Unable to use User assigned Identity as authentication to provision OCP cluster in Azure

Posted on

Hi, I am provisioning an OCP cluster in Azure pipeline using User assigned managed identity as authentication method. I have assigned the managed identity to each VM and agent pool. I am getting a conflict error for priorities in network security rule.
I tried changing the NSG rule priorities at my end but, seems like this are defined by OpenShift and I have no control over it.

The error I am getting:

level=error msg=Error: creating/updating Security Rule: (Name "bootstrap_ssh_in" / Network Security Group Name "ocp-n-3025-20240826-4-x5j95-nsg" / Resource Group "ocp-n-3025-20240826-4-x5j95-rg"): network.SecurityRulesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="SecurityRuleConflict" Message="Security rule NRMS-Rule-103 conflicts with rule bootstrap_ssh_in. Rules cannot have the same Priority and Direction. To learn more, see aka.ms/nsgrules." Details=[]

These are the configurations used in install-config.yaml file:

apiVersion: v1
baseDomain: arc-validation-conformance.com
compute:
- architecture: amd64
  hyperthreading: Enabled
  name: worker
  platform:
    azure:
      osDisk:
        diskSizeGB: 512 
      type: Standard_D4s_v3
  replicas: 3
controlPlane:
  architecture: amd64
  hyperthreading: Enabled
  name: master
  platform:
    azure:
      osDisk:
        diskSizeGB: 512
      type: Standard_D8s_v3
  replicas: 3
metadata:
  creationTimestamp: null
  name: $hostName
networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 10.0.0.0/16
  networkType: OVNKubernetes
  serviceNetwork:
  - 172.30.0.0/16
platform:
  azure:
    baseDomainResourceGroupName: conformance-common
    cloudName: AzurePublicCloud
    outboundType: Loadbalancer
    region: eastus2
credentialsMode: Manual    
publish: External
pullSecret: '$OCP_PULLSECRET'

Can someone help on setting up the correct NSG priorities and come out of this issue?

Attachments

MP

Responses