Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Azure

The procedure to set up CCM for Azure by using Harness Self-Managed Enterprise Edition.

This topic walks you through the steps required to set up CACM for Azure in a self-managed platform.

Figure: Azure CACM Self-Managed Enterprise Edition architecture diagram

Click to view full size image

The flow at a high level works similarly to our SaaS environment. We support syncing data from multiple Azure account exports residing in different source storage accounts into CACM via a destination storage account (staging).

The goal of this particular documentation page is to set up an Azure Destination Storage Account and Application Registration, then configure an existing Harness Self-Managed Enterprise Edition deployment to utilize these components to act as a "staging area" for future Azure Billing Exports to be processed and made available for Harness CACM capabilities.

Figure: Azure CACM Self-Managed Documentation Goal

Click to view full size image

This goal consists of four tasks. For steps 1, 2, and 3 sign in to your Azure Portal:

  1. Setup a new Application via App Registration.

  2. Create a new Client secret.

  3. Create a new Destination Storage Account and a new Storage Container.

  4. Deploy workloads via Helm charts.

There are several times when you'll need to note some items as suggested variables. Keep these values in a document or note as they will be used later in the process.

Setup a new Application via App Registration

Within your Microsoft Azure WebUI:

  1. Navigate to App registrations.

  2. Select "New Registration"

  3. Give your App registration a Name like Harness CACM App.

  4. For Supported account types select: Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

  5. Click on Register. For more information, go to Quickstart: Register an App.

Click to view full size image

Create a new Client secret

  1. Once you click register, the App Overview Page would be open.

  2. From the overview page, make a note and the save the following from it:

  • Note & Save Directory (tenant) ID → tenantId

  • Note & Save Application (client) ID → clientId.

    Click to view full size image

  1. Now click on Certificates & secrets in the left panel.

  2. Go to Client secrets (0) tab.

  3. Click on New client secret.

  4. Enter Description Harness CACM Client Secret.

  5. Select Expires from the drop down select 730 days (24 months)(or the maximum allowed time).

  6. Click Add Button.

Click to view full size image

  1. From the new Client secret, Note & Save Value → clientSecret. For more information, go to Add credentials.

Make a note of the following:

  • tenantId

  • clientId

  • clientSecret

Create a new Destination Storage Account and a new Storage Container

This Storage Account will act as a staging area for CACM to sync data from multiple billing exports originating from other Storage Accounts.

  1. Select Create within the Storage Accounts page.

  2. Select a Subscription you intend to use from the drop down.

  3. Select a Resource Group you intend to use from the drop down.

  4. Enter Storage account name ccmbillingdatasmp. Note this as → storageName

  5. Move to Advanced Tab.

  6. In Blob storage section, enable Allow cross-tenant replication

  7. Click on Review + create.

Click to view full size image

  1. Click on Create. For more information, go to Create a storage account.

  2. Once the storage account is created, navigate to the storage account then to Containers in left panel.

  3. Click on + Container.

  4. Enter Name as billingdatacontainer. Note Name as → containerName

  5. Click on Create. For more information, go to Create a container.

Click to view full size image

  1. Go to Shared access signature in left panel.

  2. Check all Allowed resource types which are Service, Container and Object.

  3. Add 10 years to End in Start and expiry date/time.

  4. Click on Generate SAS and connection string. This is required to sync data from multiple source account to destination storage account.

  5. Note SAS token as → sasToken starting from sv=, ignore ? in beginning. For more information, go to Create your SAS tokens.

Click to view full size image

Make a note of the following:

  • storageName

  • containerName

  • sasToken

Deploy workloads via Helm charts

From here, we will use the values we've noted from previous steps to update our Harness SMP deployment.

  1. Clone the chart repository if you have not already.

  1. Upgrade charts if you're already using Harness Self-managed Enterprise Edition services. Perform the following steps to update the override files:

    1. Retrieve the current override values provided during the installation or upgrade of the Helm charts.

    2. After obtaining the override file, you can make necessary modifications as mentioned below, replacing values in brackets with the values noted from the Azure interface.

Air-gapped environment for Azure in SMP is not supported as of now

  1. After making the necessary updates to the override file, you can proceed with the Helm chart upgrade.

Handling Kubernetes secrets

When installing or upgrading the Helm charts, Kubernetes secrets with default values are created within the cluster. These generated secrets should be updated with the values mentioned above.

Before updating the secrets, you need to convert the secret into base64 encoded format. For example, if your HARNESS_CE_AZURE_CLIENTID value is "clientId", it would be stored as Y2xpZW50SWQ== after encoding. Please

After changing secrets, we will provide directives to kubectl delete the corresponding pods in order for your release to inherit new changes.

The following are the secrets specific to CACM services:

  • batch-processing

After these secrets are implemented, please kubectl delete the batch-processing pod for this release to start a newly configured pod.

  • cloud-info-secret-mount [config-file]

Config file

After these secrets are implemented, please `kubectl delete` the `cloud-info` pod for this release to start a newly configured pod.

  • nextgen-ce

After these secrets are implemented, please kubectl delete the nextgen-ce pods for this release to start a newly configured pod.

The following are some secrets from platform-service that you need to update:

  • smtp-secret - Required to support budget alerts email.

After these secrets are implemented, please kubectl delete any pods related to platform-service and batch-processing for this release to start newly configured pods.

Please ensure your Persistent Volumes related to TimescaleDB is at least 100Gi, run: kubectl edit pvc wal-volume-harness-timescaledb-0 -n <namespace>. These volumes are critical for capabilities like Recommendations and Anomalies within CACM.

Next steps

At this point, your "staging area" for future Microsoft Azure Billing Exports is ready and we can follow our standard methodologies for onboarding these assets.

Figure: Azure CACM Self-Managed Documentation Next Steps

Click to view full size image

  • Use Azure connector setup to set up Azure Billing Exports and push them to our configured destination storage account.

  • Use Kubernetes connector setup to expand visibility and reporting for Azure Kubernetes and other Kubernetes clusters hosted in Azure.

Troubleshooting

If in case the K8s secrets expire, the secrets will have to be set again. First you would have to update the secrets in respective secret.yaml and then delete the pod. We recommend to `kubectl delete`` the following pods:

  • batch-processing

  • ce-nextgen

  • cloud-info

and then follow the same steps to set the keys. After the new keys are set, verify the changes by looking at the configs for the pods. Please refer to the steps below for a faster execution.

  • batch-processing: kubectl exec -it -n <namespace> batch-processing cat batch-processing-config.yml | grep -E 'awsAccessKey|awsSecretKey

  • cloud-info:

kubectl exec -it -n <namespace> cloud-info cat config/config.toml | grep -E 'accessKey|secretKey'

  • nextgen-ce: kubectl exec -it -n <namespace> nextgen-ce cat config.yml | grep -E 'accessKey|secretKey|harnessAwsAccountId|destinationBucket:|awsConnectorTemplate'

PreviousAWS
NextGCP

Last updated

Was this helpful?