Skip to content

Commit eac5428

Browse files
SyntaxC4SyntaxC4
authored
Merge pull request #100882 from MicrosoftDocs/master
HotFix
2 parents 8e9a697 + 331fc12 commit eac5428

File tree

54 files changed

+1932
-861
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+1932
-861
lines changed

‎articles/active-directory/managed-identities-azure-resources/TOC.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@
2020
href: tutorial-windows-vm-access-datalake.md
2121
- name: Access Azure Storage
2222
href: tutorial-vm-windows-access-storage.md
23-
- name: Access Azure Storage using an access key
24-
href: tutorial-windows-vm-access-storage.md
2523
- name: Access Azure SQL
2624
href: tutorial-windows-vm-access-sql.md
2725
- name: Access Azure Key Vault

‎articles/aks/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,8 @@
229229
href: certificate-rotation.md
230230
- name: Create a private cluster
231231
href: private-clusters.md
232+
- name: BYOK for disks
233+
href: azure-disk-customer-managed-keys.md
232234
- name: Monitoring and logging
233235
items:
234236
- name: Azure Monitor for containers

‎articles/aks/azure-disk-customer-managed-keys.md

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
title: Use a customer-managed key to encrypt Azure disks in Azure Kubernetes Service (AKS)
3+
description: Bring your own keys (BYOK) to encrypt AKS OS and Data disks.
4+
services: container-service
5+
author: mlearned
6+
7+
ms.service: container-service
8+
ms.topic: article
9+
ms.date: 01/09/2020
10+
ms.author: mlearned
11+
---
12+
13+
# Bring your own keys (BYOK) with Azure disks in Azure Kubernetes Service (AKS)
14+
15+
Azure Storage encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can supply [customer-managed keys][customer-managed-keys] to use for encryption of both the OS and data disks for your AKS clusters.
16+
17+
> [!NOTE]
18+
> Linux and Windows based AKS clusters are both supported.
19+
20+
## Before you begin
21+
22+
* This article assumes that you are creating a *new AKS cluster*. You will also need to use or create an instance of Azure Key Vault to store your encryption keys.
23+
24+
* You must enable soft delete and purge protection for *Azure Key Vault* when using Key Vault to encrypt managed disks.
25+
26+
* You need the Azure CLI version 2.0.79 or later and the aks-preview 0.4.26 extension
27+
28+
> [!IMPORTANT]
29+
> AKS preview features are self-service opt-in. Previews are provided "as-is" and "as available" and are excluded from the service level agreements and limited warranty. AKS Previews are partially covered by customer support on best effort basis. As such, these features are not meant for production use. For additional infromation, please see the following support articles:
30+
>
31+
> * [AKS Support Policies](support-policies.md)
32+
> * [Azure Support FAQ](faq.md)
33+
34+
## Install latest AKS CLI preview extension
35+
36+
To use customer-managed keys, you need the *aks-preview* CLI extension version 0.4.26 or higher. Install the *aks-preview* Azure CLI extension using the [az extension add][az-extension-add] command, then check for any available updates using the [az extension update][az-extension-update] command:
37+
38+
```azurecli-interactive
39+
# Install the aks-preview extension
40+
az extension add --name aks-preview
41+
42+
# Update the extension to make sure you have the latest version installed
43+
az extension update --name aks-preview
44+
```
45+
46+
## Create an Azure Key Vault instance to store your keys
47+
48+
You can optionally use the Azure portal to [Configure customer-managed keys with Azure Key Vault][byok-azure-portal]
49+
50+
Create a new *resource group*, then create a new *Key Vault* instance and enable soft delete and purge protection.
51+
52+
```azurecli-interactive
53+
# Optionally retrieve Azure region short names for use on upcoming commands
54+
az account list-locations
55+
56+
# Create new resource group in a supported Azure region
57+
az group create -l myAzureRegionName -n myResourceGroup
58+
59+
# Create an Azure Key Vault resource in a supported Azure region
60+
az keyvault create -n myKeyVaultName -g myResourceGroup-l myAzureRegionName --enable-purge-protection true --enable-soft-delete true
61+
```
62+
63+
## Create an instance of a DiskEncryptionSet
64+
65+
You will need a *key* stored in Azure Key Vault to complete the following steps. Either store your existing Key in the Key Vault you created, or [generate a key][key-vault-generate]
66+
67+
```azurecli-interactive
68+
# Retrieve the Key Vault Id and store it in a variable
69+
keyVaultId=$(az keyvault show --name myKeyVaultName --query [id] -o tsv)
70+
71+
# Retrieve the Key Vault key URL and store it in a variable
72+
