Skip to content

Commit 78ae4fd

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #249314 from msangapu-msft/keyvault
key vault
2 parents 6cb1f3b + 3c6ee65 commit 78ae4fd

File tree

7 files changed

+346
-26
lines changed

7 files changed

+346
-26
lines changed

‎articles/app-service/configure-connect-to-azure-storage.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to attach custom network share in Azure App Service. Sha
44
author: msangapu-msft
55

66
ms.topic: article
7-
ms.date: 8/4/2023
7+
ms.date: 8/24/2023
88
ms.author: msangapu
99
zone_pivot_groups: app-service-containers-code
1010
---

‎articles/app-service/includes/configure-azure-storage/azure-storage-linux-container-pivot.md

Lines changed: 125 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,14 @@
22
author: msangapu-msft
33
ms.service: app-service
44
ms.topic: include
5-
ms.date: 08/04/2023
5+
ms.date: 08/24/2023
66
ms.author: msangapu
77
---
88

9+
> [!NOTE]
10+
> Azure Key Vault support for Azure Storage is in preview.
11+
>
12+
913
This guide shows how to mount Azure Storage as a network share in a built-in Linux container or a custom Linux container in App Service. See the video [how to mount Azure Storage as a local share](https://www.youtube.com/watch?v=OJkvpWYr57Y). For using Azure Storage in an ARM template, see [Bring your own storage](https://github.com/Azure/app-service-linux-docs/blob/master/BringYourOwnStorage/BYOS_azureFiles.json). Azure Storage is non-default storage for App Service and billed separately.
1014

1115
The benefits of custom-mounted storage include:
@@ -19,11 +23,49 @@ The following features are supported for Linux containers:
1923
- Azure Blobs (read-only).
2024
- Up to five mount points per app.
2125

26+
This article covers three options for mounting your storage account:
27+
28+
### [Basic](#tab/basic)
29+
30+
Choose this option when mounting storage using the Azure portal. You can use the basic option as long as the storage account isn't using [service endpoints](../../../storage/common/storage-network-security.md#grant-access-from-a-virtual-network), [private endpoints](../../../storage/common/storage-private-endpoints.md), or [Azure Key Vault](../../../key-vault/general/overview.md). In this case, the portal gets and stores the access key for you.
31+
32+
If you plan to mount storage using the Azure CLI, you need to obtain an access key.
33+
34+
### [Access Key](#tab/access-key)
35+
36+
Choose this option storage account isn't using [service endpoints](../../../storage/common/storage-network-security.md#grant-access-from-a-virtual-network), [private endpoints](../../../storage/common/storage-private-endpoints.md), or [Azure Key Vault](../../../key-vault/general/overview.md).
37+
38+
Also use this option when you plan to mount storage using the Azure CLI, which requires the access key.
39+
40+
### [Key Vault](#tab/key-vault)
41+
42+
Choose this option when using Azure Key Vault to securely store and retrieve access keys. [Azure Key Vault](../../../key-vault/general/overview.md) has the benefits of storing application secrets centrally and securely with the ability to monitor, administer, and integrate with other Azure services like Azure App Service.
43+
44+
---
45+
46+
2247
## Prerequisites
2348

49+
### [Basic](#tab/basic)
50+
51+
- An existing [App Service on Linux app](../../index.yml).
52+
- An [Azure Storage account](../../../storage/common/storage-account-create.md?tabs=azure-cli).
53+
- An [Azure file share and directory](../../../storage/files/storage-how-to-use-files-portal.md).
54+
55+
### [Access Key](#tab/access-key)
56+
2457
- An existing [App Service on Linux app](../../index.yml).
25-
- An [Azure Storage Account](../../../storage/common/storage-account-create.md?tabs=azure-cli).
26-
- An [Azure file share and directory](../../../storage/files/storage-how-to-use-files-portal.md).
58+
- An [Azure Storage account](../../../storage/common/storage-account-create.md?tabs=azure-cli).
59+
- An [Azure file share and directory](../../../storage/files/storage-how-to-use-files-portal.md).
60+
61+
### [Key Vault](#tab/key-vault)
62+
63+
- An existing [App Service on Linux app](../../index.yml).
64+
- An [Azure Storage account](../../../storage/common/storage-account-create.md?tabs=azure-cli).
65+
- An [Azure file share and directory](../../../storage/files/storage-how-to-use-files-portal.md).
66+
- An [Azure Key Vault](../../../key-vault/general/overview.md) instance using the [vault access policy](../../../key-vault/general/assign-access-policy.md?WT.mc_id=Portal-Microsoft_Azure_KeyVault&tabs=azure-portal) and a [secret](../../../key-vault/secrets/quick-create-portal.md), which is required to configure the Key Vault with Azure Storage.
67+
68+
---
2769

