You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-cache-for-redis/cache-how-to-encryption.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -59,7 +59,7 @@ In the **Enterprise Flash** tier, keys and values are also partially stored on-d
59
59
60
60
In the **Basic, Standard, and Premium** tiers, the OS disk is encrypted using MMK. There's no persistence disk mounted and Azure Storage is used instead.
61
61
62
-
## Prerequisites and Limitations
62
+
## Prerequisites and limitations
63
63
64
64
### General prerequisites and limitations
65
65
@@ -73,7 +73,7 @@ In the **Basic, Standard, and Premium** tiers, the OS disk is encrypted using MM
73
73
-[Purge protection and soft-delete](../key-vault/general/soft-delete-overview.md) must be enabled in the Azure Key Vault instance. Purge protection isn't enabled by default.
74
74
- When you use firewall rules in the Azure Key Vault, the Key Vault instance must be configured to [allow trusted services](/azure/key-vault/general/network-security).
75
75
- Only RSA keys are supported
76
-
- The user assigned managed identity must be given the permissions _Get_, _Unwrap Key_, and _Wrap Key_ in the Key Vault access policies, or the equivalent permissions within Azure Role Based Access Control. A recommended built-in role definition with the least priveleges needed for this scenario is called [KeyVault Crypto Service Encryption User](../role-based-access-control/built-in-roles.md#key-vault-crypto-service-encryption-user).
76
+
- The user assigned managed identity must be given the permissions _Get_, _Unwrap Key_, and _Wrap Key_ in the Key Vault access policies, or the equivalent permissions within Azure Role Based Access Control. A recommended built-in role definition with the least privileges needed for this scenario is called [KeyVault Crypto Service Encryption User](../role-based-access-control/built-in-roles.md#key-vault-crypto-service-encryption-user).
77
77
78
78
## How to configure CMK encryption on Enterprise caches
79
79
@@ -100,7 +100,7 @@ In the **Basic, Standard, and Premium** tiers, the OS disk is encrypted using MM
100
100
101
101
:::image type="content" source="media/cache-how-to-encryption/cache-managed-identity-version.png" alt-text="Screenshot showing the select identity and key fields completed.":::
102
102
103
-
1. If using the **URI** input method, enter the Key Indentifier URI for your chosen key from Azure Key Vault.
103
+
1. If using the **URI** input method, enter the Key Identifier URI for your chosen key from Azure Key Vault.
104
104
105
105
1. When you've entered all the information for your cache, select **Review + create**.
106
106
@@ -125,11 +125,11 @@ In the **Basic, Standard, and Premium** tiers, the OS disk is encrypted using MM
125
125
1. Choose the specific key using the **Customer-managed key (RSA)** drop-down. If there are multiple versions of the key to choose from, use the **Version** drop-down.
126
126
:::image type="content" source="media/cache-how-to-encryption/cache-encryption-existing-key.png" alt-text="Screenshot showing the select identity and key fields completed for Encryption.":::
127
127
128
-
1. If using the **URI** input method, enter the Key Indentifier URI for your chosen key from Azure Key Vault.
128
+
1. If using the **URI** input method, enter the Key Identifier URI for your chosen key from Azure Key Vault.
|**Backup Frequency**| Use the drop-down and select a backup interval. Choices include **60 Minutes**, **6 hours**, and **12 hours**. | This interval starts counting down after the previous backup operation successfully completes. When it elapses, a new backup starts. |
136
136
137
137
1. To enable AOF persistence, select **AOF** and configure the settings.
|**Backup Frequency**| Drop down and select a backup interval. Choices include **Write every second** and **Always write**. | The _Always write_ option will append new entries to the AOF file after every write to the cache. This choice offers the best durability but does lower cache performance. |
Because Redis persistence creates data at rest, encrypting this data is an important concern for many users. Encryption options vary based on the tier of Azure Cache for Redis being used.
208
208
209
209
With the **Premium** tier, data is streamed directly from the cache instance to Azure Storage when persistence is initiated. Various encryption methods can be used with Azure Storage, including Microsoft-managed keys, customer-managed keys, and customer-provided keys. For information on encryption methods, see [Azure Storage encryption for data at rest](../storage/common/storage-service-encryption.md).
