Skip to content

Commit 3b4bf88

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #287721 from kgremban/m2-touchups
Touchups from reviews
2 parents 8373020 + 30e7c05 commit 3b4bf88

File tree

8 files changed

+111
-116
lines changed

8 files changed

+111
-116
lines changed

‎articles/iot-operations/deploy-iot-ops/howto-deploy-iot-operations.md

Lines changed: 93 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,95 @@ Use the Azure portal or Azure CLI to deploy Azure IoT Operations to your Arc-ena
7373

7474
The Azure portal deployment experience is a helper tool that generates a deployment command based on your resources and configuration. The final step is to run an Azure CLI command, so you still need the Azure CLI prerequisites described in the previous section.
7575

76+
### [Azure portal](#tab/portal)
77+
78+
1. In the [Azure portal](https://portal.azure.com), search for and select **Azure IoT Operations**.
79+
80+
1. Select **Create**.
81+
82+
1. On the **Basics** tab, provide the following information:
83+
84+
| Parameter | Value |
85+
| --------- | ----- |
86+
| **Subscription** | Select the subscription that contains your Arc-enabled cluster. |
87+
| **Resource group** | Select the resource group that contains your Arc-enabled cluster. |
88+
| **Cluster name** | Select the cluster that you want to deploy Azure IoT Operations to. |
89+
| **Custom location name** | *Optional*: Replace the default name for the custom location. |
90+
91+
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-basics.png" alt-text="A screenshot that shows the first tab for deploying Azure IoT Operations from the portal.":::
92+
93+
1. Select **Next: Configuration**.
94+
95+
1. On the **Configuration** tab, provide the following information:
96+
97+
| Parameter | Value |
98+
| --------- | ----- |
99+
| **Azure IoT Operations name** | *Optional*: Replace the default name for the Azure IoT Operations instance. |
100+
| **MQTT broker configuration** | *Optional*: Edit the default settings for the MQTT broker. For more information, see [Configure core MQTT broker settings](../manage-mqtt-broker/howto-configure-availability-scale.md). |
101+
| **Dataflow profile configuration** | *Optional*: Edit the default settings for dataflows. For more information, see [Configure dataflow profile](../connect-to-cloud/howto-configure-dataflow-profile.md). |
102+
103+
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-configuration.png" alt-text="A screenshot that shows the second tab for deploying Azure IoT Operations from the portal.":::
104+
105+
1. Select **Next: Dependency management**.
106+
107+
1. On the **Dependency management** tab, select an existing schema registry or use these steps to create one:
108+
109+
1. Select **Create new**.
110+
111+
1. Provide a **Schema registry name** and **Schema registry namespace**.
112+
113+
1. Select **Select Azure Storage container**.
114+
115+
1. Schema registry requires an Azure Storage account with hierarchical namespace and public network access enabled. Choose a storage account from the list of hierarchical namespace-enabled accounts, or select **Create** to create one.
116+
117+
1. Select a container in your storage account or select **Container** to create one.
118+
119+
1. Select **Apply** to confirm the schema registry configurations.
120+
121+
1. On the **Dependency management** tab, select the **Secure settings** deployment option.
122+
123+
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-dependency-management-1.png" alt-text="A screenshot that shows selecting secure settings on the third tab for deploying Azure IoT Operations from the portal.":::
124+
125+
1. In the **Deployment options** section, provide the following information:
126+
127+
| Parameter | Value |
128+
| --------- | ----- |
129+
| **Subscription** | Select the subscription that contains your Azure key vault. |
130+
| **Azure Key Vault** | Select an Azure key vault select **Create new**.<br><br>Ensure that your key vault has **Vault access policy** as its permission model. To check this setting, select **Manage selected vault** > **Settings** > **Access configuration**. |
131+
| **User assigned managed identity for secrets** | Select an identity or select **Create new**. |
132+
| **User assigned managed identity for AIO components** | Select an identity or select **Create new**. Don't use the same managed identity as the one you selected for secrets. |
133+
134+
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-dependency-management-2.png" alt-text="A screenshot that shows configuring secure settings on the third tab for deploying Azure IoT Operations from the portal.":::
135+
136+
1. Select **Next: Automation**.
137+
138+
1. One at a time, run each Azure CLI command on the **Automation** tab in a terminal:
139+
140+
1. Sign in to Azure CLI interactively with a browser even if you already signed in before. If you don't sign in interactively, you might get an error that says *Your device is required to be managed to access your resource* when you continue to the next step to deploy Azure IoT Operations.
141+
142+
```azurecli
143+
az login
144+
```
145+
146+
1. If you didn't prepare your Azure CLI environment as described in the prerequisites, do so now in a terminal of your choice:
147+
148+
```azurecli
149+
az upgrade
150+
az extension add --upgrade --name azure-iot-ops
151+
```
152+
153+
1. If you chose to create a new schema registry on the previous tab, copy and run the `az iot ops schema registry create` command.
154+
155+
1. Copy and run the `az iot ops init` command.
156+
157+
1. Copy and run the `az iot ops create` command.
158+
159+
1. Copy and run the `az iot ops secretsync enable` command.
160+
161+
1. Copy and run the `az iot ops identity assign` command.
162+
163+
1. Once all of the Azure CLI commands complete successfully, you can close the **Install Azure IoT Operations** wizard.
164+
76165
### [Azure CLI](#tab/cli)
77166
78167
1. Sign in to Azure CLI interactively with a browser even if you already signed in before.
@@ -106,9 +195,11 @@ Azure IoT Operations requires a schema registry on your cluster. Schema registry
106195

