Skip to content

Commit c0f434f

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #285058 from priyamshet/priyshet/networkCloudClusterDocUpdate
[operator-nexus] Instructions about managed identity use for the Cluster
2 parents 244e78c + b6457d8 commit c0f434f

File tree

1 file changed

+82
-10
lines changed

1 file changed

+82
-10
lines changed

‎articles/operator-nexus/howto-configure-cluster.md

Lines changed: 82 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ The Infrastructure Cluster resource represents an on-premises deployment of the
3434
within the Cluster Manager. All other platform-specific resources are
3535
dependent upon it for their lifecycle.
3636

37-
You should create the Network Fabric prior to this on-premises deployment.
37+
You should create the Network Fabric before this on-premises deployment.
3838
Each Operator Nexus on-premises instance has a one-to-one association
3939
with a Network Fabric.
4040

41-
### Create the Cluster using AZ CLI:
41+
### Create the Cluster using Azure CLI:
4242

4343
```azurecli
4444
az networkcloud cluster create --name "$CLUSTER_NAME" --location "$LOCATION" \
@@ -61,10 +61,8 @@ az networkcloud cluster create --name "$CLUSTER_NAME" --location "$LOCATION" \
6161
--secret-archive "{key-vault-id:$KVRESOURCE_ID, use-key-vault:true}" \
6262
--cluster-type "$CLUSTER_TYPE" --cluster-version "$CLUSTER_VERSION" \
6363
--tags $TAG_KEY1="$TAG_VALUE1" $TAG_KEY2="$TAG_VALUE2"
64-
6564
```
6665

67-
6866
### Parameters for cluster operations
6967

7068
| Parameter name | Description |
@@ -88,11 +86,11 @@ az networkcloud cluster create --name "$CLUSTER_NAME" --location "$LOCATION" \
8886
| COMPX_RACK_SKU | Rack SKU for CompX Rack; repeat for each rack in compute-rack-definitions |
8987
| COMPX_RACK_SN | Rack Serial Number for CompX Rack; repeat for each rack in compute-rack-definitions |
9088
| COMPX_RACK_LOCATION | Rack physical location for CompX Rack; repeat for each rack in compute-rack-definitions |
91-
| COMPX_SVRY_BMC_PASS | CompX Rack ServerY BMC password, repeat for each rack in compute-rack-definitions and for each server in rack |
92-
| COMPX_SVRY_BMC_USER | CompX Rack ServerY BMC user, repeat for each rack in compute-rack-definitions and for each server in rack |
93-
| COMPX_SVRY_BMC_MAC | CompX Rack ServerY BMC MAC address, repeat for each rack in compute-rack-definitions and for each server in rack |
94-
| COMPX_SVRY_BOOT_MAC | CompX Rack ServerY boot NIC MAC address, repeat for each rack in compute-rack-definitions and for each server in rack |
95-
| COMPX_SVRY_SERVER_DETAILS | CompX Rack ServerY details, repeat for each rack in compute-rack-definitions and for each server in rack |
89+
| COMPX_SVRY_BMC_PASS | CompX Rack ServerY BMC password; repeat for each rack in compute-rack-definitions and for each server in rack |
90+
| COMPX_SVRY_BMC_USER | CompX Rack ServerY BMC user; repeat for each rack in compute-rack-definitions and for each server in rack |
91+
| COMPX_SVRY_BMC_MAC | CompX Rack ServerY BMC MAC address; repeat for each rack in compute-rack-definitions and for each server in rack |
92+
| COMPX_SVRY_BOOT_MAC | CompX Rack ServerY boot NIC MAC address; repeat for each rack in compute-rack-definitions and for each server in rack |
93+
| COMPX_SVRY_SERVER_DETAILS | CompX Rack ServerY details; repeat for each rack in compute-rack-definitions and for each server in rack |
9694
| COMPX_SVRY_SERVER_NAME | CompX Rack ServerY name, repeat for each rack in compute-rack-definitions and for each server in rack |
9795
| MRG_NAME | Cluster managed resource group name |
9896
| MRG_LOCATION | Cluster Azure region |
@@ -111,6 +109,14 @@ az networkcloud cluster create --name "$CLUSTER_NAME" --location "$LOCATION" \
111109
| TAG_VALUE2 | Optional tag2 value to pass to Cluster Create |
112110

