Deploy the Connector in private mode

10/25/2024 Contributors

Deploy the Connector in private mode so that you can use BlueXP with no outbound connectivity to the BlueXP software as a service (SaaS) layer. To get started, install the Connector, set up BlueXP by accessing the user interface that's running on the Connector, and then provide the cloud permissions that you previously set up.

Step 1: Install the Connector

Download the product installer from the NetApp Support Site and then manually install the Connector on your own Linux host.

If you want to use BlueXP in the AWS Secret Cloud or the AWS Top Secret Cloud, then you should follow separate instructions to get started in those environments. Learn how to get started with Cloud Volumes ONTAP in the AWS Secret Cloud or Top Secret Cloud

Before you begin

Root privileges are required to install the Connector.
Depending on your operating system, either Podman or Docker Engine is required before you install the Connector.

Steps

Download the Connector software from the NetApp Support Site

Be sure to download the offline installer for private networks without internet access.
Copy the installer to the Linux host.
Assign permissions to run the script.
```
chmod +x /path/BlueXP-Connector-offline-<version>
```
Cli
Copy
Where <version> is the version of the Connector that you downloaded.
Run the installation script:
```
sudo /path/BlueXP-Connector-offline-<version>
```
Cli
Copy
Where <version> is the version of the Connector that you downloaded.

Result

The Connector software is installed. You can now set up BlueXP.

Step 2: Set up BlueXP

When you access the BlueXP console for the first time, you'll be prompted to set up BlueXP.

Steps

Open a web browser and enter https://ipaddress where ipaddress is the IP address of the Linux host where you installed the Connector.

You should see the following screen.
Select Set Up New BlueXP Connector and follow the prompts to set up the system.
- System Details: Enter a name for the Connector and your company name.
- Create an Admin User: Create the admin user for the system.
  
  This user account runs locally on the system. There's no connection to the auth0 service available through BlueXP.
- Review: Review the details, accept the license agreement, and then select Set Up.
Log in to BlueXP using the admin user that you just created.

Result

The Connector is now installed and set up.

When new versions of the Connector software are available, they'll be posted to the NetApp Support Site. Learn how to upgrade the Connector.

What's next?

Provide BlueXP with the permissions that you previously set up.

Step 3: Provide permissions to BlueXP

If you want to create Cloud Volumes ONTAP working environments, you'll need to provide BlueXP with the cloud permissions that you previously set up.

Learn how to prepare cloud permissions.

Attach the IAM role that you previously created to the Connector EC2 instance.

Steps

Go to the Amazon EC2 console.
Select Instances.
Select the Connector instance.
Select Actions > Security > Modify IAM role.
Select the IAM role and select Update IAM role.

Result

BlueXP now has the permissions that it needs to perform actions in AWS on your behalf.

Provide BlueXP with the AWS access key for an IAM user that has the required permissions.

Steps

In the upper right of the BlueXP console, select the Settings icon, and select Credentials.
Select Add Credentials and follow the steps in the wizard.
1. Credentials Location: Select Amazon Web Services > Connector.
2. Define Credentials: Enter an AWS access key and secret key.
3. Marketplace Subscription: Associate a Marketplace subscription with these credentials by subscribing now or by selecting an existing subscription.
4. Review: Confirm the details about the new credentials and select Add.

Result

BlueXP now has the permissions that it needs to perform actions in AWS on your behalf.

Go to the Azure portal and assign the Azure custom role to the Connector virtual machine for one or more subscriptions.

Steps

From the Azure Portal, open the Subscriptions service and select your subscription.

It's important to assign the role from the Subscriptions service because this specifies the scope of the role assignment at the subscription level. The scope defines the set of resources that the access applies to. If you specify a scope at a different level (for example, at the virtual machine level), your ability to complete actions from within BlueXP will be affected.

Microsoft Azure documentation: Understand scope for Azure RBAC
Select Access control (IAM) > Add > Add role assignment.
In the Role tab, select the BlueXP Operator role and select Next.

BlueXP Operator is the default name provided in the BlueXP policy. If you chose a different name for the role, then select that name instead.
In the Members tab, complete the following steps:
1. Assign access to a Managed identity.
2. Select Select members, select the subscription in which the Connector virtual machine was created, under Managed identity, choose Virtual machine, and then select the Connector virtual machine.
3. Select Select.
4. Select Next.
5. Select Review + assign.
6. If you want to manage resources in additional Azure subscriptions, switch to that subscription and then repeat these steps.

Result

BlueXP now has the permissions that it needs to perform actions in Azure on your behalf.

Provide BlueXP with the credentials for the Azure service principal that you previously setup.

Steps

In the upper right of the BlueXP console, select the Settings icon, and select Credentials.
Select Add Credentials and follow the steps in the wizard.
1. Credentials Location: Select Microsoft Azure > Connector.
2. Define Credentials: Enter information about the Microsoft Entra service principal that grants the required permissions:
  - Application (client) ID
  - Directory (tenant) ID
  - Client Secret
3. Marketplace Subscription: Associate a Marketplace subscription with these credentials by subscribing now or by selecting an existing subscription.
4. Review: Confirm the details about the new credentials and select Add.

Result

BlueXP now has the permissions that it needs to perform actions in Azure on your behalf.

Associate the service account with the Connector VM.

Steps

Go to the Google Cloud portal and assign the service account to the Connector VM instance.

Google Cloud documentation: Changing the service account and access scopes for an instance
If you want to manage resources in other projects, grant access by adding the service account with the BlueXP role to that project. You'll need to repeat this step for each project.

Result

BlueXP now has the permissions that it needs to perform actions in Google Cloud on your behalf.

Deploy the Connector in private mode

Creating your file...

Step 1: Install the Connector

Step 2: Set up BlueXP

Step 3: Provide permissions to BlueXP