Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure Red Hat OpenShift with hosted control planes uses user-assigned managed identities to grant OpenShift cluster Operators the Azure permissions they need to carry out cluster operations. You must create these managed identities and assign them the correct Azure roles before you create your cluster.
This article explains how managed identities work in Azure Red Hat OpenShift with hosted control planes, lists every required identity, and describes the role assignments each one needs.
How managed identities work in Azure Red Hat OpenShift with hosted control planes
In Azure Red Hat OpenShift with hosted control planes, the OpenShift cluster Operators that manage infrastructure run as separate components that each need their own Azure permissions. Rather than sharing a single credential, each Operator gets its own user-assigned managed identity with only the permissions it needs.
Managed identities are organized into three categories:
- Control plane Operator identities - Used by the OpenShift Operators that run on the hosted control plane in Red Hat's Azure account. These Operators manage cluster-wide infrastructure such as node provisioning, network configuration, and ingress.
- Data plane Operator identities - Used by the OpenShift Operators that run on the worker nodes in your Azure account. Three Operators (Disk Storage, File Storage, and Image Registry) require a separate data plane identity in addition to their control plane identity.
- Service managed identity - A single identity used by the Azure Red Hat OpenShift hosted control planes service itself. This identity enables the managed identities for the cluster Operators and creates federated credentials for the data plane Operator identities.
For more information about OpenShift cluster Operators, see Cluster Operators in the OpenShift Container Platform documentation.
Required managed identities
An Azure Red Hat OpenShift with hosted control planes cluster requires 13 user-assigned managed identities: nine for control plane operators, three for data plane operators, and one for the service itself.
The control plane operator identities include an identity for the KMS Operator, which accesses the customer-managed etcd encryption key in Azure Key Vault.
The cluster must have these managed identities in the same subscription and location.
You need Contributor and User Access Administrator permissions, or Owner permissions, on the resource group to create the identities and their role assignments.
Control plane operator identities
You need one user-assigned managed identity for each of the following control plane operators:
| Operator | Description |
|---|---|
| OpenShift Cluster API Provider | Manages nodes, networks, and disks for the cluster. |
| OpenShift Control Plane Operator | Reads resources necessary for the OpenShift cluster. |
| OpenShift Cloud Controller Manager | Manages cloud provider integration for load balancers and node lifecycle. |
| OpenShift Cluster Ingress Operator | Manages external access to cluster services through load balancers and DNS. |
| OpenShift Disk Storage Operator | Manages Azure Disk persistent volumes for the cluster. |
| OpenShift File Storage Operator | Manages Azure Files persistent volumes for the cluster. |
| OpenShift Image Registry Operator | Manages the cluster's built-in container image registry. |
| OpenShift Network Operator | Manages the cluster's cloud network configuration. |
You must also have an identity for the KMS Operator:
| Operator | Description |
|---|---|
| KMS | Accesses the customer-managed encryption key in Azure Key Vault. |
Data plane Operator identities
Three operators require a separate data plane identity in addition to their control plane identity. You must have one user-assigned managed identity for each of the following data plane Operators:
| Operator | Purpose |
|---|---|
| OpenShift Disk Storage Operator | Manages Azure Disk operations from the worker nodes. |
| OpenShift File Storage Operator | Manages Azure Files operations from the worker nodes. |
| OpenShift Image Registry Operator | Manages image registry operations from the worker nodes. |
Service managed identity
You must have one user-assigned managed identity for the Azure Red Hat OpenShift with hosted control planes service. This identity performs management operations on the cluster, enables the managed identities for the cluster Operators, and creates federated credentials for the data plane Operator identities.
Role assignments
Assign each managed identity one or more Azure roles at the correct scope. Create all role assignments before you create the cluster. The scopes referenced in the following tables (Subnet, VNet, and Network Security Group) are the same network resources you plan when planning your cluster network.
Control plane operator role assignments
The following table lists the required role assignment for each control plane Operator identity, and the scope at which the role is assigned.
| Managed identity | Role | Scope |
|---|---|---|
| OpenShift Cluster API Provider | Azure Red Hat OpenShift hosted control planes Cluster API Provider | VNet and Subnet |
| OpenShift Control Plane Operator | Azure Red Hat OpenShift hosted control planes Control Plane Operator | Subnet and Network Security Group |
| OpenShift Cloud Controller Manager | Azure Red Hat OpenShift Cloud Controller Manager | VNet, Subnet, and Network Security Group |
| OpenShift Cluster Ingress Operator | Azure Red Hat OpenShift Cluster Ingress Operator | VNet and Subnet |
| OpenShift Disk Storage Operator | None | N/A |
| OpenShift File Storage Operator | Azure Red Hat OpenShift File Storage Operator | VNet, Subnet, and Network Security Group |
| OpenShift Image Registry Operator | Azure Red Hat OpenShift Image Registry Operator | VNet |
| OpenShift Network Operator | Azure Red Hat OpenShift Network Operator | VNet and Subnet |
The KMS identity also requires the following role assignment:
| Managed identity | Role | Scope |
|---|---|---|
| KMS | Key Vault Crypto User | Azure Key Vault |
Data plane Operator role assignments
The following table lists the required role assignments for the data plane Operator identities.
| Managed identity | Role | Scope |
|---|---|---|
| OpenShift Disk Storage Operator | None | N/A |
| OpenShift File Storage Operator | Azure Red Hat OpenShift File Storage Operator | VNet, Subnet, and Network Security Group |
| OpenShift Image Registry Operator | Azure Red Hat OpenShift Image Registry Operator | VNet |
Service managed identity role assignments
The service managed identity needs multiple role assignments across different scopes.
Service role assignments
Assign the Azure Red Hat OpenShift with hosted control planes service role to the service managed identity at the following scopes:
- VNet
- Subnet
- Network Security Group
Reader role assignments
Assign the Reader role to the service managed identity on each control plane Operator managed identity. This role grants the service the ability to read the properties of each Operator identity during cluster provisioning.
Federated Credential role assignments
Assign the Azure Red Hat OpenShift Federated Credential role to the service managed identity on each data plane Operator managed identity. This role grants the service the ability to create federated credentials that enable the data plane Operators to authenticate by using workload identity.