feat: Azure get-well [COMP-806] by justinegeffen · Pull Request #1315 · seqeralabs/docs

justinegeffen · 2026-04-16T10:23:20Z

Fixes: https://seqera.atlassian.net/browse/COMP-806.
Fixes: https://seqera.atlassian.net/browse/EDU-1058

netlify · 2026-04-16T10:23:26Z

✅ Deploy Preview for seqera-docs ready!

Name	Link
🔨 Latest commit	`261fa1c`
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/69e0b89ced746c000860f47c
😎 Deploy Preview	https://deploy-preview-1315--seqera-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Revert studios/add-studio.md to master version. The overview.md whitespace fixes are enforced by pre-commit hooks and remain as-is. Cloud changes ported to azure-getwell-cloud branch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Restore custom-roles.md and roles.md to master versions. Cloud changes to be ported separately to azure-getwell-cloud branch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…s/docs into justine-azure-get-well

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

justinegeffen · 2026-04-27T16:35:34Z

@MichaelTansiniSeqera, this is good to review.

MichaelTansiniSeqera · 2026-05-01T13:21:08Z

 When you submit a pipeline to this compute environment, Nextflow will authenticate using the managed identity associated with the Azure Batch node it runs on, rather than relying on access keys.

+:::caution
+If a managed identity is misconfigured (e.g., invalid client ID or missing RBAC roles), the pipeline will fail with an explicit error. Seqera will not silently fall back to access key authentication.


@adamrtalbot or @jonmarti correct me if I'm wrong but we fall back to the Entra Service Principal if the MI is wrong, but we DON'T do that for access keys right? If so, we should make that clear here

The fallback model is a bit subtler than "MI wrong → fall back to SP". Two layers behave differently:

Control plane (Platform → Azure Batch / Storage): whatever credential is configured (access keys or Entra service principal) is what Platform uses. The two are alternatives, not a runtime chain. Bad keys, invalid/expired client secrets, or missing RBAC all fail loudly with no silent fallback. Some features (VNet/subnet, managed identity assignment) require Entra because the underlying operation only accepts AAD tokens.

Data plane on the VM (Nextflow head + tasks → Storage / ACR):

Credential Head MI configured? How the head VM authenticates

Access keys n/a Storage account key provisioned to the VM

Entra SP No SP credentials passed into the Nextflow config ⚠ secret on the VM

Entra SP Yes Short-lived token from the Azure metadata service (no creds on the VM)

Entra SP Yes, but invalid / missing RBAC Fails — no silent fallback to the SP at runtime

So the existing caution is correct for runtime. What's worth adding is the config-time half , that's where the "fallback" really lives:

When a head managed identity is not configured, Platform passes the service principal credentials to the head job so it can authenticate to Azure services. The managed identity removes the long-lived secret from the compute node, so configuring it is recommended for production deployments. The same applies to the pool managed identity used by compute tasks.

@jonmarti, I have updated the content - please could you review and LMK if you have any feedback. Thanks!

@justinegeffen reviewed, looking good

Document the disable/enable compute environment feature in the enterprise compute environment overview, mirroring the cloud docs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ty guidance - Fix swapped Tenant ID / Client ID field labels in the Entra credential instructions (Tenant ID maps to Directory (tenant) ID; Client ID maps to Application (client) ID). - Add Managed Identity Operator role assignment for the service principal, required to attach a managed identity to a Batch pool. - Rename Azure Batch Data Contributor to Azure Batch Contributor (the built-in role sufficient for management-plane pool creation). - Add AcrPull role guidance on the managed identity for ACR image pulls. - Document why managed identities require Entra credentials (management-plane pool creation only accepts AAD tokens). - Document the four managed identity fields (resource ID vs client ID, head vs worker pool) and how they work in single-pool and dual-pool topologies. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

jonmarti

LGTM, minor suggestions

jonmarti · 2026-05-15T14:34:03Z

+1. In Azure, create a user-assigned managed identity. See [Manage user-assigned managed identities][azure-managed-identity] for detailed steps. Take note of both the **client ID** and the **resource ID** of the managed identity when you create it.
+2. Assign the following roles to the managed identity:
+   - **Storage Blob Data Contributor** on the Azure Storage account, so the pool VMs can read inputs and write outputs.
+   - **AcrPull** on any Azure Container Registry the pipeline pulls images from. Without thƒis role, container pulls fail when the pool VM authenticates via the managed identity.


Suggested change

- **AcrPull** on any Azure Container Registry the pipeline pulls images from. Without thƒis role, container pulls fail when the pool VM authenticates via the managed identity.

- **AcrPull** on any Azure Container Registry the pipeline pulls images from. Without this role, container pulls fail when the pool VM authenticates via the managed identity.

jonmarti · 2026-05-15T14:34:56Z

-1. Select **Review and Create**.
-1. Select **Create** to create the Azure Storage account.
+8. Select **Data protection**.
+   - Configure appropriate settings. All settings are supported Platform.


Suggested change

- Configure appropriate settings. All settings are supported Platform.

