|
| 1 | +--- |
| 2 | +title: Enabling Network Security Group flow logs for Azure Red Hat OpenShift |
| 3 | +description: In this article, learn how to enable flow logs to analyze traffic for Network Security Groups. |
| 4 | +author: johnmarc |
| 5 | +ms.service: azure-redhat-openshift |
| 6 | +ms.topic: how-to |
| 7 | +ms.author: johnmarc |
| 8 | +ms.date: 08/30/2022 |
| 9 | +topic: how-to |
| 10 | +recommendations: true |
| 11 | +keywords: azure, openshift, aro, red hat, azure CLI |
| 12 | +#Customer intent: I need to create and use an Azure service principal to restrict permissions to my Azure Red Hat OpenShift cluster. |
| 13 | +--- |
| 14 | + |
| 15 | +# Enable Network Security Group flow logs |
| 16 | + |
| 17 | +Flow logs allow you to analyze traffic for Network Security Groups in specific regions that have Azure Network Watcher configured. |
| 18 | + |
| 19 | +## Prerequisites |
| 20 | + |
| 21 | +You must have an existing Azure Red Hat OpenShift cluster. Follow [this guide](tutorial-create-cluster.md) to create a private Azure Red Hat OpenShift cluster. |
| 22 | + |
| 23 | +## Configure Azure Network Watcher |
| 24 | + |
| 25 | +Make sure an Azure Network Watcher exists in the applicable region or use the one existing by convention. For example, for the eastus region: |
| 26 | +``` |
| 27 | +"subscriptions/{subscriptionID}/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus" |
| 28 | +``` |
| 29 | +See [Enable Azure Network Watcher](../network-watcher/enable-network-watcher-flow-log-settings.md)for more information. |
| 30 | + |
| 31 | +## Create storage account |
| 32 | + |
| 33 | +[Create a storage account](../storage/common/storage-account-create.md) (or use an existing storage account) for storing the actual flow logs. It must be in the same region as where the flow logs are going to be created. It cannot be in the same resource group as the cluster's resources. |
| 34 | + |
| 35 | +## Configure service principal |
| 36 | + |
| 37 | +The service principal used by the cluster needs the [proper permissions](../network-watcher/required-rbac-permissions.md) in order to create the necessary resources for the flow logs, and to access the storage account. The easiest way to achieve that is by assigning it the network administrator and storage account contributor roles at the subscription level. Alternatively, you can create a custom role containing the required actions from the page linked above and assign it to the service principal. |
| 38 | + |
| 39 | +To get the service principal ID, run the following command: |
| 40 | +``` |
| 41 | +az aro show -g {ResourceGroupName} -n {ClusterName} --query servicePrincipalProfile.clientId -o tsv |
| 42 | +``` |
| 43 | +Use the output of the above command to get the object ID: |
| 44 | +``` |
| 45 | +az ad sp show --id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX --query id --out tsv |
| 46 | +``` |
| 47 | +To assign network admin, run the following command: |
| 48 | +``` |
| 49 | +az role assignment create --assignee "{servicePrincipalObjectID}" --role "4d97b98b-1d4f-4787-a291-c67834d212e7" --subscription "{subscriptionID}" --resource-group "{networkWatcherResourceGroup}" |
| 50 | +``` |
| 51 | +To assign storage account contributor, run the following command: |
| 52 | +``` |
| 53 | +az role assignment create --role "17d1049b-9a84-46fb-8f53-869881c3d3ab" --assignee-object-id "{servicePrincipalObjectID}" |
| 54 | +``` |
| 55 | +See [Azure built-in roles](../role-based-access-control/built-in-roles.md) for IDs of built-in roles. |
| 56 | + |
| 57 | +Create a manifest as in the following example, or update the existing object to contain `spec.nsgFlowLogs` in case you are already using another preview feature: |
| 58 | +``` |
| 59 | +apiVersion: "preview.aro.openshift.io/v1alpha1" |
| 60 | +kind: PreviewFeature |
| 61 | +metadata: |
| 62 | + name: cluster |
| 63 | +spec: |
| 64 | + azEnvironment: "AzurePublicCloud" |
| 65 | + resourceId: "subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.RedHatOpenShift/openShiftClusters/{clusterID}" |
| 66 | + nsgFlowLogs: |
| 67 | + enabled: true |
| 68 | + networkWatcherID: "subscriptions/{subscriptionID}/resourceGroups/{networkWatcherRG}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}" |
| 69 | + flowLogName: "{flowlogName}" |
| 70 | + retentionDays: {retentionDays} |
| 71 | + storageAccountResourceId: "subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}" |
| 72 | + version: {version} |
| 73 | +``` |
| 74 | +See [Tutorial: Log network traffic to and from a virtual machine using the Azure portal](../network-watcher/network-watcher-nsg-flow-logging-portal.md) for possible values for `version` and `retentionDays`. |
| 75 | + |
| 76 | +The cluster will create flow logs for each Network Security Group in the cluster resource group. |
0 commit comments