Manually install the Connector in Azure
To manually install the Connector on your own Linux host, you need to review host requirements, set up your networking, prepare Azure permissions, install the Connector, and then provide the permissions that you prepared.
You should review Connector limitations.
Step 1: Review host requirements
The Connector software must run on a host that meets specific operating system requirements, RAM requirements, port requirements, and so on.
- Dedicated host
-
The Connector is not supported on a host that is shared with other applications. The host must be a dedicated host.
- Supported operating systems
-
-
Ubuntu 22.04 LTS
-
Red Hat Enterprise Linux
-
8.6 to 8.10
-
9.1 to 9.3
The host must be registered with Red Hat Subscription Management. If it's not registered, the host can't access repositories to update required 3rd-party software during Connector installation.
The Connector is supported on English-language versions of these operating systems.
-
-
- Hypervisor
-
A bare metal or hosted hypervisor that is certified to run a supported operating system is required.
- CPU
-
8 cores or 8 vCPUs
- RAM
-
32 GB
- Azure VM size
-
An instance type that meets the CPU and RAM requirements above. We recommend Standard_D8s_v3.
- Disk space in /opt
-
100 GiB of space must be available
BlueXP uses
/opt
to install the/opt/application/netapp
directory and it's contents. - Disk space in /var
-
20 GiB of space must be available
BlueXP requires this space in
/var
because Docker or Podman are architected to create the containers within this directory. Specifically, they will create containers in the/var/lib/containers/storage
directory. External mounts or symlinks do not work for this space.
- Container orchestration tool
-
Depending on your operating system, either Podman or Docker Engine is required before you install the Connector.
-
Podman is required for Red Hat Enterprise Linux 8 and 9.
RHEL version Supported Podman version RHEL 8.6 to 8.9
Podman 4.6.1
RHEL 8.10
Podman 4.6.1 and 4.9.4
RHEL 9.1 to 9.3
Podman 4.6.1
The following prerequisites must be met for Podman:
-
The podman.socket service must be enabled and started
-
python3 must be installed
-
The podman-compose package version 1.0.6 must be installed
-
podman-compose must be added to the PATH environment variable
-
-
Docker Engine is required for Ubuntu.
-
The minimum supported version is 23.0.6.
-
The maximum supported version is 25.0.5.
-
-
Step 2: Install Podman or Docker Engine
Depending on your operating system, either Podman or Docker Engine is required before you install the Connector.
-
Podman is required for Red Hat Enterprise Linux 8 and 9.
-
Docker Engine is required for Ubuntu.
Install a supported version of Podman. View the Podman versions that BlueXP supports.
-
Remove the podman-docker package if it's installed on the host.
dnf remove podman-docker rm /var/run/docker.sock
-
Install Podman.
Podman is available from official Red Hat Enterprise Linux repositories.
For Red Hat Enterprise Linux 9:
sudo dnf install podman-2:<version>
Where <version> is the supported version of Podman that you're installing. View the Podman versions that BlueXP supports.
For Red Hat Enterprise Linux 8:
sudo dnf install podman-3:<version>
Where <version> is the supported version of Podman that you're installing. View the Podman versions that BlueXP supports.
-
Enable and start the podman.socket service.
sudo systemctl enable --now podman.socket
-
Install python3.
sudo dnf install python3
-
Install the EPEL repository package if it's not already available on your system.
This step is required because podman-compose is available from the Extra Packages for Enterprise Linux (EPEL) repository.
For Red Hat Enterprise Linux 9:
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
For Red Hat Enterprise Linux 8:
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
-
Install podman-compose package 1.0.6.
sudo dnf install podman-compose-1.0.6
Using the dnf install
command meets the requirement for adding podman-compose to the PATH environment variable. The installation command adds podman-compose to /usr/bin, which is already included in thesecure_path
option on the host.
Install a version of Docker Engine between 23.0.6 and 25.0.5.
-
Install Docker Engine.
Be sure to follow the steps to install a specific version of Docker Engine. Installing the latest version will install a version of Docker that BlueXP doesn't support.
-
Verify that Docker is enabled and running.
sudo systemctl enable docker && sudo systemctl start docker
Step 3: Set up networking
Ensure that the network location where you plan to install the Connector supports the following requirements. Meeting these requirements enables the Connector to manage resources and processes within your hybrid cloud environment.
- Azure region
-
If you use Cloud Volumes ONTAP, the Connector should be deployed in the same Azure region as the Cloud Volumes ONTAP systems that it manages, or in the Azure region pair for the Cloud Volumes ONTAP systems. This requirement ensures that an Azure Private Link connection is used between Cloud Volumes ONTAP and its associated storage accounts.
