of the subscription that owns the application.
52+
53+
```azure
54+
az account show --query tenantId -o tsv
55+
```
56+
57+
You should get back something like this. Make note of it as this is the **TenantId** you'll need in later steps.
58+
59+
```output
60+
72f999sx-8sk1-8snc-js82-2d7cj902db47
61+
```
62+
63+
## Create a manifest file to define the optional claims to include in the ID Token
64+
65+
Application developers can use [optional claims](https://docs.microsoft.com/azure/active-directory/develop/active-directory-optional-claims) in their Azure AD applications to specify which claims they want in tokens sent to their application.
66+
67+
You can use optional claims to:
68+
69+
- Select additional claims to include in tokens for your application.
70+
- Change the behavior of certain claims that Azure AD returns in tokens.
71+
- Add and access custom claims for your application.
72+
73+
We'll configure OpenShift to use the `email` claim and fall back to `upn` to set the Preferred Username by adding the `upn` as part of the ID token returned by Azure Active Directory.
74+
75+
Create a **manifest.json** file to configure the Azure Active Directory application.
76+
77+
```bash
78+
cat > manifest.json<< EOF
79+
[{
80+
"name": "upn",
81+
"source": null,
82+
"essential": false,
83+
"additionalProperties": []
84+
},
85+
{
86+
"name": "email",
87+
"source": null,
88+
"essential": false,
89+
"additionalProperties": []
90+
}]
91+
EOF
92+
```
93+
94+
## Update the Azure Active Directory application's optionalClaims with a manifest
95+
96+
Replace **\<AppID>** with the ID you got earlier.
97+
98+
```azurecli-interactive
99+
az ad app update \
100+
--set [email protected] \
101+
--id <AppId>
102+
```
103+
104+
## Update the Azure Active Directory application scope permissions
105+
106+
To be able to read the user information from Azure Active Directory, we need to define the proper scopes.
107+
108+
Replace **\<AppID>** with the ID you got earlier.
109+
110+
Add permission for the **Azure Active Directory Graph.User.Read** scope to enable sign in and read user profile.
111+
112+
```azurecli-interactive
113+
az ad app permission add \
114+
--api 00000002-0000-0000-c000-000000000000 \
115+
--api-permissions 311a71cc-e848-46a1-bdf8-97ff7156d8e6=Scope \
116+
--id <AppId>
117+
```
118+
119+
> [!NOTE]
120+
> Unless you are authenticated as a Global Administrator for this Azure Active Directory, you can ignore the message to grant the consent, since you'll be asked to do this once you login on your own account.
121+
122+
## Assign users and groups to the cluster (optional)
123+
124+
Applications registered in an Azure Active Directory (Azure AD) tenant are, by default, available to all users of the tenant who authenticate successfully. Azure AD allows tenant administrators and developers to restrict an app to a specific set of users or security groups in the tenant.
125+
126+
Follow the instructions on the Azure Active Directory documentation to [assign users and groups to the app](https://docs.microsoft.com/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-users#app-registration).
127+
128+
## Configure OpenShift OpenID authentication
129+
130+
Retrieve the `kubeadmin` credentials. Run the following command to find the password for the `kubeadmin` user.
131+
132+
```azurecli-interactive
133+
az aro list-credentials \
134+
--name aro-cluster \
135+
--resource-group aro-rg
136+
```
137+
138+
The following example output shows the password will be in `kubeadminPassword`.
139+
140+
```json
141+
{
142+
"kubeadminPassword": "<generated password>",
143+
"kubeadminUsername": "kubeadmin"
144+
}
145+
```
146+
147+
Log in to the OpenShift cluster's API server using the following command. The `$apiServer` variable was set [earlier](). Replace **\<kubeadmin password>** with the password you retrieved.
148+
149+
```azurecli-interactive
150+
oc login $apiServer -u kubeadmin -p <kubeadmin password>
151+
```
152+
153+
Create an OpenShift secret to store the Azure Active Directory application secret, replacing **\<ClientSecret>** with the secret you retrieved earlier.
