You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/service-fabric/service-fabric-cluster-creation-via-arm.md
+30-31Lines changed: 30 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,13 +27,13 @@ This step-by-step guide walks you through setting up a secure Azure Service Fabr
27
27
28
28
The guide covers the following procedures:
29
29
30
-
* Key Concepts that you need to be aware off before deploying a service fabric cluster.
31
-
* Creating a cluster in Azure by using service fabric Resource Manager modules.
30
+
* Key Concepts that you need to be aware of before deploying a Service Fabric cluster.
31
+
* Creating a cluster in Azure by using Service Fabric Resource Manager modules.
32
32
* Setting up Azure Active Directory (Azure AD) for authenticating users performing management operations on the cluster.
33
33
* Authoring a custom Azure Resource Manager template for your cluster and deploying it.
34
34
35
35
## Key concepts to be aware of
36
-
In Azure, Service fabric mandates that you to use an x509 certificate to secure your cluster and its endpoints. Certificates are used in Service Fabric to provide authentication and encryption to secure various aspects of a cluster and its applications. For client access/performing management operations on the cluster,including deploying, upgrading, and deleting applications, services, and the data they contain, you can use certificates or Azure Active Directory credentials. The use of Azure Active Directory is highly encouraged, since that is the only way to prevent sharing of certificates on your clients. For more information on how certificates are used in Service Fabric, see [Service Fabric cluster security scenarios][service-fabric-cluster-security].
36
+
In Azure, Service Fabric mandates that you to use an x509 certificate to secure your cluster and its endpoints. Certificates are used in Service Fabric to provide authentication and encryption to secure various aspects of a cluster and its applications. For client access/performing management operations on the cluster,including deploying, upgrading, and deleting applications, services, and the data they contain, you can use certificates or Azure Active Directory credentials. The use of Azure Active Directory is highly encouraged, since that is the only way to prevent sharing of certificates on your clients. For more information on how certificates are used in Service Fabric, see [Service Fabric cluster security scenarios][service-fabric-cluster-security].
37
37
38
38
Service Fabric uses X.509 certificates to secure a cluster and provide application security features. You use [Key Vault][key-vault-get-started] to manage certificates for Service Fabric clusters in Azure.
39
39
@@ -71,29 +71,29 @@ Any number of additional certificates can be specified for Admin or user client
71
71
72
72
73
73
## Prerequisites
74
-
The concept of creating secure clusters is the same, whether they are Linux or Windows clusters. This guide covers the use of azure powershell or azure CLI to create new clusters. The prerequisites are either
74
+
The concept of creating secure clusters is the same, whether they are Linux or Windows clusters. This guide covers the use of Azure PowerShell or Azure CLI to create new clusters. The prerequisites are either:
75
75
76
76
-[Azure PowerShell 4.1 and above][azure-powershell] or [Azure CLI 2.0 and above][azure-CLI].
77
-
- you can find details on the service fabric modules here - [AzureRM.ServiceFabric](https://docs.microsoft.com/powershell/module/azurerm.servicefabric) and [az SF CLI module](https://docs.microsoft.com/cli/azure/sf?view=azure-cli-latest)
77
+
- you can find details on the Service Fabric modules here - [AzureRM.ServiceFabric](https://docs.microsoft.com/powershell/module/azurerm.servicefabric) and [az SF CLI module](https://docs.microsoft.com/cli/azure/sf?view=azure-cli-latest)
78
78
79
79
80
-
## Use service fabric RM module to deploy a cluster
80
+
## Use Service Fabric RM module to deploy a cluster
81
81
82
-
In this document, we would use the service fabric RM powershell and CLI module to deploy a cluster, the powershell or the CLI module command allows for multiple scenarios. Let us go through each of the them. Pick the scenario that you feel best meets your needs.
82
+
In this document, we will use the Service Fabric RM powershell and CLI module to deploy a cluster, the PowerShell or the CLI module command allows for multiple scenarios. Let us go through each of the them. Pick the scenario that you feel best meets your needs.
83
83
84
84
- Create a new cluster
85
85
- using a system generated self signed certificate
86
86
- using a certificate you already own
87
87
88
-
You can use Use a default cluster template or a template that you already have
88
+
You can use a default cluster template or a template that you already have
89
89
90
90
### Create new cluster - using a system generated self signed certificate
91
91
92
-
Use the following command to create cluster, if you have want the system to generate a selfsigned certificate and use it to secure your cluster. This command sets up a primary cluster certificate that is used for cluster security and to set up admin access to perform management operations using that certificate.
92
+
Use the following command to create cluster, if you want the system to generate a self-signed certificate and use it to secure your cluster. This command sets up a primary cluster certificate that is used for cluster security and to set up admin access to perform management operations using that certificate.