- Connections to target networks
-
A Connector requires a network connection to the location where you're planning to create and manage working environments. For example, the network where you plan to create Cloud Volumes ONTAP systems or a storage system in your on-premises environment.
- Outbound internet access
-
The network location where you deploy the Connector must have an outbound internet connection to contact specific endpoints.
- Endpoints contacted during manual installation
-
When you manually install the Connector on your own Linux host, the installer for the Connector requires access to the following URLs during the installation process:
-
https://support.netapp.com
-
https://mysupport.netapp.com
-
https://cloudmanager.cloud.netapp.com/tenancy
-
https://stream.cloudmanager.cloud.netapp.com
-
https://production-artifacts.cloudmanager.cloud.netapp.com
-
https://*.blob.core.windows.net
-
https://cloudmanagerinfraprod.azurecr.io
The host might try to update operating system packages during installation. The host can contact different mirroring sites for these OS packages.
-
- Endpoints contacted from the Connector
-
The Connector requires outbound internet access to contact the following endpoints in order to manage resources and processes within your public cloud environment for day-to-day operations.
Note that the endpoints listed below are all CNAME entries.
Endpoints Purpose https://management.azure.com
https://login.microsoftonline.com
https://blob.core.windows.net
https://core.windows.netTo manage resources in Azure public regions.
https://management.chinacloudapi.cn
https://login.chinacloudapi.cn
https://blob.core.chinacloudapi.cn
https://core.chinacloudapi.cnTo manage resources in Azure China regions.
https://support.netapp.com
https://mysupport.netapp.comTo obtain licensing information and to send AutoSupport messages to NetApp support.
https://*.api.bluexp.netapp.com
https://api.bluexp.netapp.com
https://*.cloudmanager.cloud.netapp.com
https://cloudmanager.cloud.netapp.com
https://netapp-cloud-account.auth0.com
To provide SaaS features and services within BlueXP.
Note that the Connector is currently contacting "cloudmanager.cloud.netapp.com" but it will start contacting "api.bluexp.netapp.com" in an upcoming release.
https://*.blob.core.windows.net
https://cloudmanagerinfraprod.azurecr.io
To upgrade the Connector and its Docker components.
- Proxy server
-
If your organization requires deployment of a proxy server for all outgoing internet traffic, obtain the following information about your HTTP or HTTPS proxy. You'll need to provide this information during installation. Note that BlueXP does not support transparent proxy servers.
-
IP address
-
Credentials
-
HTTPS certificate
-
- Ports
-
There's no incoming traffic to the Connector, unless you initiate it or if the Connector is used as a proxy to send AutoSupport messages from Cloud Volumes ONTAP to NetApp Support.
-
HTTP (80) and HTTPS (443) provide access to the local UI, which you'll use in rare circumstances.
-
SSH (22) is only needed if you need to connect to the host for troubleshooting.
-
Inbound connections over port 3128 are required if you deploy Cloud Volumes ONTAP systems in a subnet where an outbound internet connection isn't available.
If Cloud Volumes ONTAP systems don't have an outbound internet connection to send AutoSupport messages, BlueXP automatically configures those systems to use a proxy server that's included with the Connector. The only requirement is to ensure that the Connector's security group allows inbound connections over port 3128. You'll need to open this port after you deploy the Connector.
-
- Enable NTP
-
If you're planning to use BlueXP classification to scan your corporate data sources, you should enable a Network Time Protocol (NTP) service on both the BlueXP Connector system and the BlueXP classification system so that the time is synchronized between the systems. Learn more about BlueXP classification
Step 4: Set up permissions
You need to provide Azure permissions to BlueXP by using one of the following options:
-
Option 1: Assign a custom role to the Azure VM using a system-assigned managed identity.
-
Option 2: Provide BlueXP with the credentials for an Azure service principal that has the required permissions.
Follow the steps to prepare permissions for BlueXP.
Note that you can create an Azure custom role using the Azure portal, Azure PowerShell, Azure CLI, or REST API. The following steps show how to create the role using the Azure CLI. If you would prefer to use a different method, refer to Azure documentation
-
If you're planning to manually install the software on your own host, enable a system-assigned managed identity on the VM so that you can provide the required Azure permissions through a custom role.
-
Copy the contents of the custom role permissions for the Connector and save them in a JSON file.
-
Modify the JSON file by adding Azure subscription IDs to the assignable scope.
You should add the ID for each Azure subscription that you want to use with BlueXP.
Example
"AssignableScopes": [ "/subscriptions/d333af45-0d07-4154-943d-c25fbzzzzzzz", "/subscriptions/54b91999-b3e6-4599-908e-416e0zzzzzzz", "/subscriptions/398e471c-3b42-4ae7-9b59-ce5bbzzzzzzz"
-
Use the JSON file to create a custom role in Azure.
The following steps describe how to create the role by using Bash in Azure Cloud Shell.
