Search <book_title>...

Veritas NetBackup™ CloudPoint 安装和升级指南

Last Published: 2021-07-28

Product(s): NetBackup (9.1)

在 Microsoft Azure Stack Hub 上配置权限

CloudPoint 必须有权访问 Microsoft Azure Stack 资产，然后才能保护这些资产。您必须关联 CloudPoint 用户可用于处理 Azure Stack 资产的自定义角色。

以下是自定义角色定义（JSON 格式），它使 CloudPoint 能够执行以下操作：

配置 Azure Stack Hub 插件和发现资产。
创建主机和磁盘快照。
将快照还原到原始位置或新位置。
删除快照。

{ "Name": "CloudPoint Admin",
"IsCustom": true,
"Description": "Necessary permissions for
 Azure Stack Hub plug-in operations in CloudPoint",
"Actions": [
"Microsoft.Storage/*/read",
"Microsoft.Storage/storageAccounts/listKeys/action",
"Microsoft.Storage/storageAccounts/ListAccountSas/action",
"Microsoft.Compute/*/read",
"Microsoft.Compute/disks/write",
"Microsoft.Compute/disks/delete",
"Microsoft.Compute/images/write",
"Microsoft.Compute/images/delete",
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/beginGetAccess/action",
"Microsoft.Compute/snapshots/endGetAccess/action",
"Microsoft.Compute/virtualMachines/capture/action",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Compute/virtualMachines/generalize/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Compute/virtualMachines/runCommand/action",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/vmSizes/read",
"Microsoft.Compute/virtualMachines/powerOff/action",
"Microsoft.Authorization/locks/*",
"Microsoft.Network/*/read",
"Microsoft.Network/networkInterfaces/delete",
"Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
"Microsoft.Network/networkInterfaces/join/action",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Network/networkSecurityGroups/join/action",
"Microsoft.Network/networkSecurityGroups/securityRules/write",
"Microsoft.Network/networkSecurityGroups/write",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/publicIPAddresses/join/action",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/routeTables/join/action",
"Microsoft.Network/virtualNetworks/delete",
"Microsoft.Network/virtualNetworks/subnets/delete",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Resources/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/ \
validateMoveResources/action",
"Microsoft.Resources/subscriptions/tagNames/tagValues/write",
"Microsoft.Resources/subscriptions/tagNames/write",
"Microsoft.Subscription/*/read",
"Microsoft.Authorization/*/read" ],
"NotActions": [ ],
"AssignableScopes": [ 
"/subscriptions/subscription_GUID", 
"/subscriptions/subscription_GUID/ \
resourceGroups/myCloudPointGroup" ] }

要使用 Powershell 创建自定义角色，请执行以下 Azure Stack 文档中的步骤：

https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-registration-role?view=azs-2008

例如：

New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json"

要使用 Azure CLI 创建自定义角色，请执行以下 Azure 文档中的步骤：

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-cli

例如：

az role definition create --role-definition "~/CustomRoles/
registrationrole.json"

注意:

在创建角色之前，必须先将角色定义（JSON 格式的文本）复制到 .json 文件，然后将该文件用作输入文件。在前面显示的示例命令中，registrationrole.json 将用作包含角色定义文本的输入文件。

要使用此角色，请执行以下操作：

将此角色分配给在 Azure Stack 环境中运行的应用程序。
在 CloudPoint 中，使用应用程序的凭据配置 Azure Stack 脱离主机插件。

更多信息

Microsoft Azure Stack Hub 插件配置说明