93
93
94
-
### login in to Azure.
94
+
### login to Azure
95
95
96
-
```Powershell
96
+
```PowerShell
97
97
Connect-AzureRmAccount
98
98
Set-AzureRmContext -SubscriptionId <guid>
99
99
```
@@ -106,12 +106,12 @@ az account set --subscription $subscriptionId
106
106
107
107
Use the following command to create a cluster quickly, by specifying minimal parameters
108
108
109
-
The template that is used is available on the [azure service fabric template samples : windows template](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master/5-VM-Windows-1-NodeTypes-Secure-NSG)
109
+
The template that is used is available on the [Azure Service Fabric template samples : windows template](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master/5-VM-Windows-1-NodeTypes-Secure-NSG)
110
110
and [Ubuntu template](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master/5-VM-Ubuntu-1-NodeTypes-Secure)
111
111
112
-
The commands below works for creating Windows and Linux clusters, you just need to specify the OS accordingly. The PowerShell/CLI commands also outputs the certificate in the specified CertificateOutputFolder however make sure certificate folder already created. The command takes in other parameters like VM SKU as well.
112
+
The commands below works for creating Windows and Linux clusters, you just need to specify the OS accordingly. The PowerShell/CLI commands also output the certificate in the specified CertificateOutputFolder; however, make sure certificate folder already created. The command takes in other parameters like VM SKU as well.
113
113
114
-
```Powershell
114
+
```PowerShell
115
115
$resourceGroupLocation="westus"
116
116
$resourceGroupName="mycluster"
117
117
$vaultName="myvault"
@@ -147,9 +147,9 @@ az sf cluster create --resource-group $resourceGroupName --location $resourceGro
147
147
148
148
#### Use the custom template that you already have
149
149
150
-
If you need to author a custom template to suit your needs, it is highly recommended that you start with one of the templates that are available on the [azure service fabric template samples](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master). Follow guidance and explanations to [customize your cluster template][customize-your-cluster-template] section below.
150
+
If you need to author a custom template to suit your needs, it is highly recommended that you start with one of the templates that are available on the [Azure Service Fabric template samples](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master). Follow guidance and explanations to [customize your cluster template][customize-your-cluster-template] section below.
151
151
152
-
If you already have a custom template, then make sure to double check, that all the three certificate related parameters in the template and the parameter file are named as follows and values are null as follows.
152
+
If you already have a custom template, then make sure to double check that all the three certificate related parameters in the template and the parameter file are named as follows and values are null as follows.
153
153
154
154
```Json
155
155
"certificateThumbprint": {
@@ -195,15 +195,15 @@ az sf cluster create --resource-group $resourceGroupName --location $resourceGro
195
195
```
196
196
197
197
198
-
### Create new cluster - using the certificate you bought from a CA or you already have.
198
+
### Create new cluster - using the certificate you bought from a CA or you already have
199
199
200
200
Use the following command to create cluster, if you have a certificate that you want to use to secure your cluster with.
201
201
202
202
If this is a CA signed certificate that you will end up using for other purposes as well, then it is recommended that you provide a distinct resource group specifically for your key vault. We recommend that you put the key vault into its own resource group. This action lets you remove the compute and storage resource groups, including the resource group that contains your Service Fabric cluster, without losing your keys and secrets. **The resource group that contains your key vault _must be in the same region_ as the cluster that is using it.**
203
203
204
204
205
205
#### Use the default 5 Node 1 node type template that ships in the module
206
-
The template that is used is available on the [azure samples : windows template](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master/5-VM-Windows-1-NodeTypes-Secure-NSG)
206
+
The template that is used is available on the [Azure samples : Windows template](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master/5-VM-Windows-1-NodeTypes-Secure-NSG)
207
207
and [Ubuntu template](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master/5-VM-Ubuntu-1-NodeTypes-Secure)
208
208
209
209
```PowerShell
@@ -238,9 +238,9 @@ az sf cluster create --resource-group $resourceGroupName --location $resourceGro
238
238
```
239
239
240
240
#### Use the custom template that you have
241
-
If you need to author a custom template to suit your needs, it is highly recommended that you start with one of the templates that are available on the [azure service fabric template samples](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master). Follow guidance and explanations to [customize your cluster template][customize-your-cluster-template] section below.
241
+
If you need to author a custom template to suit your needs, it is highly recommended that you start with one of the templates that are available on the [Azure Service Fabric template samples](https://github.com/Azure-Samples/service-fabric-cluster-templates/tree/master). Follow guidance and explanations to [customize your cluster template][customize-your-cluster-template] section below.
242
242
243
-
If you already have a custom template, then make sure to double check, that all the three certificate related parameters in the template and the parameter file are named as follows and values are null as follows.
