Skip to content

Commit 0bd2639

Browse files
GitHubber17GitHubber17
committed
edits
1 parent ab76f4c commit 0bd2639

File tree

1 file changed

+114
-124
lines changed

1 file changed

+114
-124
lines changed

‎articles/virtual-machines/extensions/key-vault-windows.md

Lines changed: 114 additions & 124 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,16 @@ The Key Vault VM extension supports the following versions of Windows:
2828

2929
The Key Vault VM extension is also supported on a custom local VM. The VM should be uploaded and converted into a specialized image for use in Azure by using Windows Server 2019 core install.
3030

31-
> [!NOTE]
32-
> The Key Vault VM extension downloads all certificates to the Windows certificate store or to the location specified in the `certificateStoreLocation` property in the VM extension settings.
33-
34-
### Supported certificate content types
31+
### Supported certificates
3532

3633
The Key Vault VM extension supports the following certificate content types:
3734

3835
- PKCS #12
3936
- PEM
4037

38+
> [!NOTE]
39+
> The Key Vault VM extension downloads all certificates to the Windows certificate store or to the location specified in the `certificateStoreLocation` property in the VM extension settings.
40+
4141
## Updates in Version 3.0
4242

4343
Version 3.0 of the Key Vault VM extension for Windows adds support for the following features:
@@ -61,7 +61,7 @@ Review the following prerequisites for using the Key Vault VM extension for Wind
6161

6262
- Virtual Machine Scale Sets should have the following `identity` configuration:
6363

64-
```
64+
```json
6565
"identity": {
6666
"type": "UserAssigned",
6767
"userAssignedIdentities": {
@@ -72,7 +72,7 @@ Review the following prerequisites for using the Key Vault VM extension for Wind
7272

7373
- The Key Vault VM extension should have the following `authenticationSettings` configuration:
7474

75-
```
75+
```json
7676
"authenticationSettings": {
7777
"msiEndpoint": "[parameters('userAssignedIdentityEndpoint')]",
7878
"msiClientId": "[reference(parameters('userAssignedIdentityResourceId'), variables('msiApiVersion')).clientId]"
@@ -89,7 +89,7 @@ The following JSON shows the schema for the Key Vault VM extension. Before you c
8989

9090
- The extension doesn't require protected settings. All settings are considered public information.
9191

92-
- Observed certificates URLs should be of the form "https://myVaultName.vault.azure.net/secrets/myCertName".
92+
- Observed certificates URLs should be of the form `https://myVaultName.vault.azure.net/secrets/myCertName`.
9393

9494
This form is preferred because the `/secrets` path returns the full certificate, including the private key, but the `/certificates` path doesn't. For more information about certificates, see [Azure Key Vault keys, secrets and certificates overview](/azure/key-vault/general/about-keys-secrets-certificates).
9595

@@ -181,7 +181,7 @@ The following JSON shows the schema for the Key Vault VM extension. Before you c
181181

182182
## Property values
183183

184-
The JSON schema includes values for the following properties.
184+
The JSON schema includes the following properties.
185185

186186
### [Version-3.0](#tab/version3)
187187

@@ -216,7 +216,7 @@ The JSON schema includes values for the following properties.
216216
| `linkOnRenewal` | true | boolean |
217217
| `certificateStoreLocation` | LocalMachine or CurrentUser (case sensitive) | string |
218218
| `requireInitialSync` | false | boolean |
219-
| `observedCertificates` | ["https://myvault.vault.azure.net/secrets/mycertificate", "https://myvault.vault.azure.net/secrets/mycertificate2"] | string array
219+
| `observedCertificates` | ["https://myvault.vault.azure.net/secrets/mycertificate", <br> "https://myvault.vault.azure.net/secrets/mycertificate2"] | string array
220220
| `msiEndpoint` | "http://169.254.169.254/metadata/identity/oauth2/token" | string |
221221
| `msiClientId` | c7373ae5-91c2-4165-8ab6-7381d6e75619 | string |
222222

@@ -378,39 +378,35 @@ The following JSON snippets provide example settings for deploying the Key Vault
378378
}
379379
```
380380

381-
#### Version 3.0 deployment
382-
383-
Use PowerShell to deploy the version 3.0 Key Vault VM extension to an existing VM or Virtual Machine Scale Sets instance.
384-
385-
- Deploy the extension on a VM:
381+
#### Deploy on a VM
386382

387-
```powershell
388-
# Build settings
389-
$settings = (get-content -raw ".\settings.json")
390-
$extName = "KeyVaultForWindows"
391-
$extPublisher = "Microsoft.Azure.KeyVault"
392-
$extType = "KeyVaultForWindows"
393-
394-
# Start the deployment
395-
Set-AzVmExtension -TypeHandlerVersion "3.0" -ResourceGroupName <ResourceGroupName> -Location <Location> -VMName <VMName> -Name $extName -Publisher $extPublisher -Type $extType -SettingString $settings
396-
```
383+
```powershell
384+
# Build settings
385+
$settings = (get-content -raw ".\settings.json")
386+
$extName = "KeyVaultForWindows"
387+
$extPublisher = "Microsoft.Azure.KeyVault"
388+
$extType = "KeyVaultForWindows"
389+
390+
# Start the deployment
391+
Set-AzVmExtension -TypeHandlerVersion "3.0" -ResourceGroupName <ResourceGroupName> -Location <Location> -VMName <VMName> -Name $extName -Publisher $extPublisher -Type $extType -SettingString $settings
392+
```
397393

398-
- Deploy the extension on a Virtual Machine Scale Sets instance:
394+
#### Deploy on a Virtual Machine Scale Sets instance
399395

400-
```powershell
401-
# Build settings
402-
$settings = ".\settings.json"
403-
$extName = "KeyVaultForWindows"
404-
$extPublisher = "Microsoft.Azure.KeyVault"
405-
$extType = "KeyVaultForWindows"
406-
407-
# Add extension to Virtual Machine Scale Sets
408-
$vmss = Get-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName>
409-
Add-AzVmssExtension -VirtualMachineScaleSet $vmss -Name $extName -Publisher $extPublisher -Type $extType -TypeHandlerVersion "3.0" -Setting $settings
410-
411-
# Start the deployment
412-
Update-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName> -VirtualMachineScaleSet $vmss
413-
```
396+
```powershell
397+
# Build settings
398+
$settings = ".\settings.json"
399+
$extName = "KeyVaultForWindows"
400+
$extPublisher = "Microsoft.Azure.KeyVault"
401+
$extType = "KeyVaultForWindows"
402+
403+
# Add extension to Virtual Machine Scale Sets
404+
$vmss = Get-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName>
405+
Add-AzVmssExtension -VirtualMachineScaleSet $vmss -Name $extName -Publisher $extPublisher -Type $extType -TypeHandlerVersion "3.0" -Setting $settings
406+
407+
# Start the deployment
408+
Update-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName> -VirtualMachineScaleSet $vmss
409+
```
414410

415411
### [Version-1.0](#tab/version1)
416412

@@ -419,55 +415,55 @@ Use PowerShell to deploy the version 1.0 Key Vault VM extension to an existing V
419415
> [!WARNING]
420416
> PowerShell clients often prefix a quote mark `"` with a backslash `\` in the settings JSON file. The extraneous characters cause the akvvm_service to fail with the error, "[CertificateManagementConfiguration] Failed to parse the configuration settings with:not an object."
421417
>
422-
> You can see the supplied backslash `\` and quote `"` characters in the Azure portal. Check the contents of the settings JSON file under **Settings** > **Extensions**. To avoid the error, initialize the `$settings` property as a PowerShell `HashTable` as follows:
418+
> You can see the supplied backslash `\` and quote `"` characters in the Azure portal. Check the contents of the settings JSON file under **Settings** > **Extensions + Applications**. To avoid the error, initialize the `$settings` property as a PowerShell `HashTable` as follows:
423419
>
424420
> ```powershell
425421
> $settings = @{"secretsManagementSettings" = @{"pollingIntervalInS"="<pollingInterval>"; "certificateStoreName"="<certStoreName>";"certificateStoreLocation"="<certStoreLoc>";"observedCertificates"=@("<observedCert1>", "<observedCert2>")};"authenticationSettings"=@{"msiEndpoint"="<msiEndpoint>";"msiClientId"="<msiClientId>"} }
426422
> ```
427423
428-
- Deploy the extension on a VM:
429-
430-
```powershell
431-
# Build settings
432-
$settings = '{"secretsManagementSettings":
433-
{ "pollingIntervalInS": "' + <pollingInterval> +
434-
'", "certificateStoreName": "' + <certStoreName> +
435-
'", "certificateStoreLocation": "' + <certStoreLoc> +
436-
'", "observedCertificates": ["' + <observedCert1> + '","' + <observedCert2> + '"] },
437-
"authenticationSettings":
438-
{ "msiEndpoint": "' + <msiEndpoint> +
439-
'", "msiClientId" :"' + <msiClientId> + '"}}'
440-
$extName = "KeyVaultForWindows"
441-
$extPublisher = "Microsoft.Azure.KeyVault"
442-
$extType = "KeyVaultForWindows"
443-
444-
# Start the deployment
445-
Set-AzVmExtension -TypeHandlerVersion "1.0" -ResourceGroupName <ResourceGroupName> -Location <Location> -VMName <VMName> -Name $extName -Publisher $extPublisher -Type $extType -SettingString $settings
446-
```
424+
#### Deploy on a VM
425+
426+
```powershell
427+
# Build settings
428+
$settings = '{"secretsManagementSettings":
429+
{ "pollingIntervalInS": "' + <pollingInterval> +
430+
'", "certificateStoreName": "' + <certStoreName> +
431+
'", "certificateStoreLocation": "' + <certStoreLoc> +
432+
'", "observedCertificates": ["' + <observedCert1> + '","' + <observedCert2> + '"] },
433+
"authenticationSettings":
434+
{ "msiEndpoint": "' + <msiEndpoint> +
435+
'", "msiClientId" :"' + <msiClientId> + '"}}'
436+
$extName = "KeyVaultForWindows"
437+
$extPublisher = "Microsoft.Azure.KeyVault"
438+
$extType = "KeyVaultForWindows"
439+
440+
# Start the deployment
441+
Set-AzVmExtension -TypeHandlerVersion "1.0" -ResourceGroupName <ResourceGroupName> -Location <Location> -VMName <VMName> -Name $extName -Publisher $extPublisher -Type $extType -SettingString $settings
442+
```
447443
448-
- Deploy the extension on a Virtual Machine Scale Sets instance:
444+
#### Deploy on a Virtual Machine Scale Sets instance
445+
446+
```powershell
447+
# Build settings
448+
$settings = '{"secretsManagementSettings":
449+
{ "pollingIntervalInS": "' + <pollingInterval> +
450+
'", "certificateStoreName": "' + <certStoreName> +
451+
'", "certificateStoreLocation": "' + <certStoreLoc> +
452+
'", "observedCertificates": ["' + <observedCert1> + '","' + <observedCert2> + '"] } },
453+
"authenticationSettings":
454+
{ "msiEndpoint": "' + <msiEndpoint> +
455+
'", "msiClientId" :"' + <msiClientId> + '"}}'
456+
$extName = "KeyVaultForWindows"
457+
$extPublisher = "Microsoft.Azure.KeyVault"
458+
$extType = "KeyVaultForWindows"
459+
460+
# Add extension to Virtual Machine Scale Sets
461+
$vmss = Get-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName>
462+
Add-AzVmssExtension -VirtualMachineScaleSet $vmss -Name $extName -Publisher $extPublisher -Type $extType -TypeHandlerVersion "1.0" -Setting $settings
449463
450-
```powershell
451-
# Build settings
452-
$settings = '{"secretsManagementSettings":
453-
{ "pollingIntervalInS": "' + <pollingInterval> +
454-
'", "certificateStoreName": "' + <certStoreName> +
455-
'", "certificateStoreLocation": "' + <certStoreLoc> +
456-
'", "observedCertificates": ["' + <observedCert1> + '","' + <observedCert2> + '"] } },
457-
"authenticationSettings":
458-
{ "msiEndpoint": "' + <msiEndpoint> +
459-
'", "msiClientId" :"' + <msiClientId> + '"}}'
460-
$extName = "KeyVaultForWindows"
461-
$extPublisher = "Microsoft.Azure.KeyVault"
462-
$extType = "KeyVaultForWindows"
463-
464-
# Add extension to Virtual Machine Scale Sets
465-
$vmss = Get-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName>
466-
Add-AzVmssExtension -VirtualMachineScaleSet $vmss -Name $extName -Publisher $extPublisher -Type $extType -TypeHandlerVersion "1.0" -Setting $settings
467-
468-
# Start the deployment
469-
Update-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName> -VirtualMachineScaleSet $vmss
470-
```
464+
# Start the deployment
465+
Update-AzVmss -ResourceGroupName <ResourceGroupName> -VMScaleSetName <VmssName> -VirtualMachineScaleSet $vmss
466+
```
471467

472468
---
473469

@@ -511,60 +507,54 @@ The following JSON snippets provide example settings for deploying the Key Vault
511507
}
512508
}
513509
```
514-
515-
#### Version 3.0 deployment
516-
517-
Use the Azure CLI to deploy the version 3.0 Key Vault VM extension to an existing VM or Virtual Machine Scale Sets instance.
518510

519-
- Deploy the extension on a VM:
511+
#### Deploy on a VM
520512

521-
```azurecli
522-
# Start the deployment
523-
az vm extension set --name "KeyVaultForWindows" `
524-
--publisher Microsoft.Azure.KeyVault `
525-
--resource-group "<resourcegroup>" `
526-
--vm-name "<vmName>" `
527-
--settings "@settings.json"
528-
```
513+
```azurecli
514+
# Start the deployment
515+
az vm extension set --name "KeyVaultForWindows" `
516+
--publisher Microsoft.Azure.KeyVault `
517+
--resource-group "<resourcegroup>" `
518+
--vm-name "<vmName>" `
519+
--settings "@settings.json"
520+
```
529521

530-
- Deploy the extension on a Virtual Machine Scale Sets instance:
522+
#### Deploy on a Virtual Machine Scale Sets instance
531523

532-
```
533-
# Start the deployment
534-
az vmss extension set --name "KeyVaultForWindows" `
535-
--publisher Microsoft.Azure.KeyVault `
536-
--resource-group "<resourcegroup>" `
537-
--vmss-name "<vmssName>" `
538-
--settings "@settings.json"
539-
```
524+
```
525+
# Start the deployment
526+
az vmss extension set --name "KeyVaultForWindows" `
527+
--publisher Microsoft.Azure.KeyVault `
528+
--resource-group "<resourcegroup>" `
529+
--vmss-name "<vmssName>" `
530+
--settings "@settings.json"
531+
```
540532

541533
### [Version-1.0](#tab/version1)
542534

543535
Use the Azure CLI to deploy the version 1.0 Key Vault VM extension to an existing VM or Virtual Machine Scale Sets instance.
544536

545-
- Deploy the extension on a VM:
537+
#### Deploy on a VM
546538

547-
```azurecli
548-
# Start the deployment
549-
az vm extension set --name "KeyVaultForWindows" `
550-
--publisher Microsoft.Azure.KeyVault `
551-
--resource-group "<resourcegroup>" `
552-
--vm-name "<vmName>" `
553-
--settings '{\"secretsManagementSettings\": { \"pollingIntervalInS\": \"<pollingInterval>\", \"certificateStoreName\": \"<certStoreName>\", \"certificateStoreLocation\": \"<certStoreLoc>\", \"observedCertificates\": [\" <observedCert1> \", \" <observedCert2> \"] },
554-
\"authenticationSettings\": { \"msiEndpoint\": \"<msiEndpoint>\", \"msiClientId\": \"<msiClientId>\"}}'
555-
```
539+
```azurecli
540+
# Start the deployment
541+
az vm extension set --name "KeyVaultForWindows" `
542+
--publisher Microsoft.Azure.KeyVault `
543+
--resource-group "<resourcegroup>" `
544+
--vm-name "<vmName>" `
545+
--settings '{\"secretsManagementSettings\": { \"pollingIntervalInS\": \"<pollingInterval>\", \"certificateStoreName\": \"<certStoreName>\", \"certificateStoreLocation\": \"<certStoreLoc>\", \"observedCertificates\": [\" <observedCert1> \", \" <observedCert2> \"] }, \"authenticationSettings\": { \"msiEndpoint\": \"<msiEndpoint>\", \"msiClientId\": \"<msiClientId>\"}}'
546+
```
556547

557-
- Deploy the extension on a Virtual Machine Scale Sets instance:
548+
#### Deploy on a Virtual Machine Scale Sets instance
558549

559-
```azurecli
560-
# Start the deployment
561-
az vmss extension set --name "KeyVaultForWindows" `
562-
--publisher Microsoft.Azure.KeyVault `
563-
--resource-group "<resourcegroup>" `
564-
--vmss-name "<vmName>" `
565-
--settings '{\"secretsManagementSettings\": { \"pollingIntervalInS\": \"<pollingInterval>\", \"certificateStoreName\": \"<certStoreName>\", \"certificateStoreLocation\": \"<certStoreLoc>\", \"observedCertificates\": [\" <observedCert1> \", \" <observedCert2> \"] },
566-
\"authenticationSettings\": { \"msiEndpoint\": \"<msiEndpoint>\", \"msiClientId\": \"<msiClientId>\"}}'
567-
```
550+
```azurecli
551+
# Start the deployment
552+
az vmss extension set --name "KeyVaultForWindows" `
553+
--publisher Microsoft.Azure.KeyVault `
554+
--resource-group "<resourcegroup>" `
555+
--vmss-name "<vmName>" `
556+
--settings '{\"secretsManagementSettings\": { \"pollingIntervalInS\": \"<pollingInterval>\", \"certificateStoreName\": \"<certStoreName>\", \"certificateStoreLocation\": \"<certStoreLoc>\", \"observedCertificates\": [\" <observedCert1> \", \" <observedCert2> \"] }, \"authenticationSettings\": { \"msiEndpoint\": \"<msiEndpoint>\", \"msiClientId\": \"<msiClientId>\"}}'
557+
```
568558

569559
---
570560

@@ -606,7 +596,7 @@ To see the deployment state of extensions for a given VM, run the following comm
606596

607597
### Review logs and configuration
608598

609-
The Key Vault VM extension logs exist only locally on the VM. Checking the log details can be helpful for troubleshooting.
599+
The Key Vault VM extension logs exist only locally on the VM. Review the log details to help with troubleshooting.
610600

611601
| Log file | Description |
612602
| --- | --- |

0 commit comments

Comments
 (0)