You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/concepts-network.md
+17-9Lines changed: 17 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,19 +24,27 @@ This article introduces the core concepts that provide networking to your applic
24
24
*[Network policies](#network-policies)
25
25
26
26
## Kubernetes basics
27
+
Kubernetes employs a virtual networking layer to manage access within and between your applications or their components. This involves the following key aspects:
27
28
28
-
To allow access to your applications or between application components, Kubernetes provides an abstraction layer to virtual networking. Kubernetes nodes connect to a virtual network, providing inbound and outbound connectivity for pods. The *kube-proxy* component runs on each node to provide these network features.
29
+
-**Kubernetes nodes and virtual network**: Kubernetes nodes are connected to a virtual network. This setup enables pods (basic units of deployment in Kubernetes) to have both inbound and outbound connectivity.
29
30
30
-
In Kubernetes:
31
+
-**Kube-proxy component**: Running on each node, kube-proxy is responsible for providing the necessary network features.
31
32
32
-
**Services* logically group pods to allow for direct access on a specific port via an IP address or DNS name.
33
-
**ServiceTypes* allow you to specify what kind of Service you want.
34
-
* You can distribute traffic using a *load balancer*.
35
-
* Layer 7 routing of application traffic can also be achieved with *ingress controllers*.
36
-
* You can *control outbound (egress) traffic* for cluster nodes.
37
-
* Security and filtering of the network traffic for pods is possible with *network policies*.
33
+
Regarding specific Kubernetes functionalities:
38
34
39
-
The Azure platform also simplifies virtual networking for AKS clusters. When you create a Kubernetes load balancer, you also create and configure the underlying Azure load balancer resource. As you open network ports to pods, the corresponding Azure network security group rules are configured. For HTTP application routing, Azure can also configure *external DNS* as new Ingress routes are configured.
35
+
-**Services**: These are used to logically group pods, allowing direct access to them through a specific IP address or DNS name on a designated port.
36
+
-**Service types**: This feature lets you specify the kind of Service you wish to create.
37
+
-**Load balancer**: You can use a load balancer to distribute network traffic evenly across various resources.
38
+
-**Ingress controllers**: These facilitate Layer 7 routing, which is essential for directing application traffic.
39
+
-**Egress traffic control**: Kubernetes allows you to manage and control outbound traffic from cluster nodes.
40
+
-**Network policies**: These policies enable security measures and filtering for network traffic in pods.
41
+
42
+
In the context of the Azure platform:
43
+
44
+
- Azure streamlines virtual networking for AKS (Azure Kubernetes Service) clusters.
45
+
- Creating a Kubernetes load balancer on Azure simultaneously sets up the corresponding Azure load balancer resource.
46
+
- As you open network ports to pods, Azure automatically configures the necessary network security group rules.
47
+
- Azure can also manage external DNS configurations for HTTP application routing as new Ingress routes are established.
Copy file name to clipboardExpand all lines: articles/azure-functions/functions-scale.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ The Azure Functions hosting plan you choose dictates the following behaviors:
16
16
* The resources available to each function app instance.
17
17
* Support for advanced functionality, such as Azure Virtual Network connectivity.
18
18
19
-
In addition to Azure Functions hosting, you can also host containerized function apps in containers can also be deployed to Kubernetes clusters and to Azure Container Apps. If you choose to host your functions in a Kubernetes cluster, consider using an [Azure Arc-enabled Kubernetes cluster](../azure-arc/kubernetes/overview.md). To learn more about deploying custom container apps, see [Azure Container Apps hosting of Azure Functions](./functions-container-apps-hosting.md).
19
+
In addition to Azure Functions hosting, you can also host containerized function apps in containers that can be deployed to Kubernetes clusters or to Azure Container Apps. If you choose to host your functions in a Kubernetes cluster, consider using an [Azure Arc-enabled Kubernetes cluster](../azure-arc/kubernetes/overview.md). To learn more about deploying custom container apps, see [Azure Container Apps hosting of Azure Functions](./functions-container-apps-hosting.md).
20
20
21
21
This article provides a detailed comparison between the various hosting plans, including container-based hosting options.
Copy file name to clipboardExpand all lines: articles/iot-operations/deploy-iot-ops/howto-manage-secrets.md
+102-1Lines changed: 102 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ author: kgremban
5
5
ms.author: kgremban
6
6
# ms.subservice: orchestrator
7
7
ms.topic: how-to
8
-
ms.date: 12/06/2023
8
+
ms.date: 12/19/2023
9
9
ms.custom:
10
10
- ignite-2023
11
11
@@ -26,6 +26,107 @@ Azure IoT Operations supports Azure Key Vault for storing secrets and certificat
26
26
27
27
For more information, see [Deploy Azure IoT Operations extensions](./howto-deploy-iot-operations.md?tabs=cli).
28
28
29
+
## Configure service principal and Azure Key Vault upfront
30
+
31
+
If the Azure account executing the `az iot ops init` command does not have permissions to query the Azure Resource Graph and create service principals, you can prepare these upfront and use extra arguments when running the CLI command as described in [Deploy Azure IoT Operations extensions](./howto-deploy-iot-operations.md?tabs=cli).
