You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-instances/container-instances-tutorial-deploy-confidential-containers-cce-arm.md
+53-50Lines changed: 53 additions & 50 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Tutorial - Prepare a deployment for a confidential container on Azure Container Instances
3
-
description: Azure Container Instances tutorial deploys a confidential container - ARM
3
+
description: Learn how to create an Azure Resource Manager template for a confidential container deployment with a custom confidential computing enforcement policy.
# Tutorial: Create an ARM template for a confidential container deployment with custom confidential computing enforcement policy
13
+
# Tutorial: Prepare a deployment for a confidential container on Azure Container Instances
14
14
15
-
Confidential containers on ACI is a SKU on the serverless platform that enables customers to run container applications in a hardware-based and attested trusted execution environment (TEE), which can protect data in use and provides in-memory encryption via Secure Nested Paging.
15
+
In Azure Container Instances, you can use confidential containers on the serverless platform to run container applications in a hardware-based and attested trusted execution environment (TEE). This capability can help protect data in use and provides in-memory encryption via Secure Nested Paging.
16
16
17
-
In this article, you'll:
17
+
In this tutorial, you learn how to:
18
18
19
19
> [!div class="checklist"]
20
-
> * Create an ARM template for a confidential container group
21
-
> * Generate a confidential computing enforcement (CCE) policy
22
-
> * Deploy the confidential container group to Azure
20
+
>
21
+
> * Create an Azure Resource Manager template (ARM template) for a confidential container group.
22
+
> * Generate a confidential computing enforcement (CCE) policy.
23
+
> * Deploy the confidential container group to Azure.
## Create an ARM template for a Container Instances container group
29
30
30
-
In this tutorial, you deploy a hello world application that generates a hardware attestation report. You start by creating an ARM template with a container group resource to define the properties of this application. You'll use this ARM template with the Azure CLI confcom tooling to generate a confidential computing enforcement (CCE) policy for attestation. In this tutorial, we use this [ARM template](https://raw.githubusercontent.com/Azure-Samples/aci-confidential-hello-world/main/template.json?token=GHSAT0AAAAAAB5B6SJ7VUYU3G6MMQUL7KKKY7QBZBA). To view the source code for this application, visit [ACI Confidential Hello World](https://aka.ms/ccacihelloworld).
31
+
In this tutorial, you deploy a Hello World application that generates a hardware attestation report. You start by creating an ARM template with a container group resource to define the properties of this application. You'll use this ARM template with the Azure CLI confcom tooling to generate a CCE policy for attestation.
31
32
32
-
> [!NOTE]
33
-
> The ccePolicy parameter of the template is blank and needs to be updated based on the next step of this tutorial.
33
+
This tutorial uses [this ARM template](https://raw.githubusercontent.com/Azure-Samples/aci-confidential-hello-world/main/template.json?token=GHSAT0AAAAAAB5B6SJ7VUYU3G6MMQUL7KKKY7QBZBA). To view the source code for this application, see [Azure Container Instances Confidential Hello World](https://aka.ms/ccacihelloworld).
34
34
35
-
There are two properties added to the Azure Container Instance resource definition to make the container group confidential:
35
+
Two properties are added to the Container Instances resource definition to make the container group confidential:
36
36
37
-
1.**sku**: The SKU property enables you to select between confidential and standard container group deployments. If this property isn't added, the container group will be deployed as standard SKU.
38
-
2.**confidentialComputeProperties**: The confidentialComputeProperties object enables you to pass in a custom confidential computing enforcement policy for attestation of your container group. If this object isn't added to the resource there will be no validation of the software components running within the container group.
37
+
*`sku`: Enables you to select between confidential and standard container group deployments. If you don't add this property to the resource, the container group will be a standard deployment.
38
+
*`confidentialComputeProperties`: Enables you to pass in a custom CCE policy for attestation of your container group. If you don't add this object to the resource, the software components that run within the container group won't be validated.
39
39
40
-
Use your preferred text editor to save this ARM template on your local machine as **template.json**.
40
+
> [!NOTE]
41
+
> The `ccePolicy` parameter under `confidentialComputeProperties` is blank. You'll fill it in after you generate the policy later in the tutorial.
41
42
42
-
You can see under **confidentialComputeProperties**, we have left a blank **ccePolicy** for you to fill in once you generate the policy in the next step.
43
+
Use your preferred text editor to save this ARM template on your local machine as *template.json*.
