You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Set up customer provided Key Vault for Managed Credential rotation
3
3
description: Step by step guide on setting up a key vault for managing and rotating credentials used within Azure Operator Nexus Cluster resource.
4
-
author: ghugo
5
-
ms.author: gagehugo
4
+
author: eak13
5
+
ms.author: ekarandjeff
6
6
ms.service: azure-operator-nexus
7
7
ms.topic: how-to
8
-
ms.date: 01/24/2024
8
+
ms.date: 02/5/2025
9
9
ms.custom: template-how-to, devx-track-azurecli
10
10
---
11
11
12
12
# Set up Key Vault for Managed Credential Rotation in Operator Nexus
13
13
14
-
Azure Operator Nexus utilizes secrets and certificates to manage component security across the platform. The Operator Nexus platform handles the rotation of these secrets and certificates. By default, Operator Nexus stores the credentials in a managed Key Vault. To keep the rotated credentials in their own Key Vault, the user must configure their own Key Vault to receive rotated credentials. This configuration requires the user to set up the Key Vault for the Azure Operator Nexus instance. Once created, the user needs to add a role assignment on the Customer Key Vault to allow the Operator Nexus Platform to write updated credentials, and additionally link the Customer Key Vault to the Nexus Cluster Resource.
14
+
Azure Operator Nexus utilizes secrets and certificates to manage component security across the platform. The Operator Nexus platform handles the rotation of these secrets and certificates. By default, Operator Nexus stores the credentials in a managed Key Vault. To keep the rotated credentials in their own Key Vault, the user must configure their own Key Vault to receive rotated credentials. This configuration requires the user to configure the Key Vault for the Azure Operator Nexus instance. Once created, the user needs to add a role assignment on the Customer Key Vault to allow the Operator Nexus Platform to write updated credentials, and additionally link the Customer Key Vault to the Nexus Cluster Resource.
- Get the *Subscription ID* for the customer's subscription
20
+
- Get the _Subscription ID_ for the customer's subscription
21
21
22
22
> [!NOTE]
23
23
> A single Key Vault can be used for any number of clusters.
24
24
25
+
## Configure Key Vault Using Managed Identity for the Cluster
26
+
27
+
> [!NOTE]
28
+
> The managed identity functionality for Key Vault and Cluster managed identity exists with the 2024-10-01-preview API and will be available with the 2025-02-01 GA API.
29
+
30
+
See [Azure Operator Nexus Cluster support for managed identities and user provided resources](./howto-managed-identity-user-provided-resources.md)
31
+
25
32
## Configure Key Vault Using Managed Identity for Cluster Manager
26
33
27
-
Beginning with the 2024-06-01-public-preview API version, managed identities in the Cluster Manager are used for write access to deliver rotated credentials to a key vault. The Cluster Manager identity may be system-assigned or [user-assigned](/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities), and can be managed directly via APIs or via CLI.
34
+
> [!NOTE]
35
+
> This method is deprecated with the roll out of the 2025-02-01 GA API. A transition period is in place to support migration, but existing users should look to migrate to using the Cluster managed identity.
36
+
37
+
Beginning with the 2024-06-01-public-preview API version, managed identities in the Cluster Manager are used for write access to deliver rotated credentials to a key vault. The Cluster Manager identity can be system-assigned or [user-assigned](/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities), and can be managed directly via APIs or via CLI.
28
38
29
39
These examples describe how to configure a managed identity for a Cluster Manager.
30
40
31
41
- Create or update Cluster Manager with system-assigned identity
42
+
32
43
```
33
44
az networkcloud clustermanager create --name "clusterManagerName" --location "location" \
# Show Customer Key Vault setting (secretArchive) on the Nexus cluster
73
90
az networkcloud cluster show --ids /subscriptions/<subscription ID>/resourceGroups/<Resource Group Name>/providers/Microsoft.NetworkCloud/clusters/<Nexus Cluster Name> --query secretArchive
74
91
```
92
+
75
93
<br/>
76
94
77
95
For more help:
@@ -89,19 +107,23 @@ Example:
89
107
```console
90
108
az networkcloud clustermanager show --ids /subscriptions/<Subscription ID>/resourceGroups/<Cluster Manager Resource Group Name>/providers/Microsoft.NetworkCloud/clusterManagers/<Cluster Manager Name>
Refer to [_Grant Managed Identity Access to a Key Vault for Credential Rotation_](#grant-managed-identity-access-to-a-key-vault-for-credential-rotation) to assign the appropriate role to the Managed Identity Principal ID.
