Advanced Clusters

Back Next

Update permissions for agent and cluster roles

Some permissions are no longer necessary for the agent and cluster roles if you use your own network security groups.

If you use your own NSGs in Azure, you can remove the following permissions from both the agent and cluster roles:

Microsoft.Network/networkSecurityGroups/delete
Microsoft.Network/networkSecurityGroups/write

You still need to grant the following permissions to the agent and cluster roles with the scope of the resource group for the NSGs:

Microsoft.Network/networkSecurityGroups/read
Microsoft.Network/networkSecurityGroups/join/action

If the resource group that holds the NSGs differs from the cluster resource group, make sure that the NSG resource group allows the agent and cluster roles to read the security group and assign it to the cluster nodes. For example, the resource group QA_US_WEST holds some NSGs. The agent role in

Data Integration

needs an advanced cluster in a different resource group: YX-RESOURCE-GROUP.

To allow the agent role to access the resource group, create a custom role named

k8s-cluster-resource-read

under QA_US_WEST with the following role definition:

{
    "id": "/subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<role-def-id>",
    "properties": {
        "roleName": "k8s-cluster-resource-read",
        "description": "For k8s cluster to read/use resources in different resource group",
        "assignableScopes": [
            "/subscriptions/<subscription-id>/resourceGroups/QA_US_WEST"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Network/networkSecurityGroups/read",
                    "Microsoft.Network/networkSecurityGroups/join/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Assign the custom role to the agent’s managed identity and the cluster service principal in QA_US_WEST.

When you update permissions for agent and cluster roles, consider the following guidelines:

Assign the agent's managed identity to the agent role at the Secure Agent machine level.

Assign the cluster service principal to the cluster role at the cluster resource group level or subscription level if no cluster resource group is defined.

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Update permissions for agent and cluster roles

Update permissions for agent and cluster roles