Skip to content

Commit 0c95c59

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #286113 from msftadam/patch-17
Create get-started-private-link.md
2 parents 257cf6f + f2646b7 commit 0c95c59

File tree

3 files changed

+158
-0
lines changed

3 files changed

+158
-0
lines changed

‎articles/operator-service-manager/TOC.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@
3737
href: safe-upgrade-practices.md
3838
- name: Control Upgrade Failure Behavior
3939
href: safe-upgrades-nf-level-rollback.md
40+
- name: Edge Registry and Private Link
41+
expanded: false
42+
items:
43+
- name: Get Started with Private Link
44+
href: get-started-with-private-link.md
4045
- name: Quickstarts
4146
expanded: false
4247
items:

‎articles/operator-service-manager/get-started-with-private-link.md

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
title: Get started with Azure Operator Service Manager Private Link
3+
description: Secure backhaul connectivity of on-premises artifact store hosted on Azure Operator Nexus
4+
author: msftadam
5+
ms.author: adamdor
6+
ms.date: 09/04/2024
7+
ms.topic: get-started
8+
ms.service: azure-operator-service-manager
9+
---
10+
11+
# Get started with private link
12+
13+
## Overview
14+
This guide describes the Azure Operator Service Manager (AOSM) private link (PL) feature for artifact stores hosted on Azure Operator Nexus. As part of the AOSM edge registry initiative, PL uses Azure private endpoints, and Azure private link service, to securely backhaul Nexus on-premises artifact store traffic. This traffic is never exposed to the internet, instead exclusively traversing Microsoft's private network.
15+
16+
## Introduction
17+
This document provides a quick start guide to enable private link feature for AOSM artifact store using AOSM Publisher APIs.
18+
19+
### Required permissions
20+
The operations required to link and manage a private endpoint with a Nexus fabric controller (NFC) requires the following nondefault role privileges.
21+
22+
#### Permissions for linking and managing manual private endpoint
23+
Remove private endpoint
24+
```
25+
"Microsoft.HybridNetwork/publishers/artifactStores/removePrivateEndPoints/action"
26+
```
27+
Approve private endpoint
28+
```
29+
"Microsoft.HybridNetwork/publishers/artifactStores/approvePrivateEndPoints/action"
30+
```
31+
#### Permissions for linking and managing a private endpoint with NFC
32+
Add NFC private endpoints
33+
```
34+
"Microsoft.HybridNetwork/publishers/artifactStores/addNetworkFabricControllerEndPoints/action"
35+
"Microsoft.ManagedNetworkFabric/networkFabricControllers/joinartifactstore/action"
36+
```
37+
List NFC private endpoints
38+
```
39+
"Microsoft.HybridNetwork/publishers/artifactStores/listNetworkFabricControllerPrivateEndPoints/action"
40+
```
41+
Delete NFC private endpoints
42+
```
43+
"Microsoft.HybridNetwork/publishers/artifactStores/deleteNetworkFabricControllerEndPoints/action"
44+
"Microsoft.ManagedNetworkFabric/networkFabricControllers/disjoinartifactstore/action"
45+
```
46+
47+
> [!NOTE]
48+
> As new NFC permissions are introduced, the recommended role privileges will be updated.
49+
50+
## Use AOSM APIs to set up private link
51+
Before resources can be uploaded securely, the following sequence of operations establishes a PL connection to the artifact store.
52+
53+
### Create publisher and artifact store
54+
* Create a new publisher resource with identity type set to 'SystemAssigned.'
55+
- If the publisher was already created without this property, use a reput operation to update.
56+
* Use the new property 'backingResourcePublicNetworkAcccess' to disable artifact store public access.
57+
- The property is first added in the 2024-04-15 version.
58+
- If the ArtifactResource was already created without this property, use a reput operation to update.
59+
60+
#### Sample publisher bicep script
61+
62+
```
63+
param location string = resourceGroup().location
64+
param publisherName string
65+
param acrArtifactStoreName string
66+
67+
/* AOSM publisher resource creation
68+
*/
69+
var publisherNameWithLocation = concat(publisherName, uniqueString(resourceGroup().id))
70+
resource publisher 'Microsoft.HybridNetwork/publishers@2023-09-01' = {
71+
name: publisherNameWithLocation
72+
location: location
73+
identity: {
74+
type: 'SystemAssigned'
75+
}
76+
properties: {
77+
scope: 'Private'
78+
}
79+
}
80+
81+
/* AOSM artifact store resource creation
82+
*/
83+
resource acrArtifactStore 'Microsoft.HybridNetwork/publishers/artifactStores@2024-04-15' = {
