You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/iot-operations/configure-observability-monitoring/howto-configure-observability.md
+5-9Lines changed: 5 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,8 +19,10 @@ Observability provides visibility into every layer of your Azure IoT Operations
19
19
20
20
## Prerequisites
21
21
22
-
- Azure IoT Operations Preview installed. For more information, see [Quickstart: Run Azure IoT Operations Preview in GitHub Codespaces with K3s](../get-started-end-to-end-sample/quickstart-deploy.md).
23
-
-[Git](https://git-scm.com/downloads) for cloning the repository.
22
+
* An Arc-enabled Kubernetes cluster.
23
+
* Helm installed on your development machine. For instructions, see [Install Helm](https://helm.sh/docs/intro/install/).
24
+
* Kubectl installed on your development machine. For instructions, see [Install Kubernetes tools](https://kubernetes.io/docs/tasks/tools/).
25
+
* Azure CLI installed on your development machine. For more information, see [How to install the Azure CLI](/cli/azure/install-azure-cli).
24
26
25
27
## Configure your subscription
26
28
@@ -39,17 +41,11 @@ az provider register -n "Microsoft.AlertsManagement"
39
41
40
42
The steps in this section install shared monitoring resources and configure your Arc enabled cluster to emit observability signals to these resources. The shared monitoring resources include Azure Managed Grafana, Azure Monitor Workspace, Azure Managed Prometheus, Azure Log Analytics, and Container Insights. In this section, you also deploy an [OpenTelemetry (Otel) Collector](https://opentelemetry.io/docs/collector/)
41
43
42
-
1.In your console, go to the local folder where you want to clone the Azure IoT Operations repo:
44
+
1.Clone or download the Azure IoT Operations repo to your local machine: [azure-iot-operations.git](https://github.com/Azure/azure-iot-operations.git).
43
45
44
46
> [!NOTE]
45
47
> The repo contains the deployment definition of Azure IoT Operations, and samples that include the sample dashboards used in this article.
46
48
47
-
1. Clone the repo to your local machine, using the following command:
* The following tasks require **Microsoft/Authorization/roleAssignments/write** permissions.
51
-
52
-
* Enabling resource sync rules on the Azure IoT Operations instance. If you don't have role assignment write permissions, you can disable this feature during deployment. This approach is discussed in more detail in the [Deploy](#deploy) section of this article.
53
-
54
-
* Creating a schema registry.
55
-
56
-
> [!TIP]
57
-
>
58
-
> * If you use the Azure CLI, use the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command to give permissions. For example, `az role assignment create --assignee sp_name --role "Role Based Access Control Administrator" --scope subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup`
59
-
>
60
-
> * If you use the Azure portal to assign privileged admin roles to a user or principal, you're prompted to restrict access using conditions. For this scenario, select the **Allow user to assign all roles** condition in the **Add role assignment** page.
61
-
>
62
-
> :::image type="content" source="./media/howto-deploy-iot-operations/add-role-assignment-conditions.png" alt-text="Screenshot that shows assigning users highly privileged role access in the Azure portal.":::
44
+
* Azure access permissions. For more information, see [Deployment details > Required permissions](overview-deploy.md#required-permissions).
63
45
64
46
Development resources:
65
47
@@ -73,7 +55,7 @@ Development resources:
73
55
74
56
A cluster host:
75
57
76
-
* An Azure Arc-enabled Kubernetes cluster with the custom location and workload identity features enabled. If you don't have one, follow the steps in [Prepare your Azure Arc-enabled Kubernetes cluster](./howto-prepare-cluster.md?tabs=wsl-ubuntu).
58
+
* An Azure Arc-enabled Kubernetes cluster with the custom location and workload identity features enabled. If you don't have one, follow the steps in [Prepare your Azure Arc-enabled Kubernetes cluster](./howto-prepare-cluster.md).
77
59
78
60
If you deployed Azure IoT Operations to your cluster previously, uninstall those resources before continuing. For more information, see [Update Azure IoT Operations](./howto-manage-update-uninstall.md#update).
