Skip to content

Commit 8a1a262

Browse files
megvanhuygenmegvanhuygen
authored
Merge pull request #100697 from banisadr/grid-edge-updates
Grid Edge updates for Preview2
2 parents 24d6314 + aef8bce commit 8a1a262

32 files changed

+679
-171
lines changed

‎articles/event-grid/blob-event-quickstart-portal.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ When you're finished, you see that the event data has been sent to the web app.
3636

3737
![Start steps](./media/blob-event-quickstart-portal/provide-blob-values.png)
3838

39+
>[!NOTE]
40+
> Only storage accounts of kind **StorageV2 (general purpose v2)** and **BlobStorage** support event integration. **Storage (genral purpose v1)** does *not* support integration with Event Grid.
41+
3942
## Create a message endpoint
4043

4144
Before subscribing to the events for the Blob storage, let's create the endpoint for the event message. Typically, the endpoint takes actions based on the event data. To simplify this quickstart, you deploy a [pre-built web app](https://github.com/Azure-Samples/azure-event-grid-viewer) that displays the event messages. The deployed solution includes an App Service plan, an App Service web app, and source code from GitHub.

‎articles/event-grid/cloudevents-schema.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ You can use Event Grid for both input and output of events in CloudEvents schema
6969
|--------------------|---------------------
7070
| CloudEvents format | CloudEvents format
7171
| Event Grid format | CloudEvents format
72-
| CloudEvents format | Event Grid format
7372
| Event Grid format | Event Grid format
7473

