Deploy Azure Local using local identity with Azure Key Vault via Azure Resource Manager deployment template

This article describes how to deploy Azure Local using local identity with Azure Key Vault by using an Azure Resource Manager (ARM) template configured for external DNS. The article also describes the prerequisites and the preparation steps required to begin the deployment.

Prerequisites

• Completion of Register your machines with Azure Arc and assign deployment permissions. Make sure that:
  • All machines run the same version of the OS.
  • All the machines have the same network adapter configuration.

Step 1: Prepare Azure resources

Follow these steps to prepare the Azure resources you need for the deployment:

Get the object ID for Azure Local Resource Provider

This object ID for the Azure Local Resource Provider (RP) is unique per Azure tenant.

1. In the Azure portal, search for and go to Microsoft Entra ID.

2. Go to the Overview tab and search for 00001111-aaaa-2222-bbbb-3333cccc4444.

3. Select the Service Principal Name that is listed and copy the Object ID.

   

   Alternatively, you can use Azure CLI or PowerShell to get the object ID of the Azure Local RP service principal. Run the following command:

   • Azure PowerShell
   • Azure CLI

   (Get-AzADServicePrincipal -ApplicationId "00001111-aaaa-2222-bbbb-3333cccc4444").Id
   

Use the Object ID for the hciResourceProviderObjectID parameter in the ARM template.

Step 2: Deploy by using ARM template

An ARM template creates and assigns all the resource permissions required for deployment.

When you complete all the prerequisite and preparation steps, you're ready to deploy by using a known good and tested ARM deployment template and corresponding parameters JSON file. Use the parameters contained in the JSON file to fill out all values, including the values you generated previously.

For an example of a parameters JSON file for deployments that use external DNS, see azuredeploy.parameters.json. For detailed descriptions of the parameters defined in this file, see ARM template parameters reference.

1. In the Azure portal, go to Home and select + Create a resource.

2. Select Create under Template deployment (deploy using custom templates).

   

3. Near the bottom of the page, find the Start with a quickstart template or template spec section. Select Quickstart template.

4. Use the Quickstart template (disclaimer) field to filter for the appropriate template. Type azurestackhci/create-adless-cluster-external-dns-public-preview for the filter.

5. When finished, select the Select template button.

   

6. On the Basics tab, you see the Custom deployment page. You can select the various parameters through the dropdown list or select Edit parameters.

   

   Note

   For an example parameter file that shows the format of various inputs, such as ArcNodeResourceId, see azuredeploy.parameters.json.

7. Edit parameters such as network intent or storage network intent. When you fill out all the parameters, Save the parameters file.

   

8. Select the appropriate resource group for your environment.

9. Confirm that Deployment Mode is set to Validate.

10. Select Save.

11. On the Basics tab, select Review + create.

12. On the Review + Create tab, select Create. This creates the remaining prerequisite resources and validates the deployment. Validation takes about 10 minutes to complete.

13. Once validation is complete, select Redeploy.

    

14. On the Custom deployment screen, select Edit parameters. Load the previously saved parameters and select Save.

15. At the bottom of the workspace, change the final value in the JSON from Validate to Deploy, where Deployment Mode is set to Deploy.

    

16. Verify that the Parameters JSON fills in all the fields for the ARM deployment template.

17. Select the appropriate resource group for your environment.

18. Scroll to the bottom, and confirm that Deployment Mode is set to Deploy.

19. Select Review + create.

20. Select Create. The deployment begins, using the existing prerequisite resources that the Validate step created.

    The Deployment screen cycles on the cluster resource during deployment.

    Once deployment initiates, the process runs a limited Environment Checker run, a full Environment Checker run, and starts cloud deployment. After a few minutes, you can monitor deployment in the portal.

    

21. In a new browser window, go to the resource group for your environment. Select the cluster resource.

22. Select Deployments.

23. Refresh and watch the deployment progress from the first machine (also known as the seed machine and is the first machine where you deployed the cluster). Deployment takes between 2.5 and 3 hours. Several steps take 40-50 minutes or more.

24. The step in deployment that takes the longest is Deploy Moc and ARB Stack. This step takes 40-45 minutes.

    Once complete, the task at the top updates with status and end time.

ARM template parameters reference

The following table describes the parameters that you define in the ARM template's parameters file:

dnsZones example

The following example shows how to configure the dnsZones parameter for deployments that use the external DNS template:

### dnsZones example (external DNS)

```json
"dnsZones": {
  "value": [
    {
      "dnsZoneName": "redmond.contoso.com",
      "dnsForwarder": []
    }
  ]
}

Next steps

• About Azure Local VM management.
• Create Azure Local VMs enabled by Azure Arc.

This feature is available only in Azure Local 2510 or later.