107196
| Optional parameter | Value | Description |
108197
| --------- | ----- | ----------- |
109-
| `--custom-role-id` | Role definition ID | Provide a custom role ID to assign to the schema registry instead of the default **Storage Blob Data Contributor** role. Format: `/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Authorization/roleDefinitions/<ROLE_ID>`. |
198+
| `--custom-role-id` | Role definition ID | Provide a custom role ID to assign to the schema registry instead of the default **Storage Blob Data Contributor** role. At a minimum, the role needs blob read and write permissions. Format: `/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Authorization/roleDefinitions/<ROLE_ID>`. |
110199
| `--sa-container` | string | Storage account container to store schemas. If this container doesn't exist, this command creates it. The default container name is **schemas**. |
111200

201+
1. Copy the resource ID from the output of the schema registry create command to use in the next section.
202+
112203
### Deploy Azure IoT Operations
113204

114205
1. Prepare your cluster with the dependencies that Azure IoT Operations requires by running [az iot ops init](/cli/azure/iot/ops#az-iot-ops-init).
@@ -137,7 +228,7 @@ Azure IoT Operations requires a schema registry on your cluster. Schema registry
137228
| Optional parameter | Value | Description |
138229
| --------- | ----- | ----------- |
139230
| `--no-progress` | | Disables the deployment progress display in the terminal. |
140-
| `--enable-rsync-rules` | | Enable the resource sync rules on the instance to project resources from the cloud to the edge. |
231+
| `--enable-rsync-rules` | | Enable the resource sync rules on the instance to project resources from the edge to the cloud. |
141232
| `--add-insecure-listener` | | Add an insecure 1883 port config to the default listener. *Not for production use*. |
142233
| `--broker-config-file` | Path to JSON file | Provide a configuration file for the MQTT broker. For more information, see [Advanced MQTT broker config](https://github.com/Azure/azure-iot-ops-cli-extension/wiki/Advanced-Mqtt-Broker-Config) and [Configure core MQTT broker settings](../manage-mqtt-broker/howto-configure-availability-scale.md). |
143234