7574
For all event schemas, Event Grid requires validation when publishing to an event grid topic and when creating an event subscription. For more information, see [Event Grid security and authentication](security-authentication.md).
@@ -106,8 +105,6 @@ New-AzureRmEventGridTopic `
106105
-InputSchema CloudEventSchemaV1_0
107106
```
108107

109-
The current version of CloudEvents doesn't support batching of events. To publish events with CloudEvent schema to a topic, publish each event individually.
110-
111108
### Output schema
112109

113110
You set the output schema when you create the event subscription.

‎articles/event-grid/edge/api.md

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ Samples in this section use `EndpointType=Webhook;`. The json samples for `Endpo
179179
"eventExpiryInMinutes": 120,
180180
"maxDeliveryAttempts": 50
181181
},
182+
"persistencePolicy": "true",
182183
"destination":
183184
{
184185
"endpointType": "WebHook",
@@ -682,3 +683,93 @@ SasKey:
682683
TopicName:
683684
- If the Subscription.EventDeliverySchema is set to EventGridSchema, the value from this field is put into every event's Topic field before being forwarded to Event Grid in the cloud.
684685
- If the Subscription.EventDeliverySchema is set to CustomEventSchema, this property is ignored and the custom event payload is forwarded exactly as it was received.
686+
687+
## Set up Event Hubs as a destination
688+
689+
To publish to an Event Hub, set the `endpointType` to `eventHub` and provide:
690+
691+
* connectionString: Connection string for the specific Event Hub you're targeting generated via a Shared Access Policy.
692+
693+
>[!NOTE]
694+
> The connection string must be entity specific. Using a namespace connection string will not work. You can generate an entity specific connection string by navigating to the specific Event Hub you would like to publish to in the Azure Portal and clicking **Shared access policies** to generate a new entity specific connecection string.
695+
696+
```json
697+
{
698+
"properties": {
699+
"destination": {
700+
"endpointType": "eventHub",
701+
"properties": {
702+
"connectionString": "<your-event-hub-connection-string>"
703+
}
704+
}
705+
}
706+
}
707+
```
708+
709+
## Set up Service Bus Queues as a destination
710+
711+
To publish to a Service Bus Queue, set the `endpointType` to `serviceBusQueue` and provide:
712+
713+
* connectionString: Connection string for the specific Service Bus Queue you're targeting generated via a Shared Access Policy.
714+
715+
>[!NOTE]
716+
> The connection string must be entity specific. Using a namespace connection string will not work. Generate an entity specific connection string by navigating to the specific Service Bus Queue you would like to publish to in the Azure Portal and clicking **Shared access policies** to generate a new entity specific connecection string.
717+
718+
```json
719+
{
720+
"properties": {
721+
"destination": {
722+
"endpointType": "serviceBusQueue",
723+
"properties": {
724+
"connectionString": "<your-service-bus-queue-connection-string>"
725+
}
726+
}
727+
}
728+
}
729+
```
730+
731+
## Set up Service Bus Topics as a destination
732+
733+
To publish to a Service Bus Topic, set the `endpointType` to `serviceBusTopic` and provide:
734+
735+
* connectionString: Connection string for the specific Service Bus Topic you're targeting generated via a Shared Access Policy.
736+
737+
>[!NOTE]
738+
> The connection string must be entity specific. Using a namespace connection string will not work. Generate an entity specific connection string by navigating to the specific Service Bus Topic you would like to publish to in the Azure Portal and clicking **Shared access policies** to generate a new entity specific connecection string.
739+
740+
```json
741+
{
742+
"properties": {
743+
"destination": {
744+
"endpointType": "serviceBusTopic",
745+
"properties": {
746+
"connectionString": "<your-service-bus-topic-connection-string>"
747+
}
748+
}
749+
}
750+
}
751+
```
752+
753+
## Set up Storage Queues as a destination
754+
755+
To publish to a Storage Queue, set the `endpointType` to `storageQueue` and provide:
756+
757+
* queueName: Name of the Storage Queue you're publishing to.
758+
* connectionString: Connection string for the Storage Account the Storage Queue is in.
759+
760+
>[!NOTE]
761+
> Unline Event Hubs, Service Bus Queues, and Service Bus Topics, the connection string used for Storage Queues is not entity specific. Instead, it must but the connection string for the Storage Account.
762+
763+
```json
764+
{
765+
"properties": {
766+
"destination": {
767+
"endpointType": "storageQueue",
768+
"properties": {
769+
"queueName": "<your-storage-queue-name>",
770+
"connectionString": "<your-storage-account-connection-string>"
771+
}
772+
}
773+
}
774+
}
775+
```

‎articles/event-grid/edge/configure-api-protocol.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ See [Security and authentication](security-authentication.md) guide for all the
2727
```json
2828
{
2929
"Env": [
30-
"inbound:serverAuth:tlsPolicy=strict",
31-
"inbound:serverAuth:serverCert:source=IoTEdge"
30+
"inbound__serverAuth__tlsPolicy=strict",
31+
"inbound__serverAuth__serverCert__source=IoTEdge"
3232
]
3333
}
3434
```
@@ -38,8 +38,8 @@ See [Security and authentication](security-authentication.md) guide for all the
3838
```json
3939
{
4040
"Env": [
41-
"inbound:serverAuth:tlsPolicy=strict",
42-
"inbound:serverAuth:serverCert:source=IoTEdge"
41+
"inbound__serverAuth__tlsPolicy=strict",
42+
"inbound__serverAuth__serverCert__source=IoTEdge"
4343
],
4444
"HostConfig": {
4545
"PortBindings": {
@@ -61,8 +61,8 @@ See [Security and authentication](security-authentication.md) guide for all the
6161
```json
6262
{
6363
"Env": [
64-
"inbound:serverAuth:tlsPolicy=enabled",
65-
"inbound:serverAuth:serverCert:source=IoTEdge"
64+
"inbound__serverAuth__tlsPolicy=enabled",
65+
"inbound__serverAuth__serverCert__source=IoTEdge"
6666
]
6767
}
6868
```
@@ -72,8 +72,8 @@ See [Security and authentication](security-authentication.md) guide for all the
7272
```json
7373
{
7474
"Env": [
75-
"inbound:serverAuth:tlsPolicy=enabled",
76-
"inbound:serverAuth:serverCert:source=IoTEdge"
75+
"inbound__serverAuth__tlsPolicy=enabled",
76+
"inbound__serverAuth__serverCert__source=IoTEdge"
7777
],
7878
"HostConfig": {
7979
"PortBindings": {

‎articles/event-grid/edge/configure-client-auth.md

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ services: event-grid
1313

1414
# Configure client authentication of incoming calls
1515

16-
This guide gives examples of the possible client authentication configurations for the Event Grid module. The Event Grid module supports two types of client authentication:-
16+
This guide gives examples of the possible client authentication configurations for the Event Grid module. The Event Grid module supports two types of client authentication:
1717

1818
* Shared access signature (SAS) key-based
1919
* Certificate-based
@@ -25,10 +25,10 @@ See [Security and authentication](security-authentication.md) guide for all the
2525
```json
2626
{
2727
"Env": [
28-
"inbound:clientAuth:sasKeys:enabled=false",
29-
"inbound:clientAuth:clientCert:enabled=true",
30-
"inbound:clientAuth:clientCert:source=IoTEdge",
31-
"inbound:clientAuth:clientCert:allowUnknownCA=false"
28+
"inbound__clientAuth__sasKeys__enabled=false",
29+
"inbound__clientAuth__clientCert__enabled=true",
30+
"inbound__clientAuth__clientCert__source=IoTEdge",
31+
"inbound__clientAuth__clientCert__allowUnknownCA=false"
3232
]
3333
}
3434
```
@@ -38,28 +38,28 @@ See [Security and authentication](security-authentication.md) guide for all the
3838
```json
3939
{
4040
"Env": [
41-
"inbound:clientAuth:sasKeys:enabled=false",
42-
"inbound:clientAuth:clientCert:enabled=true",
43-
"inbound:clientAuth:clientCert:source=IoTEdge",
44-
"inbound:clientAuth:clientCert:allowUnknownCA=true"
41+
"inbound__clientAuth__sasKeys__enabled=false",
42+
"inbound__clientAuth__clientCert__enabled=true",
43+
"inbound__clientAuth__clientCert__source=IoTEdge",
44+
"inbound__clientAuth__clientCert__allowUnknownCA=true"
4545
]
4646
}
4747
```
4848

4949
>[!NOTE]
50-
>Set the property **inbound:clientAuth:clientCert:allowUnknownCA** to **true** only in test environments as you might typically use self-signed certificates. For production workloads, we recommend that you set this property to **false** and certificates from a certificate authority (CA).
50+
>Set the property **inbound__clientAuth__clientCert__allowUnknownCA** to **true** only in test environments as you might typically use self-signed certificates. For production workloads, we recommend that you set this property to **false** and certificates from a certificate authority (CA).
5151
5252
## Enable certificate-based and sas-key based client authentication
5353

5454
```json
5555
{
5656
"Env": [
57-
"inbound:clientAuth:sasKeys:enabled=true",
58-
"inbound:clientAuth:sasKeys:key1=<some-secret1-here>",
59-
"inbound:clientAuth:sasKeys:key2=<some-secret2-here>",
60-
"inbound:clientAuth:clientCert:enabled=true",
61-
"inbound:clientAuth:clientCert:source=IoTEdge",
62-
"inbound:clientAuth:clientCert:allowUnknownCA=true"
57+
"inbound__clientAuth__sasKeys__enabled=true",
58+
"inbound__clientAuth__sasKeys__key1=<some-secret1-here>",
59+
"inbound__clientAuth__sasKeys__key2=<some-secret2-here>",
60+
"inbound__clientAuth__clientCert__enabled=true",
61+
"inbound__clientAuth__clientCert__source=IoTEdge",
62+
"inbound__clientAuth__clientCert__allowUnknownCA=true"
6363
]
6464
}
6565
```

‎articles/event-grid/edge/configure-event-grid.md

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -21,56 +21,64 @@ To learn about client authentication in general, see [Security and Authenticatio
2121

2222
| Property Name | Description |
2323
| ---------------- | ------------ |
24-
|`inbound:serverAuth:tlsPolicy`| TLS Policy of the Event Grid module. Default value is HTTPS only.
25-
|`inbound:serverAuth:serverCert:source`| Source of server certificate used by the Event Grid Module for its TLS configuration. Default value is IoT Edge.
24+
|`inbound__serverAuth__tlsPolicy`| TLS Policy of the Event Grid module. Default value is HTTPS only.
25+
|`inbound__serverAuth__serverCert__source`| Source of server certificate used by the Event Grid Module for its TLS configuration. Default value is IoT Edge.
2626

2727
## Incoming client authentication
2828

2929
To learn about client authentication in general, see [Security and Authentication](security-authentication.md). Examples can be found in [this article](configure-client-auth.md).
3030

3131
| Property Name | Description |
3232
| ---------------- | ------------ |
33-
|`inbound:clientAuth:clientCert:enabled`| To turn on/off certificate-based client authentication. Default value is true.
34-
|`inbound:clientAuth:clientCert:source`| Source for validating client certificates. Default value is IoT Edge.
35-
|`inbound:clientAuth:clientCert:allowUnknownCA`| Policy to allow a self-signed client certificate. Default value is true.
36-
|`inbound:clientAuth:sasKeys:enabled`| To turn on/off SAS key based client authentication. Default value is off.
37-
|`inbound:clientAuth:sasKeys:key1`| One of the values to validate incoming requests.
38-
|`inbound:clientAuth:sasKeys:key2`| Optional second value to validate incoming requests.
33+
|`inbound__clientAuth__clientCert__enabled`| To turn on/off certificate-based client authentication. Default value is true.
34+
|`inbound__clientAuth__clientCert__source`| Source for validating client certificates. Default value is IoT Edge.
35+
|`inbound__clientAuth__clientCert__allowUnknownCA`| Policy to allow a self-signed client certificate. Default value is true.
36+
|`inbound__clientAuth__sasKeys__enabled`| To turn on/off SAS key based client authentication. Default value is off.
37+
|`inbound__clientAuth__sasKeys__key1`| One of the values to validate incoming requests.
38+
|`inbound__clientAuth__sasKeys__key2`| Optional second value to validate incoming requests.
3939

4040
## Outgoing client authentication
4141
To learn about client authentication in general, see [Security and Authentication](security-authentication.md). Examples can be found in [this article](configure-identity-auth.md).
4242

4343
| Property Name | Description |
4444
| ---------------- | ------------ |
45-
|`outbound:clientAuth:clientCert:enabled`| To turn on/off attaching an identity certificate for outgoing requests. Default value is true.
46-
|`outbound:clientAuth:clientCert:source`| Source for retrieving Event Grid module's outgoing certificate. Default value is IoT Edge.
45+
|`outbound__clientAuth__clientCert__enabled`| To turn on/off attaching an identity certificate for outgoing requests. Default value is true.
46+
|`outbound__clientAuth__clientCert__source`| Source for retrieving Event Grid module's outgoing certificate. Default value is IoT Edge.
4747

4848
## Webhook event handlers
4949

5050
To learn about client authentication in general, see [Security and Authentication](security-authentication.md). Examples can be found in [this article](configure-webhook-subscriber-auth.md).
5151

5252
| Property Name | Description |
5353
| ---------------- | ------------ |
54-
|`outbound:webhook:httpsOnly`| Policy to control whether only HTTPS subscribers will be allowed. Default value is true (only HTTPS).
55-
|`outbound:webhook:skipServerCertValidation`| Flag to control whether to validate the subscriber's certificate. Default value is true.
56-
|`outbound:webhook:allowUnknownCA`| Policy to control whether a self-signed certificate can be presented by a subscriber. Default value is true.
54+
|`outbound__webhook__httpsOnly`| Policy to control whether only HTTPS subscribers will be allowed. Default value is true (only HTTPS).
55+
|`outbound__webhook__skipServerCertValidation`| Flag to control whether to validate the subscriber's certificate. Default value is true.
