You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article provides Azure Operator Service Manager guidelines to optimize the design of configuration group schemas (CGSs) and the operation of configuration group values (CGVs). Network function (NF) vendors, telco operators, and their partners should keep these practices in mind when onboarding and deploying NFs.
14
14
15
-
## Configurarion group approach
15
+
## Configuration group approach
16
16
17
17
Consider the following meta-schema guidelines when you're designing configuration resources:
18
18
@@ -26,7 +26,7 @@ Consider the following meta-schema guidelines when you're designing configuratio
26
26
27
27
## One-CGS approach
28
28
29
-
The original recommendation was to use only a single CGS/CGV set for the entire NF. This approach consolidated site-specific, instance-specific, and security-specific parameters together. Only in rare cases, where a service had multiple nfs, were multiple sets used. Many partners successfully onboarded using this approach, and it remains supported. However, this approach doesn't obscure secrets. All configuration values are stored in plain-text and are displayable via most Azure methods.
29
+
The original recommendation was to use only a single CGS/CGV set for the entire NF. This approach consolidated site-specific, instance-specific, and security-specific parameters together. Only in rare cases, where a service had multiple NFs, were multiple sets used. Many partners successfully onboarded using this approach, and it remains supported. However, this approach doesn't obscure secrets. All configuration values are stored in plain-text and are displayable via most Azure methods.
30
30
31
31
## Three-CGS approach
32
32
@@ -92,13 +92,13 @@ This example shows the rendered CGV resource created after the CGV deployment co
92
92
```
93
93
94
94
## CGS with secrets
95
-
Other then seperating secrets into a unique CGS, no special requirements exist for CGS secret support.
95
+
Other than separating secrets into a unique CGS, no special requirements exist for CGS secret support.
96
96
97
97
## CGV with secrets
98
-
Consider the following Azure Resource Manager (ARM) template reqiurements to properly obscure secret values throughout the entire CGV resource lifecycle.
98
+
Consider the following Azure Resource Manager (ARM) template requirements to properly obscure secret values throughout the entire CGV resource lifecycle.
99
99
100
100
* Use `configurationType: 'Secret'` in the template under resource properties.
101
-
* Once a CGV is deployed, this prevents displaying the secret data via most Azure methods.
101
+
* Once a CGV is deployed, this configuration prevents displaying the secret data via most Azure methods.
102
102
103
103
```json
104
104
"parameters": {
@@ -109,7 +109,7 @@ Consider the following Azure Resource Manager (ARM) template reqiurements to pro
109
109
```
110
110
111
111
* Use `"type": "secureObject"` in the template under parameter type
112
-
* This obscures the display of the secrets as template parameters.
112
+
* This configuration obscures the display of the secrets as template parameters.
113
113
114
114
```json
115
115
{
@@ -122,10 +122,10 @@ Consider the following Azure Resource Manager (ARM) template reqiurements to pro
122
122
```
123
123
124
124
* Use a template reference to Azure Key Vault (AKV) in place of the plain-text secret.
125
-
* This obscures the display of the secrets as template variables.
125
+
* This configuration obscures the display of the secrets as template variables.
126
126
127
127
> [!NOTE]
128
-
> *Only Azure Key Vault is supported by ARM for secret reference substition.
128
+
> *ARM template only support Azure Key Vault for secret reference substitution.
129
129
130
130
This example shows how to include an AKV reference to a secret named `secretName` in an ARM template.
131
131
@@ -139,7 +139,7 @@ This example shows how to include an AKV reference to a secret named `secretName
139
139
}
140
140
```
141
141
142
-
To further secure resources, consinder restricting access to the RBAC scope `Microsoft.Resources/deployments/exportTemplate/action` to only roles which absolutely need to this access.
142
+
To further secure resources, consider restricting access to the role based access control (RBAC) scope `Microsoft.Resources/deployments/exportTemplate/action` to only roles that absolutely need to this access.
0 commit comments