Provisioning on Azure

​

Prerequisites

To provision through Porter, you must enable certain Azure resource providers for your subscription.

1. In the Azure portal, search for Subscriptions, select the subscription you would like to use to provision, and click the Resource providers tab in the subscription console.

2. Enable the following providers by selecting the providers and clicking Register:

• Microsoft.Capacity
• Microsoft.Compute
• Microsoft.ContainerRegistry
• Microsoft.ContainerService
• Microsoft.ManagedIdentity
• Microsoft.Network
• Microsoft.OperationalInsights
• Microsoft.OperationsManagement
• Microsoft.ResourceGraph
• Microsoft.Resources
• Microsoft.Storage

It might take a few minutes for providers to complete registration. Once you confirm that all resource providers are enabled, proceed to the next section.

​

Creating the Service Principal

1. Create a new role with the Azure CLI

Most of the permissions required by Porter to manage your infrastructure come with Azure’s built-in Contributor role. However, this role does not allow for role assignments, which are crucial for Porter.

For this reason, we need to create a new role that combines the Contributor scope along with permissions to create role assignments. We will do this through the Azure CLI.

To get started, set the PORTER_AZURE_SUBSCRIPTION_ID environment variable to your subscription id:

PORTER_AZURE_SUBSCRIPTION_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Run the following command to create the role:

envsubst << EOF | az role definition create --role-definition @-
{
    "assignableScopes": ["/subscriptions/${PORTER_AZURE_SUBSCRIPTION_ID}"],
    "description": "Grants Porter access to manage resources for an AKS cluster.",
    "id": "/subscriptions/${PORTER_AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/porter-aks-restricted",
    "isCustom": true,
    "name": "porter-aks-restricted",
    "permissions": [
        {
            "actions": ["*"],
            "dataActions": [],
            "notActions": [
                "Microsoft.Authorization/elevateAccess/Action",
                "Microsoft.Blueprint/blueprintAssignments/write",
                "Microsoft.Blueprint/blueprintAssignments/delete",
                "Microsoft.Compute/galleries/share/action"
            ],
            "notDataActions": []
        }
    ],
    "roleName": "Contributor",
    "roleType": "BuiltInRole",
    "type": "Microsoft.Authorization/roleDefinitions"
}
EOF

2. Create a new service principal through the Azure CLI that uses the role you just created:

az ad sp create-for-rbac \
--name="azure-porter-restricted-sp" \
--role="porter-aks-restricted" \
--scopes="/subscriptions/${PORTER_AZURE_SUBSCRIPTION_ID}"

Running this will display the following output, which you will need when you go to provision your cluster on the Porter dashboard:

{
  "appId": "00000000-0000-0000-0000-000000000000",
  "displayName": "azure-porter-restricted-sp",
  "name": "azure-porter-restricted-sp",
  "password": "0000-0000-0000-0000-000000000000",
  "tenant": "00000000-0000-0000-0000-000000000000"
}

3. Grant API permissions to your service principal

In your Azure portal, search for App registrations. Under the All applications tab, you should see the newly-created service principal. Select the principal and navigate to the API Permissions tab:

Select Add a permission > Microsoft Graph > Application permissions and select the following seven permissions:

• Application.ReadWrite.All
• Directory.ReadWrite.All
• Domain.Read.All
• Group.Create
• Group.ReadWrite.All
• RoleManagement.ReadWrite.Directory
• User.ReadWrite.All

Click Add permissions to save these permissions, and then click Grant admin consent for Default Directory to grant these permissions to your service principal.

​

Compute Quotas

By default, Azure limits the types of resources you can provision in your subscription. To provision a Porter cluster, you will need to request a quota increase for the compute resources you plan to use.

In your Azure portal, navigate to your subscription and select Usage + quotas. Set the resource filter to Compute and region to your desired region.

While the exact virtual machines provisioned by Porter will depend on your selected region’s availability, the following table lists the default virtual machine types that Porter will provision along with recommended initial quota limits:

After selecting each resource family, click Request quota increase and input your desired quota limit. Requests should be approved automatically within a few minutes. If your request is not approved automatically, fill out the support ticket as prompted. Approval is typically granted in a few hours.

​

Provisioning Your Porter Cluster

Once you create your project and select Azure as your cloud provider, you will be prompted to provide the credentials for the service principal you created earlier.

​

Deleting Provisioned Resources

We recommend that you delete all provisioned resources through Porter as well as confirm resources have been deleted from the Azure portal. This will ensure that you do not get charged on Azure for lingering resources.

To delete resources, click on Additional settings from the Infrastructure tab.

Click Delete Cluster to remove the cluster from Porter and delete resources in your Azure console. It may take up to 30 minutes for these resources to be deleted from your Azure subscription.

To confirm that resources have been deleted, navigate to your Azure portal and search for Resource groups. You should expect to see a resource group named <PROJECT_ID>-<AZURE_REGION> containing an Azure container registry with your application build images. By default, Porter will not delete your build images, so you will need to delete this resource group manually.

No other resource groups should be present. If any are, you should delete them manually by clicking on the resource group and selecting Delete resource group.