What's the purpose and role of "Azure Red Hat OpenShift RP" SPN in ARO deployment and further ?

Question

Hi,

I want to know "What's the purpose and role of "Azure Red Hat OpenShift RP" SPN in ARO deployment and further". Based on that we can get the required permission for this SPN and work on this.

Regards,

Balaraju M

Answer 1

Hi Balaraju,

The "Azure Red Hat OpenShift Resource Provider" (ARO RP) Service Principal Name (SPN) is essential for the deployment and ongoing management of Azure Red Hat OpenShift (ARO) clusters.

Purpose

The ARO RP SPN allows the Azure Red Hat OpenShift managed service to interact with other Azure resources on behalf of the ARO service. This SPN is necessary for deploying, managing, and maintaining ARO clusters.

Role

1. Resource Management: The SPN manages Azure resources such as virtual networks, subnets, public IPs, and load balancers required for the ARO cluster.
2. Cluster Deployment: During cluster deployment, the SPN provisions the necessary infrastructure and components within the specified Azure subscription and resource group.
3. Operations and Maintenance: The SPN is involved in scaling, updating, and monitoring the cluster to ensure it remains healthy and operational.
4. Security and Compliance: The SPN helps enforce security and compliance by managing access controls and ensuring the cluster adheres to organizational and regulatory standards.

Required Permissions for the SPN

To perform its role effectively, the ARO RP SPN needs specific permissions within your Azure environment. These permissions can be granted through role-based access control (RBAC) assignments. Here are the typical permissions required:

1. Contributor Role: Assign the Contributor role at the resource group level where the ARO cluster will be deployed. This allows the SPN to manage all resources within the resource group.
2. Network Contributor Role: Assign the Network Contributor role to the virtual network (VNet) used by the ARO cluster. This permits the SPN to manage network resources like subnets and network security groups.
3. Reader Role: Assign the Reader role at the subscription level. This enables the SPN to read all resources within the subscription for monitoring and management purposes.
4. Custom Roles: You can create custom roles to fine-tune permissions, providing only the necessary access while adhering to the principle of least privilege.

Steps to Assign Permissions

Here’s how you can assign these permissions using the Azure Portal and Azure CLI:

Azure Portal

1. Assign Contributor Role to Resource Group:
   • Navigate to the resource group where the ARO cluster will be deployed.
   • Go to "Access control (IAM)".
   • Click "Add role assignment".
   • Select "Contributor" and assign it to the ARO RP SPN.
2. Assign Network Contributor Role to VNet:
   • Navigate to the virtual network used by the ARO cluster.
   • Go to "Access control (IAM)".
   • Click "Add role assignment".
   • Select "Network Contributor" and assign it to the ARO RP SPN.
3. Assign Reader Role at Subscription Level:
   • Navigate to the subscription level.
   • Go to "Access control (IAM)".
   • Click "Add role assignment".
   • Select "Reader" and assign it to the ARO RP SPN.

Azure CLI

```bash

# Assign Contributor role to the resource group

az role assignment create --assignee <SPN_ID> --role "Contributor" --resource-group <RESOURCE_GROUP>

# Assign Network Contributor role to the VNet

az role assignment create --assignee <SPN_ID> --role "Network Contributor" --scope <VNET_RESOURCE_ID>

# Assign Reader role at the subscription level

az role assignment create --assignee <SPN_ID> --role "Reader" --scope /subscriptions/<SUBSCRIPTION_ID>

```

By ensuring the ARO RP SPN has the necessary permissions, you can facilitate a smooth deployment and management process for your Azure Red Hat OpenShift clusters.