Skip to content

Commit 6055768

Browse files
jlichwajlichwa
authored
Update key-vault-linux.md
1 parent 31e2d25 commit 6055768

File tree

1 file changed

+47
-58
lines changed

1 file changed

+47
-58
lines changed

‎articles/virtual-machines/extensions/key-vault-linux.md

Lines changed: 47 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ The Key Vault VM extension supports these Linux distributions:
3434

3535
Version 3.0+ of the Key Vault VM extension for Linux adds support for the following features:
3636

37-
- Add ACL permissions for downloaded certificates
37+
- Add ACL permissions for downloaded certificates to provide read access for users and groups
3838
- Certificate installation location configuration
3939
- Custom symbolic name support
4040
- VM extension logging integration support through [Fluentd](https://www.fluentd.org/)
@@ -99,12 +99,13 @@ The following JSON shows the schema for the Key Vault VM extension. The extensio
9999
"autoUpgradeMinorVersion": true,
100100
"enableAutomaticUpgrade": true,
101101
"settings": {
102-
"loggingSettings": {
102+
"loggingSettings": <Optional logging settings, e.g.:
103+
{
103104
"logger": <Logger engine name. e.g.: "fluentd">,
104-
"endpoint": <Logger listening endpoint "unix:///var/run/azuremonitoragent/sometenant/default_fluent.socket">,
105+
"endpoint": <Logger listening endpoint "tcp://localhost:24224">,
105106
"format": <Logging format. e.g.: "forward">,
106107
"servicename": <Service name used in logs. e.g.: "akvvm_service">
107-
},
108+
}>,
108109
"secretsManagementSettings": {
109110
"pollingIntervalInS": <polling interval in seconds, e.g. "3600">,
110111
"linkOnRenewal": <Not available on Linux e.g.: false>,
@@ -137,10 +138,11 @@ The following JSON shows the schema for the Key Vault VM extension. The extensio
137138
}
138139
]>
139140
},
140-
"authenticationSettings": {
141+
"authenticationSettings": <Optional msi settings, e.g.:
142+
{
141143
"msiEndpoint": <Required when msiClientId is provided. MSI endpoint e.g. for most Azure VMs: "http://169.254.169.254/metadata/identity">,
142144
"msiClientId": <Required when VM has any user assigned identities. MSI identity e.g.: "c7373ae5-91c2-4165-8ab6-7381d6e75619".>
143-
}
145+
}>
144146
}
145147
}
146148
}
@@ -201,44 +203,47 @@ The following JSON shows the schema for the Key Vault VM extension. The extensio
201203

202204
| Name | Value / Example | Data Type |
203205
| ---- | ---- | ---- |
204-
| apiVersion | 2022-07-01 | date |
205-
| publisher | Microsoft.Azure.KeyVault | string |
206-
| type | KeyVaultForLinux | string |
207-
| typeHandlerVersion | 3.0 | int |
208-
| pollingIntervalInS | 3600 | string |
209-
| certificateStoreName | It's ignored on Linux | string |
210-
| linkOnRenewal | false | boolean |
211-
| requireInitialSync | true | boolean |
212-
| certificateStoreLocation | /var/lib/waagent/Microsoft.Azure.KeyVault.Store | string |
213-
| observedCertificates | [{...}, {...}] | string array |
214-
| observedCertificates/url | "https://myvault.vault.azure.net/secrets/mycertificate1" | string |
215-
| observedCertificates/certificateStoreLocation | "/var/lib/waagent/Microsoft.Azure.KeyVault/app1" | string |
216-
| observedCertificates/customSymbolicLinkName | "app1Cert1" | string |
217-
| observedCertificates/acls | "{...}, {...}" | string array |
218-
| msiEndpoint | http://169.254.169.254/metadata/identity | string |
219-
| msiClientId | c7373ae5-91c2-4165-8ab6-7381d6e75619 | string |
220-
| logger | "fluentd" | string |
221-
| endpoint | "unix:///var/run/azuremonitoragent/sometenant/default_fluent.socket" | string |
222-
| format | "forward" | string |
223-
| servicename | "akvvm_service" | string |
206+
| `apiVersion` | 2022-07-01 | date |
207+
| `publisher` | Microsoft.Azure.KeyVault | string |
208+
| `type` | KeyVaultForLinux | string |
209+
| `typeHandlerVersion` | 3.0 | int |
210+
| `pollingIntervalInS` | 3600 | string |
211+
| `certificateStoreName` | It's ignored on Linux | string |
212+
| `linkOnRenewal` | false | boolean |
213+
| `requireInitialSync` | true | boolean |
214+
| `aclEnabled` | true | boolean |
215+
| `certificateStoreLocation` | /var/lib/waagent/Microsoft.Azure.KeyVault.Store | string |
216+
| `observedCertificates` | [{...}, {...}] | string array |
217+
| `observedCertificates/url` | "https://myvault.vault.azure.net/secrets/mycertificate1" | string |
218+
| `observedCertificates/certificateStoreLocation` | "/var/lib/waagent/Microsoft.Azure.KeyVault/app1" | string |
219+
| `observedCertificates/customSymbolicLinkName` (optional) | "app1Cert1" | string |
220+
| `observedCertificates/acls` (optional) | "{...}, {...}" | string array |
221+
| `authenticationSettings` (optional) | {...} | object |
222+
| `authenticationSettings/msiEndpoint` | http://169.254.169.254/metadata/identity | string |
223+
| `authenticationSettings/msiClientId` | c7373ae5-91c2-4165-8ab6-7381d6e75619 | string |
224+
| `loggingSettings` (optional) | {...} | object |
225+
| `loggingSettings/logger` | "fluentd" | string |
226+
| `loggingSettings/endpoint` | "tcp://localhost:24224" | string |
227+
| `loggingSettings/format` | "forward" | string |
228+
| `loggingSettings/servicename` | "akvvm_service" | string |
224229

