//Module included in the following assemblies:
// hosted_control_planes/hcp-deploy/hcp-deploy-azure.adoc

:_mod-docs-content-type: PROCEDURE
[id="hcp-azure-private-iam_{context}"]
= Configuring IAM resources for a private hosted cluster

[role="_abstract"]
Create Workload Identities so that your private clusters can manage private endpoints and private DNS zones.

.Prerequisites

* You have an {product-title} management cluster on {azure-short} that has the HyperShift Operator installed.

* The {azure-short} command-line interface (CLI) is installed and configured.

* The {oc-first} is installed.

* If you are using external DNS, the `jq` command-line JSON processor is installed.

* You configured an OIDC issuer. For more information, see "Setting up an OIDC issuer".

.Procedure

. Set your environment variables:
+
.. Set your prefix by entering the following command:
+
[source,bash]
----
$ PREFIX="<my_prefix>"
----
+
.. Set the cluster name by entering the following command:
+
[source,bash]
----
$ CLUSTER_NAME="${PREFIX}-hc"
----
+
.. Set the resource group name by entering the following command:
+
[source,bash]
----
$ RESOURCE_GROUP_NAME="${CLUSTER_NAME}-${PREFIX}"
----
+
.. Set the location by entering the following command:
+
[source,bash]
----
$ LOCATION="<my_region>"
----
+
.. Set the variable for the path to the {azure-short} credentials file by entering the following command:
+
[source,bash]
----
$ AZURE_CREDS="<path_to_azure_credentials_json>"
----
+
.. Set the variable for the OIDC issuer URL by entering the following command:
+
[source,bash]
----
$ OIDC_ISSUER_URL="<my_oidc_url_com>"
----
.. Set the path to the Workload Identities file by entering the following command:
+
[source,bash]
----
$ WORKLOAD_IDENTITIES_FILE="<path_to_workload_identities_file_json>"
----

. Create Workload Identities by entering the following command:
+
[source,terminal]
----
$ hcp create iam azure \
  --name "${CLUSTER_NAME}" \
  --infra-id "${PREFIX}" \
  --azure-creds "${AZURE_CREDS}" \
  --location "${LOCATION}" \
  --resource-group-name "${RESOURCE_GROUP_NAME}" \
  --oidc-issuer-url "${OIDC_ISSUER_URL}" \
  --output-file "${WORKLOAD_IDENTITIES_FILE}"
----
+
The command creates 8 Workload Identities. For `Private` and `PublicAndPrivate` clusters, the Control Plane Operator identity is used to create and manage private endpoints, private DNS zones, {azure-short} Virtual Network (VNet) links, and DNS A records. The Control Plane Identity is assigned the `Contributor` role by default. To use a more restrictive role, use the `--assign-custom-hcp-roles` flag.