Skip to content

Commit 621bf26

Browse files
craigshoemakercraigshoemaker
committed
move Managed Identity section to usage article
1 parent f0481c8 commit 621bf26

File tree

2 files changed

+114
-114
lines changed

2 files changed

+114
-114
lines changed

‎articles/container-apps/sessions-code-interpreter.md

Lines changed: 1 addition & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.topic: how-to
8-
ms.date: 04/07/2025
8+
ms.date: 05/19/2025
99
ms.author: cshoe
1010
ms.custom: references_regions
1111
ms.collection: ce-skilling-ai-copilot
@@ -157,118 +157,6 @@ The following listing shows a sample of the type of response you can expect from
157157

158158
Code interpreter sessions are designed to run untrusted code in isolated environments, ensuring that your applications and data remain protected.
159159

160-
### Use managed identity
161-
162-
A managed identity from Microsoft Entra ID allows your container session pools and their sessions to access other Microsoft Entra protected resources. Both system-assigned and user-assigned managed identities are supported in a session pool.
163-
164-
For more about managed identities in Microsoft Entra ID, see [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).
165-
166-
There are two ways to use managed identities with custom container session pools:
167-
168-
- **Image pull authentication**: Use the managed identity to authenticate with the container registry to pull the container image.
169-
170-
- **Resource access**: Use the session pool's managed identity in a session to access other Microsoft Entra protected resources. Due to its security implications, this capability is disabled by default.
171-
172-
> [!IMPORTANT]
173-
> If you enable access to managed identity in a session, any code or programs running in the session can create Microsoft Entra tokens for the pool's managed identity. Since sessions typically run untrusted code, use this feature with extreme caution.
174-
175-
# [Azure CLI](#tab/azure-cli)
176-
177-
To enable managed identity for a custom container session pool, use Azure Resource Manager.
178-
179-
# [Azure Resource Manager](#tab/arm)
180-
181-
To enable managed identity for a custom container session pool, you add an `identity` property to the session pool resource.
182-
183-
The `identity` property must have a `type` property with the value `SystemAssigned` or `UserAssigned`. For more information on how to configure this property, see [Configure managed identities](managed-identity.md?tabs=arm%2Cdotnet#configure-managed-identities).
184-
185-
The following example shows an ARM template snippet that enables a user-assigned identity for a custom container session pool and use it for image pull authentication.
186-
187-
Before you send the request, replace the placeholders between the `<>` brackets with the appropriate values for your session pool and session identifier.
188-
189-
```json
190-
{
191-
"type": "Microsoft.App/sessionPools",
192-
"apiVersion": "2024-08-02-preview",
193-
"name": "my-session-pool",
194-
"location": "westus2",
195-
"properties": {
196-
"environmentId": "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerApps/environments/<ENVIRONMENT_NAME>",
197-
"poolManagementType": "Dynamic",
198-
"containerType": "CustomContainer",
199-
"scaleConfiguration": {
200-
"maxConcurrentSessions": 10,
201-
"readySessionInstances": 5
202-
},
203-
"dynamicPoolConfiguration": {
204-
"executionType": "Timed",
205-
"cooldownPeriodInSeconds": 600
206-
},
207-
"customContainerTemplate": {
208-
"registryCredentials": {
209-
"server": "myregistry.azurecr.io",
210-
"identity": "<IDENTITY_RESOURCE_ID>"
211-
},
212-
"containers": [
213-
{
214-
"image": "myregistry.azurecr.io/my-container-image:1.0",
215-
"name": "mycontainer",
216-
"resources": {
217-
"cpu": 0.25,
218-
"memory": "0.5Gi"
219-
},
220-
"command": [
221-
"/bin/sh"
222-
],
223-
"args": [
224-
"-c",
225-
"while true; do echo hello; sleep 10;done"
226-
],
227-
"env": [
228-
{
229-
"name": "key1",
230-
"value": "value1"
231-
},
232-
{
233-
"name": "key2",
234-
"value": "value2"
235-
}
236-
]
237-
}
238-
],
239-
"ingress": {
240-
"targetPort": 80
241-
}
242-
},
243-
"sessionNetworkConfiguration": {
244-
"status": "EgressEnabled"
245-
},
246-
"managedIdentitySettings": [
247-
{
248-
"identity": "<IDENTITY_RESOURCE_ID>",
249-
"lifecycle": "None"
250-
}
251-
]
252-
},
253-
"identity": {
254-
"type": "UserAssigned",
255-
"userAssignedIdentities": {
256-
"<IDENTITY_RESOURCE_ID>": {}
257-
}
258-
}
259-
}
260-
```
261-
262-
This template contains the following settings for managed identity:
263-
264-
| Parameter | Value | Description |
265-
|---------|-------|-------------|
266-
| `customContainerTemplate.registryCredentials.identity` | `<IDENTITY_RESOURCE_ID>` | The resource ID of the managed identity to use for image pull authentication. |
267-
| `managedIdentitySettings.identity` | `<IDENTITY_RESOURCE_ID>` | The resource ID of the managed identity to use in the session. |
268-
| `managedIdentitySettings.lifecycle` | `None` | The session lifecycle where the managed identity is available.<br><br>- `None` (default): The session can't access the identity. This setting is only used for image pull.<br><br>- `Main`: In addition to image pull, the main session can also access the identity. **Use with caution.** |
269-
270-
---
271-
272160
## LLM framework integrations
273161