225230

226231
#### [Version-1.0/2.0](#tab/version12)
227232

228233
| Name | Value / Example | Data Type |
229234
| ---- | ---- | ---- |
230-
| apiVersion | 2022-07-01 | date |
231-
| publisher | Microsoft.Azure.KeyVault | string |
232-
| type | KeyVaultForLinux | string |
233-
| typeHandlerVersion | 2.0 | int |
234-
| pollingIntervalInS | 3600 | string |
235-
| certificateStoreName | It's ignored on Linux | string |
236-
| linkOnRenewal | false | boolean |
237-
| certificateStoreLocation | /var/lib/waagent/Microsoft.Azure.KeyVault.Store | string |
238-
| requireInitialSync | true | boolean |
239-
| observedCertificates | ["https://myvault.vault.azure.net/secrets/mycertificate", "https://myvault.vault.azure.net/secrets/mycertificate2"] | string array
240-
| msiEndpoint | http://169.254.169.254/metadata/identity | string |
241-
| msiClientId | c7373ae5-91c2-4165-8ab6-7381d6e75619 | string |
235+
| `apiVersion` | 2022-07-01 | date |
236+
| `publisher` | Microsoft.Azure.KeyVault | string |
237+
| `type` | KeyVaultForLinux | string |
238+
| `typeHandlerVersion` | 2.0 | int |
239+
| `pollingIntervalInS` | 3600 | string |
240+
| `certificateStoreName` | It's ignored on Linux | string |
241+
| `linkOnRenewal` | false | boolean |
242+
| `certificateStoreLocation` | /var/lib/waagent/Microsoft.Azure.KeyVault.Store | string |
243+
| `requireInitialSync` | true | boolean |
244+
| `observedCertificates` | ["https://myvault.vault.azure.net/secrets/mycertificate", "https://myvault.vault.azure.net/secrets/mycertificate2"] | string array
245+
| `msiEndpoint` | http://169.254.169.254/metadata/identity | string |
246+
| `msiClientId` | c7373ae5-91c2-4165-8ab6-7381d6e75619 | string |
242247

243248
---
244249

@@ -270,15 +275,10 @@ The JSON configuration for a virtual machine extension must be nested inside the
270275
"autoUpgradeMinorVersion": true,
271276
"enableAutomaticUpgrade": true,
272277
"settings": {
273-
"loggingSettings": {
274-
"logger": <Logger engine name. e.g.: "fluentd">,
275-
"endpoint": <Logger listening endpoint "unix:///var/run/azuremonitoragent/sometenant/default_fluent.socket">,
276-
"format": <Logging format. e.g.: "forward">,
277-
"servicename": <Service name used in logs. e.g.: "akvvm_service">
278-
},
279278
"secretsManagementSettings": {
280279
"pollingIntervalInS": <polling interval in seconds, e.g. "3600">,
281280
"requireInitialSync": <initial synchronization of certificates e..g: false>,
281+
"aclEnabled": <enables/disables acls on defined certificates e.g.: true>,
282282
"observedCertificates": <An array of KeyVault URIs that represent monitored certificates, including certificate store location and ACL permission to certificate private key. Example:
283283
[
284284
{
@@ -383,15 +383,10 @@ The following JSON snippets provide example settings for deploying the Key Vault
383383

384384
```json
385385
{
386-
"loggingSettings": {
387-
"logger": "fluentd",
388-
"endpoint": "unix:///var/run/azuremonitoragent/sometenant/default_fluent.socket",
389-
"format": "forward",
390-
"servicename": "akvvm_service"
391-
},
392386
"secretsManagementSettings": {
393387
"pollingIntervalInS": "3600",
394388
"linkOnRenewal": true,
389+
"aclEnabled": true,
395390
"observedCertificates":
396391
[
397392
{
@@ -513,15 +508,10 @@ The following JSON snippets provide example settings for deploying the Key Vault
513508

514509
```json
515510
{
516-
"loggingSettings": {
517-
"logger": "fluentd",
518-
"endpoint": "unix:///var/run/azuremonitoragent/sometenant/default_fluent.socket",
519-
"format": "forward",
520-
"servicename": "akvvm_service"
521-
},
522511
"secretsManagementSettings": {
523512
"pollingIntervalInS": "3600",
524513
"linkOnRenewal": true,
514+
"aclEnabled": true,
525515
"observedCertificates":
526516
[
527517
{
@@ -637,7 +627,7 @@ Get-AzVMExtension -VMName <vmName> -ResourceGroupname <resource group name>
637627

638628
### Logs and configuration
639629

640-
The Key Vault VM extension logs exist locally on the VM and are most informative when it comes to troubleshooting.
630+
The Key Vault VM extension logs exist locally on the VM and are most informative when it comes to troubleshooting. You can use optional logging section to integrate with logging provider through `fluentd`
641631

642632
|Location|Description|
643633
|--|--|
@@ -655,7 +645,6 @@ Symbolic links or Symlinks are advanced shortcuts. To avoid monitoring the folde
655645
* Is there's a limit on the number of observedCertificates you can configure?
656646
No, Key Vault VM Extension doesn’t have limit on the number of observedCertificates.
657647

658-
659648
### Support
660649

661650
If you need more help at any point in this article, you can contact the Azure experts on the [MSDN Azure and Stack Overflow forums](https://azure.microsoft.com/support/forums/). Alternatively, you can file an Azure support incident. Go to the [Azure support site](https://azure.microsoft.com/support/options/) and select Get support. For information about using Azure Support, read the [Microsoft Azure support FAQ](https://azure.microsoft.com/support/faq/).

0 commit comments

Comments
 (0)