Search <book_title>...

Veritas NetBackup™ CloudPoint 安装和升级指南

Last Published: 2021-07-28

Product(s): NetBackup & Alta Data Protection (9.1)

在 Microsoft Azure 上配置权限

CloudPoint 必须有权访问 Microsoft Azure 资产，然后才能保护这些资产。您必须关联 CloudPoint 用户可用于处理 Azure 资产的自定义角色。

以下是自定义角色定义（JSON 格式），它使 CloudPoint 能够执行以下操作：

配置 Azure 插件和发现资产。
创建主机和磁盘快照。
将快照还原到原始位置或新位置。
删除快照。

{ "Name": "CloudPoint Admin",
"IsCustom": true,
"Description": "Necessary permissions for
Azure plug-in operations in CloudPoint",
"Actions": [
"Microsoft.Storage/*/read",
"Microsoft.Compute/*/read",
"Microsoft.Compute/disks/write",
"Microsoft.Compute/disks/delete",
"Microsoft.Compute/disks/beginGetAccess/action",
"Microsoft.Compute/disks/endGetAccess/action",
"Microsoft.Compute/images/write",
"Microsoft.Compute/images/delete",
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/beginGetAccess/action",
"Microsoft.Compute/snapshots/endGetAccess/action",
"Microsoft.Compute/virtualMachines/capture/action",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Compute/virtualMachines/generalize/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Compute/virtualMachines/runCommand/action",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/vmSizes/read",
"Microsoft.Compute/virtualMachines/powerOff/action",
"Microsoft.Network/*/read",
"Microsoft.Network/networkInterfaces/delete",
"Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
"Microsoft.Network/networkInterfaces/join/action",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Network/networkSecurityGroups/join/action",
"Microsoft.Network/networkSecurityGroups/securityRules/write",
"Microsoft.Network/networkSecurityGroups/write",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/publicIPAddresses/join/action",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/routeTables/join/action",
"Microsoft.Network/virtualNetworks/delete",
"Microsoft.Network/virtualNetworks/subnets/delete",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Resources/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/ \
validateMoveResources/action",
"Microsoft.Resources/subscriptions/tagNames/tagValues/write",
"Microsoft.Resources/subscriptions/tagNames/write",
"Microsoft.Subscription/*/read",
"Microsoft.Authorization/locks/*",
"Microsoft.Authorization/*/read" ],
"NotActions": [ ],
"AssignableScopes": [ 
"/subscriptions/subscription_GUID", 
"/subscriptions/subscription_GUID/ \
resourceGroups/myCloudPointGroup" ] }

如果 Cloudpoint 扩展安装在 Azure 中的托管 Kubernetes 群集上，则还可以在配置插件之前添加以下权限：

"Microsoft.ContainerService/managedClusters/agentPools/read",
"Microsoft.ContainerService/managedClusters/read",
"Microsoft.Compute/virtualMachineScaleSets/write",
"Microsoft.Compute/virtualMachineScaleSet

要使用 powershell 创建自定义角色，请执行以下 Azure 文档中的步骤：

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

例如：

New-AzureRmRoleDefinition -InputFile "C:\CustomRoles\ReaderSupportRole.json"

要使用 Azure CLI 创建自定义角色，请执行以下 Azure 文档中的步骤：

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-cli

例如：

az role definition create --role-definition "~/CustomRoles/
ReaderSupportRole.json"

注意:

在创建角色之前，必须先将之前提供的角色定义（JSON 格式的文本）复制到 .json 文件，然后将该文件用作输入文件。在前面显示的示例命令中，ReaderSupportRole.json 将用作包含角色定义文本的输入文件。

要使用此角色，请执行以下操作：

将此角色分配给在 Azure 环境中运行的应用程序。
在 CloudPoint 中，使用应用程序的凭据配置 Azure 脱离主机插件。

更多信息

Microsoft Azure 插件配置说明