keyVaultKeyUrl=$(az keyvault key show --vault-name myKeyVaultName --name myKeyName --query [key.kid] -o tsv)
73+
74+
# Create a DiskEncryptionSet
75+
az disk-encryption-set create -n myDiskEncryptionSetName -l myAzureRegionName -g myResourceGroup--source-vault $keyVaultId --key-url $keyVaultKeyUrl
76+
```
77+
78+
## Grant the DiskEncryptionSet resource access to the key vault
79+
80+
Use the DiskEncryptionSet and resource groups you created on the prior steps, and grant the DiskEncryptionSet resource access to the Azure Key Vault.
81+
82+
```azurecli-interactive
83+
# Retrieve the DiskEncryptionSet value and set a variable
84+
desIdentity=$(az disk-encryption-set show -n myDiskEncryptionSetName -g myResourceGroup--query [identity.principalId] -o tsv)
85+
86+
# Update security policy settings
87+
az keyvault set-policy -n myKeyVaultName -g myResourceGroup--object-id $desIdentity --key-permissions wrapkey unwrapkey get
88+
89+
# Assign the reader role
90+
az role assignment create --assignee $desIdentity --role Reader --scope $keyVaultId
91+
```
92+
93+
## Create a new AKS cluster and encrypt the OS disk with a customer-manged key
94+
95+
Create a new resource group and AKS cluster, then use your key to encrypt the OS disk.
96+
97+
```azurecli-interactive
98+
# Retrieve the DiskEncryptionSet value and set a variable
99+
diskEncryptionSetId=$(az resource show -n $diskEncryptionSetName -g ssecmktesting --resource-type "Microsoft.Compute/diskEncryptionSets" --query [id] -o tsv)
100+
101+
# Create a resource group for the AKS cluster
102+
az group create -n myResourceGroup-l myAzureRegionName
103+
104+
# Create the AKS cluster
105+
az aks create -n myAKSCluster -g myResourceGroup --node-osdisk-diskencryptionsetid diskEncryptionId
106+
```
107+
108+
## Add a node pool to an existing AKS cluster and encrypt the OS disk with a customer-managed key
109+
110+
New nodepools do not use encrypted disks by default. You can add a new node pool to an existing cluster and encrypt the OS disk with your own key by using the following command.
111+
112+
```azurecli-interactive
113+
# Add a nodepool to an existing cluster with BYOK encryption
114+
nodepool add –-cluster-name myAKSCluster -n myNodePoolName -g myResourceGroup --node-osdisk-diskencryptionsetid diskEncryptionId
115+
```
116+
117+
## Encrypt your AKS cluster data disk with a customer-managed key
118+
119+
You can also encrypt the AKS data disks with your own keys. Replace myResourceGroup and myDiskEncryptionSetName with your real values, and apply the yaml.
120+
121+
### Deploy the sample image from ACR to AKS
122+
123+
Ensure you have the proper AKS credentials
124+
125+
Create a file called **byok-azure-disk.yaml** that contains the following information. Replace myResourceGroup and myDiskEncrptionSetName with your values.
126+
127+
```
128+
kind: StorageClass
129+
apiVersion: storage.k8s.io/v1
130+
metadata:
131+
name: hdd
132+
provisioner: kubernetes.io/azure-disk
133+
parameters:
134+
skuname: Standard_LRS
135+
kind: managed
136+
diskEncryptionSetID: "/subscriptions/{subs-id}/resourceGroups/{myResourceGroup}/providers/Microsoft.Compute/diskEncryptionSets/{myDiskEncryptionSetName}"
137+
```
138+
Next, run this deployment in your AKS cluster:
139+
```azurecli-interactive
140+
kubectl apply -f byok-azure-disk.yaml
141+
```
142+
143+
## Limitations
144+
145+
* OS Disk Encryption supported with Kubernetes version 1.17 and above
146+
* Available only in regions where BYOK is supported
147+
* This is currently for new AKS clusters only, existing clusters cannot be upgraded
148+
* AKS cluster using Virtual Machine Scale Sets are required, no support for Virtual Machine Availability Sets
149+
150+
151+
## Next steps
152+
153+
Review [best practices for AKS cluster security][best-practices-security]
154+
155+
<!-- LINKS - external -->
156+
157+
<!-- LINKS - internal -->
158+
[az-extension-add]: /cli/azure/extension#az-extension-add
159+
[az-extension-update]: /cli/azure/extension#az-extension-update
160+
[best-practices-security]: /azure/aks/operator-best-practices-cluster-security
161+
[byok-azure-portal]: /azure/storage/common/storage-encryption-keys-portal
162+
[customer-managed-keys]: /azure/virtual-machines/windows/disk-encryption#customer-managed-keys-public-preview
163+
[key-vault-generate]: /azure/key-vault/key-vault-manage-with-cli2

‎articles/api-management/api-management-access-restriction-policies.md

Lines changed: 7 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.service: api-management
1212
ms.workload: mobile
1313
ms.tgt_pltfrm: na
1414
ms.topic: article
15-
ms.date: 03/21/2019
15+
ms.date: 01/10/2020
1616
ms.author: apimpm
1717
---
1818

@@ -116,11 +116,11 @@ The `rate-limit` policy prevents API usage spikes on a per subscription basis by
116116

