Skip to content

Commit 9c68ff5

Browse files
zfengmszfengms
committed
fix acrolinx issues
1 parent 9b8fc3e commit 9c68ff5

File tree

2 files changed

+132
-123
lines changed

2 files changed

+132
-123
lines changed

‎articles/batch/automatic-certificate-rotation.md

Lines changed: 58 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,32 @@
11
---
22
title: Enable automatic certificate rotation in a Batch pool
3-
description: You can create a Batch pool with a managed identity and a certificate that will automatically be renewed.
3+
description: You can create a Batch pool with a managed identity and a certificate that can automatically be renewed.
44
ms.topic: conceptual
55
ms.custom: linux-related-content
66
ms.date: 12/05/2023
77
---
8+
89
# Enable automatic certificate rotation in a Batch pool
910

10-
You can create a Batch pool with a certificate that will automatically be renewed. To do so, your pool must be created with a [user-assigned managed identity](managed-identity-pools.md) that will have access to the certificate in [Azure Key Vault](../key-vault/general/overview.md).
11+
You can create a Batch pool with a certificate that can automatically be renewed. To do so, your pool must be created with a [user-assigned managed identity](managed-identity-pools.md) that has access to the certificate in [Azure Key Vault](../key-vault/general/overview.md).
1112

1213
## Create a user-assigned identity
1314

1415
First, [create your user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity) in the same tenant as your Batch account. This managed identity doesn't need to be in the same resource group or even in the same subscription.
1516

16-
Be sure to note the **Client ID** of the user-assigned managed identity. You'll need this value later.
17+
Be sure to note the **Client ID** of the user-assigned managed identity. You need this value later.
1718

1819
:::image type="content" source="media/automatic-certificate-rotation/client-id.png" alt-text="Screenshot showing the client ID of a user-assigned managed identity in the Azure portal.":::
1920

2021
## Create your certificate
2122

22-
Next, you'll need to create a certificate and add it to Azure Key Vault. If you haven't already created a key vault, you'll need to do that first. For instructions, see [Quickstart: Set and retrieve a certificate from Azure Key Vault using the Azure portal](../key-vault/certificates/quick-create-portal.md).
23+
Next, you need to create a certificate and add it to Azure Key Vault. If you haven't already created a key vault, you need to do that first. For instructions, see [Quickstart: Set and retrieve a certificate from Azure Key Vault using the Azure portal](../key-vault/certificates/quick-create-portal.md).
2324

2425
When creating your certificate, be sure to set **Lifetime Action Type** to automatically renew, and specify the number of days after which the certificate should renew.
2526

2627
:::image type="content" source="media/automatic-certificate-rotation/certificate.png" alt-text="Screenshot of the certificate creation screen in the Azure portal.":::
2728

28-
After your certificate has been created, make note of its **Secret Identifier**. You'll need this value later.
29+
After your certificate has been created, make note of its **Secret Identifier**. You need this value later.
2930

3031
:::image type="content" source="media/automatic-certificate-rotation/secret-identifier.png" alt-text="Screenshot showing the Secret Identifier of a certificate.":::
3132

@@ -52,62 +53,61 @@ Request Body for Linux node
5253

5354
```json
5455
{
55-
"name": "test2",
56-
"type": "Microsoft.Batch/batchAccounts/pools",
57-
"properties": {
58-
"vmSize": "STANDARD_DS2_V2",
59-
"taskSchedulingPolicy": {
60-
"nodeFillType": "Pack"
61-
},
62-
"deploymentConfiguration": {
63-
"virtualMachineConfiguration": {
64-
"imageReference": {
65-
"publisher": "canonical",
66-
"offer": "ubuntuserver",
67-
"sku": "20.04-lts",
68-
"version": "latest"
69-
},
70-
"nodeAgentSkuId": "batch.node.ubuntu 20.04",
71-
"extensions": [
72-
{
73-
"name": "KVExtensions",
74-
"type": "KeyVaultForLinux",
75-
"publisher": "Microsoft.Azure.KeyVault",
76-
"typeHandlerVersion": "3.0",
77-
"autoUpgradeMinorVersion": true,
78-
"settings": {
79-
"secretsManagementSettings": {
80-
"pollingIntervalInS": "300",
81-
"certificateStoreLocation": "/var/lib/waagent/Microsoft.Azure.KeyVault",
82-
"requireInitialSync": true,
83-
"observedCertificates": [
84-
"https://testkvwestus2s.vault.azure.net/secrets/authcertforumatesting/8f5f3f491afd48cb99286ba2aacd39af"
85-
]
86-
},
87-
"authenticationSettings": {
88-
"msiEndpoint": "http://169.254.169.254/metadata/identity",
89-
"msiClientId": "b9f6dd56-d2d6-4967-99d7-8062d56fd84c"
90-
}
91-
},
92-
}
93-
]
94-
}
56+
"name": "test2",
57+
"type": "Microsoft.Batch/batchAccounts/pools",
58+
"properties": {
59+
"vmSize": "STANDARD_DS2_V2",
60+
"taskSchedulingPolicy": {
61+
"nodeFillType": "Pack"
62+
},
63+
"deploymentConfiguration": {
64+
"virtualMachineConfiguration": {
65+
"imageReference": {
66+
"publisher": "canonical",
67+
"offer": "ubuntuserver",
68+
"sku": "20.04-lts",
69+
"version": "latest"
9570
},
96-
"scaleSettings": {
97-
"fixedScale": {
98-
"targetDedicatedNodes": 1,
99-
"resizeTimeout": "PT15M"
71+
"nodeAgentSkuId": "batch.node.ubuntu 20.04",
72+
"extensions": [
73+
{
74+
"name": "KVExtensions",
75+
"type": "KeyVaultForLinux",
76+
"publisher": "Microsoft.Azure.KeyVault",
77+
"typeHandlerVersion": "3.0",
78+
"autoUpgradeMinorVersion": true,
79+
"settings": {
80+
"secretsManagementSettings": {
81+
"pollingIntervalInS": "300",
82+
"certificateStoreLocation": "/var/lib/waagent/Microsoft.Azure.KeyVault",
83+
"requireInitialSync": true,
84+
"observedCertificates": [
85+
"https://testkvwestus2s.vault.azure.net/secrets/authcertforumatesting/8f5f3f491afd48cb99286ba2aacd39af"
86+
]
87+
},
88+
"authenticationSettings": {
89+
"msiEndpoint": "http://169.254.169.254/metadata/identity",
90+
"msiClientId": "b9f6dd56-d2d6-4967-99d7-8062d56fd84c"
91+
}
10092
}
101-
},
93+
}
94+
]
95+
}
10296
},
103-
"identity": {
104-
"type": "UserAssigned",
105-
"userAssignedIdentities": {
106-
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
107-
}
97+
"scaleSettings": {
98+
"fixedScale": {
99+
"targetDedicatedNodes": 1,
100+
"resizeTimeout": "PT15M"
101+
}
108102
}
103+
},
104+
"identity": {
105+
"type": "UserAssigned",
106+
"userAssignedIdentities": {
107+
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
108+
}
109+
}
109110
}
110-
111111
```
112112

113113
Request Body for Windows node
@@ -177,7 +177,7 @@ Request Body for Windows node
177177

178178
## Validate the certificate
179179

180-
To confirm that the certificate has been successfully deployed, log in to the compute node. You should see output similar to the following:
180+
To confirm that the certificate is successfully deployed, log in to the compute node. You should see output similar to the following:
181181

182182
```
183183
root@74773db5fe1b42ab9a4b6cf679d929da000000:/var/lib/waagent/Microsoft.Azure.KeyVault.KeyVaultForLinux-1.0.1363.13/status# cat 1.status
@@ -186,12 +186,11 @@ root@74773db5fe1b42ab9a4b6cf679d929da000000:/var/lib/waagent/Microsoft.Azure.Key
186186

187187
## Troubleshooting Key Vault Extension
188188

189-
If Key Vault extension is not configured correctly, the compute node might be in usuable state, to troubleshoot Key Vault extension failure, you can temporarily set requireInitialSync to false, redploy your pool, then the compute node will be in idle state, you can login to the compute node to check KeyVault extension logs for errors and fix the configuration issues. Please visit Key Vault extension doc link below for more information.
189+
If Key Vault extension is configured incorrectly, the compute node might be in usuable state. To troubleshoot Key Vault extension failure, you can temporarily set requireInitialSync to false and redeploy your pool, then the compute node is in idle state, you can log in to the compute node to check KeyVault extension logs for errors and fix the configuration issues. Visit following Key Vault extension doc link for more information.
190190

191191
- [Azure Key Vault extension for Linux](../virtual-machines/extensions/key-vault-linux.md)
192192
- [Azure Key Vault extension for Windows](../virtual-machines/extensions/key-vault-windows.md)
193193

194-
195194
## Next steps
196195

197196
- Learn more about [Managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).

‎articles/batch/create-pool-extensions.md

Lines changed: 74 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ ms.date: 12/05/2023
88

99
# Use extensions with Batch pools
1010

11-
Extensions are small applications that facilitate post-provisioning configuration and setup on Batch compute nodes. You can select any of the extensions that are allowed by Azure Batch and have them installed on the compute nodes as they're provisioned. After that, the extension can perform its intended operation.
11+
Extensions are small applications that facilitate post-provisioning configuration and setup on Batch compute nodes. You can select any of the extensions that are allowed by Azure Batch and install them on the compute nodes as they're provisioned. After that, the extension can perform its intended operation.
1212

1313
You can check the live status of the extensions you use and retrieve the information they return in order to pursue any detection, correction, or diagnostics capabilities.
1414

1515
## Prerequisites
1616

1717
- Pools with extensions must use [Virtual Machine Configuration](nodes-and-pools.md#virtual-machine-configuration).
1818
- The CustomScript extension type is reserved for the Azure Batch service and can't be overridden.
19-
- Some extensions may need pool-level Managed Identity accessible in the context of a compute node in order to function properly. Please see [configuring managed identities in Batch pools](managed-identity-pools.md) if applicable for the extension(s).
19+
- Some extensions may need pool-level Managed Identity accessible in the context of a compute node in order to function properly. See [configuring managed identities in Batch pools](managed-identity-pools.md) if applicable for the extensions.
2020

2121
> [!TIP]
2222
> Extensions cannot be added to an existing pool. Pools must be recreated to add, remove, or update extensions.
@@ -38,11 +38,11 @@ The following extensions can currently be installed when creating a Batch pool:
3838
- [Azure Monitor agent for Linux](../azure-monitor/agents/azure-monitor-agent-manage.md)
3939
- [Azure Monitor agent for Windows](../azure-monitor/agents/azure-monitor-agent-manage.md)
