Skip to content

Commit 8c4b559

Browse files
jhlodinjhlodin
committed
Add missing onboarding steps for Azure BYOC
1 parent 2628bbc commit 8c4b559

1 file changed

Lines changed: 152 additions & 31 deletions

File tree

‎src/current/cockroachcloud/byoc-deployment.md‎

Lines changed: 152 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -49,36 +49,157 @@ Once this Azure subscription has been created and configured to host CockroachDB
4949

5050
{{ site.data.alerts.end }}
5151

52-
## Step 2. Grant IAM permissions to Cockroach Labs
53-
54-
When BYOC is enabled for your account, Cockroach Labs provisions a multi-tenant App Registration associated with your CockroachDB {{ site.data.products.cloud }} organization and provides you with a URL to grant tenant-wide admin consent to the application. Visit this URL with a user account that is [authorized to consent on behalf of your organization](https://learn.microsoft.com/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal#prerequisites).
55-
56-
Once the Cockroach Labs App Registration has been granted admin consent in the tenant, grant the following set of roles to the app:
57-
58-
- `Role Based Access Control Administrator`
59-
- `Azure Kubernetes Service Cluster User Role`
60-
- `Azure Kubernetes Service Contributor Role`
61-
- `Azure Kubernetes Service RBAC Cluster Admin`
62-
- `Managed Identity Contributor`
63-
- `Network Contributor`
64-
- `Storage Account Contributor`
65-
- `Storage Blob Data Contributor`
66-
- `Virtual Machine Contributor`
67-
- A custom role, `Resource Group Manager`, with the following permissions:
68-
- `Microsoft.Resources/subscriptions/resourceGroups/read`
69-
- `Microsoft.Resources/subscriptions/resourceGroups/write`
70-
- `Microsoft.Resources/subscriptions/resourceGroups/delete`
71-
- `Microsoft.Resources/subscriptions/resourceGroups/moveResources/action`
72-
- `Microsoft.Resources/subscriptions/resourceGroups/validateMoveResources/action`
73-
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/read`
74-
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/write`
75-
- `Microsoft.Resources/subscriptions/resourcegroups/resources/read`
76-
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read`
77-
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read`
78-
79-
The custom `Resource Group Manager` role is required to create and manage resource groups in the subscription. This role is used instead of requesting the more broad `Contributor` role.
80-
81-
## Step 3. Register resource providers
52+
## Step 2. Grant admin consent to Cockroach Labs support
53+
54+
The CockroachDB {{ site.data.products.cloud }} BYOC Reader is an enterprise application in Azure that is used
55+
by Cockroach Labs support. Granting admin consent to this application gives **read-only** permissions to allow
56+
Cockroach Labs support engineers to securely view your Azure resources if needed.
57+
58+
Follow these steps to grant admin consent to the reader application and assign the necessary permissions:
59+
60+
1. Log in to the Azure portal as a user with Global Administrator or Privileged Role Administrator permissions.
61+
2. Open the following URL in your browser:
62+
{% include_cached copy-clipboard.html %}
63+
~~~ text
64+
https://login.microsoftonline.com/adminconsent?client_id=7f6538cb-f687-4411-9bbe-2f96bfbce028
65+
~~~
66+
67+
If you have multiple tenants, replace `customer-tenant-id` in the following URL with the tenant containing your newly-created Azure subscription:
68+
69+
{% include_cached copy-clipboard.html %}
70+
~~~ text
71+
https://login.microsoftonline.com/<customer-tenant-id>/adminconsent?client_id=7f6538cb-f687-4411-9bbe-2f96bfbce028
72+
~~~
73+
3. Review the requested permissions and click **Accept**.
74+
4. A service principal for the CockroachDB {{ site.data.products.cloud }} BYOC reader is created. Grant the following set of roles to the app:
75+
- `Role Based Access Control Administrator`
76+
- `Azure Kubernetes Service Cluster User Role`
77+
- `Azure Kubernetes Service Contributor Role`
78+
- `Azure Kubernetes Service RBAC Cluster Admin`
79+
- `Managed Identity Contributor`
80+
- `Network Contributor`
81+
- `Storage Account Contributor`
82+
- `Storage Blob Data Contributor`
83+
- `Virtual Machine Contributor`
84+
- A custom role, `Resource Group Manager`, with the following permissions:
85+
86+
- `Microsoft.Resources/subscriptions/resourceGroups/read`
87+
- `Microsoft.Resources/subscriptions/resourceGroups/write`
88+
- `Microsoft.Resources/subscriptions/resourceGroups/delete`
89+
- `Microsoft.Resources/subscriptions/resourceGroups/moveResources/action`
90+
- `Microsoft.Resources/subscriptions/resourceGroups/validateMoveResources/action`
91+
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/read`
92+
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/write`
93+
- `Microsoft.Resources/subscriptions/resourcegroups/resources/read`
94+
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read`
95+
- `Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read`
96+
97+
The custom `Resource Group Manager` role is required to create and manage resource groups in the subscription. This role is used instead of requesting the more broad `Contributor` role.
