Skip to content

Commit 4e61555

Browse files
mbashtovayambashtovaya
committed
included instructions about managed identity use for the ClusterManager
1 parent 9174f28 commit 4e61555

File tree

1 file changed

+90
-4
lines changed

1 file changed

+90
-4
lines changed

‎articles/operator-nexus/howto-cluster-manager.md

Lines changed: 90 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,9 @@ Some arguments that are available for every Azure CLI command
3636
- **--query** - uses the JMESPath query language to filter the output returned from Azure services.
3737
- **--verbose** - prints information about resources created in Azure during an operation, and other useful information
3838

39-
## Cluster Manager elements
39+
## Cluster Manager properties
4040

41-
| Elements | Description |
41+
| Property Name | Description |
4242
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
4343
| Name, ID, location, tags, type | Name: User friendly name <br> ID: < Resource ID > <br> Location: Azure region where the Cluster Manager is created. Values from: `az account list -locations`.<br> Tags: Resource tags <br> Type: Microsoft.NetworkCloud/clusterManagers |
4444
| managerExtendedLocation | The ExtendedLocation associated with the Cluster Manager |
@@ -48,7 +48,25 @@ Some arguments that are available for every Azure CLI command
4848
| clusterVersions[] | List of ClusterAvailableVersions objects. <br> Cluster versions that the manager supports. Will be used as an input in the cluster clusterVersion property. |
4949
| provisioningState | Succeeded, Failed, Canceled, Provisioning, Accepted, Updating |
5050
| detailedStatus | Detailed statuses that provide additional information about the status of the Cluster Manager. |
51-
| detailedStatusMessage | Descriptive message about the current detailedStatus. |
51+
| detailedStatusMessage | Descriptive message about the current detailedStatus.
52+
|
53+
54+
## Cluster Manager Identity
55+
56+
Starting with the 2024-06-01-preview API version, Cluster Manager can be assigned managed identity. Both System-assigned and User-Assigned managed identities are supported.
57+
58+
If a Cluster Manager is created with the User-assigned managed identity, a customer is required to provision access to that identity for the Nexus platform.
59+
Specifically, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` permission needs to be added to the User-assigned identity for `AFOI-NC-MGMT-PME-PROD` Entra ID. It is a known limitation of the platform that will be addressed in the future.
60+
61+
The role assignment can be done via Portal:
62+
63+
- Open Azure Portal and locate User-assigned identity in question.
64+
- If you expect multiple managed identities provisioned, the role can be added instead at the resource group or subscription level.
65+
- Under Access control (IAM), click Add new role assignment
66+
- Select Role: `Managed Identity Operator`. See the [permissions](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/identity#managed-identity-operator) that the role provides.
67+
- Assign access to: User, group, or service principal
68+
- Select Member: `AFOI-NC-MGMT-PME-PROD` application
69+
- Review and assign
5270

5371
## Create a Cluster Manager
5472

@@ -83,7 +101,8 @@ az networkcloud clustermanager create \
83101
- **wait/--no-wait** - Wait for command to complete or don't wait for the long-running operation to finish.
84102
- **--tags** - Space-separated tags: key[=value] [key[=value]...]. Use '' to clear existing tags
85103
- **--subscription** - Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.
86-
104+
- **--mi-system-assigned** - Enable System-assigned managed identity. Once added, the Identity can only be removed via the API call at this time.
105+
- **--mi-user-assigned** - Space-separated resource IDs of the User-assigned managed identities to be added. Once added, the Identity can only be removed via the API call at this time.
87106

88107
### Create the Cluster Manager using Azure Resource Manager template editor:
89108

@@ -169,6 +188,73 @@ az networkcloud clustermanager update \
169188
- **--IDs** - One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource ID' arguments.
170189
- **--resource-group -g** - Name of resource group. You can configure the default group using `az configure --defaults group=<name>`.
171190
- **--subscription** - Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.
191+
- **--mi-system-assigned** - Enable System-assigned managed identity. Once added, the Identity can only be removed via the API call at this time.
192+
- **--mi-user-assigned** - Space-separated resource IDs of the User-assigned managed identities to be added. Once added, the Identity can only be removed via the API call at this time.
193+
194+
### Update Cluster Manager Identities via APIs
195+
196+
Cluster Manager managed identities can be assigned via CLI. The un-assignment of the identities can be done via API calls.
197+
Note, `<APIVersion>` is the API version 2024-06-01-preview or newer.
198+
199+
- To remove all managed identities, execute:
200+
201+
```azurecli
202+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_MANAGER_RG/providers/Microsoft.NetworkCloud/clusterManagers/$CLUSTER_MANAGER_NAME?api-version=<APIVersion> --body "{\"identity\":{\"type\":\"None\"}}"
203+
```
204+
205+
- If both User-assigned and System-assigned managed identities were added, the User-assigned can be removed by updating the `type` to `SystemAssigned`:
206+
207+
```azurecli
208+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_MANAGER_RG/providers/Microsoft.NetworkCloud/clusterManagers/$CLUSTER_MANAGER_NAME?api-version=<APIVersion> --body @~/uai-body.json
209+
```
210+
211+
The request body (uai-body.json) example:
212+
213+
```azurecli
214+
{
215+
"identity": {
216+
"type": "SystemAssigned"
217+
}
218+
}
219+
```
220+
221+
- If both User-assigned and System-assigned managed identities were added, the System-assigned can be removed by updating the `type` to `UserAssigned`:
222+
223+
```azurecli
224+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_MANAGER_RG/providers/Microsoft.NetworkCloud/clusterManagers/$CLUSTER_MANAGER_NAME?api-version=<APIVersion> --body @~/uai-body.json
225+
```
226+
227+
The request body (uai-body.json) example:
228+
229+
```azurecli
230+
{
231+
"identity": {
232+
"type": "UserAssigned",
233+
"userAssignedIdentities": {
234+
"/subscriptions/$SUB_ID/resourceGroups/$UAI_RESOURCE_GROUP/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$UAI_NAME": {}
235+
}
236+
}
237+
}
238+
```
239+
240+
- If multiple User-assigned managed identities were added, one of them can be removed by executing:
241+
242+
```azurecli
243+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_MANAGER_RG/providers/Microsoft.NetworkCloud/clusterManagers/$CLUSTER_MANAGER_NAME?api-version=<APIVersion> --body @~/uai-body.json
244+
```
245+
246+
The request body (uai-body.json) example:
247+
248+
```azurecli
249+
{
250+
"identity": {
251+
"type": "UserAssigned",
252+
"userAssignedIdentities": {
253+
"/subscriptions/$SUB_ID/resourceGroups/$UAI_RESOURCE_GROUP/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$UAI_NAME": null
254+
}
255+
}
256+
}
257+
```
172258

173259
## Delete Cluster Manager
174260

0 commit comments

Comments
 (0)