Skip to content

Commit 701667f

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #211219 from macolso/troubleshoot
Troubleshoot cleanup
2 parents bec8716 + 6f631a2 commit 701667f

File tree

2 files changed

+1
-244
lines changed

2 files changed

+1
-244
lines changed

‎articles/container-instances/container-instances-encrypt-data.md

Lines changed: 0 additions & 243 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,6 @@ The rest of the document covers the steps required to encrypt your ACI deploymen
3232

3333
[!INCLUDE [azure-cli-prepare-your-environment.md](../../includes/azure-cli-prepare-your-environment.md)]
3434

35-
This article reviews two flows for encrypting data with a customer-managed key:
36-
* Encrypt data with a customer-managed key stored in a standard Azure Key Vault
37-
* Encrypt data with a customer-managed key stored in a network-protected Azure Key Vault with [Trusted Services](../key-vault/general/network-security.md) enabled.
38-
39-
## Encrypt data with a customer-managed key stored in a standard Azure Key Vault
40-
4135
### Create Service Principal for ACI
4236

4337
The first step is to ensure that your [Azure tenant](../active-directory/develop/quickstart-create-new-tenant.md) has a service principal assigned for granting permissions to the Azure Container Instances service.
@@ -243,243 +237,6 @@ az deployment group create --resource-group myResourceGroup --template-file depl
243237

244238
Within a few seconds, you should receive an initial response from Azure. Once the deployment completes, all data related to it persisted by the ACI service will be encrypted with the key you provided.
245239

246-
## Encrypt data with a customer-managed key in a network protected Azure Key Vault with Trusted Services enabled
247-
248-
### Create a Key Vault resource
249-
250-
Create an Azure Key Vault using [Azure portal](../key-vault/general/quick-create-portal.md), [Azure CLI](../key-vault/general/quick-create-cli.md), or [Azure PowerShell](../key-vault/general/quick-create-powershell.md). To start, do not apply any network-limitations so we can add necessary keys to the vault. In subsequent steps, we will add network-limitations and enable trusted services.
251-
252-
For the properties of your key vault, use the following guidelines:
253-
* Name: A unique name is required.
254-
* Subscription: Choose a subscription.
255-
* Under Resource Group, either choose an existing resource group, or create new and enter a resource group name.
256-
* In the Location pull-down menu, choose a location.
257-
* You can leave the other options to their defaults or pick based on additional requirements.
258-
259-
> [!IMPORTANT]
260-
> When using customer-managed keys to encrypt an ACI deployment template, it is recommended that the following two properties be set on the key vault, Soft Delete and Do Not Purge. These properties are not enabled by default, but can be enabled using either PowerShell or Azure CLI on a new or existing key vault.
261-
262-
### Generate a new key
263-
264-
Once your key vault is created, navigate to the resource in Azure portal. On the left navigation menu of the resource blade, under Settings, click **Keys**. On the view for "Keys," click "Generate/Import" to generate a new key. Use any unique Name for this key, and any other preferences based on your requirements. Make sure to capture key name and version for subsequent steps.
265-
266-
![Screenshot of key creation settings, PNG.](./media/container-instances-encrypt-data/generate-key.png)
267-
268-
### Create a user-assigned managed identity for your container group
269-
Create an identity in your subscription using the [az identity create](/cli/azure/identity#az-identity-create) command. You can use the same resource group used to create the key vault, or use a different one.
270-
271-
```azurecli-interactive
272-
az identity create \
273-
--resource-group myResourceGroup \
274-
--name myACIId
275-
```
276-
277-
To use the identity in the following steps, use the [az identity show](/cli/azure/identity#az-identity-show) command to store the identity's service principal ID and resource ID in variables.
278-
279-
```azurecli-interactive
280-
# Get service principal ID of the user-assigned identity
281-
spID=$(az identity show \
282-
--resource-group myResourceGroup \
283-
--name myACIId \
284-
--query principalId --output tsv)
285-
```
286-
287-
### Set access policy
288-
289-
Create a new access policy for allowing the user-assigned identity to access and unwrap your key for encryption purposes.
290-
291-
```azurecli-interactive
292-
az keyvault set-policy \
293-
--name mykeyvault \
294-
--resource-group myResourceGroup \
295-
--object-id $spID \
296-
--key-permissions get unwrapKey
297-
```
298-
299-
### Modify Azure Key Vault's network permissions
300-
The following commands set up an Azure Firewall for your Azure Key Vault and allow Azure Trusted Services such as ACI access.
301-
302-
```azurecli-interactive
303-
az keyvault update \
304-
--name mykeyvault \
305-
--resource-group myResourceGroup \
306-
--default-action Deny
307-
```
308-
309-
```azurecli-interactive
310-
az keyvault update \
311-
--name mykeyvault \
312-
--resource-group myResourceGroup \
313-
--bypass AzureServices
314-
```
315-
316-
### Modify your JSON deployment template
317-
318-
> [!IMPORTANT]
319-
> Encrypting deployment data with a customer-managed key is available in the 2022-09-01 API version or newer. The 2022-09-01 API version is only available via ARM or REST. If you have any issues with this, please reach out to Azure Support.
320-
321-
Once the key vault key and access policy are set up, add the following properties to your ACI deployment template. Learn more about deploying ACI resources with a template in the [Tutorial: Deploy a multi-container group using a Resource Manager template](./container-instances-multi-container-group.md).
322-
* Under `resources`, set `apiVersion` to `2022-09-01`.
323-
* Under the container group properties section of the deployment template, add an `encryptionProperties`, which contains the following values:
324-
* `vaultBaseUrl`: the DNS Name of your key vault. This can be found on the overview blade of the key vault resource in Portal
325-
* `keyName`: the name of the key generated earlier
326-
* `keyVersion`: the current version of the key. This can be found by clicking into the key itself (under "Keys" in the Settings section of your key vault resource)
327-
* `identity`: this is the resource URI of the Managed Identity instance created earlier
328-
* Under the container group properties, add a `sku` property with value `Standard`. The `sku` property is required in API version 2022-09-01.
329-
* Under resources, add the `identity` object required to use Managed Identity with ACI, which contains the following values:
330-
* `type`: the type of the identity being used (either user-assigned or system-assigned). This case will be set to "UserAssigned"
331-
* `userAssignedIdentities`: the resourceURI of the same user-assigned identity used above in the `encryptionProperties` object.
332-
333-
The following template snippet shows these additional properties to encrypt deployment data:
334-
335-
```json
336-
[...]
337-
"resources": [
338-
{
339-
"name": "[parameters('containerGroupName')]",
340-
"type": "Microsoft.ContainerInstance/containerGroups",
341-
"apiVersion": "2019-12-01",
342-