@@ -262,6 +262,12 @@ AOF persistence saves every write to a log, which has a significant effect on th
262
262
263
263
For more information on performance when using AOF persistence, see [Does AOF persistence affect throughput, latency, or performance of my cache?](#does-aof-persistence-affect-throughput-latency-or-performance-of-my-cache)
264
264
265
+
### Does AOF persistence affect throughput, latency, or performance of my cache?
266
+
267
+
AOF persistence does affect throughput. AOF runs on both the primary and replica process, therefore you see higher CPU and Server Load for a cache with AOF persistence than an identical cache without AOF persistence. AOF offers the best consistency with the data in memory because each write and delete is persisted with only a few seconds of delay. The trade-off is that AOF is more compute intensive.
268
+
269
+
As long as CPU and Server Load are both less than 90%, there is a penalty on throughput, but the cache operates normally, otherwise. Above 90% CPU and Server Load, the throughput penalty can get much higher, and the latency of all commands processed by the cache increases. This is because AOF persistence runs on both the primary and replica process, increasing the load on the node in use, and putting persistence on the critical path of data.
270
+
265
271
### What happens if I've scaled to a different size and a backup is restored that was made before the scaling operation?
266
272
267
273
For both RDB and AOF persistence:
@@ -301,11 +307,7 @@ All RDB persistence backups, except for the most recent one, are automatically d
301
307
302
308
Use a second storage account for AOF persistence when you think you've higher than expected set operations on the cache. Setting up the secondary storage account helps ensure your cache doesn't reach storage bandwidth limits. This option is only available for Premium tier caches.
303
309
304
-
### Does AOF persistence affect throughput, latency, or performance of my cache?
305
-
306
-
AOF persistence does affect throughput. AOF runs on both the primary and replica process, therefore you see both higher CPU and Server Load for a cache with AOF persistence, than for a cache with an identical workload without AOF persistence. AOF offers the best consistency with the data in memory because as each write and delete is persisted right away. The trade-off is that AOF is more compute intensive.
307
310
308
-
As long as CPU and Server Load are both less than 90%, the penalty on throughput is not generally problematic. Above 90% CPU and Server Load, the penalty can get much higher. Persistence runs on the primary and replica process, increasing the load on the node in use, and putting persistence on the critical path of data. If persistence to storage is slow, then overall writes/deletes are also slow, also known as latency.
Azure Cache for Redis has different tier offerings that provide flexibility in the choice of cache size and features. Through scaling, you can change the size, tier, and number of nodes after creating a cache instance to match your application needs. This article shows you how to scale your cache using the Azure portal, plus tools such as Azure PowerShell and Azure CLI.
17
17
18
-
## Types of Scaling
18
+
## Types of scaling
19
19
20
20
There are fundamentally two ways to scale an Azure Cache for Redis Instance:
21
21
@@ -60,7 +60,7 @@ For more information on determining the cache pricing tier to use, see [Choosing
60
60
> For more information on how to optimize the scaling process, see the [best practices for scaling guide](cache-best-practices-scale.md)
61
61
>
62
62
63
-
## Prerequisites/Limitations of Scaling Azure Cache for Redis
63
+
## Prerequisites/limitations of scaling Azure Cache for Redis
64
64
65
65
You can scale up/down to a different pricing tier with the following restrictions:
66
66
@@ -89,15 +89,15 @@ You can scale out/in with the following restrictions:
89
89
90
90
1. To scale your cache, [browse to the cache](cache-configure.md#configure-azure-cache-for-redis-settings) in the [Azure portal](https://portal.azure.com) and select **Scale** from the Resource menu.
91
91
92
-
:::image type="content" source="media/cache-how-to-scale/scale-a-cache.png" alt-text="scale on the resource menu":::
92
+
:::image type="content" source="media/cache-how-to-scale/scale-a-cache.png" alt-text="Screenshot showing Scale on the resource menu.":::
93
93
94
94
1. Choose a pricing tier in the working pane and then choose **Select**.
95
95
96
-
:::image type="content" source="media/cache-how-to-scale/select-a-tier.png" alt-text="Azure Cache for Redis tiers":::
96
+
:::image type="content" source="media/cache-how-to-scale/select-a-tier.png" alt-text="Screenshot showing the Azure Cache for Redis tiers.":::
97
97
98
98
1. While the cache is scaling to the new tier, a **Scaling Redis Cache** notification is displayed.
99
99
100
-
:::image type="content" source="media/cache-how-to-scale/scaling-notification.png" alt-text="notification of scaling":::
100
+
:::image type="content" source="media/cache-how-to-scale/scaling-notification.png" alt-text="Screenshot showing the notification of scaling.":::
101
101
102
102
1. When scaling is complete, the status changes from **Scaling** to **Running**.
0 commit comments