|
1 | | ---- |
2 | | -title: Create a pool with disk encryption enabled |
3 | | -description: Learn how to use disk encryption configuration to encrypt nodes with a platform-managed key. |
4 | | -ms.topic: how-to |
5 | | -ms.date: 04/16/2021 |
6 | | -ms.devlang: csharp |
7 | | -ms.custom: devx-track-azurecli |
8 | | ---- |
9 | | - |
10 | | -# Create a pool with disk encryption enabled |
11 | | - |
12 | | -When you create an Azure Batch pool using [Virtual Machine Configuration](nodes-and-pools.md#virtual-machine-configuration), you can encrypt compute nodes in the pool with a platform-managed key by specifying the disk encryption configuration. |
13 | | - |
14 | | -This article explains how to create a Batch pool with disk encryption enabled. |
15 | | - |
16 | | -## Why use a pool with disk encryption configuration? |
17 | | - |
18 | | -With a Batch pool, you can access and store data on the OS and temporary disks of the compute node. Encrypting the server-side disk with a platform-managed key will safeguard this data with low overhead and convenience. |
19 | | - |
20 | | -Batch will apply one of these disk encryption technologies on compute nodes, based on pool configuration and regional supportability. |
21 | | - |
22 | | -- [Managed disk encryption at rest with platform-managed keys](../virtual-machines/disk-encryption.md#platform-managed-keys) |
23 | | -- [Encryption at host using a platform-managed Key](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data) |
24 | | -- [Azure Disk Encryption](../security/fundamentals/azure-disk-encryption-vms-vmss.md) |
25 | | - |
26 | | -You won't be able to specify which encryption method will be applied to the nodes in your pool. Instead, you provide the target disks you want to encrypt on their nodes, and Batch can choose the appropriate encryption method, ensuring the specified disks are encrypted on the compute node. |
27 | | - |
28 | | -> [!IMPORTANT] |
29 | | -> If you are creating your pool with a Linux [custom image](batch-sig-images.md), you can only enable disk encryption only if your pool is using an [Encryption At Host Supported VM size](../virtual-machines/disk-encryption.md#supported-vm-sizes). |
30 | | -> Encryption At Host is not currently supported on User Subscription Pools until the feature becomes [publicly available in Azure](../virtual-machines/disks-enable-host-based-encryption-portal.md#prerequisites). |
31 | | -
|
32 | | -## Azure portal |
33 | | - |
34 | | -When creating a Batch pool in the the Azure portal, select either **TemporaryDisk** or **OsAndTemporaryDisk** under **Disk Encryption Configuration**. |
35 | | - |
36 | | -:::image type="content" source="media/disk-encryption/portal-view.png" alt-text="Screenshot of the Disk Encryption Configuration option in the Azure portal."::: |
37 | | - |
38 | | -After the pool is created, you can see the disk encryption configuration targets in the pool's **Properties** section. |
39 | | - |
40 | | -:::image type="content" source="media/disk-encryption/configuration-target.png" alt-text="Screenshot showing the disk encryption configuration targets in the Azure portal."::: |
41 | | - |
42 | | -## Examples |
43 | | - |
44 | | -The following examples show how to encrypt the OS and temporary disks on a Batch pool using the Batch .NET SDK, the Batch REST API, and the Azure CLI. |
45 | | - |
46 | | -### Batch .NET SDK |
47 | | - |
48 | | -```csharp |
49 | | -pool.VirtualMachineConfiguration.DiskEncryptionConfiguration = new DiskEncryptionConfiguration( |
50 | | - targets: new List<DiskEncryptionTarget> { DiskEncryptionTarget.OsDisk, DiskEncryptionTarget.TemporaryDisk } |