@@ -184,95 +275,6 @@ Azure secret requires a user-assigned managed identity with access to the Azure
184275
az iot ops identity assign --name <INSTANCE_NAME> --resource-group <RESOURCE_GROUP> --mi-user-assigned <USER_ASSIGNED_MI_RESOURCE_ID>
185276
```
186277

187-
### [Azure portal](#tab/portal)
188-
189-
1. In the [Azure portal](https://portal.azure.com), search for and select **Azure IoT Operations**.
190-
191-
1. Select **Create**.
192-
193-
1. On the **Basics** tab, provide the following information:
194-
195-
| Parameter | Value |
196-
| --------- | ----- |
197-
| **Subscription** | Select the subscription that contains your Arc-enabled cluster. |
198-
| **Resource group** | Select the resource group that contains your Arc-enabled cluster. |
199-
| **Cluster name** | Select the cluster that you want to deploy Azure IoT Operations to. |
200-
| **Custom location name** | *Optional*: Replace the default name for the custom location. |
201-
202-
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-basics.png" alt-text="A screenshot that shows the first tab for deploying Azure IoT Operations from the portal.":::
203-
204-
1. Select **Next: Configuration**.
205-
206-
1. On the **Configuration** tab, provide the following information:
207-
208-
| Parameter | Value |
209-
| --------- | ----- |
210-
| **Azure IoT Operations name** | *Optional*: Replace the default name for the Azure IoT Operations instance. |
211-
| **MQTT broker configuration** | *Optional*: Edit the default settings for the MQTT broker. For more information, see [Configure core MQTT broker settings](../manage-mqtt-broker/howto-configure-availability-scale.md). |
212-
| **Dataflow profile configuration** | *Optional*: Edit the default settings for dataflows. For more information, see [Configure dataflow profile](../connect-to-cloud/howto-configure-dataflow-profile.md). |
213-
214-
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-configuration.png" alt-text="A screenshot that shows the second tab for deploying Azure IoT Operations from the portal.":::
215-
216-
1. Select **Next: Dependency management**.
217-
218-
1. On the **Dependency management** tab, select an existing schema registry or use these steps to create one:
219-
220-
1. Select **Create new**.
221-
222-
1. Provide a **Schema registry name** and **Schema registry namespace**.
223-
224-
1. Select **Select Azure Storage container**.
225-
226-
1. Schema registry requires an Azure Storage account with hierarchical namespace and public network access enabled. Choose a storage account from the list of hierarchical namespace-enabled accounts, or select **Create** to create one.
227-
228-
1. Select a container in your storage account or select **Container** to create one.
229-
230-
1. Select **Apply** to confirm the schema registry configurations.
231-
232-
1. On the **Dependency management** tab, select the **Secure settings** deployment option.
233-
234-
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-dependency-management-1.png" alt-text="A screenshot that shows selecting secure settings on the third tab for deploying Azure IoT Operations from the portal.":::
235-
236-
1. In the **Deployment options** section, provide the following information:
237-
238-
| Parameter | Value |
239-
| --------- | ----- |
240-
| **Subscription** | Select the subscription that contains your Azure key vault. |
241-
| **Azure Key Vault** | Select an Azure key vault select **Create new**.<br><br>Ensure that your key vault has **Vault access policy** as its permission model. To check this setting, select **Manage selected vault** > **Settings** > **Access configuration**. |
242-
| **User assigned managed identity for secrets** | Select an identity or select **Create new**. |
243-
| **User assigned managed identity for AIO components** | Select an identity or select **Create new**. Don't use the same managed identity as the one you selected for secrets. |
244-
245-
:::image type="content" source="./media/howto-deploy-iot-operations/deploy-dependency-management-2.png" alt-text="A screenshot that shows configuring secure settings on the third tab for deploying Azure IoT Operations from the portal.":::
246-
247-
1. Select **Next: Automation**.
248-
249-
1. One at a time, run each Azure CLI command on the **Automation** tab in a terminal:
250-
251-