119
-
120
-
## Configure Key Vault Using Managed Identity for Cluster
121
-
122
-
> [!IMPORTANT]
123
-
> Please note that this method for configuring a key vault for credential rotation is in preview. **This method can only be used with key vaults that do not have firewall enabled.** If your environment requires the key vault firewall be enabled, use the existing [Cluster Manager]() identity method.
124
138
125
-
Beginning with the 2024-10-01-preview API, managed identities in the Nexus Cluster resource can be used instead of Cluster Manager. The Cluster managed identity may be system-assigned or [user-assigned](/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities), and can be managed directly via APIs or via CLI.
126
-
127
-
> [!NOTE]
128
-
> If Nexus Cluster managed identity is configured for the key vault, then these settings will supersede settings configured in [_Configure Key Vault Using Managed Identity for Cluster Manager_](#configure-key-vault-using-managed-identity-for-cluster-manager)
The Nexus Cluster _secret-archive-settings_ specify the Azure Key Vault URI where rotated credentials are stored and the managed identity which is used to access it.
133
-
134
-
These examples describe how to configure a managed identity for a Nexus Cluster and configure it as part of _secret-archive-settings_.
135
-
136
-
> [!NOTE]
137
-
> Secret archive settings specify the Key Vault URI, not the Key Vault resource ID, and the managed identity specified must be configured for the Nexus Cluster.
138
-
139
-
- Create Nexus Cluster with system-assigned identity to access Key Vault for rotated credentials.
140
-
```azurecli-interactive
141
-
az networkcloud cluster create --name "<cluster-name>" \
az networkcloud cluster update --secret-archive-settings '??' --help
183
-
```
184
-
<br/>
185
-
186
-
### Get the Principal ID for the Cluster Managed Identity
187
-
188
-
Once a managed identity is configured for the Nexus Cluster, use the CLI to view the identity and get the _principalId_ for the managed identity specified in the secret archive settings.
189
-
190
-
Example:
191
-
192
-
```console
193
-
az networkcloud cluster show --ids <cluster-resource-id>
Refer to [_Grant Managed Identity Access to a Key Vault for Credential Rotation_](#grant-managed-identity-access-to-a-key-vault-for-credential-rotation) to assign the appropriate role to the Managed Identity Principal ID.
222
-
223
-
## Grant Managed Identity Access to a Key Vault for Credential Rotation
224
-
225
-
> [!NOTE]
226
-
> A user-assigned managed identity may be created and assigned access to the key vault before the Nexus Cluster is created and prior to deployment. A system-assigned identity must be granted access to the key vault after cluster creation but before deployment.
227
-
228
-
- Assign the *Operator Nexus Key Vault Writer Service Role*. Ensure that *Azure role-based access control* is selected as the permission model for the key vault on the *Access configuration* view. Then from the *Access Control* view, select to add a role assignment.
| Operator Nexus Key Vault Writer Service Role (Preview) | 44f0a1a8-6fea-4b35-980a-8ff50c487c97 |
233
-
234
-
<br/>
235
-
Example:
236
-
237
-
```console
238
-
az role assignment create --assignee <Managed Identity Principal Id> --role 44f0a1a8-6fea-4b35-980a-8ff50c487c97 --scope /subscriptions/<Subscription ID>/resourceGroups/<Resource Group Name>/providers/Microsoft.KeyVault/vaults/<Key Vault Name>
239
-
```
240
-
<br/>
241
-
242
-
If using a user-assigned managed identity, proceed to [add permission to user-assigned identity](#add-a-permission-to-user-assigned-identity)
243
-
244
-
## Add a permission to User-assigned identity
245
-
246
-
When using a user-assigned managed identity to access a Key Vault, a customer is required to provision access to that identity for the Nexus platform.
247
-
Specifically, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` permission needs to be added to the User-assigned identity for `AFOI-NC-MGMT-PME-PROD` Microsoft Entra ID. It's a known limitation of the platform that will be addressed in the future.
248
-
249
-
1. Open the Azure portal and locate the User-assigned identity in question.
250
-
2. Under **Access control (IAM)**, click **Add role assignment**.
251
-
3. Select **Role**: Managed Identity Operator. (See the permissions that the role provides [managed-identity-operator](/azure/role-based-access-control/built-in-roles/identity#managed-identity-operator)).
252
-
4. Assign access to: **User, group, or service principal**.
0 commit comments