Skip to content

Commit 9b8fc3e

Browse files
zfengmszfengms
committed
add KeyVault Extension for Windows template and troubleshooting information
1 parent ea654e2 commit 9b8fc3e

File tree

2 files changed

+157
-5
lines changed

2 files changed

+157
-5
lines changed

‎articles/batch/automatic-certificate-rotation.md

Lines changed: 75 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ REST API URI
4848
PUT https://management.azure.com/subscriptions/<subscriptionid>/resourceGroups/<resourcegroupName>/providers/Microsoft.Batch/batchAccounts/<batchaccountname>/pools/<poolname>?api-version=2021-01-01
4949
```
5050

51-
Request Body
51+
Request Body for Linux node
5252

5353
```json
5454
{
@@ -73,7 +73,7 @@ Request Body
7373
"name": "KVExtensions",
7474
"type": "KeyVaultForLinux",
7575
"publisher": "Microsoft.Azure.KeyVault",
76-
"typeHandlerVersion": "1.0",
76+
"typeHandlerVersion": "3.0",
7777
"autoUpgradeMinorVersion": true,
7878
"settings": {
7979
"secretsManagementSettings": {
@@ -110,6 +110,71 @@ Request Body
110110

111111
```
112112

113+
Request Body for Windows node
114+
115+
```json
116+
{
117+
"name": "test2",
118+
"type": "Microsoft.Batch/batchAccounts/pools",
119+
"properties": {
120+
"vmSize": "STANDARD_DS2_V2",
121+
"taskSchedulingPolicy": {
122+
"nodeFillType": "Pack"
123+
},
124+
"deploymentConfiguration": {
125+
"virtualMachineConfiguration": {
126+
"imageReference": {
127+
"publisher": "microsoftwindowsserver",
128+
"offer": "windowsserver",
129+
"sku": "2022-datacenter",
130+
"version": "latest"
131+
},
132+
"nodeAgentSkuId": "batch.node.windows amd64",
133+
"extensions": [
134+
{
135+
"name": "KVExtensions",
136+
"type": "KeyVaultForWindows",
137+
"publisher": "Microsoft.Azure.KeyVault",
138+
"typeHandlerVersion": "3.0",
139+
"autoUpgradeMinorVersion": true,
140+
"settings": {
141+
"secretsManagementSettings": {
142+
"pollingIntervalInS": "300",
143+
"requireInitialSync": true,
144+
"observedCertificates": [
145+
{
146+
"https://testkvwestus2s.vault.azure.net/secrets/authcertforumatesting/8f5f3f491afd48cb99286ba2aacd39af",
147+
"certificateStoreLocation": "LocalMachine",
148+
"keyExportable": true
149+
}
150+
]
151+
},
152+
"authenticationSettings": {
153+
"msiEndpoint": "http://169.254.169.254/metadata/identity",
154+
"msiClientId": "b9f6dd56-d2d6-4967-99d7-8062d56fd84c"
155+
}
156+
},
157+
}
158+
]
159+
}
160+
},
161+
"scaleSettings": {
162+
"fixedScale": {
163+
"targetDedicatedNodes": 1,
164+
"resizeTimeout": "PT15M"
165+
}
166+
},
167+
},
168+
"identity": {
169+
"type": "UserAssigned",
170+
"userAssignedIdentities": {
171+
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
172+
}
173+
}
174+
}
175+
176+
```
177+
113178
## Validate the certificate
114179

115180
To confirm that the certificate has been successfully deployed, log in to the compute node. You should see output similar to the following:
@@ -119,6 +184,14 @@ root@74773db5fe1b42ab9a4b6cf679d929da000000:/var/lib/waagent/Microsoft.Azure.Key
119184
[{"status":{"code":0,"formattedMessage":{"lang":"en","message":"Successfully started Key Vault extension service. 2021-03-03T23:12:23Z"},"operation":"Service start.","status":"success"},"timestampUTC":"2021-03-03T23:12:23Z","version":"1.0"}]root@74773db5fe1b42ab9a4b6cf679d929da000000:/var/lib/waagent/Microsoft.Azure.KeyVault.KeyVaultForLinux-1.0.1363.13/status#
120185
```
121186

187+
## Troubleshooting Key Vault Extension
188+
189+
If Key Vault extension is not configured correctly, the compute node might be in usuable state, to troubleshoot Key Vault extension failure, you can temporarily set requireInitialSync to false, redploy your pool, then the compute node will be in idle state, you can login to the compute node to check KeyVault extension logs for errors and fix the configuration issues. Please visit Key Vault extension doc link below for more information.
190+
191+
- [Azure Key Vault extension for Linux](../virtual-machines/extensions/key-vault-linux.md)
192+
- [Azure Key Vault extension for Windows](../virtual-machines/extensions/key-vault-windows.md)
193+
194+
122195
## Next steps
123196

124197
- Learn more about [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).

‎articles/batch/create-pool-extensions.md

Lines changed: 82 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,15 @@ You can request support for additional publishers and/or extension types by open
4242

4343
## Create a pool with extensions
4444

45-
The example below creates a Batch pool of Linux nodes that uses the Azure Key Vault extension.
45+
The example below creates a Batch pool of Linux/Windows nodes that uses the Azure Key Vault extension.
4646

4747
REST API URI
4848

4949
```http
5050
PUT https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Batch/batchAccounts/<batchaccountName>/pools/<batchpoolName>?api-version=2021-01-01
5151
```
5252

53-
Request Body
53+
Request Body for Linux node
5454

5555
```json
5656
{
@@ -75,7 +75,7 @@ Request Body
7575
"name": "secretext",
7676
"type": "KeyVaultForLinux",
7777
"publisher": "Microsoft.Azure.KeyVault",
78-
"typeHandlerVersion": "1.0",
78+
"typeHandlerVersion": "3.0",
7979
"autoUpgradeMinorVersion": true,
8080
"settings": {
8181
"secretsManagementSettings": {
@@ -103,6 +103,78 @@ Request Body
103103
"resizeTimeout": "PT15M"
104104
}
105105
}
106+
},
107+
"identity": {
108+
"type": "UserAssigned",
109+
"userAssignedIdentities": {
110+
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
111+
}
112+
}
113+
}
114+
```
115+
116+
Request Body for Windows node
117+
118+
```json
119+
{
120+
"name": "test1",
121+
"type": "Microsoft.Batch/batchAccounts/pools",
122+
"properties": {
123+
"vmSize": "STANDARD_DS2_V2",
124+
"taskSchedulingPolicy": {
125+
"nodeFillType": "Pack"
126+
},
127+
"deploymentConfiguration": {
128+
"virtualMachineConfiguration": {
129+
"imageReference": {
130+
"publisher": "microsoftwindowsserver",
131+
"offer": "windowsserver",
132+
"sku": "2022-datacenter",
133+
"version": "latest"
134+
},
135+
"nodeAgentSkuId": "batch.node.windows amd64",
136+
"extensions": [
137+
{
138+
"name": "secretext",
139+
"type": "KeyVaultForWindows",
140+
"publisher": "Microsoft.Azure.KeyVault",
141+
"typeHandlerVersion": "3.0",
142+
"autoUpgradeMinorVersion": true,
143+
"settings": {
144+
"secretsManagementSettings": {
145+
"pollingIntervalInS": "300",
146+
"requireInitialSync": true,
147+
"observedCertificates": [
148+
{
149+
"https://testkvwestus2.vault.azure.net/secrets/authsecreat"
150+
"certificateStoreLocation": "LocalMachine",
151+
"keyExportable": true
152+
}
153+
]
154+
},
155+
"authenticationSettings": {
156+
"msiEndpoint": "http://169.254.169.254/metadata/identity",
157+
"msiClientId": "885b1a3d-f13c-4030-afcf-9f05044d78dc"
158+
}
159+
},
160+
"protectedSettings":{}
161+
}
162+
]
163+
}
164+
},
165+
"scaleSettings": {
166+
"fixedScale": {
167+
"targetDedicatedNodes": 1,
168+
"targetLowPriorityNodes": 0,
169+
"resizeTimeout": "PT15M"
170+
}
171+
}
172+
},
173+
"identity": {
174+
"type": "UserAssigned",
175+
"userAssignedIdentities": {
176+
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
177+
}
106178
}
107179
}
108180
```
@@ -134,6 +206,13 @@ Response Body
134206

135207
```
136208

209+
## Troubleshooting Key Vault Extension
210+
211+
If Key Vault extension is not configured correctly, the compute node might be in usuable state, to troubleshoot Key Vault extension failure, you can temporarily set requireInitialSync to false, redploy your pool, then the compute node will be in idle state, you can login to the compute node to check KeyVault extension logs for errors and fix the configuration issues. Please visit Key Vault extension doc link below for more information.
212+
213+
- [Azure Key Vault extension for Linux](../virtual-machines/extensions/key-vault-linux.md)
214+
- [Azure Key Vault extension for Windows](../virtual-machines/extensions/key-vault-windows.md)
215+
137216
## Next steps
138217

139218
- Learn about various ways to [copy applications and data to pool nodes](batch-applications-to-pool-nodes.md).

0 commit comments

Comments
 (0)