2870
## Limitations
2971

@@ -33,13 +75,75 @@ The following features are supported for Linux containers:
3375
- Mapping `/` or `/home` to custom-mounted storage isn't supported.
3476
- Don't map the storage mount to `/tmp` or its subdirectories as this action may cause a timeout during app startup.
3577
- Azure Storage isn't supported with [Docker Compose](../../configure-custom-container.md?pivots=container-linux#docker-compose-options) scenarios.
36-
- Storage mounts aren't included in [backups](../../manage-backup.md). Be sure to follow best practices to backup the Azure Storage accounts.
78+
- Storage mounts aren't included in [backups](../../manage-backup.md). Be sure to follow best practices to back up the Azure Storage accounts.
3779
- Azure Files [NFS](../../../storage/files/files-nfs-protocol.md) is currently unsupported for App Service on Linux. Only Azure Files [SMB](../../../storage/files/files-smb-protocol.md) are supported.
38-
- With VNET integration on your app, the mounted drive will use an RC1918 IP address and not an IP address from your VNET.
80+
- With VNET integration on your app, the mounted drive uses an RFC1918 IP address and not an IP address from your VNET.
81+
82+
## Prepare for mounting
83+
84+
85+
### [Basic](#tab/basic)
86+
87+
No extra steps are required because the portal gets and stores the access key for you.
88+
89+
### [Access Key](#tab/access-key)
90+
91+
You need to obtain the access key from your storage account. <!--link or instructions? -->
92+
93+
### [Key Vault](#tab/key-vault)
94+
95+
Before you can mount storage using Key Vault access, you need to get the Key Vault secret and add it as an application setting in your app.
96+
97+
1. In the portal, browse to your Key Vault secret and copy the **Secret Identifier** into your clipboard.
98+
:::image type="content" source="../../media/configure-azure-storage/key-vault-secret-identifier.png" alt-text="Screenshot of Key Vault secret identifier.":::
99+
100+
1. Back in your app, create an [**application setting**](../../configure-common.md?tabs=portal#configure-app-settings) and paste the Key Vault **Secret Identifier** into **Value**.
101+
:::image type="content" source="../../media/configure-azure-storage/secret-identifier-application-setting.png" alt-text="Screenshot of Secret Identifier application setting.":::
102+
103+
Now you're ready to use Key Vault to access your storage account.
104+
105+
---
106+
39107

40108
## Mount storage to Linux container
41109

42-
# [Azure portal](#tab/portal)
110+
The way that you mount storage depends on your storage access option and whether you are using the portal or the Azure CLI.
111+
112+
# [Azure portal](#tab/portal/basic)
113+
114+
1. In the [Azure portal](https://portal.azure.com), navigate to the app.
115+
1. From the left navigation, click **Configuration** > **Path Mappings** > **New Azure Storage Mount**.
116+
1. Configure the storage mount according to the following table. When finished, click **OK**.
117+
118+
| Setting | Description |
119+
|-|-|
120+
| **Name** | Name of the mount configuration. Spaces aren't allowed. |
121+
| **Configuration options** | Select **Basic**. if the storage account isn't using [service endpoints](../../../storage/common/storage-network-security.md#grant-access-from-a-virtual-network), [private endpoints](../../../storage/common/storage-private-endpoints.md), or [Azure Key Vault](../../../key-vault/general/overview.md). Otherwise, select **Advanced**. |
122+
| **Storage accounts** | Azure Storage account. |
123+
| **Storage type** | Select the type based on the storage you want to mount. Azure Blobs only supports read-only access. |
124+
| **Storage container** or **Share name** | Files share or Blobs container to mount. |
125+
| **Mount path** | Directory inside the Linux container to mount to Azure Storage. Don't use `/` or `/home`.|
126+
| **Deployment slot setting** | When checked, the storage mount settings also apply to deployment slots.|
127+
128+
# [Azure portal](#tab/portal/access-key)
129+
130+
1. In the [Azure portal](https://portal.azure.com), navigate to the app.
131+
1. From the left navigation, click **Configuration** > **Path Mappings** > **New Azure Storage Mount**.
132+
1. Configure the storage mount according to the following table. When finished, click **OK**.
133+
134+
| Setting | Description |
135+
|-|-|
136+
| **Name** | Name of the mount configuration. Spaces aren't allowed. |
137+
| **Configuration options** | Select **Advanced**. |
138+
| **Storage accounts** | Azure Storage account. |
139+
| **Storage type** | Select the type based on the storage you want to mount. Azure Blobs only supports read-only access. |
140+
| **Storage container** or **Share name** | Files share or Blobs container to mount. |
141+
| **Storage access** | Select **Manual input**. |
142+
| **Access key** | Enter the [access key](../../../storage/common/storage-account-keys-manage.md) for your storage account. |
143+
| **Mount path** | Directory inside the Linux container to mount to Azure Storage. Don't use `/` or `/home`.|
144+
| **Deployment slot setting** | When checked, the storage mount settings also apply to deployment slots.|
145+
146+
# [Azure portal](#tab/portal/key-vault)
43147

