Create a Connector in Azure from BlueXP

03/04/2024 Contributors

To create a Connector in Azure from BlueXP, you need to set up your networking, prepare Azure permissions, and then create the Connector.

Before you begin

You should review Connector limitations.

Step 1: Set up networking

Ensure that the network location where you plan to install the Connector supports the following requirements. Meeting these requirements enables the Connector to manage resources and processes within your hybrid cloud environment.

Azure region: If you use Cloud Volumes ONTAP, the Connector should be deployed in the same Azure region as the Cloud Volumes ONTAP systems that it manages, or in the Azure region pair for the Cloud Volumes ONTAP systems. This requirement ensures that an Azure Private Link connection is used between Cloud Volumes ONTAP and its associated storage accounts.

Learn how Cloud Volumes ONTAP uses an Azure Private Link

VNet and subnet: When you create the Connector, you need to specify the VNet and subnet where the Connector should reside.

Connections to target networks: A Connector requires a network connection to the location where you're planning to create and manage working environments. For example, the network where you plan to create Cloud Volumes ONTAP systems or a storage system in your on-premises environment.

Outbound internet access: The network location where you deploy the Connector must have an outbound internet connection to contact specific endpoints.

Endpoints contacted from the Connector

The Connector requires outbound internet access to contact the following endpoints in order to manage resources and processes within your public cloud environment for day-to-day operations.

Note that the endpoints listed below are all CNAME entries.

Endpoints	Purpose
https://management.azure.com https://login.microsoftonline.com https://blob.core.windows.net https://core.windows.net	To manage resources in Azure public regions.
https://management.chinacloudapi.cn https://login.chinacloudapi.cn https://blob.core.chinacloudapi.cn https://core.chinacloudapi.cn	To manage resources in Azure China regions.
https://support.netapp.com https://mysupport.netapp.com	To obtain licensing information and to send AutoSupport messages to NetApp support.
https://.api.bluexp.netapp.com https://api.bluexp.netapp.com https://.cloudmanager.cloud.netapp.com https://cloudmanager.cloud.netapp.com https://netapp-cloud-account.auth0.com	To provide SaaS features and services within BlueXP. Note that the Connector is currently contacting "cloudmanager.cloud.netapp.com" but it will start contacting "api.bluexp.netapp.com" in an upcoming release.
https://*.blob.core.windows.net https://cloudmanagerinfraprod.azurecr.io	To upgrade the Connector and its Docker components.

Endpoints

Purpose

https://management.azure.com
https://login.microsoftonline.com
https://blob.core.windows.net
https://core.windows.net

To manage resources in Azure public regions.

https://management.chinacloudapi.cn
https://login.chinacloudapi.cn
https://blob.core.chinacloudapi.cn
https://core.chinacloudapi.cn

To manage resources in Azure China regions.

https://support.netapp.com
https://mysupport.netapp.com

To obtain licensing information and to send AutoSupport messages to NetApp support.

https://*.api.bluexp.netapp.com

https://api.bluexp.netapp.com

https://*.cloudmanager.cloud.netapp.com

https://cloudmanager.cloud.netapp.com

https://netapp-cloud-account.auth0.com

To provide SaaS features and services within BlueXP.

Note that the Connector is currently contacting "cloudmanager.cloud.netapp.com" but it will start contacting "api.bluexp.netapp.com" in an upcoming release.

https://*.blob.core.windows.net

https://cloudmanagerinfraprod.azurecr.io

To upgrade the Connector and its Docker components.

Endpoints contacted from the BlueXP console: As you use the BlueXP web-based console that's provided through the SaaS layer, it contacts several endpoints to complete data management tasks. This includes endpoints that are contacted to deploy the Connector from the BlueXP console.

View the list of endpoints contacted from the BlueXP console.

Proxy server

If your organization requires deployment of a proxy server for all outgoing internet traffic, obtain the following information about your HTTP or HTTPS proxy. You'll need to provide this information during installation.

IP address
Credentials
HTTPS certificate

Note that BlueXP does not support transparent proxy servers.

