Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up AWS
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Setting up a local cluster
  8. Advanced configurations
  9. Troubleshooting
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Update permissions for agent and cluster roles

Update permissions for agent and cluster roles

Some permissions are no longer necessary for the agent and cluster roles if you use your own network security groups.
If you use your own NSGs in Azure, you can remove the following permissions from both the agent and cluster roles:
Microsoft.Network/networkSecurityGroups/delete Microsoft.Network/networkSecurityGroups/write
You still need to grant the following permissions to the agent and cluster roles with the scope of the resource group for the NSGs:
Microsoft.Network/networkSecurityGroups/read Microsoft.Network/networkSecurityGroups/join/action
If the resource group that holds the NSGs differs from the cluster resource group, make sure that the NSG resource group allows the agent and cluster roles to read the security group and assign it to the cluster nodes. For example, the resource group QA_US_WEST holds some NSGs. The agent role in
Data Integration
needs an advanced cluster in a different resource group: YX-RESOURCE-GROUP.
To allow the agent role to access the resource group, create a custom role named
k8s-cluster-resource-read
under QA_US_WEST with the following role definition:
{ "id": "/subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<role-def-id>", "properties": { "roleName": "k8s-cluster-resource-read", "description": "For k8s cluster to read/use resources in different resource group", "assignableScopes": [ "/subscriptions/<subscription-id>/resourceGroups/QA_US_WEST" ], "permissions": [ { "actions": [ "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.ManagedIdentity/userAssignedIdentities/*/read", "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action", "Microsoft.Authorization/*/read", "Microsoft.Resources/subscriptions/resourceGroups/read" ], "notActions": [], "dataActions": [], "notDataActions": [] } ] } }
Assign the custom role to the agent’s managed identity and the cluster service principal in QA_US_WEST.
When you update permissions for agent and cluster roles, consider the following guidelines:
  • Assign the agent's managed identity to the agent role at the Secure Agent machine level.
  • Assign the cluster service principal to the cluster role at the cluster resource group level or subscription level if no cluster resource group is defined.

0 COMMENTS

We’d like to hear from you!