Advanced Clusters > Setting up Microsoft Azure > Step 7. Create a managed identity for the Secure Agent
  

Step 7. Create a managed identity for the Secure Agent

The Secure Agent uses a managed identity to log in to the Microsoft Azure cloud and to create an advanced cluster. If you run the list-clusters.sh and delete-clusters.sh commands, the Secure Agent uses the managed identity to authenticate to the Azure CLI.
In Azure, complete the following tasks:
  1. 1Create a cluster resource group.
  2. 2Create a managed identity.
  3. 3Create an agent role.
  4. 4Add role assignments to assign the agent role to the managed identity and to assign the managed identity to the Secure Agent machine.

Create a cluster resource group

In Azure, create a resource group named cluster_resource_group.
The Secure Agent uses this resource group to store cluster resources such as master and worker node VMs, virtual machine scale sets, network interfaces, and load balancers.

Create a managed identity

Create a managed identity named agent_identity.
You can use a system-assigned managed identity or create a user-assigned managed identity. If you create a user-assigned managed identity and there are multiple identities attached to the Secure Agent machine, set the Elastic Server property azure_agent_role_identity_client_id to the client ID of agent_identity.
For information about creating a managed identity, refer to the Microsoft Azure documentation. Microsoft Azure provides best practices for managed identities and can help you decide whether to use a system-assigned or user-assigned managed identity.

Create an agent role

Create an agent role to define the permissions for the managed identity agent_identity.
Create a custom role named agent_role with the following role definition:
{
"properties":{
"roleName":"agent_role",
"description":"",
"assignableScopes":[
"/subscriptions/<subscription ID>/resourceGroups/<cluster_resource_group>",
"/subscriptions/<subscription ID>/resourceGroups/<storage_resource_group>",
"/subscriptions/<subscription ID>/resourceGroups/<vnet_resource_group>"
],
"permissions":[
{
"actions":[
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Storage/storageAccounts/listKeys/action",
"Microsoft.Compute/virtualMachineScaleSets/delete",
"Microsoft.Compute/virtualMachineScaleSets/write",
"Microsoft.Compute/virtualMachineScaleSets/read",
"Microsoft.Network/loadBalancers/delete",
"Microsoft.Network/loadBalancers/write",
"Microsoft.Network/loadBalancers/read",
"Microsoft.Network/networkSecurityGroups/delete",
"Microsoft.Network/networkSecurityGroups/write",
"Microsoft.Network/networkSecurityGroups/read",
"Microsoft.Network/virtualNetworks/delete",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/publicIPAddresses/read",
"Microsoft.Network/publicIPAddresses/join/action",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/write",
"Microsoft.Network/networkSecurityGroups/join/action",
"Microsoft.Network/loadBalancers/backendAddressPools/join/action",
"Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read",
"Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
"Microsoft.Compute/virtualMachines/instanceView/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
"Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action"
],
"notActions":[

],
"dataActions":[

],
"notDataActions":[

]
}
]
}
}
The following table describes the permissions:
Permission
Description
Microsoft.Resources/subscriptions/resourcegroups/read
Required. Checks if the cluster resource group exists.
Microsoft.Resources/subscriptions/resourcegroups/write
Microsoft.Resources/subscriptions/resourcegroups/delete
Required when the cluster resource group is not specified in the advanced configuration.
If the cluster resource group is not specified in the advanced configuration, then the Secure Agent creates a new resource group in a subscription named <cluster-instance-id>-rg.
Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/write
Microsoft.Storage/storageAccounts/listKeys/action
Required. Lists storage account keys and performs storage operations. These actions assume that the staging storage account is within the cluster resource group.
Microsoft.Compute/virtualMachineScaleSets/delete
Microsoft.Compute/virtualMachineScaleSets/write
Microsoft.Compute/virtualMachineScaleSets/read
Required. Discovers and manages virtual machine scale sets (VMSS) for master and worker nodes.
Microsoft.Network/loadBalancers/delete
Microsoft.Network/loadBalancers/write
Microsoft.Network/loadBalancers/read
Required. Discovers and manages load-balancer used for API-server endpoint.
Microsoft.Network/networkSecurityGroups/delete
Microsoft.Network/networkSecurityGroups/write
Microsoft.Network/networkSecurityGroups/read
Required. Discovers and manages network security groups created for master and worker nodes. If the network security group (NSG) is attached to a subnet, these permissions override rules specified in the subnet.
Microsoft.Network/virtualNetworks/read
Required. Discovers the VNet for a cluster.
Microsoft.Network/virtualNetworks/delete
Microsoft.Network/virtualNetworks/write
Required when a VNet is not specified in the cluster asset.
Microsoft.Network/publicIPAddresses/delete
Microsoft.Network/publicIPAddresses/write
Microsoft.Network/publicIPAddresses/read
Microsoft.Network/publicIPAddresses/join/action
Required. Discovers and manages the public IP address associated with the cluster end-point. The join action is required to let the load-balancer use this public IP address.
Microsoft.Network/virtualNetworks/subnets/join/action
Required. Allows master and worker nodes to join a specific subnet. This permission is required for any form of VNet setting.
If you use an existing VNet, the scope for this permission must include the resource group that holds the VNet.
Microsoft.Network/virtualNetworks/subnets/read
Required if you use an existing VNet. The scope for this permission must include the resource group that holds the VNet.
Microsoft.Network/virtualNetworks/subnets/write
Required. Used to create and update a subnet.
Microsoft.Network/networkSecurityGroups/join/action
Required. Allows the master and worker nodes to attach a pre-created network security group (NSG).
Microsoft.Network/loadBalancers/backendAddressPools/join/action
Required. Allows the master and worker nodes to be added to a cluster end-point. Master nodes are added to the cluster end-point during cluster provisioning.
Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read
Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read
Required. Used by the Secure Agent to get the IP addresses assigned to the master and worker nodes. The Secure Agent uses these permissions to connect to master nodes using SSH and download the kubeconfig file for a given cluster.
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read
Microsoft.Compute/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachineScaleSets/instanceView/read
Required. Checks the master and worker node status.
Microsoft.Compute/virtualMachineScaleSets/manualupgrade/action
Required when you use the initialization script.
Also required to manually update the master and worker nodes to apply a script extension.
Microsoft.Authorization/roleAssignments/read
Microsoft.Authorization/roleDefinitions/read
Required. Validates the advanced configuration.
Microsoft.Compute/virtualMachines/read
Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
Required when you use managed identity authentication to connect to a source or target. The Secure Agent uses these permissions to detect the managed identity of the agent and assign the identity to the virtual machine scale sets.

Add role assignments

Add role assignments to assign the agent role to the managed identity. Then, assign the managed identity to the Secure Agent machine.
Complete the following tasks:
  1. 1Assign the custom role agent_role to the managed identity named agent_identity.
  2. 2Assign the managed identity agent_identity to the machine where the Secure Agent is installed.