"location": "[resourceGroup().location]",
343-
"identity": {
344-
"type": "UserAssigned",
345-
"userAssignedIdentities": {
346-
"/subscriptions/XXXXXXXXXXXXXXXXXXXXXX/resourcegroups/XXXXXXXXXXXXXXXXXXXXXX/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myACIId": {}
347-
}
348-
},
349-
"properties": {
350-
"encryptionProperties": {
351-
"vaultBaseUrl": "https://example.vault.azure.net",
352-
"keyName": "acikey",
353-
"keyVersion": "xxxxxxxxxxxxxxxx",
354-
"identity": "/subscriptions/XXXXXXXXXXXXXXXXXXXXXX/resourcegroups/XXXXXXXXXXXXXXXXXXXXXX/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myACIId"
355-
},
356-
"sku": "Standard",
357-
"containers": {
358-
[...]
359-
}
360-
}
361-
}
362-
]
363-
```
364-
365-
Following is a complete template, adapted from the template in [Tutorial: Deploy a multi-container group using a Resource Manager template](./container-instances-multi-container-group.md).
366-
367-
```json
368-
{
369-
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
370-
"contentVersion": "1.0.0.0",
371-
"parameters": {
372-
"containerGroupName": {
373-
"type": "string",
374-
"defaultValue": "myContainerGroup",
375-
"metadata": {
376-
"description": "Container Group name."
377-
}
378-
}
379-
},
380-
"variables": {
381-
"container1name": "aci-tutorial-app",
382-
"container1image": "mcr.microsoft.com/azuredocs/aci-helloworld:latest",
383-
"container2name": "aci-tutorial-sidecar",
384-
"container2image": "mcr.microsoft.com/azuredocs/aci-tutorial-sidecar"
385-
},
386-
"resources": [
387-
{
388-
"name": "[parameters('containerGroupName')]",
389-
"type": "Microsoft.ContainerInstance/containerGroups",
390-
"apiVersion": "2022-09-01",
391-
"location": "[resourceGroup().location]",
392-
"identity": {
393-
"type": "UserAssigned",
394-
"userAssignedIdentities": {
395-
"/subscriptions/XXXXXXXXXXXXXXXXXXXXXX/resourcegroups/XXXXXXXXXXXXXXXXXXXXXX/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myACIId": {}
396-
}
397-
},
398-
"properties": {
399-
"encryptionProperties": {
400-
"vaultBaseUrl": "https://example.vault.azure.net",
401-
"keyName": "acikey",
402-
"keyVersion": "xxxxxxxxxxxxxxxx",
403-
"identity": "/subscriptions/XXXXXXXXXXXXXXXXXXXXXX/resourcegroups/XXXXXXXXXXXXXXXXXXXXXX/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myACIId"
404-
},
405-
"sku": "Standard",
406-
"containers": [
407-
{
408-
"name": "[variables('container1name')]",
409-
"properties": {
410-
"image": "[variables('container1image')]",
411-
"resources": {
412-
"requests": {
413-
"cpu": 1,
414-
"memoryInGb": 1.5
415-
}
416-
},
417-
"ports": [
418-
{
419-
"port": 80
420-
},
421-
{
422-
"port": 8080
423-
}
424-
]
425-
}
426-
},
427-
{
428-
"name": "[variables('container2name')]",
429-
"properties": {
430-
"image": "[variables('container2image')]",
431-
"resources": {
432-
"requests": {
433-
"cpu": 1,
434-
"memoryInGb": 1.5
435-
}
436-
}
437-
}
438-
}
439-
],
440-
"osType": "Linux",
441-
"ipAddress": {
442-
"type": "Public",
443-
"ports": [
444-
{
445-
"protocol": "tcp",
446-
"port": "80"
447-
},
448-
{
449-
"protocol": "tcp",
450-
"port": "8080"
451-
}
452-
]
453-
}
454-
}
455-
}
456-
],
457-
"outputs": {
458-
"containerIPv4Address": {
459-
"type": "string",
460-
"value": "[reference(resourceId('Microsoft.ContainerInstance/containerGroups/', parameters('containerGroupName'))).ipAddress.ip]"
461-
}
462-
}
463-
}
464-
```
465-
466-
### Deploy your resources
467-
468-
If you created and edited the template file on your desktop, you can upload it to your Cloud Shell directory by dragging the file into it.
469-
470-
Create a resource group with the [az group create][az-group-create] command.
471-
472-
```azurecli-interactive
473-
az group create --name myResourceGroup --location eastus
474-
```
475-
476-
Deploy the template with the [az deployment group create][az-deployment-group-create] command.
477-
478-
```azurecli-interactive
479-
az deployment group create --resource-group myResourceGroup --template-file deployment-template.json
480-
```
481-
482-
Within a few seconds, you should receive an initial response from Azure. Once the deployment completes, all data related to it persisted by the ACI service will be encrypted with the key you provided.
483240
<!-- LINKS - Internal -->
484241
[az-group-create]: /cli/azure/group#az_group_create
485242
[az-deployment-group-create]: /cli/azure/deployment/group/#az_deployment_group_create

‎articles/container-instances/container-instances-troubleshooting.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ On initial creation, Windows containers may have no inbound or outbound connecti
201201

202202
### Cannot connect to underlying Docker API or run privileged containers
203203

204-
Azure Container Instances does not expose direct access to the underlying infrastructure that hosts container groups. This includes access to the Docker API running on the container's host and running privileged containers. If you require Docker interaction, check the [REST reference documentation](/rest/api/container-instances/) to see what the ACI API supports. If there is something missing, submit a request on the [ACI feedback forums](https://aka.ms/aci/feedback).
204+
Azure Container Instances does not expose direct access to the underlying infrastructure that hosts container groups. This includes access to the container runtime, orchestration technology, and running privileged container operations. To see what operations are supported by ACI, check the [REST reference documentation](/rest/api/container-instances/). If there is something missing, submit a request on the [ACI feedback forums](https://aka.ms/aci/feedback).
205205

206206
### Container group IP address may not be accessible due to mismatched ports
207207

0 commit comments

Comments
 (0)