//Module included in the following assemblies:
// hosted_control_planes/hcp-deploy/hcp-deploy-azure.adoc

:_mod-docs-content-type: REFERENCE
[id="hcp-azure-infra-creds_{context}"]
= {azure-short} infrastructure and credentials

[role="_abstract"]
Before you get started with {hcp} on {azure-first}, get familiar with the required {azure-short} resources and the necessary permissions.

[id="hcp-azure-prereq-summary_{context}"]
== Summary of requirements

You need the following resources, tools, access, and permissions to set up {hcp} on {azure-short}:

{azure-short} resources::

** An {product-title} management cluster on {azure-short}.
** An {azure-short} subscription with contributor and user-access administrator permissions.
** (Optional) A parent DNS zone in {azure-short} for delegating cluster DNS records. This DNS zone is required only if you plan to use external DNS.

Tools and access::

** {azure-short} command-line interface (CLI), `az`, configured with your subscription
** {oc-first}
** {hcp} CLI, `hcp`
** `jq` command-line JSON processor
** Cloud Credential Operator utility (`ccoctl`)
** A valid {product-title} pull secret

Permissions::

** Subscription-level contributor and user access administrator roles
** Microsoft Graph API permissions for creating service principals

[id="hcp-azure-dns-options_{context}"]
== DNS management options

You can set up {hcp} on {azure-short} with or without external DNS. If you plan to use a private or a public-private topology, external DNS is required. See the following table for more information:

.DNS approaches for {hcp} on {azure-short}
[cols="3",options="header"]
|===
| |With external DNS |Without external DNS

|*Best for*
|Production, multi-cluster
|Development, testing

|*API server DNS*
|Custom (`api-cluster.example.com`)
|{azure-short} Load Balancer (`abc123.region.cloudapp.azure.com`)

|*Setup complexity*
|Low, requires DNS zones and service principals
|None

|*Management*
|Fully automatic
|Manual or {azure-short}-provided

|===

[id="hcp-azure-resource-group_{context}"]
== Resource group strategy

Cluster-specific resource groups are created and deleted with each hosted cluster. These resources include managed resource groups for cluster infrastructure. If you use custom networking, these resources also include Virtual Network (VNet) resource groups and Network Security Group (NSG) resource groups.

[id="hcp-azure-security_{context}"]
== Security considerations for {hcp} on {azure-short}

{hcp-capital} on {azure-short} employs the following security best practices:

* Workload identity federation, which eliminates long-lived credentials by using OIDC-based authentication.
* Least-privilege access, where each component has its own managed identity with minimal required permissions.
* Network isolation, where you can use custom VNets and NSGs to implement network segmentation and security policies.
* Federated credentials, where trust relationships are scoped to specific service accounts, preventing unauthorized access.
* Private connectivity, available as an option through Azure Private Link, which provides private API server access to ensure that control-plane traffic never traverses the public internet. Private connectivity is available for private and public-private topologies only.
