Skip to content

Commit 5b9fe83

Browse files
KellylorenebakerKellylorenebaker
authored
Merge pull request #101591 from dlepow/acifix2
[ACI] Encrypt and dedicated host updates
2 parents 9cd4b52 + fecb21e commit 5b9fe83

File tree

2 files changed

+148
-22
lines changed

2 files changed

+148
-22
lines changed

‎articles/container-instances/container-instances-dedicated-hosts.md

Lines changed: 41 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
---
2-
title: Deploy on dedicated hosts
3-
description: Use dedicated hosts to achieve true host level isolation for your workloads
2+
title: Deploy on dedicated host
3+
description: Use a dedicated host to achieve true host-level isolation for your Azure Container Instances workloads
44
ms.topic: article
5-
ms.date: 01/10/2020
6-
ms.author: danlep
5+
ms.date: 01/17/2020
6+
author: dkkapur
7+
ms.author: dekapur
78
---
89

910
# Deploy on dedicated hosts
@@ -12,23 +13,50 @@ ms.author: danlep
1213

1314
The dedicated sku is appropriate for container workloads that require workload isolation from a physical server perspective.
1415

15-
## Using the dedicated sku
16+
## Prerequisites
17+
18+
* The default limit for any subscription to use the dedicated sku is 0. If you would like to use this sku for your production container deployments, create an [Azure Support request][azure-support] to increase the limit.
19+
20+
## Use the dedicated sku
1621

1722
> [!IMPORTANT]
18-
> Using the dedicated sku is only available in the latest API version (2019-12-01) that is currently rolling out. Specify this API version in your deployment template. Additionally, the default limit for any subscription to use the dedicated sku is 0. If you would like to use this sku for your production container deployments, please create an [Azure Support request][azure-support]
23+
> Using the dedicated sku is only available in the latest API version (2019-12-01) that is currently rolling out. Specify this API version in your deployment template.
24+
>
1925
20-
Starting with API version 2019-12-01, there is a "sku" property under the container group properties section of a deployment template, which is required for an ACI deployment. Currently, you can use this property as part of an Azure Resource Manager deployment template for ACI. You can learn more about deploying ACI resources with a template in the [Tutorial: Deploy a multi-container group using a Resource Manager template](https://docs.microsoft.com/azure/container-instances/container-instances-multi-container-group).
26+
Starting with API version 2019-12-01, there is a `sku` property under the container group properties section of a deployment template, which is required for an ACI deployment. Currently, you can use this property as part of an Azure Resource Manager deployment template for ACI. Learn more about deploying ACI resources with a template in the [Tutorial: Deploy a multi-container group using a Resource Manager template](https://docs.microsoft.com/azure/container-instances/container-instances-multi-container-group).
2127

22-
The sku property can have one of the following values:
23-
* Standard - the standard ACI deployment choice, which still guarantees hypervisor-level security
24-
* Dedicated - used for workload level isolation with dedicated physical hosts for the container group
28+
The `sku` property can have one of the following values:
29+
* `Standard` - the standard ACI deployment choice, which still guarantees hypervisor-level security
30+
* `Dedicated` - used for workload level isolation with dedicated physical hosts for the container group
2531

2632
## Modify your JSON deployment template
2733

28-
In your deployment template, where the container group resource is specified, ensure that the `"apiVersion": "2019-12-01",`. In the properties section of the container group resource, set `"sku": "Dedicated",`.
34+
In your deployment template, modify or add the following properties:
35+
* Under `resources`, set `apiVersion` to `2012-12-01`.
36+
* Under the container group properties, add a `sku` property with value `Dedicated`.
2937

3038
Here is an example snippet for the resources section of a container group deployment template that uses the dedicated sku:
3139

40+
```json
41+
[...]
42+
"resources": [
43+
{
44+
"name": "[parameters('containerGroupName')]",
45+
"type": "Microsoft.ContainerInstance/containerGroups",
46+
"apiVersion": "2019-12-01",
47+
"location": "[resourceGroup().location]",
48+
"properties": {
49+
"sku": "Dedicated",
50+
"containers": {
51+
[...]
52+
}
53+
}
54+
}
55+
]
56+
```
57+
58+
Following is a complete template that deploys a sample container group running a single container instance:
59+
3260
```json
3361
{
3462
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
@@ -86,9 +114,8 @@ Here is an example snippet for the resources section of a container group deploy
86114
],
87115
"type": "Public"
88116
},
89-
"osType": "Linux",
117+
"osType": "Linux"
90118
},
91-
"location": "eastus2euap",
92119
"tags": {}
93120
}
94121
]
@@ -111,7 +138,7 @@ Deploy the template with the [az group deployment create][az-group-deployment-cr
111138
az group deployment create --resource-group myResourceGroup --template-file deployment-template.json
112139
```
113140

114-
Within a few seconds, you should receive an initial response from Azure. Once the deployment completes, all data related to it persisted by the ACI service will be encrypted with the key you provided.
141+
Within a few seconds, you should receive an initial response from Azure. A successful deployment takes place on a dedicated host.
115142

116143
<!-- LINKS - Internal -->
117144
[az-group-create]: /cli/azure/group#az-group-create

‎articles/container-instances/container-instances-encrypt-data.md

Lines changed: 107 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
title: Encrypt deployment data
33
description: Learn about encryption of data persisted for your container instance resources and how to encrypt the data with a customer-managed key
44
ms.topic: article
5-
ms.date: 01/10/2020
6-
ms.author: danlep
5+
ms.date: 01/17/2020
6+
author: dkkapur
7+
ms.author: dekapur
78
---
89