154+
155+
```azurecli-interactive
156+
oc create secret generic openid-client-secret-azuread \
157+
--namespace openshift-config \
158+
--from-literal=clientSecret=<ClientSecret>
159+
```
160+
161+
Create a **oidc.yaml** file to configure OpenShift OpenID authentication against Azure Active Directory. Replace **\<AppID>** and **\<TenantId>** with the values you retrieved earlier.
162+
163+
```bash
164+
cat > oidc.yaml<< EOF
165+
apiVersion: config.openshift.io/v1
166+
kind: OAuth
167+
metadata:
168+
name: cluster
169+
spec:
170+
identityProviders:
171+
- name: AAD
172+
mappingMethod: claim
173+
type: OpenID
174+
openID:
175+
clientID: <AppId>
176+
clientSecret:
177+
name: openid-client-secret-azuread
178+
extraScopes:
179+
- email
180+
- profile
181+
extraAuthorizeParameters:
182+
include_granted_scopes: "true"
183+
claims:
184+
preferredUsername:
185+
- email
186+
- upn
187+
name:
188+
- name
189+
email:
190+
- email
191+
issuer: https://login.microsoftonline.com/<TenantId>
192+
EOF
193+
```
194+
195+
Apply the configuration to the cluster.
196+
197+
```azurecli-interactive
198+
oc apply -f oidc.yaml
199+
```
200+
201+
You will get back a response similar to the following.
202+
203+
```output
204+
oauth.config.openshift.io/cluster configured
205+
```
206+
207+
## Verify login through Azure Active Directory
208+
209+
If you now logout of the OpenShift Web Console and try to log in again, you'll be presented with a new option to log in with **AAD**. You may need to wait for a few minutes.
210+
211+
![Log in screen with Azure Active Directory option](media/aro4-login-2.png)

‎articles/openshift/configure-azure-ad-ui.md

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
title: Azure Red Hat OpenShift running OpenShift 4 - Configure Azure Active Directory authentication using the Azure portal and the OpenShift web console
3+
description: Learn how to configure Azure Active Directory authentication for an Azure Red Hat OpenShift cluster running OpenShift 4 using the Azure portal and the OpenShift web console
4+
ms.service: container-service
5+
ms.topic: article
6+
ms.date: 03/12/2020
7+
author: sabbour
8+
ms.author: asabbour
9+
keywords: aro, openshift, az aro, red hat, cli
10+
ms.custom: mvc
11+
# Customer intent: As an operator, I need to configure Azure Active Directory authentication for an Azure Red Hat OpenShift cluster running OpenShift 4
12+
---
13+
14+
# Configure Azure Active Directory authentication for an Azure Red Hat OpenShift 4 cluster (Portal)
15+
16+
If you choose to install and use the CLI locally, this tutorial requires that you are running the Azure CLI version 2.0.75 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest).
17+
18+
## Before you begin
19+
20+
Construct the cluster's **OAuth callback URL** and make note of it. Make sure to replace **aro-rg** with your resource group's name and **aro-cluster** with your cluster's name.
21+
22+
> [!NOTE]
23+
> The `AAD` section in the OAuth callback URL should match the OAuth identity provider name you'll setup later.
24+
25+
```azurecli-interactive
26+
domain=$(az aro show -g aro-rg -n aro-cluster --query clusterProfile.domain -o tsv)
27+
location=$(az aro show -g aro-rg -n aro-cluster --query location -o tsv)
28+
echo "OAuth callback URL: https://oauth-openshift.apps.$domain.$location.aroapp.io/oauth2callback/AAD"
29+
```
30+
31+
## Create an Azure Active Directory application for authentication
32+
33+
Login to the Azure portal, and navigate to [App registrations blade](https://ms.portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade), then click on **New registration** to create a new application.
34+
35+
Provide a name for the application, for example **aro-azuread-auth**, and fill in the **Redirect URI** using the value of the OAuth callback URL you retrieved earlier.
