You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/cyclecloud/how-to/running-behind-proxy.md
+8-9Lines changed: 8 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,32 +2,32 @@
2
2
title: Using a Web Proxy
3
3
description: Configure Azure CycleCloud to use a proxy for HTTP/HTTPS web traffic, which is useful to monitor traffic or when direct internet access isn't allowed.
4
4
author: dpwatrous
5
-
ms.date: 2/18/2020
5
+
ms.date: 07/01/2025
6
6
ms.author: dawatrou
7
7
---
8
8
9
9
# Configuring CycleCloud to Use an HTTP(s) Proxy
10
10
11
-
Azure CycleCloud can be configured to use a proxy for all internet-bound HTTP and/or HTTPS traffic. This is generally useful when direct internet access is not allowed, or for traffic monitoring purposes.
11
+
You can configure Azure CycleCloud to use a proxy for all internet-bound HTTP and/or HTTPS traffic. This configuration is generally useful when direct internet access isn't allowed or when you want to monitor traffic.
12
12
13
13
## Proxy Setup
14
14
15
-
To enable proxies, go into the CycleCloud GUI and navigate to the **Settings** tab from the left frame, then doubleclick on the **HTTP(s) Proxies** row. In the configuration dialog that pops up, verify that **Enabled** is checked and enter the proxy details in the form.
15
+
To enable proxies, go to the CycleCloud GUI and navigate to the **Settings** tab in the left frame. Then, double-click the **HTTP(s) Proxies** row. In the configuration dialog that appears, verify that **Enabled** is checked and enter the proxy details in the form.
Changes to the proxy settings will not take effect until after a restart. To restart CycleCloud, run the following command:
19
+
Changes to the proxy settings don't take effect until after a restart. To restart CycleCloud, run the following command:
20
20
21
21
```bash
22
22
/opt/cycle_server/cycle_server restart --wait
23
23
```
24
24
25
25
## Add storage endpoint for Blob access
26
26
27
-
CycleCloud requires access to a Blob Storage container in your subscription in order to cache installation files for nodes. When operating behind a proxy or on a locked down network, you should configure a [Virtual Network Service Endpoint](/azure/virtual-network/virtual-network-service-endpoints-overview) or a [Private Endpoint](/azure/storage/common/storage-private-endpoints) to the storage service. This will route requests to the storage container through the Azure backbone network instead of through the public management URLs.
27
+
CycleCloud needs access to a Blob Storage container in your subscription to cache installation files for nodes. When operating behind a proxy or on a locked down network, configure a [Virtual Network Service Endpoint](/azure/virtual-network/virtual-network-service-endpoints-overview) or a [Private Endpoint](/azure/storage/common/storage-private-endpoints) to the storage service. This configuration routes requests to the storage container through the Azure backbone network instead of through the public management URLs.
28
28
29
29
> [!TIP]
30
-
> When combining a Service Endpoint for Azure Storage access with an HTTPS Proxy for outbound Azure API traffic, CycleCloud itself can be configured to avoid the Proxy and send Storage requests directly via the Service Endpoint.
30
+
> When you combine a Service Endpoint for Azure Storage access with an HTTPS Proxy for outbound Azure API traffic, you can configure CycleCloud to avoid the Proxy and send Storage requests directly via the Service Endpoint.
