Hgs with Certificate Stored in keyvault #2685

uday31in · 2016-10-27T00:50:45Z

Hgs keyvault

Adding ARM Template to deploy Host Guardian Service in Azure. The “Host Guardian Service” (HGS) is a new server role introduced in Windows Server 2016. HGS provides Attestation and Key Protection services that enable Hyper-V to run Shielded virtual machines. A Hyper-V host is known as a “guarded host” once the Attestation service affirmatively validates its identity & configuration. Once affirmatively attested, the Key Protection service provides the transport key (TK) needed to unlock & run Shielded VMs.

updating title

adding medata.json

edit readme.md

…"maxLength" criteria AssertionError: hgs/metadata.json - #/itemDisplayName:Failed "maxLength" criteria

# Conflicts: # hgs/metadata.json

fix metadata.json

hgs-keyvault

azurecla · 2016-10-27T00:50:53Z

Hi @uday31in, I'm your friendly neighborhood Azure Pull Request Bot (You can call me AZPRBOT). Thanks for your contribution!

It looks like you're working at Microsoft (udpandya). If you're full-time, we DON'T require a contribution license agreement.

If you are a vendor, DO please sign the electronic contribution license agreement. It will take 2 minutes and there's no faxing! https://cla.azure.com.

TTYL, AZPRBOT;

uday31in · 2016-10-27T15:18:31Z

@bmoore-msft - please integrate it in main repo.

gatneil · 2016-12-21T00:45:14Z

hgs-keyvault/README.md

@@ -0,0 +1,16 @@
+# Deploy Host Guardian Service (HGS) + KeyVault For Shielded VM in Windows Server 2016 in Standalone or High Availability mode using Failover Clustering.
+
+<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fuday31in%2Fazure-quickstart-templates%2Fmaster%2Fhgs%2Fazuredeploy.json" target="_blank">


shouldn't this link point to hgs-keyvault instead of hgs?

gatneil · 2016-12-21T00:45:19Z

hgs-keyvault/README.md

+<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fuday31in%2Fazure-quickstart-templates%2Fmaster%2Fhgs%2Fazuredeploy.json" target="_blank">
+    <img src="http://azuredeploy.net/deploybutton.png"/>
+</a>
+<a href="http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Fuday31in%2Fazure-quickstart-templates%2Fmaster%2Fhgs%2Fazuredeploy.json" target="_blank">


gatneil · 2016-12-21T00:46:52Z

hgs-keyvault/azuredeploy.json

+        "description": "Resource Group of Key Vault that has a secret"
+      }
+    },
+    "httpsCertificateUrl": {


are any of these urls supposed to be secret? If so, please use securestring instead of string; if they don't need to be secret, then this is fine as is

gatneil · 2016-12-21T00:47:22Z

hgs-keyvault/azuredeploy.json

+    {
+      "type": "Microsoft.Storage/storageAccounts",
+      "name": "[variables('storageAccountName')]",
+      "apiVersion": "2015-05-01-preview",


can we use a non-preview api version?

gatneil · 2016-12-21T00:47:59Z

hgs-keyvault/azuredeploy.json

+        "dhcpOptions": {
+          "dnsServers": [
+            "[variables('subnetdns')]",
+            "8.8.8.8" 


why use google DNS? Is the built-in DNS not sufficient?

gatneil · 2016-12-21T00:50:40Z

hgs-keyvault/azuredeploy.json

+              "settings": {
+
+                "fileUris": [
+                  "https://udayvw.blob.core.windows.net/artefacts/dscinit.ps1"


