You plan to deploy a highly available SAP HANA deployment on Azure that will be hosted on a Pacemaker cluster. You need to configure the security principal of the Azure fence agent for the cluster…

Question

Options

• Aa user-assigned managed identity
• Ba system-assigned managed identity
• Ca service principal
• DAzure shared disks

• A
  5% (1)
• B
  73% (16)
• C
  5% (1)
• D
  18% (4)

Explanation

According to the official Microsoft documentation for setting up Pacemaker clusters on Azure, the Azure fence agent can use either a managed identity or a service principal to authorize against Azure APIs for fencing operations. The recommended approach to minimize administrative effort is to use system-assigned managed identities for each VM in the cluster. If a system-assigned managed identity already exists on the VM, it will be used automatically. User-assigned managed identities are not recommended for Pacemaker fencing at this time. You must create and assign a custom role with permissions to power off and start VMs to the system-assigned managed identity of each cluster VM. This approach simplifies identity management because system-assigned managed identities are tied directly to the lifecycle of the VM and do not require manual credential management, unlike service principals.

No community discussion yet for this question.