43
44
44
45
```ARM
45
46
{
@@ -155,18 +156,17 @@ You can see under **confidentialComputeProperties**, we have left a blank **cceP
155
156
}
156
157
```
157
158
158
-
## Create a custom CCE Policy
159
-
160
-
With the ARM template that you've crafted and the Azure CLI confcom extension, you're able to generate a custom CCE policy. the CCE policy is used for attestation. The tool takes the ARM template as an input to generate the policy. The policy enforces the specific container images, environment variables, mounts, and commands, which can then be validated when the container group starts up. For more information on the Azure CLI confcom extension, see [Azure CLI confcom extension](https://github.com/Azure/azure-cli-extensions/blob/main/src/confcom/azext_confcom/README.md).
159
+
## Create a custom CCE policy
161
160
161
+
With the ARM template that you crafted and the Azure CLI confcom extension, you can generate a custom CCE policy. The CCE policy is used for attestation. The tool takes the ARM template as an input to generate the policy. The policy enforces the specific container images, environment variables, mounts, and commands, which can then be validated when the container group starts up. For more information on the Azure CLI confcom extension, see the [documentation on GitHub](https://github.com/Azure/azure-cli-extensions/blob/main/src/confcom/azext_confcom/README.md).
162
162
163
-
1. To generate the CCE policy, you'll run the following command using the ARM template as input:
163
+
1. To generate the CCE policy, run the following command by using the ARM template as input:
164
164
165
165
```azurecli-interactive
166
166
az confcom acipolicygen -a .\template.json --print-policy
167
167
```
168
168
169
-
When this command completes, you should see a Base 64 string generated as output in the format seen below. This string is the CCE policy that you will copy and paste into your ARM template under the ccePolicy property.
169
+
When this command finishes, you should see a Base64 string generated as output in the following format. This string is the CCE policy that you copy and paste into your ARM template as the value of the `ccePolicy` property.
@@ -176,61 +176,64 @@ With the ARM template that you've crafted and the Azure CLI confcom extension, y
176
176
177
177
## Deploy the template
178
178
179
-
1. Select the following **Deploy to Azure** button to sign in to Azure and begin an Azure Container Instances deployment.
179
+
In the following steps, you use the Azure portal to deploy the template. In addition to the Azure portal, you can use the Azure PowerShell, Azure CLI, and REST API. To learn about other deployment methods, see [Deploy templates](../azure-resource-manager/templates/deploy-cli.md).
180
+
181
+
1. Select the **Deploy to Azure** button to sign in to Azure and begin a Container Instances deployment.
180
182
181
183
:::image type="content" source="~/articles/reusable-content/ce-skilling/azure/media/template-deployments/deploy-to-azure-button.svg" alt-text="Button to deploy the Resource Manager template to Azure." border="false" link="https://ms.portal.azure.com/#create/Microsoft.Template":::
182
184
183
-
1.Choose**Build your own template in the editor**. You'll see a mostly blank template JSON.
185
+
1.Select**Build your own template in the editor**.
184
186
185
-
187
+
186
188
187
-
1. Select **Load file** and upload **template.json**, which you've modified by adding the CCE policy you generated in the previous steps.
189
+
The template JSON that appears is mostly blank.
188
190
189
-
191
+
1. Select **Load file** and upload **template.json**, which you modified by adding the CCE policy in the previous steps.
190
192
191
-
1. Click **Save**.
193
+
192
194
193
-
1. Select or enter the following values.
195
+
1. Select **Save**.
194
196
195
-
***Subscription**: select an Azure subscription.
196
-
***Resource group**: select **Create new**, enter a unique name for the resource group, and then select **OK**.
197
-
***Location**: select a location for the resource group. Choose a region where the [Confidential SKU is supported](./container-instances-region-availability.md#linux-container-groups). Example: **North Europe**.
198
-
***Name**: accept the generated name for the instance, or enter a name.
199
-
***Image**: accept the default image name. This sample Linux image displays a hardware attestation.
197
+
1. Select or enter the following values:
200
198
201
-
Accept default values for the remaining properties.
199
+
***Subscription**: Select an Azure subscription.
200
+
***Resource group**: Select **Create new**, enter a unique name for the resource group, and then select **OK**.
201
+
***Location**: Select a location for the resource group. Choose a region where [confidential containers are supported](./container-instances-region-availability.md#linux-container-groups). Example: **North Europe**.
202
+
***Name**: Accept the generated name for the instance, or enter a name.
203
+
***Image**: Accept the default image name. This sample Linux image displays a hardware attestation.
202
204
203
-
Review the terms and conditions. If you agree, select **I agree to the terms and conditions stated above**.
205
+
Accept default values for the remaining properties, and then select **Review + create**.
204
206
205
-
207
+
206
208
207
-
1.After the instance has been created successfully, you get a notification:
209
+
1.Review the terms and conditions. If you agree, select **I agree to the terms and conditions stated above**.
