Skip to content

Commit 0b6fca1

Browse files
Azure SP docs (#514)
* Adding Azure SP related doc * Fixing title * Fixing nit
1 parent d01d9be commit 0b6fca1

File tree

1 file changed

+117
-0
lines changed

1 file changed

+117
-0
lines changed

docs/config/azure_plugin.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
<hr style="height:1px;border:none;color:#333;">
2+
<h1 align="center">Authentication Methods for Azure Plugin </h1>
3+
4+
### Using Service Principal Credentials
5+
1. To use Service Principal as authentication mechanism, create a credential file using the following command,
6+
```
7+
cat << EOF > ./credentials-velero
8+
AZURE_SUBSCRIPTION_ID=${AZURE_SUBSCRIPTION_ID}
9+
AZURE_TENANT_ID=${AZURE_TENANT_ID}
10+
AZURE_CLIENT_ID=${AZURE_CLIENT_ID}
11+
AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}
12+
AZURE_RESOURCE_GROUP=${AZURE_RESOURCE_GROUP}
13+
AZURE_STORAGE_ACCOUNT_ACCESS_KEY=${AZURE_STORAGE_ACCOUNT_ACCESS_KEY}
14+
AZURE_CLOUD_NAME=AzurePublicCloud
15+
EOF
16+
```
17+
18+
<b>Note:</b>
19+
- Make sure to include `AZURE_STORAGE_ACCOUNT_ACCESS_KEY` in the credentails file, as it is required by the Azure registry pod to perform registry related operations.
20+
21+
2. Once you have the credentials file, create the secret using the following command,
22+
23+
```
24+
oc create secret generic cloud-credentials-azure --namespace openshift-adp --from-file cloud=./credentials-velero
25+
```
26+
27+
3. Create a DataProtectionApplication (DPA) CR with the appropriate values. For example, the DPA CR would look like,
28+
```
29+
apiVersion: oadp.openshift.io/v1alpha1
30+
kind: DataProtectionApplication
31+
metadata:
32+
name: dpa-sample
33+
spec:
34+
backupLocations:
35+
- velero:
36+
config:
37+
resourceGroup: <resource_group_name>
38+
storageAccount: <storage_account>
39+
subscriptionId: <subscription_id>
40+
credential:
41+
key: cloud
42+
name: cloud-credentials-azure
43+
default: true
44+
objectStorage:
45+
bucket: <bucket_name>
46+
prefix: velero
47+
provider: azure
48+
configuration:
49+
restic:
50+
enable: true
51+
velero:
52+
defaultPlugins:
53+
- openshift
54+
- azure
55+
snapshotLocations:
56+
- velero:
57+
config:
58+
resourceGroup: <resource_group_name>
59+
subscriptionId: <subscription_id>
60+
provider: azure
61+
```
62+
63+
### Using Storage Account Access Key Credentials
64+
65+
1. create a credential file using the following command,
66+
```
67+
cat << EOF > ./credentials-velero
68+
AZURE_STORAGE_ACCOUNT_ACCESS_KEY=${AZURE_STORAGE_ACCOUNT_ACCESS_KEY}
69+
AZURE_CLOUD_NAME=AzurePublicCloud
70+
EOF
71+
```
72+
73+
2. Once you have the credentials file, create the secret using the following command,
74+
75+
```
76+
oc create secret generic cloud-credentials-azure --namespace openshift-adp --from-file cloud=./credentials-velero
77+
```
78+
79+
3. Create a DataProtectionApplication (DPA) CR with the appropriate values. For example, the DPA CR would look like,
80+
```
81+
apiVersion: oadp.openshift.io/v1alpha1
82+
kind: DataProtectionApplication
83+
metadata:
84+
name: dpa-sample
85+
spec:
86+
backupLocations:
87+
- velero:
88+
config:
89+
resourceGroup: <resource_group_name>
90+
storageAccount: <storage_account>
91+
subscriptionId: <subscription_id>
92+
storageAccountKeyEnvVar: AZURE_STORAGE_ACCOUNT_ACCESS_KEY
93+
credential:
94+
key: cloud
95+
name: cloud-credentials-azure
96+
default: true
97+
objectStorage:
98+
bucket: <bucket_name>
99+
prefix: velero
100+
provider: azure
101+
configuration:
102+
restic:
103+
enable: true
104+
velero:
105+
defaultPlugins:
106+
- openshift
107+
- azure
108+
snapshotLocations:
109+
- velero:
110+
config:
111+
resourceGroup: <resource_group_name>
112+
subscriptionId: <subscription_id>
113+
provider: azure
114+
```
115+
116+
<b>Note:</b>
117+
If you would like to take backups to the specified VolumeSnapshotLocation, make sure to include Service Principal credentials.

0 commit comments

Comments
 (0)