Ports

There's no incoming traffic to the Connector, unless you initiate it or if the Connector is used as a proxy to send AutoSupport messages from Cloud Volumes ONTAP to NetApp Support.

HTTP (80) and HTTPS (443) provide access to the local UI, which you'll use in rare circumstances.
SSH (22) is only needed if you need to connect to the host for troubleshooting.
Inbound connections over port 3128 are required if you deploy Cloud Volumes ONTAP systems in a subnet where an outbound internet connection isn't available.

If Cloud Volumes ONTAP systems don't have an outbound internet connection to send AutoSupport messages, BlueXP automatically configures those systems to use a proxy server that's included with the Connector. The only requirement is to ensure that the Connector's security group allows inbound connections over port 3128. You'll need to open this port after you deploy the Connector.

Enable NTP: If you're planning to use BlueXP classification to scan your corporate data sources, you should enable a Network Time Protocol (NTP) service on both the BlueXP Connector system and the BlueXP classification system so that the time is synchronized between the systems. Learn more about BlueXP classification

You'll need to implement this networking requirement after you create the Connector.

Step 2: Create a custom role

Create an Azure custom role that you can assign to your Azure account or to a Microsoft Entra service principal. BlueXP authenticates with Azure and uses these permissions to create the Connector instance on your behalf.

Note that you can create an Azure custom role using the Azure portal, Azure PowerShell, Azure CLI, or REST API. The following steps show how to create the role using the Azure CLI. If you would prefer to use a different method, refer to Azure documentation

Steps

Copy the required permissions for a new custom role in Azure and save them in a JSON file.

This custom role contains only the permissions needed to launch the Connector VM in Azure from BlueXP. Don't use this policy for other situations. When BlueXP creates the Connector, it applies a new set of permissions to the Connector VM that enables the Connector to manage the resources in your public cloud environment.

{
    "Name": "Azure SetupAsService",
    "Actions": [
        "Microsoft.Compute/disks/delete",
        "Microsoft.Compute/disks/read",
        "Microsoft.Compute/disks/write",
        "Microsoft.Compute/locations/operations/read",
        "Microsoft.Compute/operations/read",
        "Microsoft.Compute/virtualMachines/instanceView/read",
        "Microsoft.Compute/virtualMachines/read",
        "Microsoft.Compute/virtualMachines/write",
        "Microsoft.Compute/virtualMachines/delete",
        "Microsoft.Compute/virtualMachines/extensions/write",
        "Microsoft.Compute/virtualMachines/extensions/read",
        "Microsoft.Compute/availabilitySets/read",
        "Microsoft.Network/locations/operationResults/read",
        "Microsoft.Network/locations/operations/read",
        "Microsoft.Network/networkInterfaces/join/action",
        "Microsoft.Network/networkInterfaces/read",
        "Microsoft.Network/networkInterfaces/write",
        "Microsoft.Network/networkInterfaces/delete",
        "Microsoft.Network/networkSecurityGroups/join/action",
        "Microsoft.Network/networkSecurityGroups/read",
        "Microsoft.Network/networkSecurityGroups/write",
        "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
        "Microsoft.Network/virtualNetworks/read",
        "Microsoft.Network/virtualNetworks/subnets/join/action",
        "Microsoft.Network/virtualNetworks/subnets/read",
        "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
        "Microsoft.Network/virtualNetworks/virtualMachines/read",
        "Microsoft.Network/publicIPAddresses/write",
        "Microsoft.Network/publicIPAddresses/read",
        "Microsoft.Network/publicIPAddresses/delete",
        "Microsoft.Network/networkSecurityGroups/securityRules/read",
        "Microsoft.Network/networkSecurityGroups/securityRules/write",
        "Microsoft.Network/networkSecurityGroups/securityRules/delete",
        "Microsoft.Network/publicIPAddresses/join/action",
        "Microsoft.Network/locations/virtualNetworkAvailableEndpointServices/read",
        "Microsoft.Network/networkInterfaces/ipConfigurations/read",
        "Microsoft.Resources/deployments/operations/read",
        "Microsoft.Resources/deployments/read",
        "Microsoft.Resources/deployments/delete",
        "Microsoft.Resources/deployments/cancel/action",
        "Microsoft.Resources/deployments/validate/action",
        "Microsoft.Resources/resources/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/resourceGroups/delete",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/resourcegroups/resources/read",
        "Microsoft.Resources/subscriptions/resourceGroups/write",
        "Microsoft.Authorization/roleDefinitions/write",
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/read",
        "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write",
        "Microsoft.Network/networkSecurityGroups/delete",
        "Microsoft.Storage/storageAccounts/delete",
        "Microsoft.Storage/storageAccounts/write",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/deployments/operationStatuses/read",
        "Microsoft.Authorization/roleAssignments/read"
    ],
    "NotActions": [],
    "AssignableScopes": [],
    "Description": "Azure SetupAsService",
    "IsCustom": "true"
}