98+
99+
## Step 3. Configure Azure Lighthouse
100+
101+
[Azure Lighthouse](https://learn.microsoft.com/azure/lighthouse/overview) enables cross-tenant management to Cockroach Labs with least-privilege access and full customer visibility. You can review or remove this access at any time from the Azure portal.
102+
103+
This Azure Lighthouse deployment grants the following permissions to Cockroach Labs:
104+
105+
- Access to the CockroachDB {{ site.data.products.cloud }} BYOC reader application for observability.
106+
- Kubernetes read access for cluster inspection.
107+
- Administrative access for managed operations.
108+
109+
These permissions are granted to Cockroach Labs's managed tenant, which has a tenant ID of `a4611215-941c-4f86-b53b-348514e57b45`
110+
111+
Follow these steps to enable secure, scoped access for Cockroach Labs to your subscription using Azure Lighthouse:
112+
113+
1. Save the following ARM template to a file named `byoc-lighthouse.json`:
114+
{% include_cached copy-clipboard.html %}
115+
~~~ json
116+
{
117+
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/subscriptionDeploymentTemplate.json#",
118+
"contentVersion": "1.0.0.0",
119+
"parameters": {
120+
"mspOfferName": {
121+
"type": "string",
122+
"metadata": {
123+
"description": "Specify a unique name for your offer"
124+
},
125+
"defaultValue": "CockroachDB Cloud BYOC"
126+
},
127+
"mspOfferDescription": {
128+
"type": "string",
129+
"metadata": {
130+
"description": "Name of the Managed Service Provider offering"
131+
},
132+
"defaultValue": "Template to onboard to CockroachDB Cloud BYOC via Lighthouse"
133+
}
134+
},
135+
"variables": {
136+
"mspRegistrationName": "[guid(parameters('mspOfferName'))]",
137+
"mspAssignmentName": "[guid(parameters('mspOfferName'))]",
138+
"managedByTenantId": "a4611215-941c-4f86-b53b-348514e57b45",
139+
"authorizations": [
140+
{
141+
"principalId": "c4139366-960c-431d-afad-29c65fd68087",
142+
"roleDefinitionId": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
143+
"principalIdDisplayName": "CockroachDB Cloud BYOC Reader Entra Group"
144+
},
145+
{
146+
"principalId": "c4139366-960c-431d-afad-29c65fd68087",
147+
"roleDefinitionId": "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
148+
"principalIdDisplayName": "CockroachDB Cloud BYOC Reader Entra Group"
149+
},
150+
{
151+
"principalId": "6532a4f2-3fa1-4b10-a4c2-05368c87c89a",
152+
"roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
153+
"principalIdDisplayName": "CockroachDB Cloud BYOC Admin Entra Group"
154+
}
155+
]
156+
},
157+
"resources": [
158+
{
159+
"type": "Microsoft.ManagedServices/registrationDefinitions",
160+
"apiVersion": "2020-02-01-preview",
161+
"name": "[variables('mspRegistrationName')]",
162+
"properties": {
163+
"registrationDefinitionName": "[parameters('mspOfferName')]",
164+
"description": "[parameters('mspOfferDescription')]",
165+
"managedByTenantId": "[variables('managedByTenantId')]",
166+
"authorizations": "[variables('authorizations')]"
167+
}
168+
},
169+
{
170+
"type": "Microsoft.ManagedServices/registrationAssignments",
171+
"apiVersion": "2020-02-01-preview",
172+
"name": "[variables('mspAssignmentName')]",
173+
"dependsOn": [
174+
"[resourceId('Microsoft.ManagedServices/registrationDefinitions/', variables('mspRegistrationName'))]"
175+
],
176+
"properties": {
177+
"registrationDefinitionId": "[resourceId('Microsoft.ManagedServices/registrationDefinitions/', variables('mspRegistrationName'))]"
178+
}
179+
}
180+
],
181+
"outputs": {
182+
"mspOfferName": {
183+
"type": "string",
184+
"value": "[concat('Managed by', ' ', parameters('mspOfferName'))]"
185+
},
186+
"authorizations": {
187+
"type": "array",
188+
"value": "[variables('authorizations')]"
189+
}
190+
}
191+
}
192+
~~~
193+
2. Deploy the template at the subscription scope using Azure CLI, Azure PowerShell, or Azure Portal. The following example command uses the Azure CLI:
194+
{% include_cached copy-clipboard.html %}
195+
~~~ shell
196+
az deployment sub create \
197+
--name cockroach-byoc-lighthouse \
198+
--location <region> \
199+
--template-file byoc-lighthouse.json
200+
~~~
201+
202+
## Step 4. Register resource providers
82203
83204
Register the following [resource providers](https://learn.microsoft.com/azure/azure-resource-manager/management/resource-providers-and-types) in the Azure subscription:
84205
@@ -88,7 +209,7 @@ Register the following [resource providers](https://learn.microsoft.com/azure/az
88209
- `Microsoft.Quota`
89210
- `Microsoft.Storage`
90211
91-
## Step 4. Create the CockroachDB {{ site.data.products.cloud }} cluster
212+
## Step 5. Create the CockroachDB {{ site.data.products.cloud }} cluster
92213
93214
In BYOC deployments, CockroachDB clusters are deployed with the {{ site.data.products.cloud }} API and must use the {{ site.data.products.advanced }} plan. Follow the API documentation to [create a CockroachDB {{ site.data.products.cloud }} {{ site.data.products.advanced }} cluster]({% link cockroachcloud/cloud-api.md %}#create-an-advanced-cluster).
94215

0 commit comments

Comments
 (0)