Configuring an Azure Stack Hub account

Before you can install OKD, you must configure a Microsoft Azure account.

Azure Stack Hub account limits

The OKD cluster uses a number of Microsoft Azure Stack Hub components, and the default Quota types in Azure Stack Hub affect your ability to install OKD clusters.

The following table summarizes the Azure Stack Hub components whose limits can impact your ability to install and run OKD clusters.

Additional resources

• Optimizing storage.

Configuring a DNS zone in Azure Stack Hub

To successfully install OKD on Azure Stack Hub, you must create DNS records in an Azure Stack Hub DNS zone. The DNS zone must be authoritative for the domain. To delegate a registrar’s DNS zone to Azure Stack Hub, see Microsoft’s documentation for Azure Stack Hub datacenter DNS integration.

Required Azure Stack Hub roles

Your Microsoft Azure Stack Hub account must have the following roles for the subscription that you use:

• Owner

To set roles on the Azure portal, see the Manage access to resources in Azure Stack Hub with role-based access control in the Microsoft documentation.

Creating a service principal

Because OKD and its installation program create Microsoft Azure resources by using the Azure Resource Manager, you must create a service principal to represent it.

Prerequisites

• Install or update the Azure CLI.

• Your Azure account has the required roles for the subscription that you use.

Procedure

1. Register your environment:

   $ az cloud register -n AzureStackCloud --endpoint-resource-manager <endpoint> (1)

   1	Specify the Azure Resource Manager endpoint, https://management.<region>.<fqdn>/.

   See the Microsoft documentation for details.

2. Set the active environment:

   $ az cloud set -n AzureStackCloud

3. Update your environment configuration to use the specific API version for Azure Stack Hub:

   $ az cloud update --profile 2019-03-01-hybrid

4. Log in to the Azure CLI:

   $ az login

   If you are in a multitenant environment, you must also supply the tenant ID.

5. If your Azure account uses subscriptions, ensure that you are using the right subscription:

   1. View the list of available accounts and record the tenantId value for the subscription you want to use for your cluster:

      $ az account list --refresh

      Example output

      [
        {
          "cloudName": AzureStackCloud",
          "id": "9bab1460-96d5-40b3-a78e-17b15e978a80",
          "isDefault": true,
          "name": "Subscription Name",
          "state": "Enabled",
          "tenantId": "6057c7e9-b3ae-489d-a54e-de3f6bf6a8ee",
          "user": {
            "name": "you@example.com",
            "type": "user"
          }
        }
      ]

   2. View your active account details and confirm that the tenantId value matches the subscription you want to use:

      $ az account show

      Example output

      {
        "environmentName": AzureStackCloud",
        "id": "9bab1460-96d5-40b3-a78e-17b15e978a80",
        "isDefault": true,
        "name": "Subscription Name",
        "state": "Enabled",
        "tenantId": "6057c7e9-b3ae-489d-a54e-de3f6bf6a8ee", (1)
        "user": {
          "name": "you@example.com",
          "type": "user"
        }
      }

      1	Ensure that the value of the tenantId parameter is the correct subscription ID.

   3. If you are not using the right subscription, change the active subscription:

      $ az account set -s <subscription_id> (1)

      1	Specify the subscription ID.

   4. Verify the subscription ID update:

      $ az account show

      Example output

      {
        "environmentName": AzureStackCloud",
        "id": "33212d16-bdf6-45cb-b038-f6565b61edda",
        "isDefault": true,
        "name": "Subscription Name",
        "state": "Enabled",
        "tenantId": "8049c7e9-c3de-762d-a54e-dc3f6be6a7ee",
        "user": {
          "name": "you@example.com",
          "type": "user"
        }
      }

6. Record the tenantId and id parameter values from the output. You need these values during the OKD installation.

7. Create the service principal for your account:

   $ az ad sp create-for-rbac --role Contributor --name <service_principal> \ (1)
     --scopes /subscriptions/<subscription_id> (2)
     --years <years> (3)

   1	Specify the service principal name.
   2	Specify the subscription ID.
   3	Specify the number of years. By default, a service principal expires in one year. By using the —years option you can extend the validity of your service principal.

   Example output

   Creating 'Contributor' role assignment under scope '/subscriptions/<subscription_id>'
   The output includes credentials that you must protect. Be sure that you do not
   include these credentials in your code or check the credentials into your source
   control. For more information, see https://aka.ms/azadsp-cli
   {
     "appId": "ac461d78-bf4b-4387-ad16-7e32e328aec6",
     "displayName": <service_principal>",
     "password": "00000000-0000-0000-0000-000000000000",
     "tenantId": "8049c7e9-c3de-762d-a54e-dc3f6be6a7ee"
   }

8. Record the values of the appId and password parameters from the previous output. You need these values during OKD installation.

Additional resources

• For more information about CCO modes, see About the Cloud Credential Operator.

Next steps

• Install an OKD cluster:

  • Installing a cluster quickly on Azure Stack Hub.

  • Install an OKD cluster on Azure Stack Hub with user-provisioned infrastructure by following Installing a cluster on Azure Stack Hub using ARM templates.