You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/operator-nexus/howto-cluster-managed-identity-user-provided-resources.md
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: "Azure Operator Nexus Cluster Support for Managed Identities and User Provided Resources"
2
+
title: "Azure Operator Nexus Cluster Support for managed identities and user provided resources"
3
3
description: Azure Operator Nexus Cluster support for managed identities and user provided resources.
4
4
author: eak13
5
5
ms.author: ekarandjeff
@@ -33,7 +33,7 @@ Once added, the Identity can only be removed via the API call at this time. For
33
33
> [!NOTE]
34
34
> The managed identity functionality for Log Analytics Workspace and Key Vault exists with the 2024-10-01-preview API and will be available with the 2025-02-01 GA API.
35
35
36
-
## Operator Nexus Clusters with User Assigned Managed Identities
36
+
## Operator Nexus Clusters with User Assigned Managed Identities (UAMI)
37
37
38
38
It's a best practice to first define all of the user provided resources (Storage Account, LAW, and Key Vault), the managed identities associated with those resources and then assign the managed identity the appropriate access to the resource. If these steps aren't done before Cluster creation, the steps need to be completed before Cluster deployment.
39
39
@@ -57,18 +57,18 @@ The following steps should be followed for using UAMIs with Nexus Clusters and a
57
57
58
58
### Create the resources and assign the UAMI to the resources
59
59
60
-
#### Storage Accounts
60
+
#### Storage Accounts setup
61
61
62
62
1. Create a storage account, or identify an existing storage account that you want to use. See [Create an Azure storage account](/azure/storage/common/storage-account-create?tabs=azure-portal).
63
63
1. Create a blob storage container in the storage account. See [Create a container](/azure/storage/blobs/storage-quickstart-blobs-portal#create-a-container).
64
64
1. Assign the `Storage Blob Data Contributor` role to users and the UAMI which need access to the run-\* command output. See [Assign an Azure role for access to blob data](/azure/storage/blobs/assign-azure-role-data-access?tabs=portal).
65
65
66
-
#### Log Analytics Workspaces
66
+
#### Log Analytics Workspaces setup
67
67
68
68
1. Create a Log Analytics Workspace (LAW), or identify an existing LAW that you want to use. See [Create a Log Analytics Workspace](/azure/azure-monitor/logs/quick-create-workspace).
69
69
1. Assign the `Log Analytics Contributor` role to the UAMI for the log analytics workspace. See [Manage access to Log Analytics workspaces](/azure/azure-monitor/logs/manage-access?tabs=portal).
70
70
71
-
#### Key Vault
71
+
#### Key Vault setup
72
72
73
73
1. Create a Key Vault, or identify an existing Key Vault that you want to use. See [Create a Key Vault](/azure/key-vault/general/quick-create-cli).
74
74
1. Enable the Key Vault for Role Based Access Control (RBAC). See [Enable Azure RBAC permissions on Key Vault](/azure/key-vault/general/rbac-guide?tabs=azure-cli#enable-azure-rbac-permissions-on-key-vault).
@@ -82,29 +82,29 @@ The following steps should be followed for using UAMIs with Nexus Clusters and a
### Create or update the Cluster to use User Assigned Managed Identities and user provided resources
85
+
### Create or update the Nexus Cluster to use User Assigned Managed Identities and user provided resources
86
86
87
87
#### Define the UAMI(S) on the Cluster
88
88
89
89
When creating or updating a Cluster with a user assigned managed identity, use the `--mi-user-assigned` parameter along with the resource ID of the UAMI. If you wish to specify multiple UAMIs, list the UAMIs' resources IDs with a space between them. Each UAMI that's used for a Key Vault, LAW, or Storage Account must be provided in this list.
90
90
91
-
#### Storage Account Settings
91
+
#### Storage Account settings
92
92
93
93
The `--command-output-settings` data construct is used to define the Storage Account where run command output is written. It consists of the following fields:
94
94
95
95
-`container-url`: The URL of the storage account container that is to be used by the specified identities.