117117
### Elements
118118

119-
| Name | Description | Required |
120-
| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
119+
| Name | Description | Required |
120+
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
121121
| rate-limit | Root element. | Yes |
122-
| api | Add one or more of these elements to impose a call rate limit on APIs within the product. Product and API call rate limits are applied independently. API can be referenced either via `name` or `id`. If both attributes are provided, `id` will be used and `name` will be ignored. | No |
123-
| operation | Add one or more of these elements to impose a call rate limit on operations within an API. Product, API, and operation call rate limits are applied independently. Operation can be referenced either via `name` or `id`. If both attributes are provided, `id` will be used and `name` will be ignored. | No |
122+
| api | Add one or more of these elements to impose a call rate limit on APIs within the product. Product and API call rate limits are applied independently. API can be referenced either via `name` or `id`. If both attributes are provided, `id` will be used and `name` will be ignored. | No |
123+
| operation | Add one or more of these elements to impose a call rate limit on operations within an API. Product, API, and operation call rate limits are applied independently. Operation can be referenced either via `name` or `id`. If both attributes are provided, `id` will be used and `name` will be ignored. | No |
124124

125125
### Attributes
126126

@@ -388,6 +388,7 @@ The `validate-jwt` policy enforces existence and validity of a JWT extracted fro
388388
require-signed-tokens="true|false"
389389
clock-skew="allowed clock skew in seconds"
390390
output-token-variable-name="name of a variable to receive a JWT object representing successfully validated token">
391+
<openid-config url="full URL of the configuration endpoint, e.g. https://login.constoso.com/openid-configuration" />
391392
<issuer-signing-keys>
392393
<key>base64 encoded signing key</key>
393394
<!-- if there are multiple keys, then add additional key elements -->
@@ -411,8 +412,6 @@ The `validate-jwt` policy enforces existence and validity of a JWT extracted fro
411412
</claim>
412413
<!-- if there are multiple possible allowed values, then add additional value elements -->
413414
</required-claims>
414-
<openid-config url="full URL of the configuration endpoint, e.g. https://login.constoso.com/openid-configuration" />
415-
<zumo-master-key id="key identifier">key value</zumo-master-key>
416415
</validate-jwt>
417416

418417
```
@@ -498,22 +497,6 @@ This example shows how to use the [Validate JWT](api-management-access-restricti
498497
</choose>
499498
```
500499

501-
#### Azure Mobile Services token validation
502-
503-
```xml
504-
<validate-jwt header-name="x-zumo-auth" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Supplied access token is invalid.">
505-
<issuers>
506-
<issuer>urn:microsoft:windows-azure:zumo</issuer>
507-
</issuers>
508-
<audiences>
509-
<audience>Facebook</audience>
510-
</audiences>
511-
<issuer-signing-keys>
512-
<zumo-master-key id="0">insert key here</zumo-master-key>
513-
</issuer-signing-keys>
514-
</validate-jwt>
515-
```
516-
517500
### Elements
518501

519502
| Element | Description | Required |
@@ -525,7 +508,6 @@ This example shows how to use the [Validate JWT](api-management-access-restricti
525508
| issuers | A list of acceptable principals that issued the token. If multiple issuer values are present, then each value is tried until either all are exhausted (in which case validation fails) or until one succeeds. | No |
526509
| openid-config | The element used for specifying a compliant Open ID configuration endpoint from which signing keys and issuer can be obtained. | No |
527510
| required-claims | Contains a list of claims expected to be present on the token for it to be considered valid. When the `match` attribute is set to `all` every claim value in the policy must be present in the token for validation to succeed. When the `match` attribute is set to `any` at least one claim must be present in the token for validation to succeed. | No |
528-
| zumo-master-key | Master key for tokens issued by Azure Mobile Services | No |
529511

530512
### Attributes
531513

@@ -544,7 +526,7 @@ This example shows how to use the [Validate JWT](api-management-access-restricti
544526
| require-signed-tokens | Boolean. Specifies whether a token is required to be signed. | No | true |
545527
| separator | String. Specifies a separator (e.g. ",") to be used for extracting a set of values from a multi-valued claim. | No | N/A |
546528
| url | Open ID configuration endpoint URL from where Open ID configuration metadata can be obtained. The response should be according to specs as defined at URL:`https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata`. For Azure Active Directory use the following URL: `https://login.microsoftonline.com/{tenant-name}/.well-known/openid-configuration` substituting your directory tenant name, e.g. `contoso.onmicrosoft.com`. | Yes | N/A |
547-
output-token-variable-name|String. Name of context variable that will receive token value as an object of type [`Jwt`](api-management-policy-expressions.md) upon successful token validation|No|N/A
529+
| output-token-variable-name | String. Name of context variable that will receive token value as an object of type [`Jwt`](api-management-policy-expressions.md) upon successful token validation | No | N/A |
548530

549531
### Usage
550532

0 commit comments

Comments
 (0)