Azure Run Command Overview and Architecture
AVS is a fully-managed VMware service provided by Azure to its customers. AVS users are given access to the cloudadmin@vsphere.local account which has sufficient privileges for general vCenter and virtual machine daily operations management. This account does not include some of the broader administrative rights. To account for this, AVS uses a framework called Run Command to allow end-users to run certain administrative actions against their AVS cluster. At its core, Run Command is a collection of PowerShell cmdlets that for the purposes of this guide is how we will accomplish initial AVS cluster configuration to use iSCSI, create and attach Everpure Cloud Dedicated volumes and manage Everpure Cloud Dedicated datastore operations within the AVS cluster or AVS clusters.
Existing Everpure VMware users are potentially familiar with the Everpure vSphere Plugin and/or the Everpure Analytics Collector. For the AVS integration, we have introduced a third flavor of our Everpure Plugin entitled VMware Cloud Manager that can be deployed on the AVS Cluster to support using and managing Everpure Cloud Dedicated via Run Command and the Pure PowerShell SDK. The version of the plugin comes preloaded with PowerShell and all of the required modules and libraries Alternatively, customers can build their own Azure VM with connectivity to AVS and Everpure Cloud Dedicated and install the required PowerShell libraries and modules. In this first section of this guide, we will show how to setup both the Pure Plugin within AVS as well as build your own Azure VM that can in turn be used to control the AVS and Everpure Cloud Dedicated integration.
Required Azure Permissions for Using AVS Run Commands
To execute Run Commands against their SDDC, the Azure user who authenticates via the VMware Cloud Manager OVA or PowerShell (using either of the deployment options described below) must have specific Azure IAM roles. The required permissions are:
Microsoft.AVS/privateClouds/writeMicrosoft.AVS/privateClouds/readMicrosoft.AVS/privateClouds/listAdminCredentials/actionIf you have Contributor or Owner role at the AVS resource level, you already have this permissions automatically. Otherwise you have to check your current permissions following way:
-
Navigate to the Azure VMware Solution (AVS) Resource and go to Access Control (IAM) on the left panel.
-
Click View my access (to check your own permissions).
-
Under Role Assignments search for permissions mentioned above.