4040

41-
You can request support for additional publishers and/or extension types by opening a support request.
41+
You can request support for other publishers and/or extension types by opening a support request.
4242

4343
## Create a pool with extensions
4444

45-
The example below creates a Batch pool of Linux/Windows nodes that uses the Azure Key Vault extension.
45+
The following example creates a Batch pool of Linux/Windows nodes that uses the Azure Key Vault extension.
4646

4747
REST API URI
4848

@@ -54,62 +54,62 @@ Request Body for Linux node
5454

5555
```json
5656
{
57-
"name": "test1",
58-
"type": "Microsoft.Batch/batchAccounts/pools",
59-
"properties": {
60-
"vmSize": "STANDARD_DS2_V2",
61-
"taskSchedulingPolicy": {
62-
"nodeFillType": "Pack"
57+
"name": "test1",
58+
"type": "Microsoft.Batch/batchAccounts/pools",
59+
"properties": {
60+
"vmSize": "STANDARD_DS2_V2",
61+
"taskSchedulingPolicy": {
62+
"nodeFillType": "Pack"
63+
},
64+
"deploymentConfiguration": {
65+
"virtualMachineConfiguration": {
66+
"imageReference": {
67+
"publisher": "microsoftcblmariner",
68+
"offer": "cbl-mariner",
69+
"sku": "cbl-mariner-2",
70+
"version": "latest"
6371
},
64-
"deploymentConfiguration": {
65-
"virtualMachineConfiguration": {
66-
"imageReference": {
67-
"publisher": "microsoftcblmariner",
68-
"offer": "cbl-mariner",
69-
"sku": "cbl-mariner-2",
70-
"version": "latest"
71-
},
72-
"nodeAgentSkuId": "batch.node.mariner 2.0",
73-
"extensions": [
74-
{
75-
"name": "secretext",
76-
"type": "KeyVaultForLinux",
77-
"publisher": "Microsoft.Azure.KeyVault",
78-
"typeHandlerVersion": "3.0",
79-
"autoUpgradeMinorVersion": true,
80-
"settings": {
81-
"secretsManagementSettings": {
82-
"pollingIntervalInS": "300",
83-
"certificateStoreLocation": "/var/lib/waagent/Microsoft.Azure.KeyVault",
84-
"requireInitialSync": true,
85-
"observedCertificates": [
86-
"https://testkvwestus2.vault.azure.net/secrets/authsecreat"
87-
]
88-
},
89-
"authenticationSettings": {
90-
"msiEndpoint": "http://169.254.169.254/metadata/identity",
91-
"msiClientId": "885b1a3d-f13c-4030-afcf-9f05044d78dc"
92-
}
93-
},
94-
"protectedSettings":{}
95-
}
72+
"nodeAgentSkuId": "batch.node.mariner 2.0",
73+
"extensions": [
74+
{
75+
"name": "secretext",
76+
"type": "KeyVaultForLinux",
77+
"publisher": "Microsoft.Azure.KeyVault",
78+
"typeHandlerVersion": "3.0",
79+
"autoUpgradeMinorVersion": true,
80+
"settings": {
81+
"secretsManagementSettings": {
82+
"pollingIntervalInS": "300",
83+
"certificateStoreLocation": "/var/lib/waagent/Microsoft.Azure.KeyVault",
84+
"requireInitialSync": true,
85+
"observedCertificates": [
86+
"https://testkvwestus2.vault.azure.net/secrets/authsecreat"
9687
]
97-
}
98-
},
99-
"scaleSettings": {
100-
"fixedScale": {
101-
"targetDedicatedNodes": 1,
102-
"targetLowPriorityNodes": 0,
103-
"resizeTimeout": "PT15M"
104-
}
105-
}
88+
},
89+
"authenticationSettings": {
90+
"msiEndpoint": "http://169.254.169.254/metadata/identity",
91+
"msiClientId": "885b1a3d-f13c-4030-afcf-9f05044d78dc"
92+
}
93+
},
94+
"protectedSettings": {}
95+
}
96+
]
97+
}
10698
},
107-
"identity": {
108-
"type": "UserAssigned",
109-
"userAssignedIdentities": {
110-
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
111-
}
99+
"scaleSettings": {
100+
"fixedScale": {
101+
"targetDedicatedNodes": 1,
102+
"targetLowPriorityNodes": 0,
103+
"resizeTimeout": "PT15M"
104+
}
112105
}
106+
},
107+
"identity": {
108+
"type": "UserAssigned",
109+
"userAssignedIdentities": {
110+
"/subscriptions/042998e4-36dc-4b7d-8ce3-a7a2c4877d33/resourceGroups/ACR/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testumaforpools": {}
111+
}
112+
}
113113
}
114114
```
115115

@@ -181,7 +181,7 @@ Request Body for Windows node
181181

182182
## Get extension data from a pool
183183

184-
The example below retrieves data from the Azure Key Vault extension.
184+
The following example retrieves data from the Azure Key Vault extension.
185185

186186
REST API URI
187187

@@ -193,22 +193,32 @@ Response Body
193193

194194
```json
195195
{
196-
"odata.metadata":"https://testwestus2batch.westus2.batch.azure.com/$metadata#extensions/@Element","instanceView":{
197-
"name":"secretext","statuses":[
196+
"odata.metadata": "https://testwestus2batch.westus2.batch.azure.com/$metadata#extensions/@Element",
197+
"instanceView": {
198+
"name": "secretext",
199+
"statuses": [
198200
{
199-
"code":"ProvisioningState/succeeded","level":0,"displayStatus":"Provisioning succeeded","message":"Successfully started Key Vault extension service. 2021-02-08T19:49:39Z"
201+
"code": "ProvisioningState/succeeded",
202+
"level": 0,
203+
"displayStatus": "Provisioning succeeded",
204+
"message": "Successfully started Key Vault extension service. 2021-02-08T19:49:39Z"
200205
}
201206
]
202-
},"vmExtension":{
203-
"name":"KVExtensions","publisher":"Microsoft.Azure.KeyVault","type":"KeyVaultForLinux","typeHandlerVersion":"1.0","autoUpgradeMinorVersion":true,"settings":"{\r\n \"secretsManagementSettings\": {\r\n \"pollingIntervalInS\": \"300\",\r\n \"certificateStoreLocation\": \"/var/lib/waagent/Microsoft.Azure.KeyVault\",\r\n \"requireInitialSync\": true,\r\n \"observedCertificates\": [\r\n \"https://testkvwestus2.vault.azure.net/secrets/testumi\"\r\n ]\r\n },\r\n \"authenticationSettings\": {\r\n \"msiEndpoint\": \"http://169.254.169.254/metadata/identity\",\r\n \"msiClientId\": \"885b1a3d-f13c-4030-afcf-922f05044d78dc\"\r\n }\r\n}"
207+
},
208+
"vmExtension": {
209+
"name": "KVExtensions",
210+
"publisher": "Microsoft.Azure.KeyVault",
211+
"type": "KeyVaultForLinux",
212+
"typeHandlerVersion": "1.0",
213+
"autoUpgradeMinorVersion": true,
214+
"settings": "{\r\n \"secretsManagementSettings\": {\r\n \"pollingIntervalInS\": \"300\",\r\n \"certificateStoreLocation\": \"/var/lib/waagent/Microsoft.Azure.KeyVault\",\r\n \"requireInitialSync\": true,\r\n \"observedCertificates\": [\r\n \"https://testkvwestus2.vault.azure.net/secrets/testumi\"\r\n ]\r\n },\r\n \"authenticationSettings\": {\r\n \"msiEndpoint\": \"http://169.254.169.254/metadata/identity\",\r\n \"msiClientId\": \"885b1a3d-f13c-4030-afcf-922f05044d78dc\"\r\n }\r\n}"
204215
}
205216
}
206-
207217
```
208218

209219
## Troubleshooting Key Vault Extension
210220

211-
If Key Vault extension is not configured correctly, the compute node might be in usuable state, to troubleshoot Key Vault extension failure, you can temporarily set requireInitialSync to false, redploy your pool, then the compute node will be in idle state, you can login to the compute node to check KeyVault extension logs for errors and fix the configuration issues. Please visit Key Vault extension doc link below for more information.
221+
If Key Vault extension is configured incorrectly, the compute node might be in usable state. To troubleshoot Key Vault extension failure, you can temporarily set requireInitialSync to false and redeploy your pool, then the compute node is in idle state, you can log in to the compute node to check KeyVault extension logs for errors and fix the configuration issues. Visit following Key Vault extension doc link for more information.
212222

213223
- [Azure Key Vault extension for Linux](../virtual-machines/extensions/key-vault-linux.md)
214224
- [Azure Key Vault extension for Windows](../virtual-machines/extensions/key-vault-windows.md)

0 commit comments

Comments
 (0)