You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/operator-best-practices-identity.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -130,14 +130,14 @@ Azure Active Directory Pod Identity supports 2 modes of operation:
130
130
* [Managed Identity Controller(MIC)](https://azure.github.io/aad-pod-identity/docs/concepts/mic/): A Kubernetes controller that watches for changes to pods, [AzureIdentity](https://azure.github.io/aad-pod-identity/docs/concepts/azureidentity/) and [AzureIdentityBinding](https://azure.github.io/aad-pod-identity/docs/concepts/azureidentitybinding/) through the Kubernetes API Server. When it detects a relevant change, the MIC adds or deletes [AzureAssignedIdentity](https://azure.github.io/aad-pod-identity/docs/concepts/azureassignedidentity/) as needed. Specifically, when a pod is scheduled, the MIC assigns the managed identity on Azure to the underlying VMSS used by the node pool during the creation phase. When all pods using the identity are deleted, it removes the identity from the VMSS of the node pool, unless the same managed identity is used by other pods. The MIC takes similar actions when AzureIdentity or AzureIdentityBinding are created or deleted.
131
131
* [Node Managed Identity (NMI)](https://azure.github.io/aad-pod-identity/docs/concepts/nmi/): is a pod that runs as a DaemonSet on each node in the AKS cluster. NMI intercepts security token requests to the [Azure Instance Metadata Service](../virtual-machines/linux/instance-metadata-service.md?tabs=linux) on each node, redirect them to itself and validates if the pod has access to the identity it's requesting a token for and fetch the token from the Azure Active Directory tenant on behalf of the application.
132
132
133
-
2. Managed Mode: In this mode, there is only NMI. The identity needs to be manually assigned and managed by the user. For more information, see [Pod Identity in Managed Mode](https://azure.github.io/aad-pod-identity/docs/configure/pod_identity_in_managed_mode/). In this mode, when you use the [az aks pod-identity add](/cli/azure/aks/pod-identity#az_aks_pod_identity_add) command to add a pod identity to an Azure Kubernetes Service (AKS) cluster, it creates the [AzureIdentity](https://azure.github.io/aad-pod-identity/docs/concepts/azureidentity/) and [AzureIdentityBinding](https://azure.github.io/aad-pod-identity/docs/concepts/azureidentitybinding/) in the namespace specified by the `--namespace` parameter, while the AKS resource provider assigns the managed identity specified by the `--identity-resource-id` parameter to virtual machine scale set (VMSS) of each node pool in the AKS cluster.
133
+
2. Managed Mode: In this mode, there is only NMI. The identity needs to be manually assigned and managed by the user. For more information, see [Pod Identity in Managed Mode](https://azure.github.io/aad-pod-identity/docs/configure/pod_identity_in_managed_mode/). In this mode, when you use the [az aks pod-identity add](/cli/azure/aks/pod-identity#az-aks-pod-identity-add) command to add a pod identity to an Azure Kubernetes Service (AKS) cluster, it creates the [AzureIdentity](https://azure.github.io/aad-pod-identity/docs/concepts/azureidentity/) and [AzureIdentityBinding](https://azure.github.io/aad-pod-identity/docs/concepts/azureidentitybinding/) in the namespace specified by the `--namespace` parameter, while the AKS resource provider assigns the managed identity specified by the `--identity-resource-id` parameter to virtual machine scale set (VMSS) of each node pool in the AKS cluster.
134
134
135
135
> [!NOTE]
136
136
> If you instead decide to install the Azure Active Directory Pod Identity using the [AKS cluster add-on](./use-azure-ad-pod-identity.md), the setup will use the `managed` mode.
137
137
138
138
The `managed` mode provides the following advantages over the `standard`:
139
139
140
-
1. Identity assignment on the VMSS of a node pool can take up 40-60s. In case of cronjobs or applications that require access to the identity and can't tolerate the assignment delay, it's best to use `managed` mode as the identity is pre-assigned to the VMSS of the node pool, manually or via the [az aks pod-identity add](/cli/azure/aks/pod-identity#az_aks_pod_identity_add) command.
140
+
1. Identity assignment on the VMSS of a node pool can take up 40-60s. In case of cronjobs or applications that require access to the identity and can't tolerate the assignment delay, it's best to use `managed` mode as the identity is pre-assigned to the VMSS of the node pool, manually or via the [az aks pod-identity add](/cli/azure/aks/pod-identity#az-aks-pod-identity-add) command.
141
141
2. In `standard` mode, MIC requires write permissions on the VMSS used by the AKS cluster and `Managed Identity Operator` permission on the user-assigned managed identities. While running in `managed mode`, since there is no MIC, the role assignments are not required.
