Deploy the Assembler in Microsoft Azure

This guide is only for V2 assemblers being deployed with a virtual machine in Microsoft Azure. The V1 assembler is no longer supported as of June 30, 2024.

Each assembler you create must be deployed via a virtual machine, and then you can add your technology as a security device in Workbench to complete the full integration. For more information about the Expel Assembler or how it works, see the About the Expel Assembler guide.

Prerequisites

1. You must have completed all of the steps in Add a New Assembler for each assembler you wish to deploy.
2. You must extract the Fedora CoreOS image file you downloaded. You will need to upload the .vhd file, not the compressed .xz file, in this guide.
3. Make sure your network security group (for your firewall configuration) is in a resource group, and that you know which group it is. You will need to place the storage account, image, and virtual machine from this guide in that same resource group.

Step 1: Download the Ignition File

The Ignition file enables the virtual machine to read a configuration file and to provision the Fedora CoreOS system based on the contents of that file. You will use this file when you configure the virtual machine in Azure.

1. Log in to Workbench.
2. In the side menu, navigate to Organization Settings > Assemblers.
3. Find the assembler you created, leave the file format as JSON, and select Download the CoreOS Ignition File. This action will download a JSON file that you will need in the next section.

You may choose a different file format if you like, but the JSON format is recommended for this type of assembler.

1. Repeat this process for any additional assemblers.

You must keep track of which files came from which assembler, because each assembler has its own unique ignition file.

Step 2: Upload the Virtual Hard Disk (VHD) to Azure

You must create a place to store the CoreOS image in Azure. Follow these steps to upload the .vhd file through the Azure Portal.

If you prefer using the Azure CLI, see Upload a VHD to Azure or copy a managed disk to another region - Azure CLI.

1. Log in to https://portal.azure.com/.
2. Select Storage Accounts.
3. Select Create.
4. Select the subscription and resource group that contains your network security group.
5. Select a region.

This should be the same region as your resource group.

1. For Performance and Redundancy, leave it as the defaults.
2. Select Review.
3. Scroll down and select Create.
4. After the deployment completes, select Go to resource.
5. Under the Properties section, select Blob service.
6. Select Container to create a new storage container.
7. Give the new container a name and select Create.
8. Select the new container's name in the list.
9. Select Upload and choose the choose the Fedora CoreOS image file you downloaded.

• Make sure you have extracted the file and are uploading the .vhd file, not the compressed .xz file.
• The upload may take a while, as the file is large.

1. Once the upload completes, a new blob appears in the list with the name of your .vhd file.

Step 3: Create a Virtual Machine From the VHD

Now you will configure the image and virtual machine, provide the contents of the ignition file, and deploy the virtual machine.

Azure requires you to have an SSH key, but SSH is disabled by default on all Expel assemblers. If you require SSH access to this VM in the future, contact Support.

1. In Azure, type "Images" into the main search bar to quickly navigate to the Images service.
2. Select Create.
3. Configure the following:

   • Subscription / Resource Group - ensure these match what you selected for your storage account.
   • Name - enter a name for your image.
   • Region - select same region as your previous resources.
   • Zone Resiliency - leave unchecked.
   • OS type - Linux.
   • VM Generation - Gen 1.
   • Storage blob - browse to the storage account, ccontainer, and select the image file you uploaded. Click Select.
   • Account type - your choice. This is the storage location of the image, not your virtual machine itself, so Standard HDD performance is acceptable.
   • Host caching - leave as Read/write.
   • Key management - leave as the default.
   • Data disk - no action needed.
4. Select Review + Create.
5. After the image validates, select Create.
6. After the deployment completes, select Go to resource.
7. Select Create VM.
8. Configure the Basics section as follows:

   • Subscription/Resource Group - these should default to your previously selected options.
   • Virtual machine name - enter a name of your choosing.
   • Region - this defaults to the region you previously selected.
   • Availability options - No infrastructure redundancy required.
   • Image - if it is not preselected, choose the image you created earlier.
   • Size - select a VM with at least 2 virtual CPUs, 8GB RAM, and 20 GB disk space.
   • Authentication type - SSH public key.
   • Username/SSH public key source/Key pair name - leave as the defaults.
   • Public inbound ports - None.
   • License type - Other (the assembler is CentOS-based, which doesn't require a license).
9. Select Next:Disks.
10. Configure the Disks section as follows:

    1. OS disk size - select an option of at least 20 GB.
    2. OS disk type - choose an SSD option.
    3. Leave the rest of the options as the default values.
11. Select Next:Networking
12. Virtual network/ Subnet/Public IP - Verify the network settings that Azure populates here are appropriate for your environment.
13. NIC network security group - Advanced.
14. The Configure network security group appears. Select the network security group you created when you edited your firewall settings.

If you have not already updated your firewall configuration, you can do it now by selecting Create new and adding the required outbound connections.

1. Select Next:Management.
2. Select Next:Monitoring.
3. Select Next:Advanced.
4. Under User data:

   • Select Enable user data.
   • Paste the contents of your ignition file into the text box.
5. Select Next:Tags.
6. Select Next:Review+Create.
7. Review your configuration and select Create.
8. On the Generate new key pair screen, select Download private key and create resource.

Delete the .pem file that downloads, as SSH is disabled for assemblers by default and you will not need this file. If you require SSH access to this virtual machine in the future, contact Support.

1. Wait for the virtual machine to deploy successfully.

Step 4: Verify a “Connected” Status in Workbench

It can take 10 to 15 minutes for the assembler’s status to update in Workbench.

1. Log in to Workbench.
2. In the side menu, navigate to Organization Settings > Assemblers (or, refresh the page if you never logged out).
3. Find your newly created assembler(s) and verify that the status has changed from “Not Yet Connected” to “Connected.”

   • If your assembler(s) still do not show as connected after waiting at least 15 minutes and refreshing the page, see the Troubleshooting section for help.

Step 5: Connect Your Technology

You can now set up your vendor technology in Workbench.

Troubleshooting

If your assembler is still not showing as “Connected” after 15 minutes:

• Make sure your have the proper firewall configurations to allow our outbound ports.
• Make sure your chosen machine’s size meets the required minimums (2 virtual CPUs, 8 GB RAM, and 20 GB disk space).
• For additional troubleshooting, access the Serial Console of your VM in Azure and check for errors.

If all firewall and machine size settings are correct, and there are no errors in Azure, but you are still unable to connect the assembler, contact Support for help.