36+
37+
![New application registration](media/aro4-ad-registerapp.png)
38+
39+
Navigate to **Certificates & secrets** and click on **New client secret** and fill in the details. Make note of the key value, as you'll use it in a later stage. You won't be able to retrieve it again.
40+
41+
![Create a secret](media/aro4-ad-clientsecret.png)
42+
43+
Navigate to the **Overview** and make note of the **Application (client) ID** and **Directory (tenant) ID**. You'll need them in a later stage.
44+
45+
![Retrieve Application (client) and Directory (tenant) IDs](media/aro4-ad-ids.png)
46+
47+
## Configure optional claims
48+
49+
Application developers can use [optional claims](https://docs.microsoft.com/azure/active-directory/develop/active-directory-optional-claims) in their Azure AD applications to specify which claims they want in tokens sent to their application.
50+
51+
You can use optional claims to:
52+
53+
* Select additional claims to include in tokens for your application.
54+
* Change the behavior of certain claims that Azure AD returns in tokens.
55+
* Add and access custom claims for your application.
56+
57+
We'll configure OpenShift to use the `email` claim and fall back to `upn` to set the Preferred Username by adding the `upn` as part of the ID token returned by Azure Active Directory.
58+
59+
Navigate to **Token configuration (preview)** and click on **Add optional claim**. Select **ID** then check the **email** and **upn** claims.
60+
61+
![Create a secret](media/aro4-ad-tokens.png)
62+
63+
## Assign users and groups to the cluster (optional)
64+
65+
Applications registered in an Azure Active Directory (Azure AD) tenant are, by default, available to all users of the tenant who authenticate successfully. Azure AD allows tenant administrators and developers to restrict an app to a specific set of users or security groups in the tenant.
66+
67+
Follow the instructions on the Azure Active Directory documentation to [assign users and groups to the app](https://docs.microsoft.com/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-users#app-registration).
68+
69+
## Configure OpenShift OpenID authentication
70+
71+
Retrieve the `kubeadmin` credentials. Run the following command to find the password for the `kubeadmin` user.
72+
73+
```azurecli-interactive
74+
az aro list-credentials \
75+
--name aro-cluster \
76+
--resource-group aro-rg
77+
```
78+
79+
The following example output shows the password will be in `kubeadminPassword`.
80+
81+
```json
82+
{
83+
"kubeadminPassword": "<generated password>",
84+
"kubeadminUsername": "kubeadmin"
85+
}
86+
```
87+
88+
You can find the cluster console URL by running the following command, which will look like `https://console-openshift-console.apps.<random>.<region>.aroapp.io/`
89+
90+
```azurecli-interactive
91+
az aro show \
92+
--name aro-cluster \
93+
--resource-group aro-rg \
94+
--query "consoleProfile.url" -o tsv
95+
```
96+
97+
Launch the console URL in a browser and login using the `kubeadmin` credentials.
98+
99+
Navigate to **Administration**, click on **Cluster Settings**, then select the **Global Configuration** tab. Scroll to select **OAuth**.
100+
101+
Scroll down to select **Add** under **Identity Providers** and select **OpenID Connect**.
102+
![Select OpenID Connect from the Identity Providers dropdown](media/aro4-oauth-idpdrop.png)
103+
104+
Fill in the name as **AAD**, the **Client ID** as the **Application ID** and the **Client Secret**. The **Issuer URL** is formatted as such: `https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Replace the placeholder with the Tenant ID you retrieved earlier.
105+
106+
![Fill in OAuth details](media/aro4-oauth-idp-1.png)
107+
108+
Scroll down to the **Claims** section and update the **Preferred Username** to use the value from the **upn** claim.
109+
110+
![Fill in claims details](media/aro4-oauth-idp-2.png)
111+
112+
## Verify login through Azure Active Directory
113+
114+
If you now logout of the OpenShift Web Console and try to login again, you'll be presented with a new option to login with **AAD**. You may need to wait for a few minutes.
115+
116+
![Login screen with Azure Active Directory option](media/aro4-login-2.png)

0 commit comments

Comments
 (0)