Hi, I'm CLEO! Something exciting is coming to the Community. Stay Tuned!
Cloudera for Azure supports CMK with Azure Key Vault. This article describes how to set up a network for CDP for Azure to allow a successful Data Service deployment.
There are two options to deploy Azure Key Vault access endpoints, public and private. With public deployment, Azure Key Vault FQDN is resolved into a public IP address. With private deployment, a private endpoint for Azure Key Vault must be created as well as a private DNS zone for Azure Key Vault.
Some Azure users have governance requirements to mandate a private endpoint for Azure Key Vault. CDP environment and DataHub clusters support Azure Key Vault private endpoints. However, Cloudera Data Services for Azure do not support private endpoints.
Best practice
To support both Cloudera Data Services and Data Hubs, please make sure to configure the networking configuration for the Azure Key Vault to be like the picture below. Do not choose the second and the private endpoint option. The reason will be discussed in the following section.
For all the subnets to be used by CDP, make sure to configure a service endpoint for Azure Key Vault, so that the traffic will be routed to the Key Vault through the Azure backbone instead of organization's firewall.
Reason for not being able to use private endpoints or Azure KeyVault Firewall
Cloudera Data Services use Azure K8s as compute infrastructure. AKS is a managed service. It deploys two parts of components in Azure subscriptions.
- The compute resources are in VMSS to be deployed in the customer’s subscription.
- The ETCD is to be deployed in a backend Azure managed subscription.
The ETCD has a public IP address. Users and workloads can access the ETCD through a private endpoint. From the ETCD point of view, it is inbound traffic. However, the egress traffic always goes through the public IP address.
Azure provides 3 alternatives for the ETCD service to access Azure Key Vault.
Option 1:
Legacy, to be deprecated in the future. In this option, ETCD accesses Azure Key Vault through the public internet. Because the ETCD public IP cannot be obtained, users cannot enable Key Vault firewall to prevent access from other sources.
This is what Cloudera is using right now.
Option 2:
Enable KMS data encryption in Azure Kubernetes Service (AKS) clusters (Preview)
There is a service tag associated with the public IP address that is being used by ETCD. Users can enable the Key Vault Firewall to allow the service tag.
However, this feature is still in preview stage and Cloudera cannot invest development effort to support it.
Option 3:
Use API Server VNet Integration in Azure Kubernetes Service (AKS)
Azure launched AKS VNET integration which will be the best solution for this requirement. In this solution, Azure assigns a private IP address to the ETCD service, which allows the ETCD to access the Key Vault through either service endpoint or private endpoint.
However, this feature is not yet available in all the regions.