113111

112+
## Cluster Identity
113+
114+
Starting with the 2024-06-01-preview API version, a customer can assign managed identity to a Cluster. Both System-assigned and User-Assigned managed identities are supported.
115+
116+
Managed Identity can be assigned to the Cluster during creation or update operations by providing the following parameters:
117+
118+
- **--mi-system-assigned** - Enable System-assigned managed identity. Once added, the Identity can only be removed via the API call at this time.
119+
- **--mi-user-assigned** - Space-separated resource IDs of the User-assigned managed identities to be added. Once added, the Identity can only be removed via the API call at this time.
114120

115121
### Create the Cluster using Azure Resource Manager template editor
116122

@@ -298,9 +304,75 @@ Cluster create Logs can be viewed in the following locations:
298304

299305
:::image type="content" source="./media/nexus-deploy-activity-log.png" lightbox="./media/nexus-deploy-activity-log.png" alt-text="Screenshot of Azure portal showing cluster deploy progress activity log.":::
300306

307+
308+
## Update Cluster Identities via APIs
309+
310+
Cluster managed identities can be assigned via CLI. The unassignment of the identities can be done via API calls.
311+
Note, `<APIVersion>` is the API version 2024-06-01-preview or newer.
312+
313+
- To remove all managed identities, execute:
314+
315+
```azurecli
316+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_RG/providers/Microsoft.NetworkCloud/clusters/$CLUSTER_NAME?api-version=<APIVersion> --body "{\"identity\":{\"type\":\"None\"}}"
317+
```
318+
319+
- If both User-assigned and System-assigned managed identities were added, the User-assigned can be removed by updating the `type` to `SystemAssigned`:
320+
321+
```azurecli
322+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_RG/providers/Microsoft.NetworkCloud/clusters/$CLUSTER_NAME?api-version=<APIVersion> --body @~/uai-body.json
323+
```
324+
325+
The request body (uai-body.json) example:
326+
327+
```azurecli
328+
{
329+
"identity": {
330+
"type": "SystemAssigned"
331+
}
332+
}
333+
```
334+
335+
- If both User-assigned and System-assigned managed identities were added, the System-assigned can be removed by updating the `type` to `UserAssigned`:
336+
337+
```azurecli
338+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_RG/providers/Microsoft.NetworkCloud/clusters/$CLUSTER_NAME?api-version=<APIVersion> --body @~/uai-body.json
339+
```
340+
341+
The request body (uai-body.json) example:
342+
343+
```azurecli
344+
{
345+
"identity": {
346+
"type": "UserAssigned",
347+
"userAssignedIdentities": {
348+
"/subscriptions/$SUB_ID/resourceGroups/$UAI_RESOURCE_GROUP/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$UAI_NAME": {}
349+
}
350+
}
351+
}
352+
```
353+
354+
- If multiple User-assigned managed identities were added, one of them can be removed by executing:
355+
356+
```azurecli
357+
az rest --method PATCH --url /subscriptions/$SUB_ID/resourceGroups/$CLUSTER_RG/providers/Microsoft.NetworkCloud/clusters/$CLUSTER_NAME?api-version=<APIVersion> --body @~/uai-body.json
358+
```
359+
360+
The request body (uai-body.json) example:
361+
362+
```azurecli
363+
{
364+
"identity": {
365+
"type": "UserAssigned",
366+
"userAssignedIdentities": {
367+
"/subscriptions/$SUB_ID/resourceGroups/$UAI_RESOURCE_GROUP/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$UAI_NAME": null
368+
}
369+
}
370+
}
371+
```
372+
301373
## Delete a cluster
302374

303-
When deleting a cluster, it will delete the resources in Azure and the cluster that resides in the on-premises environment.
375+
When deleting a cluster, it deletes the resources in Azure and the cluster that resides in the on-premises environment.
304376

305377
>[!NOTE]
306378
>If there are any tenant resources that exist in the cluster, it will not be deleted until those resources are deleted.

0 commit comments

Comments
 (0)