Skip to content

Commit d588123

Browse files
GitHubber17GitHubber17
authored
Merge pull request #101114 from mlearned/aks-mlearned-byok
Aks mlearned byok
2 parents 51f1cce + 7e79183 commit d588123

File tree

1 file changed

+55
-19
lines changed

1 file changed

+55
-19
lines changed

‎articles/aks/azure-disk-customer-managed-keys.md

Lines changed: 55 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ ms.author: mlearned
1515
Azure Storage encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can supply [customer-managed keys][customer-managed-keys] to use for encryption of both the OS and data disks for your AKS clusters.
1616

1717
> [!NOTE]
18-
> Linux and Windows based AKS clusters are both supported.
18+
> BYOK Linux and Windows based AKS clusters are available in [Azure regions][supported-regions] that support server side encryption of Azure managed disks.
1919
2020
## Before you begin
2121

22-
* This article assumes that you are creating a *new AKS cluster*. You will also need to use or create an instance of Azure Key Vault to store your encryption keys.
22+
* This article assumes that you are creating a *new AKS cluster*.
2323

2424
* You must enable soft delete and purge protection for *Azure Key Vault* when using Key Vault to encrypt managed disks.
2525

@@ -43,16 +43,18 @@ az extension add --name aks-preview
4343
az extension update --name aks-preview
4444
```
4545

46-
## Create an Azure Key Vault instance to store your keys
46+
## Create an Azure Key Vault instance
4747

48-
You can optionally use the Azure portal to [Configure customer-managed keys with Azure Key Vault][byok-azure-portal]
48+
Use an Azure Key Vault instance to store your keys. You can optionally use the Azure portal to [Configure customer-managed keys with Azure Key Vault][byok-azure-portal]
4949

50-
Create a new *resource group*, then create a new *Key Vault* instance and enable soft delete and purge protection.
50+
Create a new *resource group*, then create a new *Key Vault* instance and enable soft delete and purge protection. Ensure you use the same region and resource group names for each command.
5151

5252
```azurecli-interactive
5353
# Optionally retrieve Azure region short names for use on upcoming commands
5454
az account list-locations
55+
```
5556

57+
```azurecli-interactive
5658
# Create new resource group in a supported Azure region
5759
az group create -l myAzureRegionName -n myResourceGroup
5860
@@ -62,7 +64,7 @@ az keyvault create -n myKeyVaultName -g myResourceGroup -l myAzureRegionName --
6264

6365
## Create an instance of a DiskEncryptionSet
6466

65-
You will need a *key* stored in Azure Key Vault to complete the following steps. Either store your existing Key in the Key Vault you created, or [generate a key][key-vault-generate]
67+
Replace *myKeyVaultName* with the name of your key vault. You will also need a *key* stored in Azure Key Vault to complete the following steps. Either store your existing Key in the Key Vault you created on the previous steps, or [generate a new key][key-vault-generate] and replace *myKeyName* below with the name of your key.
6668

6769
```azurecli-interactive
6870
# Retrieve the Key Vault Id and store it in a variable
@@ -75,7 +77,7 @@ keyVaultKeyUrl=$(az keyvault key show --vault-name myKeyVaultName --name myKeyN
7577
az disk-encryption-set create -n myDiskEncryptionSetName -l myAzureRegionName -g myResourceGroup --source-vault $keyVaultId --key-url $keyVaultKeyUrl
7678
```
7779

78-
## Grant the DiskEncryptionSet resource access to the key vault
80+
## Grant the DiskEncryptionSet access to key vault
7981

8082
Use the DiskEncryptionSet and resource groups you created on the prior steps, and grant the DiskEncryptionSet resource access to the Azure Key Vault.
8183