- Configure appropriate settings. All settings are supported by Platform.

feat: Azure get-well [COMP-806]

261fa1c

justinegeffen added do not merge Do not merge until this label is removed draft/WIP enterprise-26.1 labels Apr 16, 2026

justinegeffen changed the base branch from master to enterprise-26.1-documentation April 16, 2026 11:06

MichaelTansiniSeqera reviewed Apr 17, 2026

View reviewed changes

Comment thread platform-cloud/docs/studios/add-studio.md Outdated

MichaelTansiniSeqera reviewed Apr 17, 2026

View reviewed changes

Comment thread platform-enterprise_docs/compute-envs/azure-batch.md Outdated

justinegeffen commented Apr 17, 2026

View reviewed changes

Comment thread platform-cloud/docs/studios/add-studio.md Outdated

justinegeffen and others added 8 commits April 17, 2026 12:34

Apply suggestion from @justinegeffen

3b1b5b2

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Update azure-batch.md

bb599a7

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

a5c9c65

docs: remove remaining cloud changes from Azure get-well PR

13cc105

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs: remove cloud changes from Azure get-well PR

8859b3a

Restore custom-roles.md and roles.md to master versions. Cloud changes to be ported separately to azure-getwell-cloud branch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

82227bc

Merge branch 'justine-azure-get-well' of https://github.com/seqeralab…

b264f4e

…s/docs into justine-azure-get-well

justinegeffen requested a review from MichaelTansiniSeqera April 17, 2026 17:50

justinegeffen added 4 commits April 20, 2026 13:38

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

eab2039

Update azure-batch.md

17b4a37

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

74a7fdb

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

52b3c41

justinegeffen removed the draft/WIP label Apr 27, 2026

justinegeffen added 3 commits April 28, 2026 10:22

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

991b933

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

dd9ae2e

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

714300d

justinegeffen requested a review from jonmarti April 30, 2026 18:33

justinegeffen added the 1. Dev/PM/SME Needs a review by a Dev/PM/SME label Apr 30, 2026

MichaelTansiniSeqera reviewed May 1, 2026

View reviewed changes

Comment thread platform-enterprise_docs/compute-envs/azure-batch.md Outdated

MichaelTansiniSeqera reviewed May 1, 2026

View reviewed changes

Comment thread platform-enterprise_docs/compute-envs/azure-batch.md

MichaelTansiniSeqera reviewed May 1, 2026

View reviewed changes

Comment thread platform-enterprise_docs/compute-envs/azure-batch.md Outdated

MichaelTansiniSeqera reviewed May 1, 2026

View reviewed changes

Comment thread platform-enterprise_docs/compute-envs/azure-batch.md Outdated

justinegeffen and others added 8 commits May 4, 2026 20:21

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

1d0675b

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

4942604

docs(compute-envs): add disable compute environment section

21b24a4

Document the disable/enable compute environment feature in the enterprise compute environment overview, mirroring the cloud docs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

ad9240b

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

a5670f6

Merge branch 'enterprise-26.1-documentation' into justine-azure-get-well

b0c80f7

Incorporated feedback

41cc2d0

jonmarti approved these changes May 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Azure get-well [COMP-806]#1315

feat: Azure get-well [COMP-806]#1315
justinegeffen wants to merge 24 commits into
enterprise-26.1-documentationfrom
justine-azure-get-well

justinegeffen commented Apr 16, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justinegeffen commented Apr 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MichaelTansiniSeqera May 1, 2026

Uh oh!

jonmarti May 3, 2026

Uh oh!

justinegeffen May 14, 2026

Uh oh!

jonmarti May 15, 2026

Uh oh!

Uh oh!

jonmarti left a comment

Uh oh!

jonmarti May 15, 2026

Uh oh!

jonmarti May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Credential	Head MI configured?	How the head VM authenticates
Access keys	n/a	Storage account key provisioned to the VM
Entra SP	No	SP credentials passed into the Nextflow config ⚠ secret on the VM
Entra SP	Yes	Short-lived token from the Azure metadata service (no creds on the VM)
Entra SP	Yes, but invalid / missing RBAC	Fails — no silent fallback to the SP at runtime

	- AcrPull on any Azure Container Registry the pipeline pulls images from. Without thƒis role, container pulls fail when the pool VM authenticates via the managed identity.
	- AcrPull on any Azure Container Registry the pipeline pulls images from. Without this role, container pulls fail when the pool VM authenticates via the managed identity.

	- Configure appropriate settings. All settings are supported Platform.
	- Configure appropriate settings. All settings are supported by Platform.

Conversation

justinegeffen commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for seqera-docs ready!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justinegeffen commented Apr 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MichaelTansiniSeqera May 1, 2026

Choose a reason for hiding this comment

Uh oh!

jonmarti May 3, 2026

Choose a reason for hiding this comment

Uh oh!

justinegeffen May 14, 2026

Choose a reason for hiding this comment

Uh oh!

jonmarti May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jonmarti left a comment

Choose a reason for hiding this comment

Uh oh!

jonmarti May 15, 2026

Choose a reason for hiding this comment

Uh oh!

jonmarti May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

justinegeffen commented Apr 16, 2026 •

edited

Loading

netlify Bot commented Apr 16, 2026 •

edited

Loading