274162
Instead of using the session pool management API directly, the following LLM frameworks provide integrations with code interpreter sessions:

‎articles/container-apps/sessions-usage.md

Lines changed: 113 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.topic: conceptual
8-
ms.date: 04/07/2025
8+
ms.date: 05/19/2025
99
ms.author: cshoe
1010
ms.custom: references_regions, ignite-2024
1111
---
@@ -203,6 +203,118 @@ Example strategies include:
203203
> [!IMPORTANT]
204204
> Failure to secure access to sessions could result in misuse or unauthorized access to data stored in your users' sessions.
205205
206+
### Use managed identity
207+
208+
A managed identity from Microsoft Entra ID allows your container session pools and their sessions to access other Microsoft Entra protected resources. Both system-assigned and user-assigned managed identities are supported in a session pool.
209+
210+
For more about managed identities in Microsoft Entra ID, see [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).
211+
212+
There are two ways to use managed identities with custom container session pools:
213+
214+
- **Image pull authentication**: Use the managed identity to authenticate with the container registry to pull the container image.
215+
216+
- **Resource access**: Use the session pool's managed identity in a session to access other Microsoft Entra protected resources. Due to its security implications, this capability is disabled by default.
217+
218+
> [!IMPORTANT]
219+
> If you enable access to managed identity in a session, any code or programs running in the session can create Microsoft Entra tokens for the pool's managed identity. Since sessions typically run untrusted code, use this feature with extreme caution.
220+
221+
# [Azure CLI](#tab/azure-cli)
222+
223+
To enable managed identity for a custom container session pool, use Azure Resource Manager.
224+
225+
# [Azure Resource Manager](#tab/arm)
226+
227+
To enable managed identity for a custom container session pool, you add an `identity` property to the session pool resource.
228+
229+
The `identity` property must have a `type` property with the value `SystemAssigned` or `UserAssigned`. For more information on how to configure this property, see [Configure managed identities](managed-identity.md?tabs=arm%2Cdotnet#configure-managed-identities).
230+
231+
The following example shows an ARM template snippet that enables a user-assigned identity for a custom container session pool and use it for image pull authentication.
232+
233+
Before you send the request, replace the placeholders between the `<>` brackets with the appropriate values for your session pool and session identifier.
234+
235+
```json
236+
{
237+
"type": "Microsoft.App/sessionPools",
238+
"apiVersion": "2024-08-02-preview",
239+
"name": "my-session-pool",
240+
"location": "westus2",
241+
"properties": {
242+
"environmentId": "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerApps/environments/<ENVIRONMENT_NAME>",
243+
"poolManagementType": "Dynamic",
244+
"containerType": "CustomContainer",
245+
"scaleConfiguration": {
246+
"maxConcurrentSessions": 10,
247+
"readySessionInstances": 5
248+
},
249+
"dynamicPoolConfiguration": {
250+
"executionType": "Timed",
251+
"cooldownPeriodInSeconds": 600
252+
},
253+
"customContainerTemplate": {
254+
"registryCredentials": {
255+
"server": "myregistry.azurecr.io",
256+
"identity": "<IDENTITY_RESOURCE_ID>"
257+
},
258+
"containers": [
259+
{
260+
"image": "myregistry.azurecr.io/my-container-image:1.0",
261+
"name": "mycontainer",
262+
"resources": {
263+
"cpu": 0.25,
264+
"memory": "0.5Gi"
265+
},
266+
"command": [
267+
"/bin/sh"
268+
],
269+
"args": [
270+
"-c",
271+
"while true; do echo hello; sleep 10;done"
272+
],
273+
"env": [
274+
{
275+
"name": "key1",
276+
"value": "value1"
277+
},
278+
{
279+
"name": "key2",
280+
"value": "value2"
281+
}
282+
]
283+
}
284+
],
285+
"ingress": {
286+
"targetPort": 80
287+
}
288+
},
289+
"sessionNetworkConfiguration": {
290+
"status": "EgressEnabled"
291+
},
292+
"managedIdentitySettings": [
293+
{
294+
"identity": "<IDENTITY_RESOURCE_ID>",
295+
"lifecycle": "None"
296+
}
297+
]
298+
},
299+
"identity": {
300+
"type": "UserAssigned",
301+
"userAssignedIdentities": {
302+
"<IDENTITY_RESOURCE_ID>": {}
303+
}
304+
}
305+
}
306+
```
307+
308+
This template contains the following settings for managed identity:
309+
310+
| Parameter | Value | Description |
311+
|---------|-------|-------------|
312+
| `customContainerTemplate.registryCredentials.identity` | `<IDENTITY_RESOURCE_ID>` | The resource ID of the managed identity to use for image pull authentication. |
313+
| `managedIdentitySettings.identity` | `<IDENTITY_RESOURCE_ID>` | The resource ID of the managed identity to use in the session. |
314+
| `managedIdentitySettings.lifecycle` | `None` | The session lifecycle where the managed identity is available.<br><br>- `None` (default): The session can't access the identity. This setting is only used for image pull.<br><br>- `Main`: In addition to image pull, the main session can also access the identity. **Use with caution.** |
315+
316+
---
317+
206318
## Logging
207319

208320
Console logs from containers running in a session are available in the Azure Log Analytics workspace associated with the Azure Container Apps environment in a table named `AppEnvSessionConsoleLogs_CL`.

0 commit comments

Comments
 (0)