-
Start Azure Cloud Shell and choose the Bash environment.
-
Upload the JSON file.
-
Use the Azure CLI to create the custom role:
az role definition create --role-definition Connector_Policy.json
-
You should now have a custom role called BlueXP Operator that you can assign to the Connector virtual machine.
Create and set up a service principal in Microsoft Entra ID and obtain the Azure credentials that BlueXP needs.
-
Ensure that you have permissions in Azure to create an Active Directory application and to assign the application to a role.
For details, refer to Microsoft Azure Documentation: Required permissions
-
From the Azure portal, open the Microsoft Entra ID service.
-
In the menu, select App registrations.
-
Select New registration.
-
Specify details about the application:
-
Name: Enter a name for the application.
-
Account type: Select an account type (any will work with BlueXP).
-
Redirect URI: You can leave this field blank.
-
-
Select Register.
You've created the AD application and service principal.
-
Create a custom role:
Note that you can create an Azure custom role using the Azure portal, Azure PowerShell, Azure CLI, or REST API. The following steps show how to create the role using the Azure CLI. If you would prefer to use a different method, refer to Azure documentation
-
Copy the contents of the custom role permissions for the Connector and save them in a JSON file.
-
Modify the JSON file by adding Azure subscription IDs to the assignable scope.
You should add the ID for each Azure subscription from which users will create Cloud Volumes ONTAP systems.
Example
"AssignableScopes": [ "/subscriptions/d333af45-0d07-4154-943d-c25fbzzzzzzz", "/subscriptions/54b91999-b3e6-4599-908e-416e0zzzzzzz", "/subscriptions/398e471c-3b42-4ae7-9b59-ce5bbzzzzzzz"
-
Use the JSON file to create a custom role in Azure.
The following steps describe how to create the role by using Bash in Azure Cloud Shell.
-
Start Azure Cloud Shell and choose the Bash environment.
-
Upload the JSON file.
-
Use the Azure CLI to create the custom role:
az role definition create --role-definition Connector_Policy.json
You should now have a custom role called BlueXP Operator that you can assign to the Connector virtual machine.
-
-
-
Assign the application to the role:
-
From the Azure portal, open the Subscriptions service.
-
Select the subscription.
-
Select Access control (IAM) > Add > Add role assignment.
-
In the Role tab, select the BlueXP Operator role and select Next.
-
In the Members tab, complete the following steps:
-
Keep User, group, or service principal selected.
-
Select Select members.
-
Search for the name of the application.
Here's an example:
-
Select the application and select Select.
-
Select Next.
-
-
Select Review + assign.
The service principal now has the required Azure permissions to deploy the Connector.
If you want to deploy Cloud Volumes ONTAP from multiple Azure subscriptions, then you must bind the service principal to each of those subscriptions. BlueXP enables you to select the subscription that you want to use when deploying Cloud Volumes ONTAP.
-
-
In the Microsoft Entra ID service, select App registrations and select the application.
-
Select API permissions > Add a permission.
-
Under Microsoft APIs, select Azure Service Management.
-
Select Access Azure Service Management as organization users and then select Add permissions.
-
In the Microsoft Entra ID service, select App registrations and select the application.
-
Copy the Application (client) ID and the Directory (tenant) ID.
When you add the Azure account to BlueXP, you need to provide the application (client) ID and the directory (tenant) ID for the application. BlueXP uses the IDs to programmatically sign in.
-
Open the Microsoft Entra ID service.
-
Select App registrations and select your application.
-
Select Certificates & secrets > New client secret.
-
Provide a description of the secret and a duration.
-
Select Add.
-
Copy the value of the client secret.
You now have a client secret that BlueXP can use it to authenticate with Microsoft Entra ID.
Your service principal is now setup and you should have copied the application (client) ID, the directory (tenant) ID, and the value of the client secret. You need to enter this information in BlueXP when you add an Azure account.
Step 5: Install the Connector
After the pre-requisites are complete, you can manually install the software on your own Linux host.
You should have the following:
-
Root privileges to install the Connector.
-
Details about a proxy server, if a proxy is required for internet access from the Connector.
You have the option to configure a proxy server after installation but doing so requires restarting the Connector.
Note that BlueXP does not support transparent proxy servers.
-
A CA-signed certificate, if the proxy server uses HTTPS or if the proxy is an intercepting proxy.
-
A managed identity enabled on the VM in Azure so that you can provide the required Azure permissions through a custom role.
The installer that is available on the NetApp Support Site might be an earlier version. After installation, the Connector automatically updates itself if a new version is available.
-
If the http_proxy or https_proxy system variables are set on the host, remove them:
unset http_proxy unset https_proxy
If you don't remove these system variables, the installation will fail.
