Skip to content

Commit 0a5329c

Browse files
denreadenrea
authored
Merge pull request #289455 from Mzamankhan/patch-16
Link out to AKV and UAMI public docs in Enable Secure Settings
2 parents c8994a2 + 080554f commit 0a5329c

File tree

1 file changed

+7
-144
lines changed

1 file changed

+7
-144
lines changed

‎articles/iot-operations/deploy-iot-ops/howto-enable-secure-settings.md

Lines changed: 7 additions & 144 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ If not already set up, use the following steps to enable workload identity on an
6060
--enable-oidc-issuer --enable-workload-identity
6161
```
6262

63-
1. Use the [az connectedk8s show](/cli/azure/connectedk8s#az-connectedk8s-show) command to to get the cluster's issuer url. Take a note to add it later in K3s config file.
63+
1. Use the [az connectedk8s show](/cli/azure/connectedk8s#az-connectedk8s-show) command to get the cluster's issuer url. Take a note to add it later in K3s config file.
6464

6565
```azurecli
6666
#!/bin/bash
@@ -102,119 +102,12 @@ Secrets Management for Azure IoT Operations uses Secret Store extension to sync
102102

103103
Secret Store extension requires a user-assigned managed identity with access to the Azure Key Vault where secrets are stored. To learn more, see [What are managed identities for Azure resources?](/entra/identity/managed-identities-azure-resources/overview).
104104

105-
### Create an Azure Key Vault
105+
1. Create an [Azure Key Vault](/azure/key-vault/secrets/quick-create-cli) that will be used to store secrets.
106+
2. Make sure you have `Key Vaults Secrets Officer` role on the Azure Key Vault.
107+
3. Create a [User Assigned Managed Identity](/entra/identity/managed-identities-azure-resources/overview) for secret store extension.
108+
5. Use the [az iot ops secretsync enable](/cli/azure/iot/ops/secretsync#az-iot-ops-secretsync-enable) command to set up the Azure IoT Operations instance for secret synchronization.
106109

107-
If you already have an Azure Key Vault with `Key Vault Secrets Officer` permissions, you can skip this section.
108-
109-
1. Use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command to create an Azure Key Vault.
110-
111-
# [Bash](#tab/bash)
112-
113-
```azurecli
114-
# Variable block
115-
KEYVAULT_NAME="<KEYVAULT_NAME>"
116-
RESOURCE_GROUP="<RESOURCE_GROUP>"
117-
LOCATION="<LOCATION>"
118-
119-
# Create the Key Vault
120-
az keyvault create --name $KEYVAULT_NAME \
121-
--resource-group $RESOURCE_GROUP \
122-
--location $LOCATION \
123-
--enable-rbac-authorization
124-
```
125-
126-
# [PowerShell](#tab/powershell)
127-
128-
```azurecli
129-
# Variable block
130-
$KEYVAULT_NAME="<KEYVAULT_NAME>"
131-
$RESOURCE_GROUP="<RESOURCE_GROUP>"
132-
$LOCATION="<LOCATION>"
133-
134-
# Create the Key Vault
135-
az keyvault create --name $KEYVAULT_NAME `
136-
--resource-group $RESOURCE_GROUP `
137-
--location $LOCATION `
138-
--enable-rbac-authorization
139-
```
140-
141-
---
142-
143-
1. Use the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command to give the currently logged-in user `Key Vault Secrets Officer` permissions to the key vault.
144-
145-
# [Bash](#tab/bash)
146-
147-
```azurecli
148-
# Variable block
149-
SUBSCRIPTION_ID="<SUBSCRIPTION_ID>"
150-
RESOURCE_GROUP="<RESOURCE_GROUP>"
151-
KEYVAULT_NAME="<KEYVAULT_NAME>"
152-
153-
# Get the object ID of the currently logged-in user
154-
ASSIGNEE_ID=$(az ad signed-in-user show --query id -o tsv)
155-
156-
# Assign the "Key Vault Secrets Officer" role
157-
az role assignment create --role "Key Vault Secrets Officer" \
158-
--assignee $ASSIGNEE_ID \
159-
--scope /subscriptions/$SUBSCRIPTION_ID/resourcegroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/$KEYVAULT_NAME
160-
```
161-
162-
# [PowerShell](#tab/powershell)
163-
164-
```azurecli
165-
# Variable block
166-
$SUBSCRIPTION_ID="<SUBSCRIPTION_ID>"
167-
$RESOURCE_GROUP="<RESOURCE_GROUP>"
168-
$KEYVAULT_NAME="<KEYVAULT_NAME>"
169-
170-
# Get the object ID of the currently logged-in user
171-
$ASSIGNEE_ID=$(az ad signed-in-user show --query id -o tsv)
172-
173-
# Assign the "Key Vault Secrets Officer" role
174-
az role assignment create --role "Key Vault Secrets Officer" `
175-
--assignee $ASSIGNEE_ID `
176-
--scope /subscriptions/$SUBSCRIPTION_ID/resourcegroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/$KEYVAULT_NAME
177-
```
178-
179-
---
180-
181-
### Create a user-assigned managed identity for Secret Store extension
182-
183-
Use the [az identity create](/cli/azure/identity#az-identity-create) command to create the user-assigned managed identity.
184-
185-
# [Bash](#tab/bash)
186-
187-
```azurecli
188-
# Variable block
189-
USER_ASSIGNED_MI_NAME="<USER_ASSIGNED_MI_NAME>"
190-
RESOURCE_GROUP="<RESOURCE_GROUP>"
191-
LOCATION="LOCATION"
192-
193-
# Create the identity
194-
az identity create --name $USER_ASSIGNED_MI_NAME \
195-
--resource-group $RESOURCE_GROUP \
196-
--location $LOCATION
197-
```
198-
199-
# [PowerShell](#tab/powershell)
200-
201-
```azurecli
202-
# Variable block
203-
$USER_ASSIGNED_MI_NAME="USER_ASSIGNED_MI_NAME"
204-
$RESOURCE_GROUP="<RESOURCE_GROUP>"
205-
$LOCATION="LOCATION"
206-
207-
# Create the identity
208-
az identity create --name $USER_ASSIGNED_MI_NAME `
209-
--resource-group $RESOURCE_GROUP `
210-
--location $LOCATION
211-
```
212-
213-
---
214-
215-
### Enable secret synchronization
216-
217-
Use the [az iot ops secretsync enable](/cli/azure/iot/ops) command to set up the Azure IoT Operations instance for secret synchronization. This command:
110+
This command:
218111

219112
* Creates a federated identity credential using the user-assigned managed identity.
220113
* Adds a role assignment to the user-assigned managed identity for access to the Azure Key Vault.
@@ -272,37 +165,7 @@ Now that secret synchronization setup is complete, you can refer to [Manage Secr
272165

273166
Some Azure IoT Operations components like dataflow endpoints use user-assigned managed identity for cloud connections. It's recommended to use a separate identity from the one used to set up Secrets Management.
274167

275-
1. Create a user-assigned managed identity which can be used for cloud connections. Use the [az identity create](/cli/azure/identity#az-identity-create) command to create the user-assigned managed identity.
276-
277-
# [Bash](#tab/bash)
278-
279-
```azurecli
280-
# Variable block
281-
USER_ASSIGNED_MI_NAME="<USER_ASSIGNED_MI_NAME FOR CLOUD CONNECTIONS>"
282-
RESOURCE_GROUP="<RESOURCE_GROUP>"
283-
LOCATION="LOCATION"
284-
285-
# Create the identity
286-
az identity create --name $USER_ASSIGNED_MI_NAME \
287-
--resource-group $RESOURCE_GROUP \
288-
--location $LOCATION
289-
```
290-
291-
# [PowerShell](#tab/powershell)
292-
293-
```azurecli
294-
# Variable block
295-
$USER_ASSIGNED_MI_NAME="USER_ASSIGNED_MI_NAME FOR CLOUD CONNECTIONS"
296-
$RESOURCE_GROUP="<RESOURCE_GROUP>"
297-
$LOCATION="LOCATION"
298-
299-
# Create the identity
300-
az identity create --name $USER_ASSIGNED_MI_NAME `
301-
--resource-group $RESOURCE_GROUP `
302-
--location $LOCATION
303-
```
304-
305-
---
168+
1. Create a [User Assigned Managed Identity](/entra/identity/managed-identities-azure-resources/overview) which will be used for cloud connections.
306169

307170
> [!NOTE]
308171
> You will need to grant the identity permission to whichever cloud resource this will be used for.

0 commit comments

Comments
 (0)