Modify the JSON by adding your Azure subscription ID to the assignable scope.

Example
```
"AssignableScopes": [
"/subscriptions/d333af45-0d07-4154-943d-c25fbzzzzzzz"
],
```
Use the JSON file to create a custom role in Azure.

The following steps describe how to create the role by using Bash in Azure Cloud Shell.
1. Start Azure Cloud Shell and choose the Bash environment.
2. Upload the JSON file.
3. Enter the following Azure CLI command:
  az role definition create --role-definition Policy_for_Setup_As_Service_Azure.json
You should now have a custom role called Azure SetupAsService. You can now apply this custom role to your user account or to a service principal.

Step 3: Set up authentication

When creating the Connector from BlueXP, you need to provide a login that enables BlueXP to authenticate with Azure and deploy the VM. You have two options:

Sign in with your Azure account when prompted. This account must have specific Azure permissions. This is the default option.
Provide details about a Microsoft Entra service principal. This service principal also requires specific permissions.

Follow the steps to prepare one of these authentication methods for use with BlueXP.

Azure account

Assign the custom role to the user who will deploy the Connector from BlueXP.

Steps

In the Azure portal, open the Subscriptions service and select the user's subscription.
Click Access control (IAM).
Click Add > Add role assignment and then add the permissions:
1. Select the Azure SetupAsService role and click Next.
  
  Azure SetupAsService is the default name provided in the Connector deployment policy for Azure. If you chose a different name for the role, then select that name instead.
2. Keep User, group, or service principal selected.
3. Click Select members, choose your user account, and click Select.
4. Click Next.
5. Click Review + assign.

Result

The Azure user now has the permissions required to deploy the Connector from BlueXP.

Service principal

Rather than logging in with your Azure account, you can provide BlueXP with the credentials for an Azure service principal that has the required permissions.

Create and set up a service principal in Microsoft Entra ID and obtain the Azure credentials that BlueXP needs.

Create a Microsoft Entra application for role-based access control

Ensure that you have permissions in Azure to create an Active Directory application and to assign the application to a role.

For details, refer to Microsoft Azure Documentation: Required permissions
From the Azure portal, open the Microsoft Entra ID service.
In the menu, select App registrations.
Select New registration.
Specify details about the application:
- Name: Enter a name for the application.
- Account type: Select an account type (any will work with BlueXP).
- Redirect URI: You can leave this field blank.
Select Register.

You've created the AD application and service principal.

Assign the custom role to the application

From the Azure portal, open the Subscriptions service.
Select the subscription.
Click Access control (IAM) > Add > Add role assignment.
In the Role tab, select the BlueXP Operator role and click Next.
In the Members tab, complete the following steps:
1. Keep User, group, or service principal selected.
2. Click Select members.
3. Search for the name of the application.
  
  Here's an example:
4. Select the application and click Select.
5. Click Next.
Click Review + assign.

The service principal now has the required Azure permissions to deploy the Connector.

If you want to manage resources in multiple Azure subscriptions, then you must bind the service principal to each of those subscriptions. For example, BlueXP enables you to select the subscription that you want to use when deploying Cloud Volumes ONTAP.

Add Windows Azure Service Management API permissions

In the Microsoft Entra ID service, select App registrations and select the application.
Select API permissions > Add a permission.
Under Microsoft APIs, select Azure Service Management.
Select Access Azure Service Management as organization users and then select Add permissions.

Get the application ID and directory ID for the application

In the Microsoft Entra ID service, select App registrations and select the application.
Copy the Application (client) ID and the Directory (tenant) ID.

When you add the Azure account to BlueXP, you need to provide the application (client) ID and the directory (tenant) ID for the application. BlueXP uses the IDs to programmatically sign in.

Create a client secret

Open the Microsoft Entra ID service.
Select App registrations and select your application.
Select Certificates & secrets > New client secret.
Provide a description of the secret and a duration.
Select Add.
Copy the value of the client secret.

You now have a client secret that BlueXP can use it to authenticate with Microsoft Entra ID.

Result

Your service principal is now setup and you should have copied the application (client) ID, the directory (tenant) ID, and the value of the client secret. You need to enter this information in BlueXP when you create the Connector.

Step 4: Create the Connector

Create the Connector directly from the BlueXP web-based console.

About this task

Creating the Connector from BlueXP deploys a virtual machine in Azure using a default configuration. After you create the Connector, you should not change to a smaller VM type that has less CPU or RAM. Learn about the default configuration for the Connector.

Before you begin

You should have the following:

An Azure subscription.
A VNet and subnet in your Azure region of choice.
Details about a proxy server, if your organization requires a proxy for all outgoing internet traffic:
- IP address
- Credentials
- HTTPS certificate
An SSH public key, if you want to use that authentication method for the Connector virtual machine. The other option for the authentication method is to use a password.

Learn about connecting to a Linux VM in Azure
If you don't want BlueXP to automatically create an Azure role for the Connector, then you'll need to create your own using the policy on this page.

These permissions are for the Connector instance itself. It's a different set of permissions than what you previously set up to deploy the Connector VM.

Steps

Select the Connector drop-down and select Add Connector.
Choose Microsoft Azure as your cloud provider.

On the Deploying a Connector page:

Under Authentication, select the authentication option that matches how you set up Azure permissions:

Select Azure user account to log in to your Microsoft account, which should have the required permissions.

The form is owned and hosted by Microsoft. Your credentials are not provided to NetApp.

If you're already logged in to an Azure account, then BlueXP will automatically use that account. If you have multiple accounts, then you might need to log out first to ensure that you're using the right account.

Select Active Directory service principal to enter information about the Microsoft Entra service principal that grants the required permissions:
- Application (client) ID
- Directory (tenant) ID
- Client Secret

Learn how to obtain these values for a service principal.

Follow the steps in the wizard to create the Connector:
- VM Authentication: Choose an Azure subscription, a location, a new resource group or an existing resource group, and then choose an authentication method for the Connector virtual machine that you're creating.
  
  The authentication method for the virtual machine can be a password or an SSH public key.
  
  Learn about connecting to a Linux VM in Azure
- Details: Enter a name for the instance, specify tags, and choose whether you want BlueXP to create a new role that has the required permissions, or if you want to select an existing role that you set up with the required permissions.
  
  Note that you can choose the Azure subscriptions associated with this role. Each subscription that you choose provides the Connector permissions to manage resources in that subscription (for example, Cloud Volumes ONTAP).
- Network: Choose a VNet and subnet, whether to enable a public IP address, and optionally specify a proxy configuration.
- Security Group: Choose whether to create a new security group or whether to select an existing security group that allows the required inbound and outbound rules.
  
  View security group rules for Azure.
- Review: Review your selections to verify that your set up is correct.
Click Add.

The virtual machine should be ready in about 7 minutes. You should stay on the page until the process is complete.

Result

After the process is complete, the Connector is available for use from BlueXP.

If you have Azure Blob storage in the same Azure subscription where you created the Connector, you'll see an Azure Blob storage working environment appear on the BlueXP canvas automatically. Learn how to manage Azure Blob storage from BlueXP

Create a Connector in Azure from BlueXP

Creating your file...

Step 1: Set up networking

Step 2: Create a custom role

Step 3: Set up authentication

Step 4: Create the Connector