You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/enable-host-encryption.md
+6-10Lines changed: 6 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,17 +24,17 @@ This feature can only be set at cluster creation or node pool creation time.
24
24
25
25
### Prerequisites
26
26
27
-
-Make sure you have the CLI extension v2.23 or higher version installed.
27
+
-Ensure you have the CLI extension v2.23 or higher version installed.
28
28
29
29
### Limitations
30
30
31
31
- Can only be enabled on new node pools.
32
32
- Can only be enabled in [Azure regions][supported-regions] that support server-side encryption of Azure managed disks and only with specific [supported VM sizes][supported-sizes].
33
-
- Requires an AKS cluster and node pool based on Virtual Machine Scale Sets as *VM set type*.
33
+
- Requires an AKS cluster and node pool based on Virtual Machine Scale Sets(VMSS) as *VM set type*.
34
34
35
35
## Use host-based encryption on new clusters
36
36
37
-
Configure the cluster agent nodes to use host-based encryption when the cluster is created.
37
+
Configure the cluster agent nodes to use host-based encryption when the cluster is created.
38
38
39
39
```azurecli-interactive
40
40
az aks create --name myAKSCluster --resource-group myResourceGroup -s Standard_DS2_v2 -l westus2 --enable-encryption-at-host
@@ -52,13 +52,11 @@ az aks nodepool add --name hostencrypt --cluster-name myAKSCluster --resource-gr
52
52
53
53
If you want to create new node pools without the host-based encryption feature, you can do so by omitting the `--enable-encryption-at-host` parameter.
54
54
55
-
> [!NOTE]
56
-
> Once you've enabled host-based encryption, make sure you provide the proper permissions to grant access to your Azure Key Vault keys. For more information, see [Full control of your keys][full-control-keys] and [Built-in roles for Key Vault data plane operations][akv-built-in-roles].
57
-
58
55
## Next steps
59
56
60
-
- Review [best practices for AKS cluster security][best-practices-security].
61
-
- Read more about [host-based encryption](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data).
57
+
Review [best practices for AKS cluster security][best-practices-security]
58
+
Read more about [host-based encryption](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data).
59
+
62
60
63
61
<!-- LINKS - external -->
64
62
@@ -72,5 +70,3 @@ If you want to create new node pools without the host-based encryption feature,
0 commit comments