142
142
143
143
Instead of manually defining credentials for pods, pod-managed identities request an access token in real time, using it to access only their assigned services. In AKS, there are two components that handle the operations to allow pods to use managed identities:
Copy file name to clipboardExpand all lines: articles/azure-resource-manager/templates/deployment-history.md
+12-12Lines changed: 12 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -65,13 +65,13 @@ To get the correlation ID, use:
65
65
66
66
# [Azure CLI](#tab/azure-cli)
67
67
68
-
To list all the deployments for a resource group, use [az deployment group list](/cli/azure/deployment/group#az_deployment_group_list).
68
+
To list all the deployments for a resource group, use [az deployment group list](/cli/azure/deployment/group#az-deployment-group-list).
69
69
70
70
```azurecli-interactive
71
71
az deployment group list --resource-group ExampleGroup
72
72
```
73
73
74
-
To get a specific deployment, use the [az deployment group show](/cli/azure/deployment/group#az_deployment_group_show).
74
+
To get a specific deployment, use the [az deployment group show](/cli/azure/deployment/group#az-deployment-group-show).
75
75
76
76
```azurecli-interactive
77
77
az deployment group show --resource-group ExampleGroup --name ExampleDeployment
@@ -159,13 +159,13 @@ To get the correlation ID, use:
159
159
160
160
# [Azure CLI](#tab/azure-cli)
161
161
162
-
To list all the deployments for the current subscription, use [az deployment sub list](/cli/azure/deployment/sub?#az_deployment_sub_list).
162
+
To list all the deployments for the current subscription, use [az deployment sub list](/cli/azure/deployment/sub?#az-deployment-sub-list).
163
163
164
164
```azurecli-interactive
165
165
az deployment sub list
166
166
```
167
167
168
-
To get a specific deployment, use the [az deployment sub show](/cli/azure/deployment/sub#az_deployment_sub_show).
168
+
To get a specific deployment, use the [az deployment sub show](/cli/azure/deployment/sub#az-deployment-sub-show).
169
169
170
170
```azurecli-interactive
171
171
az deployment sub show --name ExampleDeployment
@@ -253,13 +253,13 @@ To get the correlation ID, use:
253
253
254
254
# [Azure CLI](#tab/azure-cli)
255
255
256
-
To list all the deployments for a management group, use [az deployment mg list](/cli/azure/deployment/mg#az_deployment_mg_list). If you don't have sufficient permissions to view deployments for the management group, you'll get an error.
256
+
To list all the deployments for a management group, use [az deployment mg list](/cli/azure/deployment/mg#az-deployment-mg-list). If you don't have sufficient permissions to view deployments for the management group, you'll get an error.
257
257
258
258
```azurecli-interactive
259
259
az deployment mg list --management-group-id examplemg
260
260
```
261
261
262
-
To get a specific deployment, use the [az deployment mg show](/cli/azure/deployment/mg#az_deployment_mg_show).
262
+
To get a specific deployment, use the [az deployment mg show](/cli/azure/deployment/mg#az-deployment-mg-show).
263
263
264
264
```azurecli-interactive
265
265
az deployment mg show --management-group-id examplemg --name ExampleDeployment
@@ -333,13 +333,13 @@ To get the correlation ID, use:
333
333
334
334
# [Azure CLI](#tab/azure-cli)
335
335
336
-
To list all the deployments for the current tenant, use [az deployment tenant list](/cli/azure/deployment/tenant#az_deployment_tenant_list). If you don't have sufficient permissions to view deployments for the tenant, you'll get an error.
336
+
To list all the deployments for the current tenant, use [az deployment tenant list](/cli/azure/deployment/tenant#az-deployment-tenant-list). If you don't have sufficient permissions to view deployments for the tenant, you'll get an error.
337
337
338
338
```azurecli-interactive
339
339
az deployment tenant list
340
340
```
341
341
342
-
To get a specific deployment, use the [az deployment tenant show](/cli/azure/deployment/tenant#az_deployment_tenant_show).
342
+
To get a specific deployment, use the [az deployment tenant show](/cli/azure/deployment/tenant#az-deployment-tenant-show).
343
343
344
344
```azurecli-interactive
345
345
az deployment tenant show --name ExampleDeployment
@@ -425,7 +425,7 @@ To view deployment operations for other scopes, use:
425
425
426
426
# [Azure CLI](#tab/azure-cli)
427
427
428
-
To view the deployment operations for deployment to a resource group, use the [az deployment operation group list](/cli/azure/deployment/operation/group#az_deployment_operation_group_list) command. You must have Azure CLI 2.6.0 or later.
428
+
To view the deployment operations for deployment to a resource group, use the [az deployment operation group list](/cli/azure/deployment/operation/group#az-deployment-operation-group-list) command. You must have Azure CLI 2.6.0 or later.
