Uploading Oracle Installation Files to Azure Storage Container

During deployment, Oracle installation files are retrieved from an Azure Storage Blob Container. A full list of required files can be found on the Oracle Files tab of the FlashGrid Launcher, and those files must be uploaded to a container that is accessible by the deployed virtual machines.

You may use an existing Storage Account or create a new one.  A dedicated storage container for the Oracle installation files is recommended.

To configure access, you must choose both a Network Access method and an Authorization method:

1. Choose type of network-level access to the storage account:
   • Public Endpoint (simpler, allows access over public internet while keeping traffic within the Azure global network)
   • Private Endpoint (may be required in secure environments, keeps traffic within your virtual private networks)
2. Choose type of authorization for access to the file blobs:
   • Anonymous Public Access - Easiest to set up, but may be disallowed in some environments
   • Shared Access Signature (SAS) - Provides delegated access via a signed URL
   • User-assigned Managed Identity - The most secure method; uses Azure RBAC to grant permissions without managing keys.

Note: FlashGrid Launcher can verify that the container has all the required files, but only if using Public Network and Anonymous Public Access. In all other cases, you should un-check the Verify accessibility of the files checkbox in Launcher.

Network Access with Public Endpoint

1. Open the storage account and navigate to Security + networking > Networking select Public access. Set "Public network access" to Enabled from all networks.
2. The DNS name of the storage account (i.e. <storageaccount>.blob.core.windows.net) will be available through public DNS.

Network Access with Private Endpoint

The VNet and other networking configuration must exist prior to deploying a FlashGrid Cluster - enter those details in the FlashGrid Launcher when prompted.

1. Open the storage account and navigate to Security + networking > Networking select Public access. Set "Public network access" to Disabled.
2. In Security + networking > Networking > Private endpoint connections. Click + Private endpoint. Select blob as the target sub-resource and link it to your VNet.
3. Services on the linked VNet will be able to resolve the DNS name of the storage account (i.e. <storageaccount>.blob.core.windows.net) using Azure Private DNS - the DNS name will not be resolvable through the public internet.

Authorization - Anonymous Public Access

Use this option to provide a direct download URL that requires no authentication or tokens. Files can only be downloaded by knowing the exact path of each file.

1. Open the storage account and navigate to Settings > Configuration. Set "Allow Blob anonymous access" to Enabled and click Save.
2. Navigate to Data storage > Containers, select your container (or click +Add container to create one if none exist), and click Change access level. Select Blob (anonymous read access for blobs only).

Authorization - Shared Access Signature (SAS)

SAS provides limited access to resources in a storage account via a signed URL. The signed URL specifies the permissions granted to the resource and the interval over which the signature is valid.

1. Open the storage account and navigate to Settings > Configuration. Set "Allow Blob anonymous access" to Disabled and click Save.  Alternatively, if you only wish to remove Anonymous access for the specific storage container, leave this as Enabled and restrict access at the container level.
2. In Data storage > Containers, select your container (or click +Add container to create one if none exist), and click Change access level. Select Private (no anonymous access).
3. To generate the SAS token
   • Open the Storage Account and select Security + networking > Shared access signature

   • Make sure that there is Read access for Blobs. Set the start and expiry date/times as needed

     

   • Click the Generate SAS and connection string button and copy the generated SAS token

     

4. Add oracle_files_storage_sas parameter under [azure] section of the FlashGrid config file using the value of the SAS token:

   [azure]
   oracle_files_storage_sas = 'sv=2020-08-04&ss=b&srt=o&sp=rx&se=2022-04-15T20:12:07Z&st=2022-04-15T12:12:07Z&spr=https&sig=avO9blmyKQ5h3ZBtlvtXkPwYaYISbe1mf59M7yN9FCA%3D'

    

Authorization - User-assigned Managed Identity

The managed identity can be given access to a storage account, and then this managed identity can be assigned to the VMs during the deployment. As a result, the initialization process will be able to download Oracle files and complete successfully.

Begin by selecting an existing (suitable) user-assigned managed identity in the same region as the storage account, or, create a new one (Microsoft Learn documentation).

1. Locate the storage account and navigate to Settings > Configuration. Set "Allow Blob anonymous access" to Disabled and click Save. Alternatively, if you only wish to remove Anonymous access for the specific storage container, leave this as Enabled and restrict access at the container level.
2. In Data storage > Containers, select your container (or click +Add container to create one if none exist), and click Change access level. Select Private (no anonymous access).
3. Grant access to a storage account, using Azure Portal (or see next step to use CLI):
   • Open the Storage Account and select Access Control (IAM)
   • Select Role assignments
   • Click Add > Add role assignment
   • Select Storage Blob Data Reader, click Next
   • In the Assign access to section, select Managed identity
   • Click Select Members and select the previously created user-assigned managed identity
   • Click Review + assign
4. Alternatively, grant access to a storage account using Azure CLI:

   • Obtain the managed identity's object ID:

     az ad sp list --display-name <managed_identity_name> --query [*].objectId

   • Grant the Storage Blob Data Reader role:

     az role assignment create \
         --role "Storage Blob Data Reader" \
         --assignee-object-id "<managed_identity_object_id>" \
         --assignee-principal-type "ServicePrincipal" \
         --scope "/subscriptions/<subscription_id>/resourceGroups/<storage_account_resource_group>/providers/Microsoft.Storage/storageAccounts/<storage_account_name>"

5. Add Managed Identity ID to the config file:

   • Copy ID from the managed identity properties page:

     

   • Add user_assigned_identity under [azure] section of the FlashGrid config file using the copied ID:

     [azure]
     user_assigned_identity = '/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/3023-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/blobstorage'