Please see #2 in the best practices checklist: https://github.com/Azure/azure-quickstart-templates/blob/master/1-CONTRIBUTION-GUIDE/bp-checklist.md

gatneil · 2016-12-21T00:51:44Z

hgs-keyvault/azuredeploy.json

+                "fileUris": [
+                  "https://udayvw.blob.core.windows.net/artefacts/dscinit.ps1"
+                ],
+                "commandToExecute": "[concat('powershell -ExecutionPolicy Unrestricted -File ', variables('DSCInitScriptFileName') , ' -NodeType:' , concat('', copyindex()) ,' -HgsServerPrimaryIPAddress:10.0.0.4 -GenerateSelfSignedCertificate:false',  concat(' -HgsServerPrimaryAdminUsername:', parameters('adminUsername')), concat(' -HgsServerPrimaryAdminPassword:', parameters('adminPassword')) )]"


this contains a password, so the commandToExecute should go into "protectedSettings" instead of "settings"

gatneil · 2016-12-21T00:52:02Z

hgs-keyvault/azuredeploy.parameters.json

+    "contentVersion": "1.0.0.0",
+  "parameters": {
+    "adminUsername": {
+            "value": "uday"


can we use a more generic username here, like 'azureuser'?

gatneil · 2016-12-21T00:52:23Z

hgs-keyvault/azuredeploy.parameters.json

+            "value": "GEN-UNIQUE-13"
+        },
+
+    "vaultName": {


it seems the indenting is inconsistent in this file; could we run this through a json formatter?

gatneil · 2016-12-21T00:52:36Z

hgs-keyvault/azuredeploy.parameters.json

+      "value": "UdayKeyVault"
+    },
+    "httpsCertificateUrl": {
+      "value": "https://hgskeyvault.vault.azure.net:443/secrets/HTTPSCert/8ee99c94155749e5804fb373502565dd"


should probably replace urls with fake values

gatneil · 2016-12-21T00:54:32Z

Left comments on hgs-keyvault, but most of the comments also apply to hgs. Could you make the changes in both?

gatneil · 2017-02-15T22:33:09Z

No activity; closing

uday31in and others added 22 commits January 30, 2016 17:01

Merge remote-tracking branch 'Azure/master'

7138f92

Merge remote-tracking branch 'refs/remotes/Azure/master'

a9ae227

modify readme.md

40a512b

updating title

adding medata.json

a690e9c

adding medata.json

modifying title

cc4fa63

edit readme.md

b580420

edit readme.md

fix for AssertionError: hgs/metadata.json - #/itemDisplayName:Failed …

58606d9

…"maxLength" criteria AssertionError: hgs/metadata.json - #/itemDisplayName:Failed "maxLength" criteria

Merge remote-tracking branch 'refs/remotes/Azure/master'

ef0120c

upate metadata

5da3aa0

update displayname

b465343

addessing travis CI Azure#1

6451085

renaming folder to lowercasing

4b23c71

Merge remote-tracking branch 'origin/master'

17f8492

# Conflicts: # hgs/metadata.json

fix metadata.json

5b126f7

fix metadata.json

fix for url

e55e0e1

fix for raw.github url

7abed32

removing DSCInitScriptFolder

42ef32b

Adding support for KV

b213417

Fix for Generate self-signed cetificate and parsing

ef5963a

Fixing Cert permission

606b67e

hgs-keyvault

20f835b

hgs-keyvault

azurecla added the cla-not-required label Oct 27, 2016

uday31in added 2 commits October 27, 2016 12:15

Adding support dnsNameforLB

b7bf302

adding .ci_skip

57d05db

uday31in changed the title ~~Hgs keyvault~~ Hgs with Certificate Stored in keyvault Oct 27, 2016

gatneil suggested changes Dec 21, 2016

View reviewed changes

gatneil self-assigned this Dec 21, 2016

gatneil added the awaiting-author-response label Dec 21, 2016

gatneil closed this Feb 15, 2017

		@@ -0,0 +1,16 @@
		# Deploy Host Guardian Service (HGS) + KeyVault For Shielded VM in Windows Server 2016 in Standalone or High Availability mode using Failover Clustering.

		<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fuday31in%2Fazure-quickstart-templates%2Fmaster%2Fhgs%2Fazuredeploy.json" target="_blank">

Hgs with Certificate Stored in keyvault #2685

Hgs with Certificate Stored in keyvault #2685

Uh oh!

Conversation

uday31in commented Oct 27, 2016

Uh oh!

azurecla commented Oct 27, 2016

Uh oh!

uday31in commented Oct 27, 2016

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gatneil commented Dec 21, 2016

Uh oh!

gatneil commented Feb 15, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants