Skip to content

Commit db1b03a

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #247114 from tomvcassidy/publicIP
Enabling Public IP Instructions
2 parents d793dab + 3e1f04e commit db1b03a

File tree

1 file changed

+131
-14
lines changed

1 file changed

+131
-14
lines changed

‎articles/service-fabric/how-to-managed-cluster-networking.md‎

Lines changed: 131 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,12 @@ ms.date: 07/11/2022
1212

1313
# Configure network settings for Service Fabric managed clusters
1414

15-
Service Fabric managed clusters are created with a default networking configuration. This configuration consists of an [Azure Load Balancer](../load-balancer/load-balancer-overview.md) with a public ip, a VNet with one subnet allocated, and a NSG configured for essential cluster functionality. There are also optional NSG rules applied such as allowing all outbound traffic by default that is intended to make customer configuration easier. This document walks through how to modify the following networking configuration options and more:
15+
Service Fabric managed clusters are created with a default networking configuration. This configuration consists of an [Azure Load Balancer](../load-balancer/load-balancer-overview.md) with a public ip, a VNet with one subnet allocated, and an NSG configured for essential cluster functionality. There are also optional NSG rules applied such as allowing all outbound traffic by default that is intended to make customer configuration easier. This document walks through how to modify the following networking configuration options and more:
1616

1717
- [Manage NSG Rules](#nsgrules)
1818
- [Manage RDP access](#rdp)
1919
- [Manage Load Balancer config](#lbconfig)
20+
- [Enable public IP](#publicip)
2021
- [Enable IPv6](#ipv6)
2122
- [Bring your own virtual network](#byovnet)
2223
- [Bring your own load balancer](#byolb)
@@ -31,7 +32,7 @@ Service Fabric managed clusters are created with a default networking configurat
3132

3233
Be aware of these considerations when creating new NSG rules for your managed cluster.
3334

34-
* Service Fabric managed clusters reserve the NSG rule priority range 0 to 999 for essential functionality. You cannot create custom NSG rules with a priority value of less than 1000.
35+
* Service Fabric managed clusters reserve the NSG rule priority range 0 to 999 for essential functionality. You can't create custom NSG rules with a priority value of less than 1000.
3536
* Service Fabric managed clusters reserve the priority range 3001 to 4000 for creating optional NSG rules. These rules are added automatically to make configurations quick and easy. You can override these rules by adding custom NSG rules in priority range 1000 to 3000.
3637
* Custom NSG rules should have a priority within the range 1000 to 3000.
3738

@@ -105,14 +106,14 @@ Use the [networkSecurityRules](/azure/templates/microsoft.servicefabric/managedc
105106
A default NSG rule is added to allow the Service Fabric resource provider to access the cluster's clientConnectionPort and httpGatewayConnectionPort. This rule allows access to the ports through the service tag 'ServiceFabric'.
106107

107108
>[!NOTE]
108-
>This rule is always added and cannot be overridden.
109+
>This rule is always added and can't be overridden.
109110
110111
```json
111112
{
112113
"name": "SFMC_AllowServiceFabricGatewayToSFRP",
113114
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
114115
"properties": {
115-
"description": "This is required rule to allow SFRP to connect to the cluster. This rule cannot be overridden.",
116+
"description": "This is required rule to allow SFRP to connect to the cluster. This rule can't be overridden.",
116117
"protocol": "TCP",
117118
"sourcePortRange": "*",
118119
"sourceAddressPrefix": "ServiceFabric",
@@ -133,8 +134,8 @@ A default NSG rule is added to allow the Service Fabric resource provider to acc
133134

134135
This optional rule enables customers to access SFX, connect to the cluster using PowerShell, and use Service Fabric cluster API endpoints from the internet by opening LB ports for clientConnectionPort and httpGatewayPort.
135136

136-
>[!NOTE]
137-
>This rule will not be added if there is a custom rule with the same access, direction, and protocol values for the same port. You can override this rule with custom NSG rules.
137+
> [!NOTE]
138+
> This rule will not be added if there's a custom rule with the same access, direction, and protocol values for the same port. You can override this rule with custom NSG rules.
138139
139140
```json
140141
{
@@ -161,7 +162,7 @@ This optional rule enables customers to access SFX, connect to the cluster using
161162
<a id="rdp"></a>
162163
## Enable access to RDP ports from internet
163164

164-
Service Fabric managed clusters do not enable inbound access to the RDP ports from the internet by default. You can open inbound access to the RDP ports from the internet by setting the following property on a Service Fabric managed cluster resource.
165+
Service Fabric managed clusters don't enable inbound access to the RDP ports from the internet by default. You can open inbound access to the RDP ports from the internet by setting the following property on a Service Fabric managed cluster resource.
165166

166167
```json
167168
"allowRDPAccess": true
@@ -303,12 +304,128 @@ Service Fabric managed clusters automatically creates load balancer probes for f
303304
}
304305
```
305306

307+
<a id="publicip"></a>
308+
## Enable public IP
309+
310+
> [!NOTE]
311+
> Currently, only public IPv4 is supported.
312+
313+
Service Fabric managed cluster nodes don't require their own public IP addresses for communication. However, some scenarios may require a node to have its own public IP address to communicate with the internet and public-facing Azure services. For example:
314+
315+
* Gaming, where a console needs to make a direct connection to a cloud virtual machine that is doing game physics processing.
316+
* Virtual machines that need to make external connections to one another across regions in a distributed database.
317+
318+
For more information about outbound connections in Azure, see [Understand outbound connections](../load-balancer/load-balancer-outbound-connections.md).
319+
320+
Public IP can only be enabled on secondary node types, because primary node types are reserved for Service Fabric system services. Follow the steps in the [Bring your own load balancer section of this article](#bring-your-own-azure-load-balancer) to create a secondary node type for your managed cluster.
321+
322+
Azure dynamically assigns available IP addresses.
323+
324+
> [!NOTE]
325+
> Enabling public IP is only supported via ARM template.
326+
327+
The following steps describe enable public IP on your node.
328+
329+
1. Download your [ARM template](../azure-resource-manager/templates/export-template-portal.md).
330+
331+
1. For each node type in the template, add `enableNodePublicIP` to the ARM template:
332+
333+
```json
334+
{
335+
"name": "Secondary Node Type",
336+
"apiVersion": "2023-02-01-preview",
337+
"properties": {
338+
"isPrimary" : false,
339+
"vmImageResourceId": "/subscriptions/<SubscriptionID>/resourceGroups/<myRG>/providers/Microsoft.Compute/images/<MyCustomImage>",
340+
"vmSize": "Standard_D2",
341+
"vmInstanceCount": 5,
342+
"dataDiskSizeGB": 100,
343+
"enableNodePublicIP": true
344+
}
345+
}
346+
```
347+
348+
1. [Deloy your ARM template](../azure-resource-manager/templates/quickstart-create-templates-use-the-portal.md).
349+
350+
1. Verify you have a public IP on your nodes by running the following PowerShell command:
351+
352+
```powershell
353+
az vmss list-instance-public-ips -g MC_MyResourceGroup2_MyManagedCluster_eastus -n YourVirtualMachineScaleSetName
354+
```
355+
356+
The command outputs in JSON format.
357+
358+
```json
359+
[
360+
{
361+
"etag": "etag_0",
362+
"id": "<id_0/name>",
363+
"idleTimeoutInMinutes": 15,
364+
"ipAddress": "<ip_address_0>",
365+
"ipConfiguration": {
366+
"id": "<configuration_id_0>",
367+
"resourceGroup": "<your_resource_group"
368+
},
369+
"ipTags": [],
370+
"name": "<name>",
371+
"provisioningState": "Succeeded",
372+
"publicIPAddressVersion": "IPv4",
373+
"publicIPAllocationMethod": "Static",
374+
"resourceGroup": "<your_resource_group",
375+
"resourceGuid": "resource_guid_0",
376+
"sku": {
377+
"name": "Standard"
378+
}
379+
},
380+
{
381+
"etag": "etag_1",
382+
"id": "/<id_1/name>",
383+
"idleTimeoutInMinutes": 15,
384+
"ipAddress": "<ip_address_1>",
385+
"ipConfiguration": {
386+
"id": "<configuration_id_1>",
387+
"resourceGroup": "<your_resource_group"
388+
},
389+
"ipTags": [],
390+
"name": "<name>",
391+
"provisioningState": "Succeeded",
392+
"publicIPAddressVersion": "IPv4",
393+
"publicIPAllocationMethod": "Static",
394+
"resourceGroup": "<your_resource_group>",
395+
"resourceGuid": "resource_guid_1",
396+
"sku": {
397+
"name": "Standard"
398+
}
399+
},
400+
{
401+
"etag": "etag_2",
402+
"id": "<id_2/name>",
403+
"idleTimeoutInMinutes": 15,
404+
"ipAddress": "<ip_address_2>",
405+
"ipConfiguration": {
406+
"id": "<configuration_id_2>",
407+
"resourceGroup": "<your_resource_group"
408+
},
409+
"ipTags": [],
410+
"name": "<name>",
411+
"provisioningState": "Succeeded",
412+
"publicIPAddressVersion": "IPv4",
413+
"publicIPAllocationMethod": "Static",
414+
"resourceGroup": "<your_resource_group>",
415+
"resourceGuid": "resource_guid_2",
416+
"sku": {
417+
"name": "Standard"
418+
}
419+
}
420+
]
421+
```
422+
306423
<a id="ipv6"></a>
307424
## Enable IPv6
308-
Managed clusters do not enable IPv6 by default. This feature will enable full dual stack IPv4/IPv6 capability from the Load Balancer frontend to the backend resources. Any changes you make to the managed cluster load balancer config or NSG rules will affect both the IPv4 and IPv6 routing.
425+
Managed clusters don't enable IPv6 by default. This feature will enable full dual stack IPv4/IPv6 capability from the Load Balancer frontend to the backend resources. Any changes you make to the managed cluster load balancer config or NSG rules will affect both the IPv4 and IPv6 routing.
309426

310427
> [!NOTE]
311-
> This setting is not available in portal and cannot be changed once the cluster is created
428+
> This setting is not available in portal and can't be changed once the cluster is created.
312429

313430
* The Service Fabric managed cluster resource apiVersion should be **2022-01-01** or later.
314431

@@ -343,7 +460,7 @@ This feature allows customers to use an existing virtual network by specifying a
343460
> When using BYOVNET, managed cluster resources will be deployed in one subnet.
344461
345462
> [!NOTE]
346-
> This setting cannot be changed once the cluster is created and the managed cluster will assign an NSG to the provided subnet. Do not override the NSG assignment or traffic may break.
463+
> This setting can't be changed once the cluster is created and the managed cluster will assign an NSG to the provided subnet. Don't override the NSG assignment or traffic may break.
347464
348465
**To bring your own virtual network:**
349466

@@ -417,7 +534,7 @@ This feature allows customers to use an existing virtual network by specifying a
417534
> [!NOTE]
418535
> VNetRoleAssignmentID has to be a [GUID](../azure-resource-manager/templates/template-functions-string.md#examples-16). If you deploy a template again including this role assignment, make sure the GUID is the same as the one originally used. We suggest you run this isolated or remove this resource from the cluster template post-deployment as it just needs to be created once.
419536
420-
Here is a full sample [Azure Resource Manager (ARM) template that creates a VNet subnet and does role assignment](https://raw.githubusercontent.com/Azure-Samples/service-fabric-cluster-templates/master/SF-Managed-Standard-SKU-2-NT-BYOVNET/createVNet-assign-role.json) you can use for this step.
537+
Here's a full sample [Azure Resource Manager (ARM) template that creates a VNet subnet and does role assignment](https://raw.githubusercontent.com/Azure-Samples/service-fabric-cluster-templates/master/SF-Managed-Standard-SKU-2-NT-BYOVNET/createVNet-assign-role.json) you can use for this step.
421538

422539
3. Configure the `subnetId` property for the cluster deployment after the role is set up as shown below:
423540

@@ -446,14 +563,14 @@ This feature allows customers to use an existing virtual network by specifying a
446563
New-AzResourceGroupDeployment -Name deployment -ResourceGroupName MyResourceGroup -TemplateFile AzureDeploy.json
447564
```
448565

449-
When you bring your own VNet subnet the public endpoint is still created and managed by the resource provider, but in the configured subnet. The feature does not allow you to specify the public ip/re-use static ip on the Azure Load Balancer. You can [bring your own Azure Load Balancer](#byolb) in concert with this feature or by itself if you require those or other load balancer scenarios that aren't natively supported.
566+
When you bring your own VNet subnet the public endpoint is still created and managed by the resource provider, but in the configured subnet. The feature doesn't allow you to specify the public ip/re-use static ip on the Azure Load Balancer. You can [bring your own Azure Load Balancer](#byolb) in concert with this feature or by itself if you require those or other load balancer scenarios that aren't natively supported.
450567

451568
<a id="byolb"></a>
452569
## Bring your own Azure Load Balancer
453570

454571
Managed clusters create an Azure public Standard Load Balancer and fully qualified domain name with a static public IP for both the primary and secondary node types. Bring your own load balancer allows you to use an existing Azure Load Balancer for secondary node types for both inbound and outbound traffic. When you bring your own Azure Load Balancer, you can:
455572

456-
* Use a pre-configured Load Balancer static IP address for either private or public traffic
573+
* Use a preconfigured Load Balancer static IP address for either private or public traffic
457574
* Map a Load Balancer to a specific node type
458575
* Configure network security group rules per node type because each node type is deployed in its own subnet
459576
* Maintain existing policies and controls you may have in place
@@ -603,7 +720,7 @@ To configure with your own load balancer:
603720

604721
<a id="accelnet"></a>
605722
## Enable Accelerated Networking
606-
Accelerated networking enables single root I/O virtualization (SR-IOV) to a virtual machine scale set VM that is the underlying resource for node types. This high-performance path bypasses the host from the data path, which reduces latency, jitter, and CPU utilization for the most demanding network workloads. Service Fabric managed cluster node types can be provisioned with Accelerated Networking on [supported VM SKUs](../virtual-machines/sizes.md). Reference this [limitations and constraints](../virtual-network/accelerated-networking-overview.md#limitations-and-constraints) for additional considerations.
723+
Accelerated networking enables single root I/O virtualization (SR-IOV) to a virtual machine scale set VM that is the underlying resource for node types. This high-performance path bypasses the host from the data path, which reduces latency, jitter, and CPU utilization for the most demanding network workloads. Service Fabric managed cluster node types can be provisioned with Accelerated Networking on [supported VM SKUs](../virtual-machines/sizes.md). Reference these [limitations and constraints](../virtual-network/accelerated-networking-overview.md#limitations-and-constraints) for additional considerations.
607724

608725
* Note that Accelerated Networking is supported on most general purpose and compute-optimized instance sizes with 2 or more vCPUs. On instances that support hyperthreading, Accelerated Networking is supported on VM instances with 4 or more vCPUs.
609726

0 commit comments

Comments
 (0)