Give the Everpure Cloud Dedicated ArrayID Permissions over the Azure Virtual Network
Purity upgrades on Everpure Cloud Dedicated are accomplished by replacing the controller VMs one at a time. The new controller VMs come with the upgraded version of the Purity operating environment pre-installed. For the upgrade to succeed, the Everpure Cloud Dedicated identity must have permissions to the Azure virtual network Everpure Cloud Dedicated is using.
The first step is to find and copy the unique Everpure Cloud Dedicated array ID. To locate this, click on the Everpure Cloud Dedicated Managed Application within the Azure portal and select the Parameters and Outputs field from the menu on the left.
In the screen that opens, scroll down to see the Outputs section and from there, copy the value in the identityName field for later use.
To ensure the smooth operation of the CDU, the Everpure Cloud Dedicated Store identity must be granted two specific permissions on the attached VNET. This new step enhances and hardens Everpure Cloud Dedicated in two meaningful ways:
-
Improved Security Posture: By explicitly granting the unique Everpure Cloud Dedicated array ID permission to make changes only to designated components within your subscription, the security of Everpure Cloud Dedicated is significantly improved.
-
Enhanced Upgrade Capability: In previous versions of Purity, upgrades were limited to allowing only controller VM replacements to the version of Purity being upgraded. With this permissions update, more fundamental architectural upgrades to Everpure Cloud Dedicated (e.g., adding an additional network interface) are now possible without requiring a potential migration to a new Everpure Cloud Dedicated instance for new features or functionalities.
The most secure way to add these permissions is by creating a custom role assignment that includes only the two permissions outlined below. Additionally, this custom role should only be active and attached during the upgrade process. The custom role can be unassociated with the Azure VNET once the Purity upgrade operation is complete and re-added as needed for future upgrades.
Customers who wish to use a built-in role with the necessary permissions should navigate to Appendix A in this KB for instructions.
1) Create a customer role
A custom role needs to be created at the Resource Group level or above. To do this, navigate to the Resource Group or Azure Subscription, click on Access control (IAM)and click on Add custom role from the pull down menu.
Provide a name for the custom role.
Click Next to move to the Permissions tab and then select + Add Permissions.
Search for the following permission in the spawned window and select it. A description of the permission and what it allows Everpure Cloud Dedicated to do is included below:
-
Microsoft.Network/virtualNetworks/subnets/join/action: This permission is necessary because it enables the Everpure Cloud Dedicated instance to allocate and consume IP addresses from the subnets designated during deployment for various network services.
Repeat this process for the following permission:
-
Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action: This permission is necessary because it allows the Everpure Cloud Dedicated instance to instantiate and configure native Azure service endpoints, specifically CosmosDB, Key Vault, and Blob storage, for use with the Managed Application.
Confirm that both permissions are added to the custom role and then create it.
2) Add custom role to VNET
Next, we will be adding the custom role to the Azure Virtual Network (VNET) that Everpure Cloud Dedicated is connected to.
Select the Azure VNET and click on the Access control (IAM) button on the left. In the window that appears, select Add role assignment from the top menu.
To start, search for the Custom Role you created, select it, and click Next.
3) Add an Array ID (identityName)
On the following page, leave Assign access to set to User, group or service principal and then click on + Select members.
Paste in the Everpure Cloud Dedicated Array ID (identityName) you copied earlier into the search field, click on the instance that appears and make sure it appears under the Selected Members area. Click Select to add it to the role assignment.
Confirm that the Everpure Cloud Dedicated Array ID (identityName) object appears as expected and then go to Review and Assign to complete the assignment.
Add an Additional Service Endpoint to the Everpure Cloud Dedicated System Subnet
The Microsoft.Storage service endpoint allows Everpure Cloud Dedicated to use blob storage for storing and executing essential upgrade scripts. These scripts are run by the PSD Controller VM upon its first boot after an upgrade to a new version.
To accomplish this, from the Azure portal, select the Azure VNET that Everpure Cloud Dedicated is attached to and then click on Subnets.
Next, select the subnet that is using the System network service for Everpure Cloud Dedicated to edit it.
Add the Microsoft.Storage Service Endpoint to the subnet and select Save. Make sure that both the Microsoft.AzureCosmosDB and Microsoft.KeyVault service endpoints are retained as they are also utilized by Everpure Cloud Dedicated.