910
# Encrypt deployment data
@@ -83,15 +84,18 @@ The access policy should now show up in your key vault's access policies.
8384
> [!IMPORTANT]
8485
> Encrypting deployment data with a customer-managed key is available in the latest API version (2019-12-01) that is currently rolling out. Specify this API version in your deployment template. If you have any issues with this, please reach out to Azure Support.
8586
86-
Once the key vault key and access policy are set up, add the following property to your ACI deployment template. You can learn more about deploying ACI resources with a template in the [Tutorial: Deploy a multi-container group using a Resource Manager template](https://docs.microsoft.com/azure/container-instances/container-instances-multi-container-group).
87-
88-
Specifically, under the container group properties section of the deployment template, add an "encryptionProperties", which contains the following values:
89-
* vaultBaseUrl: the DNS Name of your key vault, can be found on the overview blade of the key vault resource in Portal
90-
* keyName: the name of the key generated earlier
91-
* keyVersion: the current version of the key. This can be found by clicking into the key itself (under "Keys" in the Settings section of your key vault resource)
87+
Once the key vault key and access policy are set up, add the following properties to your ACI deployment template. Learn more about deploying ACI resources with a template in the [Tutorial: Deploy a multi-container group using a Resource Manager template](https://docs.microsoft.com/azure/container-instances/container-instances-multi-container-group).
88+
* Under `resources`, set `apiVersion` to `2012-12-01`.
89+
* Under the container group properties section of the deployment template, add an `encryptionProperties`, which contains the following values:
90+
* `vaultBaseUrl`: the DNS Name of your key vault, can be found on the overview blade of the key vault resource in Portal
91+
* `keyName`: the name of the key generated earlier
92+
* `keyVersion`: the current version of the key. This can be found by clicking into the key itself (under "Keys" in the Settings section of your key vault resource)
93+
* Under the container group properties, add a `sku` property with value `Standard`. The `sku` property is required in API version 2019-12-01.
9294

95+
The following template snippet shows these additional properties to encrypt deployment data:
9396

9497
```json
98+
[...]
9599
"resources": [
96100
{
97101
"name": "[parameters('containerGroupName')]",
@@ -104,6 +108,7 @@ Specifically, under the container group properties section of the deployment tem
104108
"keyName": "acikey",
105109
"keyVersion": "xxxxxxxxxxxxxxxx"
106110
},
111+
"sku": "Standard",
107112
"containers": {
108113
[...]
109114
}
@@ -112,6 +117,100 @@ Specifically, under the container group properties section of the deployment tem
112117
]
113118
```
114119

120+
Following is a complete template, adapted from the template in [Tutorial: Deploy a multi-container group using a Resource Manager template](https://docs.microsoft.com/azure/container-instances/container-instances-multi-container-group).
121+
122+
```json
123+
{
124+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
125+
"contentVersion": "1.0.0.0",
126+
"parameters": {
127+
"containerGroupName": {
128+
"type": "string",
129+
"defaultValue": "myContainerGroup",
130+
"metadata": {
131+
"description": "Container Group name."
132+
}
133+
}
134+
},
135+
"variables": {
136+
"container1name": "aci-tutorial-app",
137+
"container1image": "mcr.microsoft.com/azuredocs/aci-helloworld:latest",
138+
"container2name": "aci-tutorial-sidecar",
139+
"container2image": "mcr.microsoft.com/azuredocs/aci-tutorial-sidecar"
140+
},
141+
"resources": [
142+
{
143+
"name": "[parameters('containerGroupName')]",
144+
"type": "Microsoft.ContainerInstance/containerGroups",
145+
"apiVersion": "2019-12-01",
146+
"location": "[resourceGroup().location]",
147+
"properties": {
148+
"encryptionProperties": {
149+
"vaultBaseUrl": "https://example.vault.azure.net",
150+
"keyName": "acikey",
151+
"keyVersion": "xxxxxxxxxxxxxxxx"
152+
},
153+
"sku": "Standard",
154+
"containers": [
155+
{
156+
"name": "[variables('container1name')]",
157+
"properties": {
158+
"image": "[variables('container1image')]",
159+
"resources": {
160+
"requests": {
161+
"cpu": 1,
162+
"memoryInGb": 1.5
163+
}
164+
},
165+
"ports": [
166+
{
167+
"port": 80
168+
},
169+
{
170+
"port": 8080
171+
}
172+
]
173+
}
174+
},
175+
{
176+
"name": "[variables('container2name')]",
177+
"properties": {
178+
"image": "[variables('container2image')]",
179+
"resources": {
180+
"requests": {
181+
"cpu": 1,
182+
"memoryInGb": 1.5
183+
}
184+
}
185+
}
186+
}
187+
],
188+
"osType": "Linux",
189+
"ipAddress": {
190+
"type": "Public",
191+
"ports": [
192+
{
193+
"protocol": "tcp",
194+
"port": "80"
195+
},
196+
{
197+
"protocol": "tcp",
198+
"port": "8080"
199+
}
200+
]
201+
}
202+
}
203+
}
204+
],
205+
"outputs": {
206+
"containerIPv4Address": {
207+
"type": "string",
208+
"value": "[reference(resourceId('Microsoft.ContainerInstance/containerGroups/', parameters('containerGroupName'))).ipAddress.ip]"
209+
}
210+
}
211+
}
212+
```
213+
115214
### Deploy your resources
116215

117216
If you created and edited the template file on your desktop, you can upload it to your Cloud Shell directory by dragging the file into it.

0 commit comments

Comments
 (0)