208
210
209
-
211
+
1. Wait until the **Deployment succeeded** notification appears. It confirms that you successfully created the instance.
210
212
211
-
The Azure portal is used to deploy the template. In addition to the Azure portal, you can use the Azure PowerShell, Azure CLI, and REST API. To learn other deployment methods, see [Deploy templates](../azure-resource-manager/templates/deploy-cli.md).
213
+
212
214
213
215
## Review deployed resources
214
216
215
-
Use the Azure portal or a tool such as the [Azure CLI](container-instances-quickstart.md) to review the properties of the container instance.
217
+
In the following steps, you use the Azure portal to review the properties of the container instance. You can also use a tool such as the [Azure CLI](container-instances-quickstart.md).
216
218
217
-
1. In the portal, search for Container Instances, and select the container instance you created.
219
+
1. In the portal, search for **Container Instances**, and then select the container instance that you created.
218
220
219
-
2. On the **Overview** page, note the **Status** of the instance and its **IP address**.
221
+
2. On the **Overview** page, note the status of the instance and its IP address.
220
222
221
-
223
+
222
224
223
-
3.Once its status is *Running*, navigate to the IP address in your browser.
225
+
3.When the status of the instance is **Running**, go to the IP address in your browser.
224
226
225
-
227
+
226
228
227
229
The presence of the attestation report below the Azure Container Instances logo confirms that the container is running on hardware that supports a TEE.
228
-
If you deploy to hardware that does not support a TEE, for example by choosing a region where the ACI Confidential SKU is not available, no attestation report will be shown.
229
230
230
-
## Next Steps
231
+
If you deploy to hardware that doesn't support a TEE (for example, by choosing a region where Container Instances Confidential is not available), no attestation report will appear.
232
+
233
+
## Related content
231
234
232
-
Now that you have deployed a confidential container group on ACI, you can learn more about how policies are enforced.
235
+
Now that you deployed a confidential container group on Container Instances, you can learn more about how policies are enforced:
Copy file name to clipboardExpand all lines: includes/container-instances-tutorial-prerequisites-confidential-containers.md
+9-11Lines changed: 9 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,24 +11,22 @@ ms.author: tomcassidy
11
11
ms.custom: include file
12
12
---
13
13
14
-
You must satisfy the following requirements to complete this tutorial:
14
+
To complete this tutorial, you must satisfy the following requirements:
15
15
16
-
1.**Azure CLI**: You must have Azure CLI version 2.44.1 or later installed on your local computer. Run `az --version` to find the version. If you need to install or upgrade, see [Install the Azure CLI][azure-cli-install].
16
+
***Azure CLI**: You must have Azure CLI version 2.44.1 or later installed on your local computer. To find your version, run `az --version`. If you need to install or upgrade, see [Install the Azure CLI][azure-cli-install].
17
17
18
-
2.**Azure CLI confcom extension**: You must have the Azure CLI confcom extension version 0.2.13+ installed to generate confidential computing enforcement policies.
18
+
***Azure CLI confcom extension**: You must have the Azure CLI confcom extension version 0.30+ installed to generate confidential computing enforcement policies.
19
19
20
-
**Docker**: This tutorial assumes a basic understanding of core Docker concepts like containers, container images, and basic `docker` commands. For a primer on Docker and container basics, see the [Docker overview][docker-get-started].
20
+
```bash
21
+
az extension add -n confcom
22
+
```
21
23
22
-
**Docker**: To complete this tutorial, you need Docker installed locally. Docker provides packages that configure the Docker environment on [macOS][docker-mac], [Windows][docker-windows], and [Linux][docker-linux].
24
+
***Docker**: You need Docker installed locally. Docker provides packages that configure the Docker environment on [macOS][docker-mac], [Windows][docker-windows], and [Linux][docker-linux].
23
25
24
-
**Azure CLI confcom extension**: You must have the Azure CLI confcom extension version 0.30+ to generate confidential computing enforcement policies.
25
-
26
-
```bash
27
-
az extension add -n confcom
28
-
```
26
+
This tutorial assumes a basic understanding of core Docker concepts like containers, container images, and basic `docker` commands. For a primer on Docker and container basics, see the [Docker overview][docker-get-started].
29
27
30
28
> [!IMPORTANT]
31
-
> Because the Azure Cloud shell does not include the Docker daemon, you *must* install both the Azure CLI and Docker Engine on your *local computer* to complete this tutorial. You cannot use the Azure Cloud Shell for this tutorial.
29
+
> Because Azure Cloud Shell doesn't include the Docker daemon, you must install both the Azure CLI and Docker Engine on your *local computer* to complete this tutorial. You can't use Azure Cloud Shell for this tutorial.
0 commit comments