32
+
33
+
### Configure service principal for interacting with Azure Key Vault via Microsoft Entra ID
34
+
35
+
Follow these steps to create a new Application Registration that will be used by the AIO application to authenticate to Key Vault.
36
+
37
+
First, register an application with Microsoft Entra ID.
38
+
39
+
1. In the Azure portal search bar, search for and select **Microsoft Entra ID**.
40
+
41
+
1. Select **App registrations** from the **Manage** section of the Microsoft Entra ID menu.
42
+
43
+
1. Select **New registration**.
44
+
45
+
1. On the **Register an application** page, provide the following information:
46
+
47
+
| Field | Value |
48
+
| ----- | ----- |
49
+
|**Name**| Provide a name for your application. |
50
+
|**Supported account types**| Ensure that **Accounts in this organizational directory only (<YOUR_TENANT_NAME> only - Single tenant)** is selected. |
51
+
|**Redirect URI**| Select **Web** as the platform. You can leave the web address empty. |
52
+
53
+
1. Select **Register**.
54
+
55
+
When your application is created, you are directed to its resource page.
56
+
57
+
1. Copy the **Application (client) ID** from the app registration overview page. You'll use this value as an argument when running Azure IoT Operations deployment.
58
+
59
+
Next, give your application permissions for key vault.
60
+
61
+
1. On the resource page for your app, select **API permissions** from the **Manage** section of the app menu.
62
+
63
+
1. Select **Add a permission**.
64
+
65
+
1. On the **Request API permissions** page, scroll down and select **Azure Key Vault**.
66
+
67
+
1. Select **Delegated permissions**.
68
+
69
+
1. Check the box to select **user_impersonation** permissions.
70
+
71
+
1. Select **Add permissions**.
72
+
73
+
Create a client secret that will be added to your Kubernetes cluster to authenticate to your key vault.
74
+
75
+
1. On the resource page for your app, select **Certificates & secrets** from the **Manage** section of the app menu.
76
+
77
+
1. Select **New client secret**.
78
+
79
+
1. Provide an optional description for the secret, then select **Add**.
80
+
81
+
1. Copy the **Value** and **Secret ID** from your new secret. You'll use these values later below.
82
+
83
+
Retrieve the service principal Object Id
84
+
85
+
1. On the **Overview** page for your app, under the section **Essentials**, click on the **Application name** link under **Managed application in local directory**. This opens the Enterprise Application properties. Copy the Object Id to use when you run `az iot ops init`.
86
+
87
+
### Create an Azure Key Vault
88
+
89
+
Create a new Azure Key Vault service and ensure it has the **Permission Model** set to Vault access policy.
90
+
91
+
```bash
92
+
az keyvault create --enable-rbac-authorization false --name "<your unique key vault name>" --resource-group "<the name of the resource group>"
93
+
```
94
+
If you have an existing key vault, you can change the permission model by executing the following:
95
+
96
+
```bash
97
+
az keyvault update --name "<your unique key vault name>" --resource-group "<the name of the resource group>" --enable-rbac-authorization false
98
+
```
99
+
You will need the Key Vault resource ID when you run `az iot ops init`. To retrieve the resource ID, run:
100
+
101
+
```bash
102
+
az keyvault show --name "<your unique key vault name>" --resource-group "<the name of the resource group>" --query id -o tsv
103
+
```
104
+
105
+
### Set service principal access policy in Azue Key Vault
106
+
107
+
The newly created service principal needs **Secret**`list` and `get` access policy for the Azure IoT Operations to work with the secret store.
108
+
109
+
Run the following to assign **secret**`get` and `list` permissions to the service principal.
110
+
111
+
```bash
112
+
az keyvault set-policy --name "<your unique key vault name>" --resource-group "<the name of the resource group>" --object-id <Object ID copied from Enterprise Application SP in Microsoft Entra ID> --secret-permissions get list --key-permissions get list
113
+
```
114
+
115
+
### Pass service principal and Key Vault arguments to Azure IoT Operations deployment
116
+
117
+
When following the guide [Deploy Azure IoT Operations extensions](./howto-deploy-iot-operations.md?tabs=cli), you will need to pass in additional flags to the `az iot ops init` command in order to use the pre-configured service principal and key vault.
118
+
119
+
The following example shows how to prepare the cluster for Azure IoT Operations without fully deploying it by using `--no-deploy` flag. You can also run the command without this argument for a default Azure IoT Operations deployment.
120
+
121
+
```bash
122
+
az iot ops init --name "<your unique key vault name>" --resource-group "<the name of the resource group>" \
123
+
--kv-id <Key Vault Resource ID> \
124
+
--sp-app-id <Application registration App ID (client ID) from Microsoft Entra ID> \
125
+
--sp-object-id <Object ID copied from Enterprise Application in Microsoft Entra ID> \
126
+
--sp-secret "<Client Secret from App registration in Microsoft Entra ID>" \
127
+
--no-deploy
128
+
```
129
+
29
130
## Add a secret to an Azure IoT Operations component
30
131
31
132
Once you have the secret store set up on your cluster, you can create and add Azure Key Vault secrets.
0 commit comments