84+
parent: publisher
85+
name: acrArtifactStoreName
86+
location: location
87+
properties: {
88+
storeType: 'AzureContainerRegistry'
89+
backingResourcePublicNetworkAccess: 'Disabled'
90+
}
91+
92+
}
93+
```
94+
95+
## Manual endpoint operations
96+
The following operations enable manual management of an artifact store once the PL is established.
97+
98+
### Manage private endpoint access
99+
By default, when the artifact store is connected to the vnet, the user doesn't have permissions to the ACR, so the private endpoint winds up in a pending state. The following Azure rest commands and payload enable a user to approve, reject and/or list these endpoints.
100+
101+
> [!NOTE]
102+
> In this workflow, the vnet is managed by the customer.
103+
>
104+
105+
#### Sample JSON payload:
106+
```
107+
{
108+
"manualPrivateEndPointConnections": [
109+
{
110+
"id":"/subscriptions/<subscriptionId>/resourceGroups/<ResourceGroup>/providers/Microsoft.Network/privateEndpoints/peName"
111+
}
112+
]
113+
}
114+
```
115+
116+
#### Sample private endpoint commands
117+
```
118+
# approve private endpoints
119+
az rest --method post --url https://management.azure.com/subscriptions/<Subscription>/resourceGroups/<ResourceGroup>/providers/Microsoft.HybridNetwork/publishers/<Publisher>/artifactStores/<ArtifactStore>/approveprivateendpoints?api-version=2024-04-15 --body '{ \"manualPrivateEndPointConnections\" : [ { \"id\" : \"/subscriptions/<Subscription>/resourceGroups/<ResourceGroup>/providers/Microsoft.Network/privateEndpoints/peName\" } ] }'
120+
```
121+
```
122+
# remove private endpoints
123+
az rest --method post --url https://management.azure.com/subscriptions/<Subscription>/resourceGroups/<ResourceGroup>/providers/Microsoft.HybridNetwork/publishers/<Publisher>/artifactStores/<ArtifactStore>/removeprivateendpoints?api-version=2024-04-15 --body '{ \"manualPrivateEndPointConnections\" : [ { \"id\" : \"/subscriptions/<Subscription>/resourceGroups/<ReourceGroup>/providers/Microsoft.Network/privateEndpoints/peName\" } ] }'
124+
```
125+
```
126+
# list private endpoints
127+
az rest --method post --url https://management.azure.com/subscriptions/<Subscription>resourceGroups/<ResourceGroup>/providers/Microsoft.HybridNetwork/publishers/<Publisher>/artifactStores/<artifactStore>/listPrivateEndPoints?api-version=2024-04-15 --body '{}'
128+
```
129+
130+
### Add private endpoints to NFC
131+
The following Azure rest commands enable a user to create, remove, and/or list the association between private endpoint, ACR, and the Nexus managed vnets.
132+
133+
#### Sample private endpoint commands
134+
```
135+
# add nfc private endpoints
136+
az rest --method post --url https://management.azure.com/subscriptions/<Subscription>/resourceGroups/<ResourceGroup>/providers/Microsoft.HybridNetwork/publishers/<Publisher>/artifactStores/<artifactStore>/addnetworkfabriccontrollerendpoints?apiversion=2024-04-15 --body '{ \"networkFabricControllerIds\":[{\"id\": \"/subscriptions/<Subscription>/resourceGroups/op2lab-nfc-useop1/providers/Microsoft.ManagedNetworkFabric/networkFabricControllers/op2labnfc01\"}] }'
137+
```
138+
```
139+
# list nfc private endpoints
140+
az rest --method post --url https://management.azure.com/subscriptions/<Subscription>/resourceGroups/<ResourceGroup>/providers/Microsoft.HybridNetwork/publishers/<Publisher>/artifactStores/<artifactStore>/listnetworkfabriccontrollerprivateendpoints?apiversion=2024-04-15 --body '{}'
141+
```
142+
```
143+
# delete nfc private endpoints
144+
az rest --method post --url https://management.azure.com/subscriptions/<Subscription>/resourceGroups/<ResourceGroup>/providers/Microsoft.HybridNetwork/publishers/<publisher>/artifactStores/<artifactStore>/deletenetworkfabriccontrollerendpoints?api-version=2024-04-15 --body '{ \"networkFabricControllerIds\":[{\"id\": \"/subscriptions/<Subscription>/resourceGroups/op2lab-nfc-useop1/providers/Microsoft.ManagedNetworkFabric/networkFabricControllers/op2labnfc01\"}] }'
145+
```

‎articles/operator-service-manager/index.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,14 @@ landingContent:
9292
links:
9393
- text: Control Upgrade Behavior on Failure
9494
url: safe-upgrades-nf-level-rollback.md
95+
96+
# Card
97+
- title: Edge Registry and Private Link
98+
linkLists:
99+
- linkListType: overview
100+
links:
101+
- text: Get Started with Private Link
102+
url: get-started-with-private-link.md
95103

96104
# Card
97105
- title: Additional Resources

0 commit comments

Comments
 (0)