@@ -90,52 +92,85 @@ az keyvault set-policy -n myKeyVaultName -g myResourceGroup --object-id $desIden
9092
az role assignment create --assignee $desIdentity --role Reader --scope $keyVaultId
9193
```
9294

93-
## Create a new AKS cluster and encrypt the OS disk with a customer-manged key
95+
## Create a new AKS cluster and encrypt the OS disk
96+
97+
Create a **new resource group** and AKS cluster, then use your key to encrypt the OS disk. Customer-managed keys are only supported in kubernetes versions greater than 1.17.
9498

95-
Create a new resource group and AKS cluster, then use your key to encrypt the OS disk. Customer managed key is only supported in kubernetes versions greater than 1.17
99+
> [!IMPORTANT]
100+
> Ensure you create a new resoruce group for your AKS cluster
96101
97102
```azurecli-interactive
98103
# Retrieve the DiskEncryptionSet value and set a variable
99104
diskEncryptionSetId=$(az resource show -n diskEncryptionSetName -g myResourceGroup --resource-type "Microsoft.Compute/diskEncryptionSets" --query [id] -o tsv)
100105
101106
# Create a resource group for the AKS cluster
102-
az group create -n myResourceGroup-l myAzureRegionName
107+
az group create -n myResourceGroup -l myAzureRegionName
103108
104109
# Create the AKS cluster
105-
az aks create -n myAKSCluster -g myResourceGroup --node-osdisk-diskencryptionset-id $diskEncryptionSetId --kubernetes-version 1.17.0
110+
az aks create -n myAKSCluster -g myResourceGroup --node-osdisk-diskencryptionset-id $diskEncryptionSetId --kubernetes-version 1.17.0 --generate-ssh-keys
106111
```
107112

108-
When new node pools are added to the cluster created above, the customer managed key provided during the create is used to encrypt the OS disk
113+
When new node pools are added to the cluster created above, the customer-managed key provided during the create is used to encrypt the OS disk.
114+
115+
## Encrypt your AKS cluster data disk
116+
117+
You can also encrypt the AKS data disks with your own keys.
109118

110-
## Encrypt your AKS cluster data disk with a customer-managed key
119+
> [!IMPORTANT]
120+
> Ensure you have the proper AKS credentials. The Service principal will need to have contributor access to the resource group where the diskencryptionset is deployed. Otherwise, you will get an error suggesting that the service principal does not have permissions.
111121
112-
You can also encrypt the AKS data disks with your own keys. Replace myResourceGroup and myDiskEncryptionSetName with your real values, and apply the yaml.
122+
```azurecli-interactive
123+
# Retrieve your Azure Subscription Id from id property as shown below
124+
az account list
125+
```
113126

114-
Ensure you have the proper AKS credentials. The Service principal will need to have contributor access to the resource group where the diskencryptionset is present. Otherwise, you will get an error suggesting that the service principal does not have permissions.
127+
```
128+
someuser@Azure:~$ az account list
129+
[
130+
{
131+
"cloudName": "AzureCloud",
132+
"id": "666e66d8-1e43-4136-be25-f25bb5de5893",
133+
"isDefault": true,
134+
"name": "MyAzureSubscription",
135+
"state": "Enabled",
136+
"tenantId": "3ebbdf90-2069-4529-a1ab-7bdcb24df7cd",
137+
"user": {
138+
"cloudShellID": true,
139+
"name": "[email protected]",
140+
"type": "user"
141+
}
142+
}
143+
]
144+
```
115145

116-
Create a file called **byok-azure-disk.yaml** that contains the following information. Replace myResourceGroup and myDiskEncrptionSetName with your values.
146+
Create a file called **byok-azure-disk.yaml** that contains the following information. Replace myAzureSubscriptionId, myResourceGroup, and myDiskEncrptionSetName with your values, and apply the yaml. Make sure to use the resource group where your DiskEncryptionSet is deployed. If you use the Azure Cloud Shell, this file can be created using vi or nano as if working on a virtual or physical system:
117147

118148
```
119149
kind: StorageClass
120-
apiVersion: storage.k8s.io/v1
150+
apiVersion: storage.k8s.io/v1
121151
metadata:
122152
name: hdd
123153
provisioner: kubernetes.io/azure-disk
124154
parameters:
125155
skuname: Standard_LRS
126156
kind: managed
127-
diskEncryptionSetID: "/subscriptions/{subs-id}/resourceGroups/{myResourceGroup}/providers/Microsoft.Compute/diskEncryptionSets/{myDiskEncryptionSetName}"
157+
diskEncryptionSetID: "/subscriptions/{myAzureSubscriptionId}/resourceGroups/{myResourceGroup}/providers/Microsoft.Compute/diskEncryptionSets/{myDiskEncryptionSetName}"
128158
```
129159
Next, run this deployment in your AKS cluster:
130160
```azurecli-interactive
161+
# Get credentials
162+
az aks get-credentials --name myAksCluster --resource-group myResourceGroup --output table
163+
164+
# Update cluster
131165
kubectl apply -f byok-azure-disk.yaml
132166
```
133167

134168
## Limitations
135169

170+
* BYOK is only currently available in GA and Preview in certain [Azure regions][supported-regions]
136171
* OS Disk Encryption supported with Kubernetes version 1.17 and above
137172
* Available only in regions where BYOK is supported
138-
* This is currently for new AKS clusters only, existing clusters cannot be upgraded
173+
* Encryption with customer-managed keys currently is for new AKS clusters only, existing clusters cannot be upgraded
139174
* AKS cluster using Virtual Machine Scale Sets are required, no support for Virtual Machine Availability Sets
140175

141176

@@ -152,3 +187,4 @@ Review [best practices for AKS cluster security][best-practices-security]
152187
[byok-azure-portal]: /azure/storage/common/storage-encryption-keys-portal
153188
[customer-managed-keys]: /azure/virtual-machines/windows/disk-encryption#customer-managed-keys-public-preview
154189
[key-vault-generate]: /azure/key-vault/key-vault-manage-with-cli2
190+
[supported-regions]: /azure/virtual-machines/windows/disk-encryption#supported-scenarios-and-restrictions

0 commit comments

Comments
 (0)