79
61
@@ -83,6 +65,8 @@ A cluster host:
83
65
az iot ops verify-host
84
66
```
85
67
68
+
* (Optional) Prepare your cluster for observability before deploying Azure IoT Operations: [Configure observability](../configure-observability-monitoring/howto-configure-observability.md).
69
+
86
70
## Deploy
87
71
88
72
Use the Azure portal or Azure CLI to deploy Azure IoT Operations to your Arc-enabled Kubernetes cluster.
@@ -154,7 +138,7 @@ Azure IoT Operations requires a schema registry on your cluster. Schema registry
154
138
| Optional parameter | Value | Description |
155
139
| --------- | ----- | ----------- |
156
140
|`--no-progress`|| Disables the deployment progress display in the terminal. |
157
-
|`--disable-rsync-rules`||Disable the resource sync rules on the deployment feature flag if you don't have **Microsoft.Authorization/roleAssignment/write** permissions in the resource group. |
141
+
|`--enable-rsync-rules`||Enable the resource sync rules on the instance to project resources from the cloud to the edge. |
158
142
|`--add-insecure-listener`|| Add an insecure 1883 port config to the default listener. *Not for production use*. |
159
143
|`--broker-config-file`| Path to JSON file | Provide a configuration file for the MQTT broker. For more information, see [Advanced MQTT broker config](https://github.com/Azure/azure-iot-ops-cli-extension/wiki/Advanced-Mqtt-Broker-Config) and [Configure core MQTT broker settings](../manage-mqtt-broker/howto-configure-availability-scale.md). |
* An Azure subscription. If you don't have an Azure subscription, [create one for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
@@ -105,10 +103,14 @@ This section provides steps to create clusters in validated environments on Linu
105
103
106
104
The [AksEdgeQuickStartForAio.ps1](https://github.com/Azure/AKS-Edge/blob/main/tools/scripts/AksEdgeQuickStart/AksEdgeQuickStartForAio.ps1) script automates the process of creating and connecting a cluster, and is the recommended path for deploying Azure IoT Operations on AKS Edge Essentials.
107
105
108
-
109
-
110
106
1. Open an elevated PowerShell window and change the directory to a working folder.
111
107
108
+
1. Get the `objectId` of the Microsoft Entra ID application that the Azure Arc service uses in your tenant.
109
+
110
+
```azurecli
111
+
az ad sp show --id bc313c14-388c-4e7d-a58e-70017303ee3b --query id -o tsv
112
+
```
113
+
112
114
1. Run the following commands, replacing the placeholder values with your information:
113
115
114
116
| Placeholder | Value |
@@ -118,26 +120,28 @@ The [AksEdgeQuickStartForAio.ps1](https://github.com/Azure/AKS-Edge/blob/main/to
118
120
| RESOURCE_GROUP_NAME | The name of an existing resource group or a name for a new resource group to be created. |
119
121
| LOCATION | An Azure region close to you. For the list of currently supported Azure regions, see [Supported regions](../overview-iot-operations.md#supported-regions). |
120
122
| CLUSTER_NAME | A name for the new cluster to be created. |
123
+
| ARC_APP_OBJECT_ID | The object ID value that you retrieved in the previous step. |
121
124
122
-
> [!NOTE]
123
-
> > **Special instructions for AIO Internal Bugbash**:
125
+
> [!NOTE]
126
+
> **Special instructions for AIO Internal Bugbash**:
127
+
>
124
128
> The instructions below for AksEdgeQuickStartForAio.ps1 from AKS-Edge GitHub repo are for external customer consumption and will only work after AIO 0.7 is released.
125
129
> For internal bug bashes, use this powershell script below instead
The following table described Azure IoT Operations deployment and management tasks that require elevated permissions. For information about assigning roles to users, see [Steps to assign an Azure role](../../role-based-access-control/role-assignments-steps.md).