56+
|`outbound__webhook__allowUnknownCA`| Policy to control whether a self-signed certificate can be presented by a subscriber. Default value is true.
5757

5858
## Delivery and retry
5959

6060
To learn about this feature in general, see [Delivery and Retry](delivery-retry.md).
6161

6262
| Property Name | Description |
6363
| ---------------- | ------------ |
64-
| `broker:defaultMaxDeliveryAttempts` | Maximum number of attempts to deliver an event. Default value is 30.
65-
| `broker:defaultEventTimeToLiveInSeconds` | Time-to-live (TTL) in seconds after which an event will be dropped if not delivered. Default value is **7200** seconds
64+
| `broker__defaultMaxDeliveryAttempts` | Maximum number of attempts to deliver an event. Default value is 30.
65+
| `broker__defaultEventTimeToLiveInSeconds` | Time-to-live (TTL) in seconds after which an event will be dropped if not delivered. Default value is **7200** seconds
6666

6767
## Output batching
6868

6969
To learn about this feature in general, see [Delivery and Output batching](delivery-output-batching.md).
7070

7171
| Property Name | Description |
7272
| ---------------- | ------------ |
73-
| `api:deliveryPolicyLimits:maxBatchSizeInBytes` | Maximum value allowed for the `ApproxBatchSizeInBytes` knob. Default value is `1_058_576`.
74-
| `api:deliveryPolicyLimits:maxEventsPerBatch` | Maximum value allowed for the `MaxEventsPerBatch` knob. Default value is `50`.
75-
| `broker:defaultMaxBatchSizeInBytes` | Maximum delivery request size when only `MaxEventsPerBatch` is specified. Default value is `1_058_576`.
76-
| `broker:defaultMaxEventsPerBatch` | Maximum number of events to add to a batch when only `MaxBatchSizeInBytes` is specified. Default value is `10`.
73+
| `api__deliveryPolicyLimits__maxBatchSizeInBytes` | Maximum value allowed for the `ApproxBatchSizeInBytes` knob. Default value is `1_058_576`.
74+
| `api__deliveryPolicyLimits__maxEventsPerBatch` | Maximum value allowed for the `MaxEventsPerBatch` knob. Default value is `50`.
75+
| `broker__defaultMaxBatchSizeInBytes` | Maximum delivery request size when only `MaxEventsPerBatch` is specified. Default value is `1_058_576`.
76+
| `broker__defaultMaxEventsPerBatch` | Maximum number of events to add to a batch when only `MaxBatchSizeInBytes` is specified. Default value is `10`.
77+
78+
## Metrics
79+
80+
To learn about using metrics with Event Grid on IoT Edge, see [monitor topics and subscriptions](monitor-topics-subscriptions.md)
81+
82+
| Property Name | Description |
83+
| ---------------- | ------------ |
84+
| `metrics__reporterType` | Reporter type for metrics enpoint. Default is `none` and disables metrics. Setting to `prometheus` enables metrics in the Prometheus exposition format.

‎articles/event-grid/edge/configure-identity-auth.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ services: event-grid
1313

1414
# Configure identity for the Event Grid module
1515

16-
This article gives you examples of the possible identity configurations for an Event Grid module. By default, the Event Grid module will present its identity certificate as configured by the IoT security daemon. An identity certificate is presented by the Event Grid module on its outgoing calls that is, when it delivers events. A subscriber to an Event Grid event can then choose to validate that it's indeed the Event Grid module that sent the event before accepting the event.
16+
This article gives shows how to configure identity for Grid on Edge. By default, the Event Grid module presents its identity certificate as configured by the IoT security daemon. Event Grid on Edge presents its identity certificate with its outgoing calls when it delivers events. A subscriber can then validate it's the Event Grid module that sent the event before accepting.
1717

1818
See [Security and authentication](security-authentication.md) guide for all the possible configurations.
1919

@@ -23,8 +23,8 @@ Here's an example configuration for always presenting an identity certificate on
2323
```json
2424
{
2525
"Env": [
26-
"outbound:clientAuth:clientCert:enabled=true",
27-
"outbound:clientAuth:clientCert:source=IoTEdge"
26+
"outbound__clientAuth__clientCert__enabled=true",
27+
"outbound__clientAuth__clientCert__source=IoTEdge"
2828
]
2929
}
3030
```
@@ -35,7 +35,7 @@ Here's an example configuration for not presenting an identity certificate on ou
3535
```json
3636
{
3737
"Env": [
38-
"outbound:clientAuth:clientCert:enabled=false"
38+
"outbound__clientAuth__clientCert__enabled=false"
3939
]
4040
}
4141
```

0 commit comments

Comments
 (0)