96
96
-`identity-resource-id`: The user assigned managed identity resource ID to use. Mutually exclusive with a system assigned identity type.
97
97
-`identity-type`: The type of managed identity that is being selected. Use `UserAssignedIdentity`.
98
98
99
-
#### Log Analytics Workspace
99
+
#### Log Analytics Workspace settings
100
100
101
101
The `--analytics-output-settings` data construct is used to define the LAW where metrics are sent. It consists of the following fields:
102
102
103
103
-`analytics-workspace-id`: The resource ID of the analytics workspace that is to be used by the specified identity.
104
104
-`identity-resource-id`: The user assigned managed identity resource ID to use. Mutually exclusive with a system assigned identity type
105
105
-`identity-type`: The type of managed identity that is being selected. Use `UserAssignedIdentity`.
106
106
107
-
#### Key Vault Settings
107
+
#### Key Vault settings
108
108
109
109
The `--secret-archive-settings` data construct is used to define the Key Vault where rotated credentials are written. It consists of the following fields:
### Create the resources and assign the SAMI to the resources
286
286
287
-
#### Storage Accounts
287
+
#### Storage Accounts setup
288
288
289
289
1. Create a storage account, or identify an existing storage account that you want to use. See [Create an Azure storage account](/azure/storage/common/storage-account-create?tabs=azure-portal).
290
290
1. Create a blob storage container in the storage account. See [Create a container](/azure/storage/blobs/storage-quickstart-blobs-portal#create-a-container).
291
291
1. Assign the `Storage Blob Data Contributor` role to users and the SAMI which need access to the run-\* command output. See [Assign an Azure role for access to blob data](/azure/storage/blobs/assign-azure-role-data-access?tabs=portal).
292
292
293
-
#### Log Analytics Workspaces
293
+
#### Log Analytics Workspaces setup
294
294
295
295
1. Create a Log Analytics Workspace (LAW), or identify an existing LAW that you want to use. See [Create a Log Analytics Workspace](/azure/azure-monitor/logs/quick-create-workspace).
296
296
1. Assign the `Log Analytics Contributor` role to the SAMI for the log analytics workspace. See [Manage access to Log Analytics workspaces](/azure/azure-monitor/logs/manage-access?tabs=portal).
297
297
298
-
#### Key Vault
298
+
#### Key Vault setup
299
299
300
300
1. Create a Key Vault, or identify an existing Key Vault that you want to use. See [Create a Key Vault](/azure/key-vault/general/quick-create-cli).
301
301
1. Enable the Key Vault for Role Based Access Control (RBAC). See [Enable Azure RBAC permissions on Key Vault](/azure/key-vault/general/rbac-guide?tabs=azure-cli#enable-azure-rbac-permissions-on-key-vault).
### Update the Cluster with the user provided resources information
306
306
307
-
#### Storage Account Settings
307
+
#### Storage Account settings
308
308
309
309
The `--command-output-settings` data construct is used to define the Storage Account where run command output is written. It consists of the following fields:
310
310
311
311
-`container-url`: The URL of the storage account container that is to be used by the specified identities.
312
312
-`identity-resource-id`: Not required when using a SAMI
313
313
-`identity-type`: The type of managed identity that is being selected. Use `SystemAssignedIdentity`.
314
314
315
-
#### Log Analytics Workspace
315
+
#### Log Analytics Workspace settings
316
316
317
317
The `--analytics-output-settings` data construct is used to define the LAW where metrics are sent. It consists of the following fields:
318
318
319
319
-`analytics-workspace-id`: The resource ID of the analytics workspace that is to be used by the specified identity.
320
320
-`identity-resource-id`: Not required when using a SAMI
321
321
-`identity-type`: The type of managed identity that is being selected. Use `SystemAssignedIdentity`.
322
322
323
-
#### Key Vault Settings
323
+
#### Key Vault settings
324
324
325
325
The `--secret-archive-settings` data construct is used to define the Key Vault where rotated credentials are written. It consists of the following fields:
0 commit comments