Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

  • Comments
  • Unable to use User assigned Identity as authentication to provision OCP cluster in Azure

    Posted on

    Hi, I am provisioning an OCP cluster in Azure pipeline using User assigned managed identity as authentication method. I have assigned the managed identity to each VM and agent pool. I am getting a conflict error for priorities in network security rule.
    I tried changing the NSG rule priorities at my end but, seems like this are defined by OpenShift and I have no control over it.

    The error I am getting:

    level=error msg=Error: creating/updating Security Rule: (Name "bootstrap_ssh_in" / Network Security Group Name "ocp-n-3025-20240826-4-x5j95-nsg" / Resource Group "ocp-n-3025-20240826-4-x5j95-rg"): network.SecurityRulesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="SecurityRuleConflict" Message="Security rule NRMS-Rule-103 conflicts with rule bootstrap_ssh_in. Rules cannot have the same Priority and Direction. To learn more, see aka.ms/nsgrules." Details=[]

    These are the configurations used in install-config.yaml file:

    apiVersion: v1
    baseDomain: arc-validation-conformance.com
    compute:
    - architecture: amd64
      hyperthreading: Enabled
      name: worker
      platform:
        azure:
          osDisk:
            diskSizeGB: 512 
          type: Standard_D4s_v3
      replicas: 3
    controlPlane:
      architecture: amd64
      hyperthreading: Enabled
      name: master
      platform:
        azure:
          osDisk:
            diskSizeGB: 512
          type: Standard_D8s_v3
      replicas: 3
    metadata:
      creationTimestamp: null
      name: $hostName
    networking:
      clusterNetwork:
      - cidr: 10.128.0.0/14
        hostPrefix: 23
      machineNetwork:
      - cidr: 10.0.0.0/16
      networkType: OVNKubernetes
      serviceNetwork:
      - 172.30.0.0/16
    platform:
      azure:
        baseDomainResourceGroupName: conformance-common
        cloudName: AzurePublicCloud
        outboundType: Loadbalancer
        region: eastus2
    credentialsMode: Manual    
    publish: External
    pullSecret: '$OCP_PULLSECRET'
    

    Can someone help on setting up the correct NSG priorities and come out of this issue?

    Attachments

    by

    points

    Responses

    Red Hat

    Quick Links

    Help

    Site Info

    Related Sites

    © 2025 Red Hat, Inc.