Azure Networking: VNet Peering

​

Prerequisites

• A dedicated Astro cluster
• Global Admin permissions in Azure to add the Astronomer Service Principal

1. Retrieve the following information from the target Azure environment that you want to connect with:
   • Azure Tenant ID and Subscription ID.
   • VNet name.
   • Resource Group name.
2. Prepare the astro-vnet-peering-creator-role.json JSON file with the following permissions. Replace {customer-subscription-id} with your value:
   astro-vnet-peering-creator-role.json

   {
       "Name": "Astro VNET Peering Contributor",
       "IsCustom": true,
       "Description": "Can create VNET peering with Astro.",
       "Actions": [
           "Microsoft.Resources/subscriptions/resourceGroups/read",
           "Microsoft.Resources/subscriptions/read",
           "Microsoft.Network/virtualNetworks/read",
           "Microsoft.Network/virtualNetworks/write",
           "Microsoft.Network/virtualNetworks/peer/action",
           "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
           "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read"
       ],
       "NotActions": [
   
       ],
       "AssignableScopes": [
         "/subscriptions/{customer-subscription-id}"
       ]
   }
   
3. Run the following Azure CLI commands to give Astronomer support temporary permissions to establish a VNet peering connection:
   # Add Astronomer Service Principal
   az ad sp create --id a67e6057-7138-4f78-bbaf-fd9db7b8aab0
   
   # Create a Custom role with permissions prepared in previous step
   az role definition create --role-definition ~/astro-vnet-peering-creator-role.json
   
   # Assign Custom role to the Astronomer Service Principal ({customer-subscription-id} has to be replaced with your value)
   az role assignment create \
   --assignee a67e6057-7138-4f78-bbaf-fd9db7b8aab0 \
   --role "Astro VNET Peering Contributor" \
   --scope "/subscriptions/{customer-subscription-id}"
   
   # Verify an assignment
   az role assignment list --assignee a67e6057-7138-4f78-bbaf-fd9db7b8aab0 --all -o table
   
4. Contact Astronomer support to tell them that you granted permissions to the Astronomer Service Principal. In addition, provide the following details in your request:
   • Astro Cluster ID
   • Azure Tenant ID and Subscription ID of the target VNet
   • Resource group name
   • VNet Name and preferred name for peering

az role assignment delete --assignee a67e6057-7138-4f78-bbaf-fd9db7b8aab0 --role "Astro VNET Peering Contributor" --scope "/subscriptions/{customer-subscription-id}"