Skip to content

Commit 92c2482

Browse files
PRMerger6PRMerger6
authored
Merge pull request #197750 from JnHs/jh-arck8-cliperm
emphasize role and RP
2 parents a0c1105 + 2bdb3e5 commit 92c2482

File tree

1 file changed

+25
-22
lines changed

1 file changed

+25
-22
lines changed

‎articles/azure-arc/kubernetes/quickstart-connect-cluster.md

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: "Quickstart: Connect an existing Kubernetes cluster to Azure Arc"
33
description: In this quickstart, you learn how to connect an Azure Arc-enabled Kubernetes cluster.
44
ms.topic: quickstart
5-
ms.date: 02/16/2022
5+
ms.date: 05/11/2022
66
ms.custom: template-quickstart, mode-other, devx-track-azurecli
77
ms.devlang: azurecli
88
---
@@ -21,6 +21,13 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
2121

2222
* A basic understanding of [Kubernetes core concepts](../../aks/concepts-clusters-workloads.md).
2323

24+
* An identity (user or service principal) which can be used to [log in to Azure CLI](/cli/azure/authenticate-azure-cli) and connect your cluster to Azure Arc.
25+
26+
> [!IMPORTANT]
27+
>
28+
> * The identity must have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
29+
> * The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) can be used for this identity. This role is useful for at-scale onboarding, as it has only the granular permissions required to connect clusters to Azure Arc, and doesn't have permission to update, delete, or modify any other clusters or other Azure resources.
30+
2431
* [Install or upgrade Azure CLI](/cli/azure/install-azure-cli) to version >= 2.16.0
2532

2633
* Install the **connectedk8s** Azure CLI extension of version >= 1.2.0:
@@ -29,10 +36,6 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
2936
az extension add --name connectedk8s
3037
```
3138

32-
* [Log in to Azure CLI](/cli/azure/authenticate-azure-cli) using the identity (user or service principal) that you want to use for connecting your cluster to Azure Arc.
33-
* The identity used needs to at least have 'Read' and 'Write' permissions on the Azure Arc-enabled Kubernetes resource type (`Microsoft.Kubernetes/connectedClusters`).
34-
* The [Kubernetes Cluster - Azure Arc Onboarding built-in role](../../role-based-access-control/built-in-roles.md#kubernetes-cluster---azure-arc-onboarding) is useful for at-scale onboarding as it has the granular permissions required to only connect clusters to Azure Arc. This role doesn't have the permissions to update, delete, or modify any other clusters or other Azure resources.
35-
3639
* An up-and-running Kubernetes cluster. If you don't have one, you can create a cluster using one of these options:
3740
* [Kubernetes in Docker (KIND)](https://kind.sigs.k8s.io/)
3841
* Create a Kubernetes cluster using Docker for [Mac](https://docs.docker.com/docker-for-mac/#kubernetes) or [Windows](https://docs.docker.com/docker-for-windows/#kubernetes)
@@ -89,23 +92,6 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
8992

9093
---
9194

92-
## Meet network requirements
93-
94-
> [!IMPORTANT]
95-
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
96-
> For `*.servicebus.windows.net`, websockets need to be enabled for outbound access on firewall and proxy.
97-
98-
| Endpoint (DNS) | Description |
99-
| ----------------- | ------------- |
100-
| `https://management.azure.com` (for Azure Cloud), `https://management.usgovcloudapi.net` (for Azure US Government) | Required for the agent to connect to Azure and register the cluster. |
101-
| `https://<region>.dp.kubernetesconfiguration.azure.com` (for Azure Cloud), `https://<region>.dp.kubernetesconfiguration.azure.us` (for Azure US Government) | Data plane endpoint for the agent to push status and fetch configuration information. |
102-
| `https://login.microsoftonline.com`, `https://<region>.login.microsoft.com`, `login.windows.net` (for Azure Cloud), `https://login.microsoftonline.us`, `<region>.login.microsoftonline.us` (for Azure US Government) | Required to fetch and update Azure Resource Manager tokens. |
103-
| `https://mcr.microsoft.com`, `https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
104-
| `https://gbl.his.arc.azure.com` (for Azure Cloud), `https://gbl.his.arc.azure.us` (for Azure US Government) | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
105-
| `https://*.his.arc.azure.com` (for Azure Cloud), `https://usgv.his.arc.azure.us` (for Azure US Government) | Required to pull system-assigned Managed Identity certificates. |
106-
|`*.servicebus.windows.net`, `guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
107-
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
108-
10995
## Register providers for Azure Arc-enabled Kubernetes
11096

11197
### [Azure CLI](#tab/azure-cli)
@@ -150,6 +136,23 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
150136

151137
---
152138

139+
## Meet network requirements
140+
141+
> [!IMPORTANT]
142+
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
143+
> For `*.servicebus.windows.net`, websockets need to be enabled for outbound access on firewall and proxy.
144+
145+
| Endpoint (DNS) | Description |
146+
| ----------------- | ------------- |
147+
| `https://management.azure.com` (for Azure Cloud), `https://management.usgovcloudapi.net` (for Azure US Government) | Required for the agent to connect to Azure and register the cluster. |
148+
| `https://<region>.dp.kubernetesconfiguration.azure.com` (for Azure Cloud), `https://<region>.dp.kubernetesconfiguration.azure.us` (for Azure US Government) | Data plane endpoint for the agent to push status and fetch configuration information. |
149+
| `https://login.microsoftonline.com`, `https://<region>.login.microsoft.com`, `login.windows.net` (for Azure Cloud), `https://login.microsoftonline.us`, `<region>.login.microsoftonline.us` (for Azure US Government) | Required to fetch and update Azure Resource Manager tokens. |
150+
| `https://mcr.microsoft.com`, `https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
151+
| `https://gbl.his.arc.azure.com` (for Azure Cloud), `https://gbl.his.arc.azure.us` (for Azure US Government) | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
152+
| `https://*.his.arc.azure.com` (for Azure Cloud), `https://usgv.his.arc.azure.us` (for Azure US Government) | Required to pull system-assigned Managed Identity certificates. |
153+
|`*.servicebus.windows.net`, `guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
154+
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
155+
153156
## Create a resource group
154157

155158
Run the following command:

0 commit comments

Comments
 (0)