Skip to content

Commit fe0e0f3

Browse files
committed
Update Batch certificate migration guide
1 parent 15c7f38 commit fe0e0f3

File tree

1 file changed

+12
-6
lines changed

1 file changed

+12
-6
lines changed

articles/batch/batch-certificate-migration-guide.md

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
---
22
title: Migrate Batch account certificates to Azure Key Vault
33
description: Learn how to migrate Batch account certificates to Azure Key Vault and plan for feature end of support.
4-
author: harperche
5-
ms.author: harpercheng
64
ms.service: batch
75
ms.topic: how-to
8-
ms.date: 10/12/2022
6+
ms.date: 03/08/2023
97
---
108

119
# Migrate Batch account certificates to Azure Key Vault
@@ -14,13 +12,13 @@ On *February 29, 2024*, the Azure Batch account certificates feature will be ret
1412

1513
## About the feature
1614

17-
Certificates are often required in various scenarios such as decrypting a secret, securing communication channels, or [accessing another service](credential-access-key-vault.md). Currently, Azure Batch offers two ways to manage certificates on Batch pools. You can add certificates to a Batch account or you can use the Azure Key Vault VM extension to manage certificates on Batch pools. Only the [certificate functionality on an Azure Batch account](/rest/api/batchservice/certificate) and the functionality it extends to Batch pools via `CertificateReference` to [Add Pool](/rest/api/batchservice/pool/add#certificatereference), [Patch Pool](/rest/api/batchservice/pool/patch#certificatereference), [Update Properties](/rest/api/batchservice/pool/update-properties#certificatereference) and the corresponding references on Get and List Pool APIs are being retired.
15+
Certificates are often required in various scenarios such as decrypting a secret, securing communication channels, or [accessing another service](credential-access-key-vault.md). Currently, Azure Batch offers two ways to manage certificates on Batch pools. You can add certificates to a Batch account or you can use the Azure Key Vault VM extension to manage certificates on Batch pools. Only the [certificate functionality on an Azure Batch account](/rest/api/batchservice/certificate) and the functionality it extends to Batch pools via `CertificateReference` to [Add Pool](/rest/api/batchservice/pool/add#certificatereference), [Patch Pool](/rest/api/batchservice/pool/patch#certificatereference), [Update Properties](/rest/api/batchservice/pool/update-properties#certificatereference) and the corresponding references on Get and List Pool APIs are being retired. Additionally, for Linux pools, the environment variable `$AZ_BATCH_CERTIFICATES_DIR` will no longer be defined and populated.
1816

1917
## Feature end of support
2018

2119
[Azure Key Vault](../key-vault/general/overview.md) is the standard, recommended mechanism for storing and accessing secrets and certificates across Azure securely. Therefore, on February 29, 2024, we'll retire the Batch account certificates feature in Azure Batch. The alternative is to use the Azure Key Vault VM Extension and a user-assigned managed identity on the pool to securely access and install certificates on your Batch pools.
2220

23-
After the certificates feature in Azure Batch is retired on February 29, 2024, a certificate in Batch won't work as expected. After that date, you'll no longer be able to add certificates to a Batch account or link these certificates to Batch pools. Pools that continue to use this feature after this date may not behave as expected such as updating certificate references or the ability to install existing certificate references.
21+
After the certificates feature in Azure Batch is retired on February 29, 2024, a certificate in Batch won't work as expected. After that date, you'll no longer be able to add certificates to a Batch account or link these certificates to Batch pools. Pools that continue to use this feature after this date may not behave as expected such as updating certificate references or the ability to install existing certificate references.
2422

2523
## Alternative: Use Azure Key Vault VM extension with pool user-assigned managed identity
2624

@@ -38,8 +36,16 @@ For a complete guide on how to enable Azure Key Vault VM Extension with Pool Use
3836

3937
Yes. You may use the same Key Vault as specified with your Batch account as for use with your pools, but your Key Vault used for certificates for your Batch pools may be entirely separate.
4038

39+
- Are both Linux and Windows Batch pools supported with the Key Vault VM extension?
40+
41+
Yes. See the documentation for [Windows](../virtual-machines/extensions/key-vault-windows.md) and [Linux](../virtual-machines/extensions/key-vault-linux.md).
42+
43+
- How do I get references to certificates on Linux Batch Pools since `$AZ_BATCH_CERTIFICATES_DIR` will be removed?
44+
45+
The Key Vault VM extension for Linux allows you to specify the `certificateStoreLocation`, which is an absolute path to where the certificate will be stored.
46+
4147
- Where can I find best practices for using Azure Key Vault?
42-
48+
4349
See [Azure Key Vault best practices](../key-vault/general/best-practices.md).
4450

4551
## Next steps

0 commit comments

Comments
 (0)