51 | | - ); |
52 | | -``` |
53 | | - |
54 | | -### Batch REST API |
55 | | - |
56 | | -REST API URL: |
57 | | - |
58 | | -``` |
59 | | -POST {batchURL}/pools?api-version=2020-03-01.11.0 |
60 | | -client-request-id: 00000000-0000-0000-0000-000000000000 |
61 | | -``` |
62 | | - |
63 | | -Request body: |
64 | | - |
65 | | -``` |
66 | | -"pool": { |
67 | | - "id": "pool2", |
68 | | - "vmSize": "standard_a1", |
69 | | - "virtualMachineConfiguration": { |
70 | | - "imageReference": { |
71 | | - "publisher": "Canonical", |
72 | | - "offer": "UbuntuServer", |
73 | | - "sku": "18.04-LTS" |
74 | | - }, |
75 | | - "diskEncryptionConfiguration": { |
76 | | - "targets": [ |
77 | | - "OsDisk", |
78 | | - "TemporaryDisk" |
79 | | - ] |
80 | | - } |
81 | | - "nodeAgentSKUId": "batch.node.ubuntu 18.04" |
82 | | - }, |
83 | | - "resizeTimeout": "PT15M", |
84 | | - "targetDedicatedNodes": 5, |
85 | | - "targetLowPriorityNodes": 0, |
86 | | - "taskSlotsPerNode": 3, |
87 | | - "enableAutoScale": false, |
88 | | - "enableInterNodeCommunication": false |
89 | | -} |
90 | | -``` |
91 | | - |
92 | | -### Azure CLI |
93 | | - |
94 | | -```azurecli-interactive |
95 | | -az batch pool create \ |
96 | | - --id diskencryptionPool \ |
97 | | - --vm-size Standard_DS1_V2 \ |
98 | | - --target-dedicated-nodes 2 \ |
99 | | - --image canonical:ubuntuserver:18.04-LTS \ |
100 | | - --node-agent-sku-id "batch.node.ubuntu 18.04" \ |
101 | | - --disk-encryption-targets OsDisk TemporaryDisk |
102 | | -``` |
103 | | - |
104 | | -## Next steps |
105 | | - |
106 | | -- Learn more about [server-side encryption of Azure Disk Storage](../virtual-machines/disk-encryption.md). |
107 | | -- For an in-depth overview of Batch, see [Batch service workflow and resources](batch-service-workflow-features.md). |
| 1 | +--- |
| 2 | +title: Create a pool with disk encryption enabled |
| 3 | +description: Learn how to use disk encryption configuration to encrypt nodes with a platform-managed key. |
| 4 | +ms.topic: how-to |
| 5 | +ms.date: 04/16/2021 |
| 6 | +ms.devlang: csharp |
| 7 | +ms.custom: devx-track-azurecli |
| 8 | +--- |
| 9 | + |
| 10 | +# Create a pool with disk encryption enabled |
| 11 | + |
| 12 | +When you create an Azure Batch pool using [Virtual Machine Configuration](nodes-and-pools.md#virtual-machine-configuration), you can encrypt compute nodes in the pool with a platform-managed key by specifying the disk encryption configuration. |
| 13 | + |
| 14 | +This article explains how to create a Batch pool with disk encryption enabled. |
| 15 | + |
| 16 | +## Why use a pool with disk encryption configuration? |
| 17 | + |
| 18 | +With a Batch pool, you can access and store data on the OS and temporary disks of the compute node. Encrypting the server-side disk with a platform-managed key will safeguard this data with low overhead and convenience. |
| 19 | + |
| 20 | +Batch will apply one of these disk encryption technologies on compute nodes, based on pool configuration and regional supportability. |
| 21 | + |
| 22 | +- [Managed disk encryption at rest with platform-managed keys](../virtual-machines/disk-encryption.md#platform-managed-keys) |
| 23 | +- [Encryption at host using a platform-managed Key](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data) |
| 24 | +- [Azure Disk Encryption](../virtual-machines/disk-encryption-overview.md) |
| 25 | + |
| 26 | +You won't be able to specify which encryption method will be applied to the nodes in your pool. Instead, you provide the target disks you want to encrypt on their nodes, and Batch can choose the appropriate encryption method, ensuring the specified disks are encrypted on the compute node. |
| 27 | + |
| 28 | +> [!IMPORTANT] |
| 29 | +> If you are creating your pool with a Linux [custom image](batch-sig-images.md), you can only enable disk encryption only if your pool is using an [Encryption At Host Supported VM size](../virtual-machines/disk-encryption.md#supported-vm-sizes). |
| 30 | +> Encryption At Host is not currently supported on User Subscription Pools until the feature becomes [publicly available in Azure](../virtual-machines/disks-enable-host-based-encryption-portal.md#prerequisites). |
| 31 | +
|
| 32 | +## Azure portal |
| 33 | + |
| 34 | +When creating a Batch pool in the the Azure portal, select either **TemporaryDisk** or **OsAndTemporaryDisk** under **Disk Encryption Configuration**. |
| 35 | + |
| 36 | +:::image type="content" source="media/disk-encryption/portal-view.png" alt-text="Screenshot of the Disk Encryption Configuration option in the Azure portal."::: |
| 37 | + |
| 38 | +After the pool is created, you can see the disk encryption configuration targets in the pool's **Properties** section. |
| 39 | + |
| 40 | +:::image type="content" source="media/disk-encryption/configuration-target.png" alt-text="Screenshot showing the disk encryption configuration targets in the Azure portal."::: |
| 41 | + |
| 42 | +## Examples |
| 43 | + |
| 44 | +The following examples show how to encrypt the OS and temporary disks on a Batch pool using the Batch .NET SDK, the Batch REST API, and the Azure CLI. |
| 45 | + |
| 46 | +### Batch .NET SDK |
| 47 | + |
| 48 | +```csharp |
| 49 | +pool.VirtualMachineConfiguration.DiskEncryptionConfiguration = new DiskEncryptionConfiguration( |
| 50 | + targets: new List<DiskEncryptionTarget> { DiskEncryptionTarget.OsDisk, DiskEncryptionTarget.TemporaryDisk } |
| 51 | + ); |
| 52 | +``` |
| 53 | + |
| 54 | +### Batch REST API |
| 55 | + |
| 56 | +REST API URL: |
| 57 | + |
| 58 | +``` |
| 59 | +POST {batchURL}/pools?api-version=2020-03-01.11.0 |
| 60 | +client-request-id: 00000000-0000-0000-0000-000000000000 |
| 61 | +``` |
| 62 | + |
| 63 | +Request body: |
| 64 | + |
| 65 | +``` |
| 66 | +"pool": { |
| 67 | + "id": "pool2", |
| 68 | + "vmSize": "standard_a1", |
| 69 | + "virtualMachineConfiguration": { |
| 70 | + "imageReference": { |
| 71 | + "publisher": "Canonical", |
| 72 | + "offer": "UbuntuServer", |
| 73 | + "sku": "18.04-LTS" |
| 74 | + }, |
| 75 | + "diskEncryptionConfiguration": { |
| 76 | + "targets": [ |
| 77 | + "OsDisk", |
| 78 | + "TemporaryDisk" |
| 79 | + ] |
| 80 | + } |
| 81 | + "nodeAgentSKUId": "batch.node.ubuntu 18.04" |
| 82 | + }, |
| 83 | + "resizeTimeout": "PT15M", |
| 84 | + "targetDedicatedNodes": 5, |
| 85 | + "targetLowPriorityNodes": 0, |
| 86 | + "taskSlotsPerNode": 3, |
| 87 | + "enableAutoScale": false, |
| 88 | + "enableInterNodeCommunication": false |
| 89 | +} |
| 90 | +``` |
| 91 | + |
| 92 | +### Azure CLI |
| 93 | + |
| 94 | +```azurecli-interactive |
| 95 | +az batch pool create \ |
| 96 | + --id diskencryptionPool \ |
| 97 | + --vm-size Standard_DS1_V2 \ |
| 98 | + --target-dedicated-nodes 2 \ |
| 99 | + --image canonical:ubuntuserver:18.04-LTS \ |
| 100 | + --node-agent-sku-id "batch.node.ubuntu 18.04" \ |
| 101 | + --disk-encryption-targets OsDisk TemporaryDisk |
| 102 | +``` |
| 103 | + |
| 104 | +## Next steps |
| 105 | + |
| 106 | +- Learn more about [server-side encryption of Azure Disk Storage](../virtual-machines/disk-encryption.md). |
| 107 | +- For an in-depth overview of Batch, see [Batch service workflow and resources](batch-service-workflow-features.md). |
0 commit comments