You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/operator-nexus/howto-cluster-managed-identity-user-provided-resources.md
+10-11Lines changed: 10 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,21 +29,20 @@ For information on using the API to update Cluster managed identities, see [Upda
29
29
30
30
-[Install Azure CLI](https://aka.ms/azcli).
31
31
- Install the latest version of the [appropriate Azure CLI extensions](./howto-install-cli-extensions.md).
32
-
33
-
> [!NOTE]
34
-
> The managed identity functionality for Log Analytics Workspace (LAW) and Key Vault exists with the 2024-10-01-preview API and will be available with the 2025-02-01 GA API.
32
+
- Storage Account managed identity support requires the 2024-07-01 or later version of the NetworkCloud API.
33
+
- Key Vault and Log Analytics Workspace managed identity support requires the 2025-02-01 or later version of the NetworkCloud API.
35
34
36
35
## Operator Nexus Clusters with User Assigned Managed Identities (UAMI)
37
36
38
37
It's a best practice to first define all of the user provided resources (Storage Account, LAW, and Key Vault), the managed identities associated with those resources and then assign the managed identity the appropriate access to the resource. If these steps aren't done before Cluster creation, the steps need to be completed before Cluster deployment.
39
38
40
39
The impacts of not configuring these resources for a new Cluster are as follows:
41
40
42
-
-_Storage Account:_ Cluster creation fails as there is a check to ensure that `commandOutputSettings` exists on the Cluster input.
41
+
-_Storage Account:_ Cluster creation fails as there's a check to ensure that `commandOutputSettings` exists on the Cluster input.
43
42
-_LAW:_ Cluster deployment fails as the LAW (Log Analytics Workplace) is required to install software extensions during deployment.
44
43
-_Key Vault:_ Credential rotations fail as there's a check to ensure write access to the user provided Key Vault before performing credential rotation.
45
44
46
-
Updating the Cluster can be done at any time. Changing the LAW settings will cause a brief disruption in sending metrics to the LAW as the extensions which use the LAW will need to be reinstalled.
45
+
Updating the Cluster can be done at any time. Changing the LAW settings causes a brief disruption in sending metrics to the LAW as the extensions which use the LAW needs to be reinstalled.
47
46
48
47
The following steps should be followed for using UAMIs with Nexus Clusters and associated resources.
49
48
@@ -235,18 +234,18 @@ Using a System Assigned Managed Identity (SAMI) follows a slightly different pat
235
234
236
235
For a new Cluster, these steps need to be completed before Cluster deployment. The impacts of not configuring these resources by deployment time for a new Cluster are as follows:
237
236
238
-
-_Storage Account:_ Cluster creation fails as there is a check to ensure that `commandOutputSettings` exists on the Cluster input.
237
+
-_Storage Account:_ Cluster creation fails as there's a check to ensure that `commandOutputSettings` exists on the Cluster input.
239
238
-_LAW:_ Cluster deployment fails as the LAW is required to install software extensions during deployment.
240
239
-_Key Vault:_ Credential rotations fail as there's a check to ensure write access to the user provided Key Vault before performing credential rotation.
241
240
242
-
Updating the Cluster can be done at any time. Changing the LAW settings will cause a brief disruption in sending metrics to the LAW as the extensions which use the LAW need to be reinstalled.
241
+
Updating the Cluster can be done at any time. Changing the LAW settings causes a brief disruption in sending metrics to the LAW as the extensions which use the LAW need to be reinstalled.
243
242
244
243
The following steps should be followed for using UAMIs with Nexus Clusters and associated resources.
245
244
246
245
_Cluster Creation_
247
246
248
247
1.[Create the user provided resources](#create-the-user-provided-resources)
249
-
1.[Create the Cluster with a SAMI and specify the resources that will use the SAMI](#create-the-cluster-with-a-sami)
248
+
1.[Create the Cluster with a SAMI and specify the resources that use the SAMI](#create-the-cluster-with-a-sami)
250
249
1.[Query the Cluster to get the SAMI](#query-the-cluster-to-get-the-sami)
251
250
1.[Update the resources and assign the SAMI to the resources](#update-the-resources-and-assign-the-sami-to-the-resources)
252
251
1. Deploy the Cluster
@@ -261,7 +260,7 @@ _Cluster Update_
261
260
262
261
### Create the user provided resources
263
262
264
-
This section covers the user provided resource setup prior to Cluster creation.
263
+
This section provides external links for the user resource setup that needs to occur before Cluster creation.
265
264
266
265
#### Storage Accounts setup
267
266
@@ -396,7 +395,7 @@ These updates are applicable post Cluster creation or update to ensure that the
396
395
397
396
### Update the Cluster with the user provided resources information
398
397
399
-
This step is only required after updating a Cluster to add a SAMI and should be performed after updating the resources to assign the SAMI the appropriate role(s).
398
+
This step is only required after updating a Cluster to add a SAMI and should be performed after updating the resources to assign the SAMI the appropriate role or roles.
400
399
401
400
#### Storage Account settings
402
401
@@ -574,7 +573,7 @@ secret-archive-settings:
574
573
identity-resource-id
575
574
```
576
575
577
-
_**Notes:**_`vault-uri` in `secret-archive-settings` is the URI for the Key Vault being specified versus the ARM resource ID that is specified for `key-vault-id`. The same managed identity that was specified for the Cluster Manager can be used on the Cluster.
576
+
_**Notes:**_`vault-uri` in `secret-archive-settings` is the URI for the Key Vault being specified versus the Azure Resource Manager (ARM) resource ID that is specified for `key-vault-id`. The same managed identity that was specified for the Cluster Manager can be used on the Cluster.
0 commit comments