Creating Azure discovery configurations - BlueCat Edge - Service Point v4.x.x

Prerequisites

Government Cloud API access requirements

Configuring Service Principal permissions

Creating the Azure discovery configuration

To configure the Azure discovery configuration

1. In the top navigation bar, click and select Discovery service > Configurations.
2. To add a new discovery configuration, click New > Azure.
3. Enter the name of the discovery configuration.
4. Under Polling interval, enter the interval at which the source of the DNS data is polled. The minimum value is 60 seconds.
5. Under Discovery timeout, enter the maximum length of time that the Discovery Instance attempts to discover DNS data for the configuration before it times out, in seconds. The default value is 1800 seconds (30 minutes).
6. Under On discovery failure, select one of the following options to determine how the global discovery configuration handles failures to retrieve data:
   • Keep last data (safe)—the discovery configuration uses the last successfully retrieved set of DNS data.
   • Overwrite last data—the discovery configuration overwrites the DNS data from the last successful retrieval.
7. Under Cloud type, select the type of Azure cloud environment that you would like to discover resources in. The cloud type can be one of the following:
   • Public—for Azure public, commercial cloud. This is the default value.
   • US Government—for Azure US Government Cloud.
   • China—for Azure China Cloud.
8. Select Generate reverse zones to automatically generate reverse zones for cloud discovered network space.
9. If the service point used for Edge Resolver service is deployed in Azure, select Use VM assigned role for authentication to use the Azure configurations and access rights assigned to the service point VM for authentication for discovery.
   Attention: The Use VM assigned role for authentication option can only be configured with Discovery Instance v25.3.0. If you select this option and the discovery instance using this discovery configuration is running version 1.2.0 or earlier, the discovery instance fails to use the discovery configuration.
   Note: If you select Use VM assigned role for authentication, the discovery configuration uses the account information assigned to the VM role to discover DNS data and for Azure Key Vault credentials, if you select Azure Key Vault as the authentication method. You do not need to enter an Azure account configuration unless you would like to add additional Azure account configure or configure different Azure Key Vault key names.
10. Under External vault, select one of the following options for authentication:
    • HashiCorp Vault—uses HashiCorp Vault (HCV) for authentication. When selected, the following additional options appear:
      • Host—the base URL of HashiCorp Vault server where the secrets are stored.
      • Port—the port used to retrieve credentials stored in the HashiCorp Vault server.
      • Namespace (required if using HashiCorp Vault namespaces)— If you are using a namespace, the value is the namespace where the user's secrets are stored in the vault. For more information, refer to https://developer.hashicorp.com/vault/docs/enterprise/namespaces.
      • Role ID—select the ID of the role that you would like to use to authenticate against HashiCorp Vault. For more information, refer to https://developer.hashicorp.com/vault/api-docs/auth/approle#read-approle-role-id.
      • Secret ID—select the secret ID generated from the role ID that is used to authenticate against HashiCorp Vault. For more information, refer to https://developer.hashicorp.com/vault/api-docs/auth/approle#generate-new-secret-id.
      • Version—enter the HashiCorp Vault secret version.
      • Secret Path—the path where you have stored the secrets within the HashiCorp Vault server. You can enter the path to locations where BlueCat Edge credentials and discovery secrets are stored.

        The discovery configuration uses the HashiCorp Vault API to look up secrets. You must prefix paths with /v1/. For example, if secrets are stored within the secret/data/edgeresolver path, the Secret Path value would be /v1/secret/data/edgeresolver.

    • Edge secrets manager—uses credentials stored in Edge secrets manager for authentication.
    • Azure Key Vault—uses credentials stored in Azure Key Vault for authentication.
      Attention: This option only appears when you select Use VM assigned role for authentication.
11. Under Accounts, specify one or more Azure configurations to discover DNS data from:
    Note: If you select Use VM assigned role for authentication, the discovery configuration uses the account information assigned to the VM role to discover DNS data and for Azure Key Vault credentials, if you select Azure Key Vault as the authentication method. You do not need to enter an Azure account configuration unless you would like to add additional Azure account configurations or configure Azure Key Vault.
    • Tenant ID—enter Azure tenant ID.
    • Client ID—select the Azure Client ID stored in secrets manager that will be used to discover the DNS data.
      Note:

      • If you are using credentials from HashiCorp Vault, enter the key name for the Client ID stored in HashiCorp Vault.
      • If you are using credentials from Azure Key Vault, enter the Secret Identifier URI of the of the Client ID stored in Azure Key Vault. For example, https://<vault_name>.vault.azure.net/secrets/<secret_name>
    • Client Secret—select the Azure Client secret stored in secrets manager that will be used to discover the DNS data.
      Note:

      • If you are using credentials from HashiCorp Vault, enter the key name for the Client Secret stored in HashiCorp Vault.
      • If you are using credentials from Azure Key Vault, enter the Secret Identifier URI of the Client Secret stored in Azure Key Vault. For example, https://<vault_name>.vault.azure.net/secrets/<secret_name>
    • On discovery failure—select one of the following options to determine how the discovery configuration handles failures to retrieve data from this Azure configuration:
      • Keep last data (safe)—the discovery configuration uses the last successfully retrieved set of DNS data.
      • Overwrite last data—the discovery configuration overwrites the DNS data from the last successful retrieval.
      • Use configuration default—the discovery configuration uses the default option defined under the Setup section.
      Note: The discovery failure options configured per Azure configuration override the discovery option failures configured at the global level. This field is optional.
    • Under Cloud type, select the type of Azure cloud environment that you would like to discover resources in. The cloud type can be one of the following:
      • Public—for Azure public, commercial cloud. This is the default value.
      • US Government—for Azure US Government Cloud.
      • China—for Azure China Cloud.
      • Use configuration default—uses the default Azure cloud type defined under the Setup section.
    • Click to add the Azure configurations.
12. Click Save.