-
Download the Connector software from the NetApp Support Site, and then copy it to the Linux host.
You should download the "online" Connector installer that's meant for use in your network or in the cloud. A separate "offline" installer is available for the Connector, but it's only supported with private mode deployments.
-
Assign permissions to run the script.
chmod +x BlueXP-Connector-Cloud-<version>
Where <version> is the version of the Connector that you downloaded.
-
Run the installation script.
./BlueXP-Connector-Cloud-<version> --proxy <HTTP or HTTPS proxy server> --cacert <path and file name of a CA-signed certificate>
The --proxy and --cacert parameters are optional. If you have a proxy server, you will need to enter the parameters as shown. The installer doesn't prompt you to provide information about a proxy.
Here's an example of the command using both optional parameters:
./BlueXP-Connector-Cloud-v3.9.40--proxy https://user:password@10.0.0.30:8080/ --cacert /tmp/cacert/certificate.cer
--proxy configures the Connector to use an HTTP or HTTPS proxy server using one of the following formats:
-
http://address:port
-
http://user-name:password@address:port
-
http://domain-name%92user-name:password@address:port
-
https://address:port
-
https://user-name:password@address:port
-
https://domain-name%92user-name:password@address:port
Note the following:
-
The user can be a local user or domain user.
-
For a domain user, you must use the ASCII code for a \ as shown above.
-
BlueXP doesn't support user names or passwords that include the @ character.
-
If the password includes any of the following special characters, you must escape that special character by prepending it with a backslash: & or !
For example:
http://bxpproxyuser:netapp1\!@address:3128
-
--cacert specifies a CA-signed certificate to use for HTTPS access between the Connector and the proxy server. This parameter is required only if you specify an HTTPS proxy server or if the proxy is an intercepting proxy.
-
-
Wait for the installation to complete.
At the end of the installation, the Connector service (occm) restarts twice if you specified a proxy server.
-
Open a web browser from a host that has a connection to the Connector virtual machine and enter the following URL:
https://ipaddress
-
After you log in, set up the Connector:
-
Specify the BlueXP account to associate with the Connector.
-
Enter a name for the system.
-
Under Are you running in a secured environment? keep restricted mode disabled.
You should keep restricted mode disabled because these steps describe how to use BlueXP in standard mode. You should enable restricted mode only if you have a secure environment and want to disconnect this account from BlueXP backend services. If that's the case, follow steps to get started with BlueXP in restricted mode.
-
Select Let's start.
-
The Connector is now installed and is set up with your BlueXP account.
If you have Azure Blob storage in the same Azure subscription where you created the Connector, you'll see an Azure Blob storage working environment appear on the BlueXP canvas automatically. Learn how to manage Azure Blob storage from BlueXP
Step 6: Provide permissions to BlueXP
Now that you've installed the Connector, you need to provide BlueXP with the Azure permissions that you previously set up. Providing the permissions enables BlueXP to manage your data and storage infrastructure in Azure.
Go to the Azure portal and assign the Azure custom role to the Connector virtual machine for one or more subscriptions.
-
From the Azure Portal, open the Subscriptions service and select your subscription.
It's important to assign the role from the Subscriptions service because this specifies the scope of the role assignment at the subscription level. The scope defines the set of resources that the access applies to. If you specify a scope at a different level (for example, at the virtual machine level), your ability to complete actions from within BlueXP will be affected.
-
Select Access control (IAM) > Add > Add role assignment.
-
In the Role tab, select the BlueXP Operator role and select Next.
BlueXP Operator is the default name provided in the BlueXP policy. If you chose a different name for the role, then select that name instead. -
In the Members tab, complete the following steps:
-
Assign access to a Managed identity.
-
Select Select members, select the subscription in which the Connector virtual machine was created, under Managed identity, choose Virtual machine, and then select the Connector virtual machine.
-
Select Select.
-
Select Next.
-
Select Review + assign.
-
If you want to manage resources in additional Azure subscriptions, switch to that subscription and then repeat these steps.
-
BlueXP now has the permissions that it needs to perform actions in Azure on your behalf.
Go to the BlueXP console to start using the Connector with BlueXP.
-
In the upper right of the BlueXP console, select the Settings icon, and select Credentials.
-
Select Add Credentials and follow the steps in the wizard.
-
Credentials Location: Select Microsoft Azure > Connector.
-
Define Credentials: Enter information about the Microsoft Entra service principal that grants the required permissions:
-
Application (client) ID
-
Directory (tenant) ID
-
Client Secret
-
-
Marketplace Subscription: Associate a Marketplace subscription with these credentials by subscribing now or by selecting an existing subscription.
-
Review: Confirm the details about the new credentials and select Add.
-
BlueXP now has the permissions that it needs to perform actions in Azure on your behalf.