44148
1. In the [Azure portal](https://portal.azure.com), navigate to the app.
45149
1. From the left navigation, click **Configuration** > **Path Mappings** > **New Azure Storage Mount**.
@@ -48,15 +152,22 @@ The following features are supported for Linux containers:
48152
| Setting | Description |
49153
|-|-|
50154
| **Name** | Name of the mount configuration. Spaces aren't allowed. |
51-
| **Configuration options** | Select **Basic** if the storage account isn't using [service endpoints](../../../storage/common/storage-network-security.md#grant-access-from-a-virtual-network) or [private endpoints](../../../storage/common/storage-private-endpoints.md). Otherwise, select **Advanced**. |
155+
| **Configuration options** | Select **Advanced**. |
52156
| **Storage accounts** | Azure Storage account. |
53157
| **Storage type** | Select the type based on the storage you want to mount. Azure Blobs only supports read-only access. |
54158
| **Storage container** or **Share name** | Files share or Blobs container to mount. |
55-
| **Access key** (Advanced only) | [Access key](../../../storage/common/storage-account-keys-manage.md) for your storage account. |
159+
| **Storage access** | Select **Key vault reference**. |
160+
| **Application settings**| Select the existing app setting that's configured with the Azure Key Vault secret.|
56161
| **Mount path** | Directory inside the Linux container to mount to Azure Storage. Don't use `/` or `/home`.|
57162
| **Deployment slot setting** | When checked, the storage mount settings also apply to deployment slots.|
58163

59-
# [Azure CLI](#tab/cli)
164+
1. [Grant your app access to the Key Vault](../../app-service-key-vault-references.md?#grant-your-app-access-to-a-key-vault) to access the storage mount.
165+
166+
# [Azure CLI](#tab/cli/basic)
167+
168+
Using Azure CLI to mount storage requires you to provide the storage access key.
169+
170+
# [Azure CLI](#tab/cli/access-key)
60171

61172
Use the [`az webapp config storage-account add`](/cli/azure/webapp/config/storage-account#az-webapp-config-storage-account-add) command. For example:
62173

@@ -73,6 +184,10 @@ Verify your storage is mounted by running the following command:
73184
az webapp config storage-account list --resource-group <resource-group> --name <app-name>
74185
```
75186

187+
# [Azure CLI](#tab/cli/key-vault)
188+
189+
Mounting storage with Key Vault access isn't currently supported by the Azure CLI. Use the portal instead.
190+
76191
---
77192

78193
> [!NOTE]
@@ -98,12 +213,10 @@ To validate that the Azure Storage is mounted successfully for the app:
98213

99214
## Best practices
100215

101-
- To avoid latency issues, place the app and the Azure Storage account in the same region. Note that if you grant access from App Service IP addresses in the [Azure Storage firewall configuration](../../../storage/common/storage-network-security.md) when the app and Azure Storage account are in the same region, then these IP restrictions aren't honored.
216+
- To avoid latency issues, place the app and the Azure Storage account in the same region. If you grant access from App Service IP addresses in the [Azure Storage firewall configuration](../../../storage/common/storage-network-security.md) when the app and Azure Storage account are in the same region, then these IP restrictions aren't honored.
102217
103218
- The mount directory in the custom container should be empty. Any content stored at this path is deleted when the Azure Storage is mounted (if you specify a directory under `/home`, for example). If you are migrating files for an existing app, make a backup of the app and its content before you begin.
104219
105-
- Mounting the storage to `/home` isn't recommended because it may result in performance bottlenecks for the app.
106-
107220
- In the Azure Storage account, avoid [regenerating the access key](../../../storage/common/storage-account-keys-manage.md) that's used to mount the storage in the app. The storage account contains two different keys. Azure App Services stores Azure storage account key. Use a stepwise approach to ensure that the storage mount remains available to the app during key regeneration. For example, assuming that you used **key1** to configure storage mount in your app:
108221

109222
1. Regenerate **key2**.

0 commit comments

Comments
 (0)