Business Scenario:
Connecting Azure DevOps applications in Azure China Cloud requires some additional steps compared to the standard Azure cloud environment. Follow below steps to deploy an Application from Azure DevOps to Azure Non-Global Environment which is Azure China cloud (21vianet).
- Deploy Azure Kubernetes Service application from Azure DevOps, which is in a different region to non-Global Azure China Subscription.
- As China Azure Cloud is physically separated from other Clouds, we need to establish communication of Azure DevOps with Azure China Cloud.
- To Establish a connection, configure a Role Based access in Azure DevOps.
Business Challenges:
- You can’t install or deploy any applications from the outside world to Azure China Cloud, as it is Azure Non-Global Environment.
- Azure DevOps is not authorized to access your Azure resources within non-global Azure subscriptions.
- SSO (single Sign on) will not authenticate from other regions to establish a connection between Azure Resources and Azure DevOps.
Solution Strategy:
- In Azure DevOps, select the Azure China Cloud.
- Create a New Service connection.
- Select a created Service Account from the Authentication method. This will provide a token that will never expire.
- Once the authentication method is established, you can select the Subscription to which access needs to be provided.
- Provide an Azure resource API server URL and Secret Value of the Service Account.
- Create a role and Role bindings that grant permissions to the desired service account.
By configuring the above steps, you can see the "Success Or Error" in the Service connection to validate the Access of Azure resources from Azure DevOps.
Outcome & Benefits:
- This process will help us establish a connection between the Azure Non-Global Cloud and Azure DevOps.
- Quickly deploy applications from Azure DevOps to Azure China Cloud irrespective of region.
- You can access Azure DevOps and Azure Subscriptions of China Cloud with SSO.
Gururaj MA
Sr. Consultant – Managed Services