429
429
430
430
```azurecli-interactive
431
431
az deployment operation group list --resource-group ExampleGroup --name ExampleDeployment
@@ -445,9 +445,9 @@ az deployment operation group list --resource-group ExampleGroup --name ExampleD
445
445
446
446
To view deployment operations for other scopes, use:
447
447
448
-
*[az deployment operation sub list](/cli/azure/deployment/operation/sub#az_deployment_operation_sub_list)
Copy file name to clipboardExpand all lines: articles/azure-sql/database/high-availability-sla.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -119,9 +119,9 @@ A failover can be initiated using PowerShell, REST API, or Azure CLI:
119
119
120
120
|Deployment type|PowerShell|REST API| Azure CLI|
121
121
|:---|:---|:---|:---|
122
-
|Database|[Invoke-AzSqlDatabaseFailover](/powershell/module/az.sql/invoke-azsqldatabasefailover)|[Database failover](/rest/api/sql/databases/failover)|[az rest](/cli/azure/reference-index#az_rest) may be used to invoke a REST API call from Azure CLI|
123
-
|Elastic pool|[Invoke-AzSqlElasticPoolFailover](/powershell/module/az.sql/invoke-azsqlelasticpoolfailover)|[Elastic pool failover](/javascript/api/@azure/arm-sql/elasticpools#failover_string__string__string__msRest_RequestOptionsBase)|[az rest](/cli/azure/reference-index#az_rest) may be used to invoke a REST API call from Azure CLI|
124
-
|Managed Instance|[Invoke-AzSqlInstanceFailover](/powershell/module/az.sql/Invoke-AzSqlInstanceFailover/)|[Managed Instances - Failover](/rest/api/sql/managed%20instances%20-%20failover/failover)|[az sql mi failover](/cli/azure/sql/mi/#az_sql_mi_failover)|
122
+
|Database|[Invoke-AzSqlDatabaseFailover](/powershell/module/az.sql/invoke-azsqldatabasefailover)|[Database failover](/rest/api/sql/databases/failover)|[az rest](/cli/azure/reference-index#az-rest) may be used to invoke a REST API call from Azure CLI|
123
+
|Elastic pool|[Invoke-AzSqlElasticPoolFailover](/powershell/module/az.sql/invoke-azsqlelasticpoolfailover)|[Elastic pool failover](/javascript/api/@azure/arm-sql/elasticpools)|[az rest](/cli/azure/reference-index#az-rest) may be used to invoke a REST API call from Azure CLI|
124
+
|Managed Instance|[Invoke-AzSqlInstanceFailover](/powershell/module/az.sql/Invoke-AzSqlInstanceFailover/)|[Managed Instances - Failover](/rest/api/sql/managed%20instances%20-%20failover/failover)|[az sql mi failover](/cli/azure/sql/mi/#az-sql-mi-failover)|
125
125
126
126
> [!IMPORTANT]
127
127
> The Failover command is not available for readable secondary replicas of Hyperscale databases.
Copy file name to clipboardExpand all lines: articles/azure-sql/database/serverless-tier-overview.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -286,7 +286,7 @@ Modifying the maximum or minimum vCores, and autopause delay, is performed by us
286
286
287
287
### Use Azure CLI
288
288
289
-
Modifying the maximum or minimum vCores, and autopause delay, is performed by using the [az sql db update](/cli/azure/sql/db#az_sql_db_update) command in Azure CLI using the `capacity`, `min-capacity`, and `auto-pause-delay` arguments.
289
+
Modifying the maximum or minimum vCores, and autopause delay, is performed by using the [az sql db update](/cli/azure/sql/db#az-sql-db-update) command in Azure CLI using the `capacity`, `min-capacity`, and `auto-pause-delay` arguments.
Copy file name to clipboardExpand all lines: articles/cosmos-db/sql/sql-query-pagination.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -55,7 +55,7 @@ If the query returns a continuation token, then there are additional query resul
55
55
56
56
In Azure Cosmos DB's REST API, you can manage continuation tokens with the `x-ms-continuation` header. As with querying with the .NET or Java SDK, if the `x-ms-continuation` response header is not empty, it means the query has additional results.
57
57
58
-
As long as you are using the same SDK version, continuation tokens never expire. You can optionally [restrict the size of a continuation token](/dotnet/api/microsoft.azure.documents.client.feedoptions.responsecontinuationtokenlimitinkb#Microsoft_Azure_Documents_Client_FeedOptions_ResponseContinuationTokenLimitInKb). Regardless of the amount of data or number of physical partitions in your container, queries return a single continuation token.
58
+
As long as you are using the same SDK version, continuation tokens never expire. You can optionally [restrict the size of a continuation token](/dotnet/api/microsoft.azure.documents.client.feedoptions.responsecontinuationtokenlimitinkb). Regardless of the amount of data or number of physical partitions in your container, queries return a single continuation token.
59
59
60
60
You cannot use continuation tokens for queries with [GROUP BY](sql-query-group-by.md) or [DISTINCT](sql-query-keywords.md#distinct) because these queries would require storing a significant amount of state. For queries with `DISTINCT`, you can use continuation tokens if you add `ORDER BY` to the query.
0 commit comments