Agent installation using an ARM template

Private preview

This topic details how to install a Matillion agent in your Azure infrastructure using an ARM template provided by Matillion. You can also, if you wish, download the supplied ARM template and edit as needed.

Note

It is possible to install multiple agents into a single resource group. This may be done if you require segregation of pipeline environments for security considerations, as one agent can't access the secrets created through a different agent.

Multiple agent installations require you to provide a different name for each container app you launch a template into. Otherwise, the process is identical to that described here. For convenience, you might want to download and amend the ARM template so that the agents you install will have consistent properties.

For troubleshooting and frequently asked questions encountered in this process, read Azure agent troubleshooting.

Prerequisites

To get started, you'll need:

A Hub account. To register, read Registration.
Access to Azure, with permissions to provision cloud resources in the Azure environment.
A suitable resource group and virtual network already defined in your Azure environment. Instructions for creating these—if they don't already exist—are included below.
Optionally, a suitable key vault already defined in your environment. This isn't a mandatory requirement, as the installation process will create a new key vault by default.

We recommend that you read the documentation and prerequisites before beginning this process. You may require input from your organization's cloud administrator for access and permissions.

Note

The container app for the agent must be deployed with the Consumption Only Workload Profile. Otherwise, the agent will be unable to update when Matillion issues an updated version.

Create a resource group

You need an Azure resource group that will contain all of the Azure resources for the agent. The agent deployment template requests the name of the resource group to deploy into and will create all resources there.

If you don't have a suitable existing resource group, create a new one as follows:

Log in to the Azure Portal.
Use the search bar to search for "resource groups", and click the Resource groups result.
On the Resource groups screen, click + Create.
On the Create resource group screen, select the Subscription you want to use for the agent from the drop-down.
Enter a new name for the Resource group.
Select an Azure Region for your resource group.
If your organization has a policy that mandates resource group tags, click Tags and assign tags as required.
Click Review + create, and then click Create if you are satisfied with your resource group configuration.

For more information, read Manage Azure resource groups by using the Azure portal in the Microsoft developer documentation.

Create a virtual network

You need a virtual network to secure access between the agent and other resources, reducing the scope of possible access to those resources.

If you don't have a suitable existing virtual network, create a new one as follows:

Log in to the Azure Portal.
Use the search bar to search for "virtual networks", and click the Virtual networks result.
On the Virtual networks screen, click + Create.
On the Create virtual network screen, select the resource group you created previously.
Enter a new Virtual network name.
Select an Azure Region for your virtual network. By default, this should be the same region as your resource group.
Click IP addresses.
Edit the default subnet, or create a new subnet, to be a minimum size of /23 (512 addresses). This size is required for a "Consumption only" environment type, as described in the Environment selection Azure documentation.
If your organization has a policy that mandates virtual network tags, click Tags and assign tags as required.
Click Review + create, and then click Create if you are satisfied with your virtual network configuration.
On the Virtual networks screen, locate the virtual network just created and click it.
Click Service endpoints.
Click + Add and select the required service endpoints from the Service drop-down. These are required if the subnet doesn't have access to the Internet (via Internet gateway or NAT gateway). As a minimum, the following service endpoints will be required:
- Microsoft.KeyVault
- Microsoft.Storage
Select the subnet you previously edited from the Subnets drop-down.
Click Add.

Create a key vault

The agent requires access to an Azure key vault. However, you don't need to create a key vault yourself; the deployment template will automatically create a key vault in the same resource group as the agent.

If you prefer, the agent can reference a different key vault you have previously created. The existing key vault may be in the same or a different resource group. You might want to reference a key vault in a different resource group so that you can have multiple agents referencing the same secrets.

If you are using an existing key vault, you will need to complete the configuration steps described in Configuring a key vault for Azure agent.

Launch the template in Azure

Ensure that the prerequisites of resource group, virtual network, and key vault (if required) have all been created, and that you are logged in to an Azure account with sufficient permissions to deploy the template in a container app.

In the Data Productivity Cloud, follow the steps to create a new agent, with Azure as the cloud provider.
On the Agent details screen, click Reveal credentials in the Credentials section and note the client_id and client secret.
Click the Launch button in the Install using ARM section. This will open the Azure portal at the Custom deployment page in a new browser tab.

Complete the following details on the Custom deployment page.

Property	Description
Subscription	Select the subscription you will deploy the agent into.
Resource group	Select the resource group you created previously.
Region	Select the Azure region you will deploy the agent to.
Create Key Vault	Select true if you want the ARM template to create a new key vault. This is the recommended method. If you prefer to use a key vault you have created yourself, select false.
Resource Prefix	This is set automatically by the template and shouldn't be changed.
Location	This is set automatically by the template and shouldn't be changed.
Matillion Cloud Region	This is set automatically by the template and shouldn't be changed. It should be the same as the MATILLION_REGION parameter shown on the Agent details screen.
Container App Name	This is set automatically by the template and shouldn't be changed.
Default Key Vault	If you are using an existing key vault, enter its name here. If you are allowing the ARM template to create the key vault, don't edit the parameter string displayed in this field.
Default Key Vault Resource Group	If you are using an existing key vault, enter the name of its resource group here. If you are allowing the ARM template to create the key vault, don't edit the parameter string displayed in this field.
Virtual Network Name	Enter than name of the virtual network you created previously.
Subnet Name	Enter than name of the subnet you created perviously.
Account ID	This is set automatically by the template and shouldn't be changed. It should be the same as the ACCOUNT_ID parameter shown on the Agent details screen.
Agent ID	This is set automatically by the template and shouldn't be changed. It should be the same as the AGENT_ID parameter shown on the Agent details screen.
Client ID	Enter the client_id credential you obtained from the Agent details screen.
Client Secret	Enter the client_secret credential you obtained from the Agent details screen.
Container Registry Username	This can be left blank.
Container Registry Password Secret Ref	This can be left blank.
Tags	Optionally, add any tags that your organization's tagging policy requires. Tags should be added as a JSON string, for example: `{"Category": "Development","Business Unit": "Data Pipelines","Owner": "owner@organization.com"}`

Click Review & Create.