Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up AWS
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Setting up a local cluster
  8. Advanced configurations
  9. Troubleshooting
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Create a cluster role

Create a cluster role

Create a cluster role to define the permissions for the service principal
cluster_principal
.
Create a custom role named
cluster_role
with the following role definition:
{ "properties":{ "roleName":"cluster_role", "description":"", "assignableScopes":[ "/subscriptions/<subscription ID>/resourceGroups/<cluster_resource_group>", "/subscriptions/<subscription ID>/resourceGroups/<storage_resource_group>", "/subscriptions/<subscription ID>/resourceGroups/<vnet_resource_group>", "/subscriptions/<subscription ID>/resourceGroups/<managed_identity_resource_group>" ], "permissions":[ { "actions":[ "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Compute/virtualMachineScaleSets/delete/action", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/write", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/virtualNetworks/subnets/write", "Microsoft.Network/loadBalancers/backendAddressPools/join/action", "Microsoft.Compute/disks/delete", "Microsoft.Compute/disks/write", "Microsoft.Compute/disks/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write", "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action" ], "notActions":[], "dataActions":[], "notDataActions":[] } ] } }
The following table describes the permissions:
Permission
Description
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read
Microsoft.Compute/virtualMachineScaleSets/write
Microsoft.Network/loadBalancers/backendAddressPools/join/action
Microsoft.Network/networkSecurityGroups/join/action
Required. Used by the Secure Agent to discover cluster resources.
Microsoft.Network/virtualNetworks/subnets/join/action
Required. Used by the Secure Agent to discover cluster resources.
If you use an existing VNet, the scope for this permission must include the resource group that holds the VNet.
Microsoft.Network/virtualNetworks/subnets/read
Required if you use an existing VNet. The scope for this permission must include the resource group that holds the VNet.
Microsoft.Network/virtualNetworks/subnets/write
Required. Used to create and update a subnet.
Microsoft.Compute/virtualMachineScaleSets/read
Microsoft.Compute/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachineScaleSets/instanceView/read
Required. Used by the Secure Agent to discover master and worker nodes running in Azure.
Microsoft.Network/virtualNetworks/subnets/join/action
Microsoft.Compute/virtualMachineScaleSets/write
Microsoft.Network/networkSecurityGroups/join/action
Required when the cluster auto-scales to add a worker node to the cluster.
Microsoft.Compute/disks/write
Microsoft.Compute/disks/read
Microsoft.Compute/disks/delete
Required when storage auto-scales.
These permissions manage disks on Azure.
Microsoft.Compute/virtualMachineScaleSets/virtualmachines/write
Required when the storage and cluster auto-scales.
These permissions attach Azure disks to worker nodes.
Microsoft.Network/virtualNetworks/subnets/join/action
Required when the storage and cluster auto-scale.
Microsoft.Network/networkSecurityGroups/join/action
Required when the storage and cluster auto-scale.
The Secure Agent uses this permission to update the metadata attached to master and worker nodes.
Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
Required when you use managed identity authentication to connect to a source or target. The service principal uses this permission to assign managed identities to virtual machines in the virtual machine scale sets.

0 COMMENTS

We’d like to hear from you!