1. Sign in to Azure CLI interactively with a browser even if you already signed in before. If you don't sign in interactively, you might get an error that says *Your device is required to be managed to access your resource* when you continue to the next step to deploy Azure IoT Operations.
252-
253-
```azurecli
254-
az login
255-
```
256-
257-
1. If you didn't prepare your Azure CLI environment as described in the prerequisites, do so now in a terminal of your choice:
258-
259-
```azurecli
260-
az upgrade
261-
az extension add --upgrade --name azure-iot-ops
262-
```
263-
264-
1. If you chose to create a new schema registry on the previous tab, copy and run the `az iot ops schema registry create` command.
265-
266-
1. Copy and run the `az iot ops init` command.
267-
268-
1. Copy and run the `az iot ops create` command.
269-
270-
1. Copy and run the `az iot ops secretsync enable` command.
271-
272-
1. Copy and run the `az iot ops identity assign` command.
273-
274-
1. Once all of the Azure CLI commands complete successfully, you can close the **Install Azure IoT Operations** wizard.
275-
276278
---
277279

278280
While the deployment is in progress, you can watch the resources being applied to your cluster.

‎articles/iot-operations/deploy-iot-ops/howto-prepare-cluster.md

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Azure IoT Operations should work on any Arc-enabled Kubernetes cluster that meet
2727

2828
Microsoft supports Azure Kubernetes Service (AKS) Edge Essentials for deployments on Windows and K3s for deployments on Ubuntu. For a list of specific hardware and software combinations that are tested and validated, see [Validated environments](../overview-iot-operations.md#validated-environments).
2929

30-
If you want to deploy Azure IoT Operations to a multi-node solution, we recommend K3s on Ubuntu.
30+
If you want to deploy Azure IoT Operations to a multi-node solution, use K3s on Ubuntu.
3131

3232
To prepare your Azure Arc-enabled Kubernetes cluster, you need:
3333

@@ -55,7 +55,7 @@ To prepare your Azure Arc-enabled Kubernetes cluster, you need:
5555
5656
* Hardware that meets the system requirements:
5757

58-
* Ensure that your machine has a minimum of 10-GB RAM, 4 vCPUs, and 40-GB free disk space.
58+
* Ensure that your machine has a minimum of 10-GB available RAM, 4 available vCPUs, and 52-GB free disk space reserved for Azure IoT Operations.
5959
* [Azure Arc-enabled Kubernetes system requirements](/azure/azure-arc/kubernetes/system-requirements).
6060
* [AKS Edge Essentials requirements and support matrix](/azure/aks/hybrid/aks-edge-system-requirements).
6161
* [AKS Edge Essentials networking guidance](/azure/aks/hybrid/aks-edge-concept-networking).
@@ -152,12 +152,6 @@ The [AksEdgeQuickStartForAio.ps1](https://github.com/Azure/AKS-Edge/blob/main/to
152152

153153
In the output of the `Get-AksEdgeDeploymentInfo` command, you should see that the cluster's Arc status is `Connected`.
154154

155-
### Configure multi-node clusters for Azure Container Storage
156-
157-
On multi-node clusters with at least three nodes, you have the option of enabling fault tolerance for storage with [Azure Container Storage enabled by Azure Arc](/azure/azure-arc/container-storage/overview) when you deploy Azure IoT Operations.
158-
159-
By default, Azure Kubernetes Service Edge Essentials clusters support Azure Container Storage. There are no extra steps to configure AKS Edge Essential clusters for fault tolerance.
160-
161155
### [Ubuntu](#tab/ubuntu)
162156

163157
To prepare a K3s Kubernetes cluster on Ubuntu:

‎articles/iot-operations/deploy-iot-ops/overview-deploy.md

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ Azure IoT Operations should work on any Arc-enabled Kubernetes cluster that meet
2020

2121
Microsoft supports Azure Kubernetes Service (AKS) Edge Essentials for deployments on Windows and K3s for deployments on Ubuntu. For a list of specific hardware and software combinations that are tested and validated, see [Validated environments](../overview-iot-operations.md#validated-environments).
2222

23-
If you want to deploy Azure IoT Operations to a multi-node solution, we recommend K3s on Ubuntu.
24-
2523
## Choose your features
2624

2725
Azure IoT Operations offers two deployment modes. You can choose to deploy with *test settings*, a basic subset of features that are simpler to get started with for evaluation scenarios. Or, you can choose to deploy with *secure settings*, the full feature set.