31
31
>
32
32
> To disable the proxy for Storage Account access, add:
33
33
> `-Dhttp.nonProxyHosts="*.core.windows.net"`
@@ -36,16 +36,15 @@ CycleCloud requires access to a Blob Storage container in your subscription in o
36
36
37
37
## Export HTTPS_PROXY before running the CycleCloud CLI installer
38
38
39
-
The [CycleCloud CLI installer](~/articles/cyclecloud/how-to/install-cyclecloud-cli.md) requires outbound access to install packages via `pip`. Prior to running the install script, be sure to set the **HTTPS_PROXY** environment variable to point to your
40
-
proxy server and port:
39
+
The [CycleCloud CLI installer](~/articles/cyclecloud/how-to/install-cyclecloud-cli.md) needs outbound access to install packages through `pip`. Before running the install script, set the **HTTPS_PROXY** environment variable to point to your proxy server and port:
41
40
42
41
```bash
43
42
export HTTPS_PROXY=myserver:8080
44
43
```
45
44
46
45
## Exporting proxy settings on nodes
47
46
48
-
If the nodes started by CycleCloud also need to have traffic routed through a proxy server, we suggest the use of [cloud-init](~/articles/cyclecloud/how-to/cloud-init.md) to help configure your proxy settings as needed. For example:
47
+
If the nodes that CycleCloud starts also need to route traffic through a proxy server, we suggest using [cloud-init](~/articles/cyclecloud/how-to/cloud-init.md) to help configure your proxy settings. For example:
Copy file name to clipboardExpand all lines: articles/cyclecloud/how-to/running-in-locked-down-network.md
+44-59Lines changed: 44 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,17 +2,17 @@
2
2
title: Running in Locked Down Networks
3
3
description: Learn how to install and run Azure CycleCloud in a locked down networks. Details on internal communication between cluster nodes and CycleCloud.
4
4
author: anhoward
5
-
ms.date: 2/26/2020
5
+
ms.date: 07/01/2025
6
6
ms.author: anhoward
7
7
---
8
8
9
9
# Operating in a locked down network
10
10
11
-
The CycleCloud application and cluster nodes can operate in environments with limited internet access, though there are a minimal number of TCP ports that must remain open.
11
+
The CycleCloud application and cluster nodes can operate in environments with limited internet access, though you must keep a minimal number of TCP ports open.
12
12
13
-
## Installing Azure CycleCloud in a locked down network
13
+
## Install Azure CycleCloud in a locked down network
14
14
15
-
The CycleCloud VM must be able to connect to a number of Azure APIs to orchestrate cluster VMs and to authenticate to Azure Active Directory. Since these APIs use HTTPS, CycleCloud requires outbound HTTPS access to:
15
+
The CycleCloud VM needs to connect to several Azure APIs to manage cluster VMs and authenticate to Azure Active Directory. Since these APIs use HTTPS, CycleCloud requires outbound HTTPS access to:
16
16
17
17
*_management.azure.com_ (Azure ARM Management)
18
18
*_login.microsoftonline.com_ (Azure AD)
@@ -22,40 +22,40 @@ The CycleCloud VM must be able to connect to a number of Azure APIs to orchestra
The management API is hosted regionally, and the public IP address ranges can be found[here](https://www.microsoft.com/en-us/download/details.aspx?id=41653).
25
+
The management API is hosted regionally. You can find the public IP address ranges [here](https://www.microsoft.com/en-us/download/details.aspx?id=41653).
26
26
27
-
The Azure AD login is part of the Microsoft 365 common APIs and IP address ranges for the service can be found[here](/office365/enterprise/urls-and-ip-address-ranges).
27
+
The Azure AD authentication is part of the Microsoft 365 common APIs. You can find the IP address ranges for this service [here](/office365/enterprise/urls-and-ip-address-ranges).
28
28
29
-
The Azure Insights and Log Analytics IP address ranges can be found[here](/azure/azure-monitor/app/ip-addresses).
29
+
You can find the IP address ranges for Azure Insights and Log Analytics[here](/azure/azure-monitor/app/ip-addresses).
30
30
31
-
Azure CycleCloud must be able to access Azure Storage accounts. The recommended way to provide private access to this service and any other supported Azure service is through[Virtual Network Service Endpoints](/azure/virtual-network/virtual-network-service-endpoints-overview).
31
+
Azure CycleCloud must access Azure Storage accounts. To provide private access to this service and any other supported Azure service, we recommend using[Virtual Network Service Endpoints](/azure/virtual-network/virtual-network-service-endpoints-overview).