243
+
If you already have a custom template, then make sure to double check that all the three certificate related parameters in the template and the parameter file are named as follows and values are null as follows.
244
244
245
245
```Json
246
246
"certificateThumbprint": {
@@ -330,7 +330,7 @@ To simplify some of the steps involved in configuring Azure AD with a Service Fa
330
330
3. Extract the zip file.
331
331
4. Run `SetupApplications.ps1`, and provide the TenantId, ClusterName, and WebApplicationReplyUrl as parameters. For example:
@@ -360,7 +360,7 @@ The script prints the JSON required by the Azure Resource Manager template when
360
360
<aid="customize-arm-template" ></a>
361
361
362
362
## Create a Service Fabric cluster resource manager template
363
-
This section is for users who want to custom author a Service Fabric cluster resource manager template. once you have a template, you can still go back and use the powershell or CLI modules to deploy it.
363
+
This section is for users who want to custom author a Service Fabric cluster resource manager template. once you have a template, you can still go back and use the PowerShell or CLI modules to deploy it.
364
364
365
365
Sample Resource Manager templates are available in the [Azure samples on GitHub](https://github.com/Azure-Samples/service-fabric-cluster-templates). These templates can be used as a starting point for your cluster template.
366
366
@@ -496,14 +496,13 @@ You add the Azure AD configuration to a cluster Resource Manager template by ref
496
496
}
497
497
```
498
498
499
-
### Populate the parameter file with the values.
500
-
Finally, use the output values from the key vault and Azure AD PowerShell commands to populate the parameters file:
499
+
### Populate the parameter file with the values
500
+
Finally, use the output values from the key vault and Azure AD PowerShell commands to populate the parameters file.
501
501
502
-
If you plan to use the Azure service fabric RM PowerShell modules, then you do not need to populate the cluster certificate information, if you you want the system to generate the self signed certificate for cluster security you, just keep them as null.
502
+
If you plan to use the Azure service fabric RM PowerShell modules, then you do not need to populate the cluster certificate information. If you want the system to generate the self signed certificate for cluster security you, just keep them as null.
503
503
504
504
> [!NOTE]
505
505
> For the RM modules to pick up and populate these empty parameter values, the parameters names much match the names below
506
-
>
507
506
508
507
```json
509
508
"clusterCertificateThumbprint": {
@@ -520,9 +519,9 @@ If you plan to use the Azure service fabric RM PowerShell modules, then you do n
520
519
},
521
520
```
522
521
523
-
If you are using application certs or are using an existing cluster that you have uploaded to the key vault, you need to get this information and populate it
522
+
If you are using application certs or are using an existing cluster that you have uploaded to the key vault, you need to get this information and populate it.
524
523
525
-
The RM modules do not have the ability to generate the Azure AD configuration for you. so if you plan to use the Azure AD for client access, you need to populate it.
524
+
The RM modules do not have the ability to generate the Azure AD configuration for you, so if you plan to use the Azure AD for client access, you need to populate it.
526
525
527
526
```json
528
527
{
@@ -582,7 +581,7 @@ The following diagram illustrates where your key vault and Azure AD configuratio
582
581
583
582
## Encrypting the disks attached to your windows cluster node/virtual machine instances
584
583
585
-
For encrypting the disks (OS drive and other managed disks) attached to your nodes, we leverage the Azure Disk Encryption. Azure Disk Encryption is a new capability that helps you [encrypt your Windows virtual machine disks](service-fabric-enable-azure-disk-encryption-windows.md).
584
+
For encrypting the disks (OS drive and other managed disks) attached to your nodes, we leverage the Azure Disk Encryption. Azure Disk Encryption is a new capability that helps you [encrypt your Windows virtual machine disks](service-fabric-enable-azure-disk-encryption-windows.md).
586
585
Azure Disk Encryption leverages the industry standard [BitLocker](https://technet.microsoft.com/library/cc732774.aspx) feature of Windows to provide volume encryption for the OS volume.
587
586
The solution is integrated with [Azure Key Vault](https://azure.microsoft.com/documentation/services/key-vault/) to help you control and manage the disk-encryption keys and secrets in your key vault subscription.
588
587
The solution also ensures that all data on the virtual machine disks are encrypted at rest in your Azure storage.
@@ -598,7 +597,7 @@ The solution also ensures that all data on the virtual machine disks are encrypt
598
597
## Create the cluster using Azure resource template
599
598
600
599
You can now deploy you cluster using the steps outlined earlier in the document, or if you have
601
-
the values in the parameter file, populated, then You are now ready to create the cluster by using [Azure resource template deployment][resource-group-template-deploy] directly.
600
+
the values in the parameter file populated, then you are now ready to create the cluster by using [Azure resource template deployment][resource-group-template-deploy] directly.
0 commit comments