@@ -55,18 +53,17 @@ The following table described Azure IoT Operations deployment and management tas
5553

5654
| Task | Required permission | Comments |
5755
| ---- | ------------------- | -------- |
58-
| Deploy Azure IoT Operations | **Contributor** permissions at the subscription level. | |
59-
| Create secrets in Key Vault | **Key Vault Secrets Officer** permissions at the resource level. | Only required for secure settings deployment. |
60-
| Enable resource sync rules on an Azure IoT Operations instance | **Microsoft/Authorization/roleAssignments/write** permissions at the resource group level. | Resource sync rules are disabled by default, but can be enabled during instance creation. |
56+
| Deploy Azure IoT Operations | **Contributor** role at the subscription level. | |
57+
| Register resource providers | **Contributor** role at the subscription level. | Only required to do once per subscription. |
6158
| Create a schema registry. | **Microsoft/Authorization/roleAssignments/write** permissions at the resource group level. | |
59+
| Create secrets in Key Vault | **Key Vault Secrets Officer** role at the resource level. | Only required for secure settings deployment. |
60+
| Enable resource sync rules on an Azure IoT Operations instance | **Microsoft/Authorization/roleAssignments/write** permissions at the resource group level. | Resource sync rules are disabled by default, but can be enabled during instance creation. |
61+
62+
If you use the Azure CLI to assign roles, use the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command to give permissions. For example, `az role assignment create --assignee sp_name --role "Role Based Access Control Administrator" --scope subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup`
63+
64+
If you use the Azure portal to assign privileged admin roles to a user or principal, you're prompted to restrict access using conditions. For this scenario, select the **Allow user to assign all roles** condition in the **Add role assignment** page.
6265

63-
> [!TIP]
64-
>
65-
> * If you use the Azure CLI to assign roles, use the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command to give permissions. For example, `az role assignment create --assignee sp_name --role "Role Based Access Control Administrator" --scope subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup`
66-
>
67-
> * If you use the Azure portal to assign privileged admin roles to a user or principal, you're prompted to restrict access using conditions. For this scenario, select the **Allow user to assign all roles** condition in the **Add role assignment** page.
68-
>
69-
> :::image type="content" source="./media/howto-deploy-iot-operations/add-role-assignment-conditions.png" alt-text="Screenshot that shows assigning users highly privileged role access in the Azure portal.":::
66+
:::image type="content" source="./media/howto-deploy-iot-operations/add-role-assignment-conditions.png" alt-text="Screenshot that shows assigning users highly privileged role access in the Azure portal.":::
7067

7168
## Included components
7269

@@ -76,10 +73,12 @@ Azure IoT Operations is a suite of data services that run on Azure Arc-enabled e
7673
* Dataflows
7774
* MQTT Broker
7875
* Connector for OPC UA
76+
* Akri
7977

8078
* Installed dependencies
8179
* [Azure Device Registry](../discover-manage-assets/overview-manage-assets.md#store-assets-as-azure-resources-in-a-centralized-registry)
8280
* [Azure Container Storage enabled by Azure Arc](/azure/azure-arc/container-storage/overview)
81+
* Secret Sync Controller
8382

8483
## Organize instances by using sites
8584

‎articles/iot-operations/get-started-end-to-end-sample/quickstart-deploy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ To connect your cluster to Azure Arc:
110110
1. Use the [az connectedk8s connect](/cli/azure/connectedk8s#az-connectedk8s-connect) command to Arc-enable your Kubernetes cluster and manage it as part of your Azure resource group:
111111

112112
```azurecli
113-
az connectedk8s connect --name $CLUSTER_NAME --location $LOCATION --resource-group $RESOURCE_GROUP --disable-auto-upgrade
113+
az connectedk8s connect --name $CLUSTER_NAME --location $LOCATION --resource-group $RESOURCE_GROUP
114114
```
115115

116116
>[!TIP]

0 commit comments

Comments
 (0)