32
32
33
-
If using Network Security Groups or the Azure Firewall to limit outbound access to the required domains, then it is possible to configure Azure Cyclecloud to route all requests through an HTTPS proxy. See: [Using a Web Proxy](./running-behind-proxy.md)
33
+
If you use Network Security Groups or the Azure Firewall to limit outbound access to the required domains, you can configure Azure CycleCloud to route all requests through an HTTPS proxy. For more information, see [Using a Web Proxy](./running-behind-proxy.md).
34
34
35
35
### Configuring an Azure Network Security Group for the CycleCloud VM
36
36
37
-
One way to limit outbound internet access from the CycleCloud VM without configuring the Azure Firewall or an HTTPS proxy is to configure a strict Azure Network Security Group for the CycleCloud VM's subnet. The simplest way to do that is to use [Service Tags](/azure/virtual-network/service-tags-overview) in the subnet or VM level [Network Security Group](/azure/virtual-network/security-overview) to permit the required outbound Azure access.
37
+
You can limit outbound internet access from the CycleCloud VM by configuring a strict Azure Network Security Group for the CycleCloud VM's subnet. This approach doesn't require configuring the Azure Firewall or an HTTPS proxy. The simplest way to do that is to use [Service Tags](/azure/virtual-network/service-tags-overview) in the subnet or VM level [Network Security Group](/azure/virtual-network/security-overview) to permit the required outbound Azure access.
38
38
39
39
1. Configure a **Storage Service Endpoint** for the Subnet to allow access from CycleCloud to Azure Storage
40
40
41
-
2. Add the following NSG Outbound rule to *Deny* outbound access by default using the "**Internet**" destination Service Tag:
41
+
1. Add the following NSG Outbound rule to *Deny* outbound access by default using the "**Internet**" destination Service Tag:
42
42
43
-
| Priority | Name | Port | Protocol | Source | Destination | Action |
@@ -65,45 +65,34 @@ These ports need to be open to allow for communication between the cluster nodes
65
65
## Launching Azure CycleCloud clusters in a locked down network
66
66
67
67
> [!NOTE]
68
-
> Running cluster nodes in a subnet without outbound internet access is fully supported today, but it is an advanced topic that often requires either a custom image or customization of the default CycleCloud cluster types and projects or both.
68
+
> Azure CycleCloud supports running cluster nodes in a subnet without outbound internet access. However, it's an advanced topic that often requires either a custom image or customization of the default CycleCloud cluster types and projects, or both.
69
69
>
70
-
> We are actively updating the cluster types and projects to eliminate most or all of that work. But, if you encounter failures with your cluster type or project in your locked down environment, please consider opening a Support request for assistance.
70
+
> We're actively updating the cluster types and projects to eliminate most or all of that work. If you encounter failures with your cluster type or project in your locked down environment, consider opening a support request for assistance.
71
71
>
72
72
73
73
Running VMs or Cyclecloud clusters in a virtual network or subnet with outbound internet access generally requires
74
-
the following:
74
+
the following steps:
75
75
76
-
1. Azure Cyclecloud must be reachable from the cluster VMs for full functionality. Either:
77
-
1. Cluster VMs must be able to connect to Azure Cyclecloud directly via HTTPS and AMQP, or
78
-
2. The Cyclecloud ReturnProxy feature must be enabled at cluster creation time and Cyclecloud itself must be able to connect to the ReturnProxy VM via SSH
79
-
2. All software packages required by the cluster must either be:
80
-
1. Pre-installed in a custom Managed Image for the cluster VMs, or
81
-
2. Available in a package repository mirror accessible from the VMs, or
82
-
3. Copied to the VM from Azure Storage and installed directly by a Cyclecloud project
83
-
3. All Cluster nodes must be able to access Azure Storage accounts. The recommended way
84
-
to provide private access to this service and any other supported Azure service is to enable a [Virtual Network Service Endpoint](/azure/virtual-network/virtual-network-service-endpoints-overview) for Azure Storage.
76
+
1. Make Azure Cyclecloud reachable from the cluster VMs for full functionality. Either:
77
+
1. Cluster VMs connect to Azure Cyclecloud directly via HTTPS and AMQP, or
78
+
1. Enable the Cyclecloud ReturnProxy feature when you create the cluster. Cyclecloud must be able to connect to the ReturnProxy VM through SSH.
79
+
1. Make sure the cluster VMs have all the required software packages by:
80
+
1. Preinstalling them in a custom Managed Image,
81
+
1. Providing a package repository mirror that the VMs can access, or
82
+
1. Copying them to the VM from Azure Storage and installing them directly through a Cyclecloud project.
83
+
1. Make sure all cluster nodes can access Azure Storage accounts. To provide private access to this service and any other supported Azure service, enable a [Virtual Network Service Endpoint](/azure/virtual-network/virtual-network-service-endpoints-overview) for Azure Storage.
85
84
86
85
87
-
## Project Updates from GitHub
86
+
## Project updates from GitHub
88
87
89
-
Cyclecloud will download cluster projects from GitHub during the "Staging" orchestration
90
-
phase. This download will occur after initial installation, after upgrading Cyclecloud, or
91
-
when starting a cluster of a certain type for the first time. In a locked down environment, HTTPS
92
-
outbound traffic to [github.com](https://www.github.com) may be blocked. In such a case, node
93
-
creation during the staging resources phase will fail.
88
+
CycleCloud downloads cluster projects from GitHub during the **Staging** orchestration phase. This download happens after initial installation, after upgrading CycleCloud, or when you start a cluster of a certain type for the first time. In a locked down environment, HTTPS outbound traffic to [github.com](https://www.github.com) might be blocked. If this traffic is blocked, node creation during the staging resources phase fails.
94
89
95
-
If access to GitHub can be opened temporarily during the creation of the first node
96
-
then CycleCloud will prepare the local files for all subsequent nodes. If temporary
97
-
access is not possible then the necessary files can be downloaded
98
-
from another machine and copied to CycleCloud.
90
+
If you can temporarily open access to GitHub during the creation of the first node, CycleCloud prepares the local files for all subsequent nodes. If temporary access isn't possible, you can download the necessary files from another machine and copy them to CycleCloud.
99
91
100
-
First determine which project and
101
-
version your cluster will need, e.g. Slurm 3.0.8. It's normally the highest version
102
-
number in the database for a given project.
103
-
You can determine the latest version either by visiting the github project page or by
104
-
querying CycleCloud for the latest version.
92
+
First, determine which project and version your cluster needs, such as Slurm 3.0.8. It's usually the highest version number in the database for a given project.
93
+
You can find the latest version by visiting the GitHub project page or by querying CycleCloud for the latest version.
105
94
106
-
To query CycleCloud (note that there will often be multiple versions listed):
95
+
To query CycleCloud (note that there are often multiple versions listed):
107
96
108
97
```shell
109
98
/opt/cycle_server/cycle_server execute 'select Name, Version, Url from cloud.project where name == "slurm" order by Version'
You can find this project version and all dependencies in the [release tag](https://github.com/Azure/cyclecloud-slurm/releases/tag/3.0.8).
118
106
119
-
You can download all release artifacts manually, but the CycleCloud CLI provides
120
-
a helper for this operation.
107
+
You can manually download all release artifacts, but the CycleCloud CLI provides a helper for this operation.
121
108
122
-
First, use the CycleCloud CLI to fetch and prepare the repository from github
123
-
(this is the same operation CycleCloud performs during the "Staging Resources" phase):
109
+
First, use the CycleCloud CLI to fetch and prepare the repository from GitHub. This operation is the same operation CycleCloud performs during the "Staging Resources" phase:
0 commit comments