Menu Close

3.8.7. Creating the Azure resource group and identity

You must create a Microsoft Azure resource group and an identity for that resource group. These are both used during the installation of your OpenShift Container Platform cluster on Azure.


  • Configure an Azure account.
  • Generate the Ignition config files for your cluster.


  1. Create the resource group in a supported Azure region:

    $ az group create --name ${RESOURCE_GROUP} --location ${AZURE_REGION}
  2. Create an Azure identity for the resource group:

    $ az identity create -g ${RESOURCE_GROUP} -n ${INFRA_ID}-identity

    This is used to grant the required access to Operators in your cluster. For example, this allows the Ingress Operator to create a public IP and its load balancer. You must assign the Azure identity to a role.

  3. Grant the Contributor role to the Azure identity:

    1. Export the following variables required by the Azure role assignment:

      $ export PRINCIPAL_ID=`az identity show -g ${RESOURCE_GROUP} -n ${INFRA_ID}-identity --query principalId --out tsv`
      $ export RESOURCE_GROUP_ID=`az group show -g ${RESOURCE_GROUP} --query id --out tsv`
    2. Assign the Contributor role to the identity:

      $ az role assignment create --assignee "${PRINCIPAL_ID}" --role 'Contributor' --scope "${RESOURCE_GROUP_ID}"