Skip to content

Commit 8dea8f7

Browse files
huypubhuypub
authored
Merge pull request #94131 from MicrosoftDocs/release-ga-service-fabric-7.0
Release ga service fabric 7.0
2 parents ef2ef10 + 55207c7 commit 8dea8f7

9 files changed

+232
-12
lines changed

‎articles/service-fabric/concepts-managed-identity.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.author: atsenthi
1212

1313
# Managed Identity for Service Fabric Application (Preview)
1414

15-
A common challenge when building cloud applications is how to manage the credentials in your code for authenticating to cloud services. Keeping credentials secure is an important task, since they never appear on developer workstations and are not checked into source control. The Managed Identity feature for Azure resources in Azure Active Directory (Azure AD) solves this problem. The feature provides Azure services with an automatically-managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.
15+
A common challenge when building cloud applications is how to manage the credentials in your code for authenticating to cloud services. Keeping credentials secure is an important task, since they never appear on developer workstations and are not checked into source control. The Managed Identity feature for Azure resources in Azure Active Directory (Azure AD) solves this problem. The feature provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.
1616

1717
The Managed Identity feature for Azure resources is free with Azure AD for Azure subscriptions. There is no additional cost.
1818

@@ -41,7 +41,7 @@ The following terms are used throughout the Managed Identity for Azure resources
4141

4242
## Supported scenarios for Service Fabric applications
4343

44-
Managed identities for Service Fabric is only supported in Azure deployed Service Fabric clusters, and only for applications deployed as Azure resources; an applications which is not deployed as an Azure resource cannot be assigned an identity. Conceptually speaking, support for managed identities in Azure Service Fabric cluster consists of two phases:
44+
Managed identities for Service Fabric is only supported in Azure deployed Service Fabric clusters, and only for applications deployed as Azure resources; an application which is not deployed as an Azure resource cannot be assigned an identity. Conceptually speaking, support for managed identities in Azure Service Fabric cluster consists of two phases:
4545

4646
1. Assign one or more managed identities to the application resource; an application may be assigned a single system-assigned identity, and/or up to 32 user-assigned identities, respectively.
4747

@@ -58,7 +58,7 @@ The list of supported scenarios for the preview release is as follows:
5858

5959
The following scenarios are not supported or not recommended; note these actions may not be blocked, but can lead to outages in your applications:
6060

61-
- Remove or change the identities assigned to an application; if you must make changes, submit separate deployments to first add a new identity assignment, and then to remove a previously assigned one. Removal of an identity from an existing application can have undesirable effects, including leaving your application in a state which is not upgradeable. It is safe to delete the application altogether if the removal of an identity is necessary; note this will delete the system-assigned identity (if so defined) associated with the application, and will remove any associations with the user-assigned identities assigned to the application.
61+
- Remove or change the identities assigned to an application; if you must make changes, submit separate deployments to first add a new identity assignment, and then to remove a previously assigned one. Removal of an identity from an existing application can have undesirable effects, including leaving your application in a state that is not upgradeable. It is safe to delete the application altogether if the removal of an identity is necessary; note this will delete the system-assigned identity (if so defined) associated with the application, and will remove any associations with the user-assigned identities assigned to the application.
6262

6363
- SF support for managed identities is not integrated at this time into the [AzureServiceTokenProvider](../key-vault/service-to-service-authentication.md); the integration will be achieved by the end of the preview period for the managed identity feature.
6464

@@ -74,3 +74,4 @@ The following scenarios are not supported or not recommended; note these actions
7474
* [Deploy an Azure Service Fabric application with a user-assigned managed identity](./how-to-deploy-service-fabric-application-user-assigned-managed-identity.md)
7575
* [Leverage the managed identity of a Service Fabric application from service code](./how-to-managed-identity-service-fabric-app-code.md)
7676
* [Grant an Azure Service Fabric application access to other Azure resources](./how-to-grant-access-other-resources.md)
77+
* [Declaring and using application secrets as KeyVaultReferences](./service-fabric-keyvault-references.md)

‎articles/service-fabric/service-fabric-cluster-resource-manager-movement-cost.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,14 @@ this.Partition.ReportMoveCost(MoveCost.Medium);
7272
```
7373

7474
## Impact of move cost
75-
MoveCost has four levels: Zero, Low, Medium, and High. MoveCosts are relative to each other, except for Zero. Zero move cost means that movement is free and should not count against the score of the solution. Setting your move cost to High does *not* guarantee that the replica stays in one place.
75+
MoveCost has five levels: Zero, Low, Medium, High and VeryHigh. The following rules apply:
76+
77+
* MoveCosts are relative to each other, except for Zero and VeryHigh.
78+
* Zero move cost means that movement is free and should not count against the score of the solution.
79+
* Setting your move cost to High or VeryHigh does *not* provide a guarantee that the replica will *never* be moved.
80+
* Replicas with VeryHigh move cost will be moved only if there is a constraint violation in the cluster that cannot be fixed in any other way (even if it requires moving many other replicas to fix the violation)
81+
82+
7683

7784
<center>
7885

@@ -85,6 +92,9 @@ MoveCost helps you find the solutions that cause the least disruption overall an
8592
- The cost of disconnection of clients. Moving a primary replica is usually more costly than the cost of moving a secondary replica.
8693
- The cost of interrupting an in-flight operation. Some operations at the data store level or operations performed in response to a client call are costly. After a certain point, you don’t want to stop them if you don’t have to. So while the operation is going on, you increase the move cost of this service object to reduce the likelihood that it moves. When the operation is done, you set the cost back to normal.
8794

95+
> [!IMPORTANT]
96+
> Using the VeryHigh move cost should be carefully considered as it significantly restricts the ability of Cluster Resource Manager to find a globally-optimal placement solution in the cluster. Replicas with VeryHigh move cost will be moved only if there is a constraint violation in the cluster that cannot be fixed in any other way (even if it requires moving many other replicas to fix the violation)
97+
8898
## Enabling move cost in your cluster
8999
In order for the more granular MoveCosts to be taken into account, MoveCost must be enabled in your cluster. Without this setting, the default mode of counting moves is used for calculating MoveCost, and MoveCost reports are ignored.
90100

‎articles/service-fabric/service-fabric-diagnostics-event-aggregation-wad.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,15 @@ Then, update the `VirtualMachineProfile` section of the template.json file by ad
162162
"DefaultEvents": {
163163
"eventDestination": "ServiceFabricSystemEventTable"
164164
}
165+
},
166+
{
167+
"provider": "02d06793-efeb-48c8-8f7f-09713309a810",
168+
"scheduledTransferLogLevelFilter": "Information",
169+
"scheduledTransferKeywordFilter": "4611686018427387904",
170+
"scheduledTransferPeriod": "PT5M",
171+
"DefaultEvents": {
172+
"eventDestination": "ServiceFabricSystemEventTable"
173+
}
165174
}
166175
]
167176
}
@@ -259,6 +268,15 @@ To enable the **Base Operational Channel** our recommendation for comprehensive
259268
"DefaultEvents": {
260269
"eventDestination": "ServiceFabricSystemEventTable"
261270
}
271+
},
272+
{
273+
"provider": "02d06793-efeb-48c8-8f7f-09713309a810",
274+
"scheduledTransferLogLevelFilter": "Information",
275+
"scheduledTransferKeywordFilter": "4611686018427387904",
276+
"scheduledTransferPeriod": "PT5M",
277+
"DefaultEvents": {
278+
"eventDestination": "ServiceFabricSystemEventTable"
279+
}
262280
}
263281
]
264282
}

‎articles/service-fabric/service-fabric-keyvault-references.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
title: Azure Service Fabric - Using Service Fabric application KeyVault references | Microsoft Docs
3+
description: This article explains how to use service-fabric KeyVaultReference support for application secrets.
4+
services: service-fabric
5+
author: athinanthny
6+
7+
ms.service: service-fabric
8+
ms.devlang: dotnet
9+
ms.topic: article
10+
ms.date: 09/20/2019
11+
ms.author: atsenthi
12+
---
13+
14+
# KeyVaultReference support for Service Fabric applications (preview)
15+
16+
A common challenge when building cloud applications is how to securely store secrets required by your application. For example, you might want to store the container repository credentials in keyvault and reference it in application manifest. Service Fabric KeyVaultReference uses Service Fabric Managed Identity and makes it easy to reference keyvault secrets. The remainder of this article details how to use Service Fabric KeyVaultReference and includes some typical usage.
17+
18+
## Prerequisites
19+
20+
- Managed Identity for Application (MIT)
21+
22+
Service Fabric KeyVaultReference support uses application's Managed Identity and therefore applications planing to use KeyVaultReferences should use Managed Identity. Follow this [document](concepts-managed-identity.md) to enable managed identity for your application.
23+
24+
- Central Secrets Store (CSS).
25+
26+
Central Secrets Store(CSS) is service-fabric's encrypted local secrets cache, KeyVaultReference once fetched are cached in CSS.
27+
28+
Add the below to your cluster configuration under `fabricSettings` to enable all the required features for KeyVaultReference support.
29+
30+
```json
31+
"fabricSettings":
32+
[
33+
...
34+
{
35+
"parameters": [
36+
"name": "CentralSecretService"
37+
{
38+
"name": "IsEnabled",
39+
"value": "true"
40+
},
41+
{
42+
"name": "MinReplicaSetSize",
43+
"value": "3"
44+
},
45+
{
46+
"name": "TargetReplicaSetSize",
47+
"value": "3"
48+
}
49+
],
50+
},
51+
{
52+
"name": "ManagedIdentityTokenService",
53+
"parameters": [
54+
{
55+
"name": "IsEnabled",
56+
"value": "true"
57+
}
58+
]
59+
}
60+
]
61+
```
62+
63+
> [!NOTE]
64+
> It's recommended to use a separate encryption certificate for CSS. You can add it under the "CentralSecretService" section.
65+
66+
```json
67+
{
68+
"name": "EncryptionCertificateThumbprint",
69+
"value": "<EncryptionCertificateThumbprint for CSS>"
70+
}
71+
```
72+
73+
- Grant application's managed identity access permission to the keyvault
74+
75+
Reference this [document](how-to-grant-access-other-resources.md) to see how to grant managed identity access to keyvault. Also note if you are using System Assigned Managed Identity, the managed identity is created only after application deployment.
76+
77+
## Keyvault secret as application parameter
78+
Let's say the application needs to read the backend database password stored in keyvault, Service Fabric KeyVaultReference support makes it easy. Below example reads `DBPassword` secret from keyvault using Service Fabric KeyVaultReference support.
79+
80+
- Add a section to settings.xml
81+
82+
Define `DBPassword` parameter with Type `KeyVaultReference` and Value `<KeyVaultURL>`
83+
84+
```xml
85+
<Section Name="dbsecrets">
86+
<Parameter Name="DBPassword" Type="KeyVaultReference" Value="https://vault200.vault.azure.net/secrets/dbpassword/8ec042bbe0ea4356b9b171588a8a1f32"/>
87+
</Section>
88+
```
89+
- Reference the new section in ApplicationManifest.xml in `<ConfigPackagePolicies>`
90+
91+
```xml
92+
<ServiceManifestImport>
93+
<Policies>
94+
<IdentityBindingPolicy ServiceIdentityRef="WebAdmin" ApplicationIdentityRef="ttkappuser" />
95+
<ConfigPackagePolicies CodePackageRef="Code">
96+
<!--Linux container example-->
97+
<ConfigPackage Name="Config" SectionName="dbsecrets" EnvironmentVariableName="SecretPath" MountPoint="/var/secrets"/>
98+
<!--Windows container example-->
99+
<!-- <ConfigPackage Name="Config" SectionName="dbsecrets" EnvironmentVariableName="SecretPath" MountPoint="C:\secrets"/> -->
100+
</ConfigPackagePolicies>
101+
</Policies>
102+
</ServiceManifestImport>
103+
```
104+
105+
- Using KeyVaultReference in your application
106+
107+
Service Fabric on service instantiation will resolve the KeyVaultReference Parameter using application's managed identity. Each parameter listed under `<Section Name=dbsecrets>` will be a file under the folder pointed to by EnvironmentVariable SecretPath. Below C# code snippet show how to read DBPassword in your application.
108+
109+
```C#
110+
string secretPath = Environment.GetEnvironmentVariable("SecretPath");
111+
using (StreamReader sr = new StreamReader(Path.Combine(secretPath, "DBPassword")))
112+
{
113+
string dbPassword = sr.ReadToEnd();
114+
// dbPassword to connect to DB
115+
}
116+
```
117+
> [!NOTE]
118+
> For the container scenario, you can use the MountPoint to control where the `secrets` will be mounted.
119+
120+
## Keyvault secret as environment variable
121+
122+
Service Fabric environment variables now support KeyVaultReference type, below example shows how to bind an environment variable to a secret stored in KeyVault.
123+
124+
```xml
125+
<EnvironmentVariables>
126+
<EnvironmentVariable Name="EventStorePassword" Type="KeyVaultReference" Value="https://ttkvault.vault.azure.net/secrets/clustercert/e225bd97e203430d809740b47736b9b8"/>
127+
</EnvironmentVariables>
128+
```
129+
130+
```C#
131+
string eventStorePassword = Environment.GetEnvironmentVariable("EventStorePassword");
132+
```
133+
## Keyvault secret as container repository password
134+
KeyVaultReference is a supported type for container RepositoryCredentials, below example shows how to use a keyvault
135+
reference as container repository password.
136+
```xml
137+
<Policies>
138+
<ContainerHostPolicies CodePackageRef="Code">
139+
<RepositoryCredentials AccountName="user1" Type="KeyVaultReference" Password="https://ttkvault.vault.azure.net/secrets/containerpwd/e225bd97e203430d809740b47736b9b8"/>
140+
</ContainerHostPolicies>
141+
```
142+
## FAQ
143+
- Managed identity needs to be enabled for KeyVaultReference support, your application activation will fail if KeyVaultReference is used without enabling Managed Identity.
144+
145+
- If you are using system assigned identity, it's created only after the application is deployed and this creates a circular dependency. Once your application is deployed, you can grant the system assigned identity access permission to keyvault. You can find the system assigned identity by name {cluster}/{application name}/{servicename}
146+
147+
- The keyvault needs to be in the same subscription as your service fabric cluster.
148+
149+
## Next steps
150+
151+
* [Azure KeyVault Documentation](https://docs.microsoft.com/azure/key-vault/)

‎articles/service-fabric/service-fabric-reliable-services-configuration.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ ReplicatorConfig
121121
| SharedLogPath |Fully qualified path name |"" |Specifies the fully qualified path where the shared log file for this replica will be created. Typically, services should not use this setting. However, if SharedLogPath is specified, then SharedLogId must also be specified. |
122122
| SlowApiMonitoringDuration |Seconds |300 |Sets the monitoring interval for managed API calls. Example: user provided backup callback function. After the interval has passed, a warning health report will be sent to the Health Manager. |
123123
| LogTruncationIntervalSeconds |Seconds |0 |Configurable interval at which log truncation will be initiated on each replica. It is used to ensure log is also truncated based on time instead of just log size. This setting also forces purge of deleted entries in reliable dictionary. Hence it can be used to ensure deleted items are purged in a timely manner. |
124+
| EnableStableReads |Boolean |False |Enabling stable reads restricts secondary replicas to returning values which have been quorum-acked. |
124125

125126
### Sample configuration via code
126127
```csharp

0 commit comments

Comments
 (0)