Azure Onboarding

Onboarding an Azure subscription to Klarity ImageFactory enables the automated creation and distribution of virtual machine images within your Azure environment. This process involves setting up a Service Principal and several infrastructure components to host the image building process.

Prerequisites

Before starting the onboarding, ensure you have the following resources available in your Azure subscription:

1. Resource Group: A dedicated resource group to hold the ImageFactory components.
2. Storage Account: Used for storing temporary VHDs during the build process.
3. Azure Compute Gallery: Formerly known as Shared Image Gallery, used to store and version your images.
4. Service Principal: An Azure AD application with credentials to manage these resources.

Required Credentials

You will need to provide the following information to ImageFactory:

• appId: The Application (Client) ID of your Service Principal.
• password: The Client Secret generated for your Service Principal.
• tenantId: Your Azure Active Directory Tenant ID.
• storageAccount: The name of your storage account.
• storageAccountKey: One of the access keys for the storage account.
• sharedImageGallery: The name of your Azure Compute Gallery.
• resourceGroupName: The name of the resource group containing these resources.

Required Azure Permissions

The Service Principal must have specific roles assigned to function correctly:

Resource	Role	Purpose
Resource Group	Contributor	Create and manage build VMs and network resources.
Storage Account	Storage Blob Data Contributor	Upload and manage VHD files.

Step-by-Step Guide

Using the Onboarding Script (Recommended)

The ImageFactory UI provides a ready-made shell script that automates the entire Azure setup. This is the fastest and most reliable way to onboard.

1. Navigate to Cloud Credentials in the sidebar and click Add Credentials.
2. Select Azure as the provider.
3. Enter your Subscription ID.
4. In step 2, you'll see the onboarding script displayed with a copy button. Run this script in Azure Cloud Shell (Bash). The script automatically:
   • Creates a Service Principal with the required permissions
   • Sets up a Resource Group
   • Creates a Storage Account
   • Creates an Azure Compute Gallery
   • Outputs all the credential values you need
5. Copy the output values into the corresponding fields in the ImageFactory form.

tip

The Azure Cloud Shell script handles all resource creation and permission assignment automatically. You don't need to manually create any of the prerequisites listed below — the script does it for you.

Manual Setup

If you prefer to set up resources manually, follow these steps:

1. Create a Resource Group

Create a new resource group in your preferred region. This group will contain the build infrastructure and the image gallery.

2. Create a Storage Account

Create a standard general-purpose v2 storage account. Ensure it is in the same region as your resource group.

3. Create an Azure Compute Gallery

Search for "Azure Compute Gallery" in the portal and create a new one. This will be the central repository for your golden images.

4. Register an Application

Go to Azure Active Directory > App registrations and create a new registration. Note the appId and tenantId. Create a new client secret and save the password immediately.

5. Assign Permissions

Navigate to your resource group, select "Access control (IAM)", and add a role assignment. Assign the Contributor role to your Service Principal. Repeat this for the storage account, assigning the Storage Blob Data Contributor role.

6. Add Account in ImageFactory

Use the ImageFactory console or API to submit your credentials. If you used the onboarding script, simply paste the output values into the form.

Advanced Configuration

Trusted Launch Support

ImageFactory supports Trusted Launch for Generation 2 virtual machines. This provides security features like Secure Boot and vTPM. Ensure your distribution and gallery image definitions are configured for Gen2 to use this feature.

China Region Scope

For deployments in Azure China, use the following regions:

• chinaeast
• chinaeast2
• chinanorth
• chinanorth2
• chinanorth3

Replica Regions

You can configure the Azure Compute Gallery to automatically replicate images to multiple regions. This ensures low-latency deployments across your global infrastructure.

Managed Image Creation

By default, ImageFactory uses the Azure Compute Gallery. However, you can enable the managed image creation option if your workflow requires standalone managed images instead of gallery versions.

Adding Your Azure Subscription

To onboard your Azure subscription, navigate to Cloud Credentials in the sidebar and click Add Credentials. Select Azure as the provider and use the provided onboarding script in Azure Cloud Shell for the quickest setup.

For a detailed walkthrough of the onboarding interface, see the Cloud Credentials guide.

Via API

You can also onboard your Azure subscription programmatically using the GraphQL API:

mutation CreateAzureAccount {
  createAccount(input: {
    name: "Production-Azure"
    provider: AZURE
    azureConfig: {
      appId: "your-app-id"
      password: "your-client-secret"
      tenantId: "your-tenant-id"
      storageAccount: "ifstorageaccount"
      storageAccountKey: "your-storage-key"
      sharedImageGallery: "IFComputeGallery"
      resourceGroupName: "IF-Resource-Group"
    }
  }) {
    id
    status
  }
}

Verifying the Setup

Once the account is added, ImageFactory will attempt to validate the credentials. Check the account status in the dashboard. A status of ACCESS_SUCCESS indicates that the platform can successfully interact with your Azure subscription.