48
+
49
+
| Task | Required permission | Comments |
50
+
| ---- | ------------------- | -------- |
51
+
| Deploy Azure IoT Operations |**Contributor** permissions at the subscription level. ||
52
+
| Create secrets in Key Vault |**Key Vault Secrets Officer** permissions at the resource level. | Only required for secure settings deployment. |
53
+
| Enable resource sync rules on an Azure IoT Operations instance |**Microsoft/Authorization/roleAssignments/write** permissions at the resource group level. | Resource sync rules are disabled by default, but can be enabled during instance creation. |
54
+
| Create a schema registry. |**Microsoft/Authorization/roleAssignments/write** permissions at the resource group level. ||
55
+
56
+
> [!TIP]
57
+
>
58
+
> * If you use the Azure CLI to assign roles, use the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command to give permissions. For example, `az role assignment create --assignee sp_name --role "Role Based Access Control Administrator" --scope subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup`
59
+
>
60
+
> * If you use the Azure portal to assign privileged admin roles to a user or principal, you're prompted to restrict access using conditions. For this scenario, select the **Allow user to assign all roles** condition in the **Add role assignment** page.
61
+
>
62
+
> :::image type="content" source="./media/howto-deploy-iot-operations/add-role-assignment-conditions.png" alt-text="Screenshot that shows assigning users highly privileged role access in the Azure portal.":::
63
+
45
64
## Included components
46
65
47
66
Azure IoT Operations is a suite of data services that run on Azure Arc-enabled edge Kubernetes clusters. It also depends on a set of support services that are also installed as part of a deployment.
Copy file name to clipboardExpand all lines: articles/iot-operations/get-started-end-to-end-sample/quickstart-deploy.md
+11Lines changed: 11 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -81,6 +81,17 @@ To connect your cluster to Azure Arc:
81
81
82
82
1. After signing in, Azure CLI displays all of your subscriptions and indicates your default subscription with an asterisk `*`. To continue with your default subscription, select `Enter`. Otherwise, type the number of the Azure subscription that you want to use.
83
83
84
+
> [!NOTE]
85
+
> **Special instructions for AIO Internal Bugbash**:
86
+
>
87
+
> Official IoT Ops CLI releases are installed via extension index like so az extension add --upgrade --name azure-iot-ops mentioned below.
88
+
> However for bug bashes, we will distribute one-off release candidates intended to expose functionality to exercise internally. Use this for Bug Bash 2 on 9/27:
Copy file name to clipboardExpand all lines: articles/iot-operations/includes/connect-cluster-k3s.md
+6-19Lines changed: 6 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,15 +33,8 @@ ms.custom: include file, ignite-2023, devx-track-azurecli
33
33
1. Download and install a preview version of the `connectedk8s` extension for Azure CLI.
34
34
35
35
```azurecli
36
-
az storage blob download --auth-mode login --blob-url https://github.com/AzureArcForKubernetes/azure-cli-extensions/blob/connectedk8s/public/cli-extensions/connectedk8s-1.10.0-py2.py3-none-any.whl -f ./connectedk8s-1.10.0-py2.py3-none-any.whl
37
-
38
-
az extension add --upgrade --source ./connectedk8s-1.10.0-py2.py3-none-any.whl
39
-
```
40
-
41
-
1. Use the [az connectedk8s connect](/cli/azure/connectedk8s#az-connectedk8s-connect) command to Arc-enable your Kubernetes cluster and manage it as part of your Azure resource group:
1. Upgrade the Azure Arc agent to use a preview build that supports the workload identity feature that Azure IoT Operations uses for user-assigned managed identities.
55
-
56
-
```azurecli
57
-
az connectedk8s upgrade --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --agent-version 0.1.15392-private
58
-
```
59
-
60
-
1. Enable the workload identity feature on the cluster.
47
+
1. Use the [az connectedk8s connect](/cli/azure/connectedk8s#az-connectedk8s-connect) command to Arc-enable your Kubernetes cluster and manage it as part of your Azure resource group:
61
48
62
49
```azurecli
63
-
az connectedk8s update --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --enable-oidc-issuer --enable-workload-identity
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments