Secondary endpoint

Author: anikammsft

articles/azure-arc/data/deploy-active-directory-sql-managed-instance-cli.md

@@ -56,8 +56,10 @@ az sql mi-arc create
 --ad-connector-name < your AD connector name > 
 --keytab-secret < SQL MI keytab secret name >  
 --ad-account-name < SQL MI AD user account >  
---primary-dns-name < SQL MI DNS endpoint > 
---primary-port-number < SQL MI port number > 
+--primary-dns-name < SQL MI primary endpoint DNS name > 
+--primary-port-number < SQL MI primary endpoint port number > 
+--secondary-dns-name < SQL MI secondary endpoint DNS name > 
+--secondary-port-number < SQL MI secondary endpoint port number > 
 --use-k8s
 ```
 
@@ -72,6 +74,8 @@ az sql mi-arc create
 --ad-account-name arcuser 
 --primary-dns-name arcsqlmi.contoso.local
 --primary-port-number 31433 
+--secondary-dns-name arcsqlmi-2.contoso.local
+--secondary-port-number 31434
 --use-k8s
 ```
 
@@ -82,9 +86,11 @@ az sql mi-arc create
 --name < SQL MI name >  
 --ad-connector-name < your AD connector name > 
 --keytab-secret < SQL MI keytab secret name >  
---ad-account-name < SQL MI AD user account >  
---primary-dns-name < SQL MI DNS endpoint > 
---primary-port-number < SQL MI port number > 
+--ad-account-name < SQL MI AD user account > 
+--primary-dns-name < SQL MI primary endpoint DNS name > 
+--primary-port-number < SQL MI primary endpoint port number > 
+--secondary-dns-name < SQL MI secondary endpoint DNS name > 
+--secondary-port-number < SQL MI secondary endpoint port number >
 --custom-location < your custom location > 
 --resource-group < resource-group >
 ```
@@ -99,6 +105,8 @@ az sql mi-arc create
 --ad-account-name arcuser 
 --primary-dns-name arcsqlmi.contoso.local
 --primary-port-number 31433 
+--secondary-dns-name arcsqlmi-2.contoso.local
+--secondary-port-number 31434
 --custom-location private-location
 --resource-group arc-rg
 ```
@@ -170,8 +178,10 @@ az sql mi-arc create
 --k8s-namespace < namespace > 
 --ad-connector-name < your AD connector name > 
 --ad-account-name < SQL MI AD user account >  
---primary-dns-name < SQL MI DNS endpoint > 
---primary-port-number < SQL MI port number > 
+--primary-dns-name < SQL MI primary endpoint DNS name > 
+--primary-port-number < SQL MI primary endpoint port number > 
+--secondary-dns-name < SQL MI secondary endpoint DNS name > 
+--secondary-port-number < SQL MI secondary endpoint port number >
 --use-k8s
 ```
 
@@ -185,6 +195,8 @@ az sql mi-arc create
 --ad-account-name arcuser 
 --primary-dns-name arcsqlmi.contoso.local
 --primary-port-number 31433 
+--secondary-dns-name arcsqlmi-2.contoso.local
+--secondary-port-number 31434
 --use-k8s
 ```
 
@@ -195,8 +207,10 @@ az sql mi-arc create
 --name < SQL MI name >  
 --ad-connector-name < your AD connector name >  
 --ad-account-name < SQL MI AD user account >  
---primary-dns-name < SQL MI DNS endpoint > 
---primary-port-number < SQL MI port number > 
+--primary-dns-name < SQL MI primary endpoint DNS name > 
+--primary-port-number < SQL MI primary endpoint port number > 
+--secondary-dns-name < SQL MI secondary endpoint DNS name > 
+--secondary-port-number < SQL MI secondary endpoint port number >
 --custom-location < your custom location > 
 --resource-group <resource-group>
 ```
@@ -210,6 +224,8 @@ az sql mi-arc create
 --ad-account-name arcuser 
 --primary-dns-name arcsqlmi.contoso.local
 --primary-port-number 31433 
+--secondary-dns-name arcsqlmi-2.contoso.local
+--secondary-port-number 31434
 --custom-location private-location
 --resource-group arc-rg
 ```

articles/azure-arc/data/deploy-active-directory-sql-managed-instance.md

@@ -35,34 +35,34 @@ The following instructions expect that the users can bring in the Active Directo
 
 * An Active Directory user account for SQL
 * Service Principal Names (SPNs) under the user account
-* DNS record for the endpoint DNS name for SQL
+* DNS A (forward) record for the primary (and optionally, secondary) endpoint of SQL
 
 #### [System-managed keytab mode](#tab/system-managed-keytab-mode)
 
 The following instructions expect that the users can bring in the Active Directory domain and provide to the AD system-managed keytab deployment.
 
 * A unique name of an Active Directory user account for SQL
-* DNS record for the endpoint DNS name for SQL
+* DNS A (forward) record for the primary (and optionally, secondary) endpoint of SQL
 
 --- 
 
 ## Before you deploy SQL Managed Instance
 
-1. Identify a DNS name for the SQL endpoint.
+1. Identify a DNS name for the SQL endpoints.
 
-   Choose a unique DNS name for the SQL endpoint that clients will connect to from outside the Kubernetes cluster.
+   Choose unique DNS names for the SQL endpoints that clients will connect to from outside the Kubernetes cluster.
 
-   This DNS name should be in the Active Directory domain or its descendant domains.
+   These DNS names should be in the Active Directory domain or its descendant domains.
 
-   The examples in these instructions use `sqlmi.contoso.local` for the DNS name.
+   The examples in these instructions use `sqlmi-primary.contoso.local` for the primary DNS name and `sqlmi-secondary.contoso.local` for the secondary DNS name.
 
-2. Identify the port number for the SQL endpoint.
+2. Identify the port numbers for the SQL endpoints.
 
-   You provide a port number for the SQL endpoint.
+   You provide a port number for each of the SQL endpoints.
 
-   This port number must be in the acceptable range of port numbers for Kubernetes cluster.
+   These port numbers must be in the acceptable range of port numbers for Kubernetes cluster.
 
-   The examples in these instructions use `31433` for the port number.
+   The examples in these instructions use `31433` for the primary port number and `31434` for the secondary port number.
 
 ### [Customer-managed keytab mode](#tab/customer-managed-keytab-mode)
 
@@ -88,17 +88,17 @@ The following instructions expect that the users can bring in the Active Directo
 
 ---
 
-4. Create a DNS record for the SQL endpoint in the Active Directory DNS servers.
+4. Create DNS records for the SQL endpoints in the Active Directory DNS servers.
 
-   In one of the Active Directory DNS servers, create an A record (forward lookup record) for the DNS name chosen in step 1. This DNS record should point to the IP address that the SQL endpoint will listen on for connections from outside the Kubernetes cluster.
+   In one of the Active Directory DNS servers, create A records (forward lookup records) for the DNS names chosen in step 1. These DNS records should point to the IP address that the SQL endpoint will listen on for connections from outside the Kubernetes cluster.
 
-   You do not need to create a PTR record (reverse lookup record) in association with the A record.
+   You do not need to create PTR records (reverse lookup records) in association with the A records.
 
 ### [Customer-managed keytab mode](#tab/customer-managed-keytab-mode)
 
 5. Create Service Principal Names (SPNs)
 
-   In order for SQL to be able to accept AD authentication against the SQL endpoint DNS name, we need to register two SPNs under the account generated in the previous step. These two SPNs should be of the following format:
+   In order for SQL to be able to accept AD authentication against the SQL endpoints, we need to register two SPNs under the account generated in the previous step. SPNs must be registered for the primary endpoint and optionally for the secondary endpoint if AD authentication is desired on the secondary endpoint. The SPNs should be of the following format:
 
    ```output
    MSSQLSvc/<DNS name>
@@ -112,11 +112,18 @@ The following instructions expect that the users can bring in the Active Directo
    setspn -S MSSQLSvc/<DNS name>:<port> <account>
    ```
 
-   With the chosen example DNS name, port number and the account name in this document, the commands should look like the following:
+   With the chosen example primary endpoint DNS name, port number and the account name in this document, the commands should look like the following:
 
    ```console
-   setspn -S MSSQLSvc/sqlmi.contoso.local sqlmi-account
-   setspn -S MSSQLSvc/sqlmi.contoso.local:31433 sqlmi-account
+   setspn -S MSSQLSvc/sqlmi-primary.contoso.local sqlmi-account
+   setspn -S MSSQLSvc/sqlmi-primary.contoso.local:31433 sqlmi-account
+   ```
+
+   Additionally, if AD authentication is needed on the secondary endpoint, the following commands will add SPNs for the secondary endpoint using the chosen example DNS name and port number:
+
+   ```console
+   setspn -S MSSQLSvc/sqlmi-secondary.contoso.local sqlmi-account
+   setspn -S MSSQLSvc/sqlmi-secondary.contoso.local:31434 sqlmi-account
    ```
 
 6. Generate a keytab file containing entries for the account and SPNs
@@ -148,12 +155,14 @@ The following instructions expect that the users can bring in the Active Directo
 
    The input parameters are expecting the following values: 
    * `--realm` expects the uppercase of the AD domain, such as CONTOSO.LOCAL
-   * `--account` expects the AD account under where the SPNs are registered, such sqlmi-account
-   * `--port` expects the SQL endpoint port number 31433
-   * `--dns-name` expects the DNS name for the SQL endpoint
+   * `--account` expects the AD account under where the SPNs are registered, such as sqlmi-account
+   * `--port` expects the primary SQL endpoint port number, such as 31433
+   * `--dns-name` expects the DNS name for the primary SQL endpoint
    * `--keytab-file` expects the path to the keytab file
    * `--secret-name` expects the name of the keytab secret to generate a specification for
    * `--secret-namespace` expects the Kubernetes namespace containing the keytab secret
+   * `--secondary-port` expects the secondary SQL endpoint port number, such as 31434 (optional)
+   * `--secondary-dns-name` expects the DNS name for the secondary SQL endpoint (optional)
 
    Choose a name for the Kubernetes secret hosting the keytab. The namespace should be the same as what SQL will be deployed in.
 
@@ -211,14 +220,18 @@ To support Active Directory authentication on SQL, the deployment specification
       Name of the Active Directory account for this managed instance. 
    - `spec.security.activeDirectory.keytabSecret`
      Name of the Kubernetes secret hosting the pre-created keytab file by users. This secret must be in the same namespace as the managed instance. This parameter is only required for the AD deployment in customer-managed keytab mode. 
-  - `spec.services.primary.dnsName`
+   - `spec.services.primary.dnsName`
       You provide a DNS name for the primary SQL endpoint.
-  - `spec.services.primary.port`
+   - `spec.services.primary.port`
       You provide a port number for the primary SQL endpoint.
 
 - **Optional**
   - `spec.security.activeDirectory.connector.namespace`
      Kubernetes namespace of the pre-existing Active Directory connector to join for AD authentication. When not provided, system will assume the same namespace as SQL.
+  - `spec.services.readableSecondaries.dnsName`
+     You provide a DNS name for the secondary SQL endpoint.
+  - `spec.services.readableSecondaries.port`
+     You provide a port number for the secondary SQL endpoint.
 
 ### [System-managed keytab mode](#tab/system-managed-keytab-mode)
 
@@ -235,8 +248,12 @@ To support Active Directory authentication on SQL, the deployment specification
 - **Optional**
   - `spec.security.activeDirectory.connector.namespace`
      Kubernetes namespace of the pre-existing Active Directory connector to join for AD authentication. When not provided, system will assume the same namespace as SQL.
-   - `spec.security.activeDirectory.encryptionTypes`
-      List of Kerberos encryption types to allow for the automatically generated AD account provided in `spec.security.activeDirectory.accountName`. Accepted values are RC4, AES128 and AES256. It defaults to allow all encryption types when there is no value provided. You can disable RC4 by providing only AES128 and AES256 as encryption types.
+  - `spec.security.activeDirectory.encryptionTypes`
+     List of Kerberos encryption types to allow for the automatically generated AD account provided in `spec.security.activeDirectory.accountName`. Accepted values are RC4, AES128 and AES256. It defaults to allow all encryption types when there is no value provided. You can disable RC4 by providing only AES128 and AES256 as encryption types.
+  - `spec.services.readableSecondaries.dnsName`
+     You provide a DNS name for the secondary SQL endpoint.
+  - `spec.services.readableSecondaries.port`
+     You provide a port number for the secondary SQL endpoint.
 
 ---
 
@@ -283,8 +300,12 @@ spec:
   services:
     primary:
       type: LoadBalancer
-      dnsName: <Endpoint DNS name>
-      port: <Endpoint port number>
+      dnsName: <Primary Endpoint DNS name>
+      port: <Primary Endpoint port number>
+    readableSecondaries:
+      type: LoadBalancer
+      dnsName: <Secondary Endpoint DNS name>
+      port: <Secondary Endpoint port number>
   storage:
     data:
       volumes:
@@ -333,8 +354,12 @@ spec:
   services:
     primary:
       type: LoadBalancer
-      dnsName: <Endpoint DNS name>
-      port: <Endpoint port number>
+      dnsName: <Primary Endpoint DNS name>
+      port: <Primary Endpoint port number>
+    readableSecondaries:
+      type: LoadBalancer
+      dnsName: <Secondary Endpoint DNS name>
+      port: <Secondary Endpoint port number>
   storage:
     data:
       volumes: