Unable to use User assigned Identity as authentication to provision OCP cluster in Azure
Hi, I am provisioning an OCP cluster in Azure pipeline using User assigned managed identity as authentication method. I have assigned the managed identity to each VM and agent pool. I am getting a conflict error for priorities in network security rule.
I tried changing the NSG rule priorities at my end but, seems like this are defined by OpenShift and I have no control over it.
The error I am getting:
level=error msg=Error: creating/updating Security Rule: (Name "bootstrap_ssh_in" / Network Security Group Name "ocp-n-3025-20240826-4-x5j95-nsg" / Resource Group "ocp-n-3025-20240826-4-x5j95-rg"): network.SecurityRulesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="SecurityRuleConflict" Message="Security rule NRMS-Rule-103 conflicts with rule bootstrap_ssh_in. Rules cannot have the same Priority and Direction. To learn more, see aka.ms/nsgrules." Details=[]
These are the configurations used in install-config.yaml file:
apiVersion: v1 baseDomain: arc-validation-conformance.com compute: - architecture: amd64 hyperthreading: Enabled name: worker platform: azure: osDisk: diskSizeGB: 512 type: Standard_D4s_v3 replicas: 3 controlPlane: architecture: amd64 hyperthreading: Enabled name: master platform: azure: osDisk: diskSizeGB: 512 type: Standard_D8s_v3 replicas: 3 metadata: creationTimestamp: null name: $hostName networking: clusterNetwork: - cidr: 10.128.0.0/14 hostPrefix: 23 machineNetwork: - cidr: 10.0.0.0/16 networkType: OVNKubernetes serviceNetwork: - 172.30.0.0/16 platform: azure: baseDomainResourceGroupName: conformance-common cloudName: AzurePublicCloud outboundType: Loadbalancer region: eastus2 credentialsMode: Manual publish: External pullSecret: '$OCP_PULLSECRET'
Can someone help on setting up the correct NSG priorities and come out of this issue?
Responses