Skip to content

Commit d3b408e

Browse files
sushantjraosushantjrao
committed
Created new page for Cross Subscription and RBAC
Created new page for Cross Subscription and RBAC
1 parent e443ac0 commit d3b408e

File tree

2 files changed

+85
-0
lines changed

2 files changed

+85
-0
lines changed

‎articles/operator-nexus/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,8 @@
169169
href: howto-monitor-interface-packet-rate.md
170170
- name: How to Delete L3 Isolation Domains in Azure Nexus Network Fabric
171171
href: howto-delete-layer-3-isolation-domains.md
172+
- name: Cross-subscription deployments and required RBAC for Network Fabric
173+
href: concepts-cross-subscription-deployments-required-rbac-for-network-fabric.md
172174
- name: Nexus Kubernetes cluster
173175
expanded: false
174176
items:

‎articles/operator-nexus/concepts-cross-subscription-deployments-required-rbac-for-network-fabric.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: Azure Operator Nexus - Cross-subscription deployments and required permissions for Network Fabric
3+
description: Operator Nexus platform and tenant resource types
4+
author: sushantjrao
5+
ms.author: sushrao
6+
ms.service: azure-operator-nexus
7+
ms.topic: conceptual
8+
ms.date: 09/17/2024
9+
ms.custom: template-concept
10+
---
11+
12+
# Overview
13+
14+
This document provides a detailed analysis of cross-subscription deployments involving Network Fabric and Isolation Domains, with a focus on role-based access control (RBAC) and the permissions required for successful operations. It examines how resources within different subscriptions—referred to as Subscription A and Subscription B—interact, highlighting the key configurations and limitations encountered during testing.
15+
16+
The tests were conducted across multiple environments to evaluate scenarios where Network Fabric and Isolation Domains were deployed in distinct subscriptions. The aim was to assess whether specific user roles (e.g., Contributor, Reader, and custom roles) could perform actions such as creating Route Policies, IP Prefixes, and ACLs, while following least-privilege access principles.
17+
18+
This document also provides a comprehensive guide to the required permissions for cross-subscription resource management and explains the scenarios where deployments succeeded or failed based on RBAC permissions. Additionally, a table is provided summarizing the necessary roles and permissions for deploying Nexus resources in different subscriptions.
19+
20+
## Test bed for Cross-subscription deployments and RBAC permissions
21+
22+
The test bed used for evaluating cross-subscription deployments of Network Fabric (NF) and Isolation Domains (ID) was designed to simulate real-world scenarios, focusing on permissions and role-based access control (RBAC). Below are the details of the environment setup and configurations used during testing:
23+
24+
### Subscriptions
25+
26+
- **Subscription A (Primary subscription):** Hosts core resources, including Network Fabric. It includes Isolation Domains, Route Policies, IP Prefixes, and IP Communities.
27+
28+
- **Subscription B (Secondary subscription):** Contains connected resources like Route Policies, IP Prefixes, and External Networks. It is used for testing cross-subscription resource sharing and policy implementation.
29+
30+
### Resources
31+
32+
- **Network Fabric (NF):** Connects Isolation Domains and External Networks, defining route policies.
33+
34+
- **Isolation Domains (L2 & L3):** Virtual network segments isolating traffic between networks.
35+
36+
- **Route Policies:** Govern traffic routing within and across subscriptions.
37+
38+
- **Access Control Lists (ACLs):** Define allowed and denied traffic.
39+
40+
- **IP Prefixes and Communities:** Used for address space definition and resource grouping for network control.
41+
42+
### User Roles and RBAC
43+
44+
- **Contributor:** Full resource management access, without role assignment.
45+
46+
- **Reader:** Read-only access to resources.
47+
48+
- **Custom Roles:** Grant specific permissions, such as "Join" resources or limited management abilities.
49+
50+
### Test cases and results
51+
52+
| Test Case | Subscription A | User RBAC (Target Resource) | Subscription B | User RBAC (Connected Resource) | Expected Result | Result | Remarks |
53+
| --- | --- | --- | --- | --- | --- | --- | --- |
54+
| 1 | NF + IP Prefix, IP Community | Contributor | Route Policy | Contributor | Failure | Failure | Route Policy creation failed (LinkedAuthorizationFailed) |
55+
| 2 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Reader/Join | Success | Success | Successfully created Route Policy |
56+
| 3 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Reader/Join | Failure | Failure | AuthorizationFailed error |
57+
| 4 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Writer/Join | Success | Success | Successfully created Route Policy |
58+
| 5 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Reader/Writer | Success | Success | Successfully created Route Policy |
59+
| 6 | NF + IP Prefix, IP Community | Contributor | Route Policy | Contributor | Success | Success | Successfully created Route Policy |
60+
| 7 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Reader/Join | Failure | Failure | AuthorizationFailed error |
61+
| 8 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Writer/Join | Success | Success | Successfully created Route Policy |
62+
| 9 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Reader/Writer | Failure | Failure | LinkedAuthorizationFailed error |
63+
| 10 | NF + IP Prefix, IP Community | Contributor | Route Policy | Custom: Reader/Writer | Failure | Failure | LinkedAuthorizationFailed error |
64+
| 11 | NF + L3 + Route Policy | Contributor | IP Prefix, IP Community | Contributor | Failure | Failure | Reader tried to enable L3 but failed (AuthorizationFailed) |
65+
| 12 | NF + L3 + Route Policy | Contributor | IP Prefix, IP Community | Custom: Reader/Join | Failure | Failure | Reader+Join tried enabling L3 but failed |
66+
| 13 | NF + L3 + Route Policy | Contributor | IP Prefix, IP Community | Custom: Reader/Join | Failure | Failure | Failed to create IP Prefix (AuthorizationFailed) |
67+
| 14 | NF + L3 + Route Policy | Contributor | IP Prefix, IP Community | Custom: Reader/Writer | Success | Success | Successfully created Route Policy |
68+
| 15 | NF + L3 + Route Policy | Contributor | IP Prefix, IP Community | Custom: Writer/Join | Success | Success | Successfully created Route Policy |
69+
| 16 | NF + L3 + Route Policy | Contributor | IP Prefix, IP Community | Custom: Reader/Writer | Failure | Failure | LinkedAuthorizationFailed error |
70+
| 17 | NFC & NF | Contributor | NF | Contributor | None of the above | None of the above | Test completed |
71+
| 18 | NF + Isolation Domain | Contributor | Isolation Domain (L2 & L3) | Contributor | Success | Success | Test completed |
72+
| 19 | NF + Isolation Domain + Route Policy | Contributor | Route Policy | Contributor | Success | Success | Test completed |
73+
| 20 | NF + NNI + Route Policy | Contributor | Route Policy | Contributor | Success | Success | Test completed |
74+
| 21 | NFC & NF | Reader | NF | Contributor | Failure | Failure | Test completed |
75+
| 22 | NF + Isolation Domain | Reader | Isolation Domain (L2 & L3) | Contributor | Failure | Failure | Test completed |
76+
| 23 | NF + Isolation Domain + Route Policy | Reader | L3 Isolation Domain + Route Policy | Contributor | Failure | Failure | Test completed |
77+
| 24 | NF + Isolation Domain + Route Policy | Reader | Route Policy | Contributor | Failure | Failure | Test completed |
78+
| 25 | NF + NNI + Route Policy | Reader | Route Policy | Contributor | Failure | Failure | Test completed |
79+
| 26 | NF + Isolation Domain + External Networks + ACL | Contributor | Isolation Domain + External Networks + ACL | Contributor | Success | Success | Test completed |
80+
| 27 | NF + Isolation Domain | Reader | Isolation Domain (L2 & L3) | Contributor / Only POST Action | Success | Success | Test completed |
81+
| 28 | NF + Isolation Domain | Reader | Isolation Domain (L2 & L3) | Reader / Only POST Action | Failure | Failure | Test completed |
82+
| 29 | NF + Isolation Domain + External Networks + ACL | Contributor | Isolation Domain + External Networks + ACL | Contributor | Success | Success | Test completed |
83+
| 30 | NF + Isolation Domain + External Networks + ACL | Reader | Isolation Domain (RBAC-Read) + External Networks (RBAC-Write) + ACL (Write) | Reader | Failure | Failure | Test completed |

0 commit comments

Comments
 (0)