You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-apps/manage-secrets.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Azure Container Apps allows your application to securely store sensitive configu
21
21
- Secrets are scoped to an application, outside of any specific revision of an application.
22
22
- New revisions don't get generated through adding, removing, or changing secrets.
23
23
- Each application revision can reference one or more secrets.
24
-
- Multiple revisions can reference the same secret(s).
24
+
- Multiple revisions can reference the same secrets.
25
25
26
26
An updated or deleted secret doesn't automatically affect existing revisions in your app. When a secret is updated or deleted, you can respond to changes in one of two ways:
27
27
@@ -39,13 +39,13 @@ Secrets are defined as a set of name/value pairs. The value of each secret is sp
39
39
40
40
### Store secret value in Container Apps
41
41
42
-
When you define secrets through the portal, or via different command line options.
42
+
The following is used when you define secrets through the portal, or via different command line options.
43
43
44
44
# [Azure portal](#tab/azure-portal)
45
45
46
46
1. Go to your container app in the [Azure portal](https://portal.azure.com).
47
47
48
-
1. Under the *Settings* section, select **Secrets**.
48
+
1. Under the *Security* section, select **Secrets**.
49
49
50
50
1. Select **Add**.
51
51
@@ -122,7 +122,7 @@ Here, a connection string to a queue storage account is declared. The value for
122
122
123
123
---
124
124
125
-
###<aname="reference-secret-from-key-vault"></a>Reference secret from Key Vault
125
+
## <aname="reference-secret-from-key-vault"></a>Reference secret from Key Vault
126
126
127
127
When you define a secret, you create a reference to a secret stored in Azure Key Vault. Container Apps automatically retrieves the secret value from Key Vault and makes it available as a secret in your container app.
128
128
@@ -136,7 +136,7 @@ To grant access to Key Vault secrets, grant the Azure RBAC role [Key Vault Secre
136
136
137
137
1. Go to your container app in the [Azure portal](https://portal.azure.com).
138
138
139
-
1. Under the *Settings* section, select **Identity**.
139
+
1. Under the *Security* section, select **Identity**.
140
140
141
141
1. In the *System assigned* tab, set the *Status* to **On**.
142
142
@@ -147,7 +147,7 @@ To grant access to Key Vault secrets, grant the Azure RBAC role [Key Vault Secre
147
147
148
148
1. A popup appears to confirm that you want to enable system assigned managed identity and register your container app with Microsoft Entra ID. Select **Yes**.
149
149
150
-
1. Under the *Settings* section, select **Secrets**.
150
+
1. Under the *Security* section, select **Secrets**.
> If you're using [UDR With Azure Firewall](user-defined-routes.md), you will need to add the `AzureKeyVault` service tag and the *login.microsoft.com* FQDN to the allow list for your firewall. Refer to [configuring UDR with Azure Firewall](use-azure-firewall.md) to decide which additional service tags you need.
219
+
> If you're using [UDR With Azure Firewall](user-defined-routes.md), you'll need to add the `AzureKeyVault` service tag and the *login.microsoft.com* FQDN to the allow list for your firewall. Refer to [configuring UDR with Azure Firewall](use-azure-firewall.md) to decide which additional service tags you need.
220
220
221
221
#### Key Vault secret URI and secret rotation
222
222
223
223
The Key Vault secret URI must be in one of the following formats:
224
224
225
-
*`https://myvault.vault.azure.net/secrets/mysecret/ec96f02080254f109c51a1f14cdb1931`: Reference a specific version of a secret.
226
-
*`https://myvault.vault.azure.net/secrets/mysecret`: Reference the latest version of a secret.
225
+
-`https://myvault.vault.azure.net/secrets/mysecret/ec96f02080254f109c51a1f14cdb1931`: Reference a specific version of a secret.
226
+
-`https://myvault.vault.azure.net/secrets/mysecret`: Reference the latest version of a secret.
227
227
228
228
If a version isn't specified in the URI, then the app uses the latest version that exists in the key vault. When newer versions become available, the app automatically retrieves the latest version within 30 minutes. Any active revisions that reference the secret in an environment variable is automatically restarted to pick up the new value.
Copy file name to clipboardExpand all lines: articles/container-apps/overview.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: container-apps
5
5
author: craigshoemaker
6
6
ms.service: azure-container-apps
7
7
ms.topic: overview
8
-
ms.date: 11/19/2024
8
+
ms.date: 03/31/2026
9
9
ms.author: cshoe
10
10
ms.custom: build-2023
11
11
---
@@ -26,7 +26,7 @@ Additionally, applications built on Azure Container Apps can dynamically scale b
26
26
- HTTP traffic
27
27
- Event-driven processing
28
28
- CPU or memory load
29
-
- Any [KEDA-supported scaler](https://keda.sh/docs/scalers/)
29
+
- Any [KEDA-supported scaler](https://keda.sh/docs/2.19/scalers/)
30
30
31
31
:::image type="content" source="media/overview/azure-container-apps-example-scenarios.png" alt-text="Example scenarios for Azure Container Apps.":::
32
32
@@ -43,13 +43,13 @@ With Azure Container Apps, you can:
43
43
44
44
-[**Use the Azure CLI extension, Azure portal or ARM templates**](get-started.md) to manage your applications.
45
45
46
-
-[**Enable HTTPS or TCP ingress**](ingress.md) without having to manage other Azure infrastructure.
46
+
-[**Enable HTTPS or TCP ingress**](ingress-overview.md) without having to manage other Azure infrastructure.
47
47
48
48
-[**Build microservices with Dapr**](microservices.md) and [access its rich set of APIs](./dapr-overview.md).
49
49
50
50
-[**Run jobs**](jobs.md) on-demand, on a schedule, or based on events.
51
51
52
-
-[**Run Azure Functions**](../container-apps/functions-overview.md) for [event-driven scenarios](../azure-functions/functions-scenarios.md) using triggers, bindings and automatic scaling.
52
+
-[**Run Azure Functions**](../container-apps/functions-overview.md) for [event-driven scenarios](../azure-functions/functions-scenarios.md) using triggers, bindings, and automatic scaling.
53
53
54
54
- Add [**Azure Spring Apps**](https://aka.ms/asaonaca) to your Azure Container Apps environment.
Azure Container Apps dynamic sessions provide fast access to secure sandboxed environments that are ideal for running code or applications that require strong isolation from other workloads.
16
16
17
-
Dynamic sessions offer prewarmed environments through a [session pools](./session-pool.md) that starts the container in milliseconds, scales on demand, and maintains strong isolation. This makes them ideal for interactive workloads, running LLM generated scripts, and secure execution of custom code.
18
-
17
+
Dynamic sessions offer prewarmed environments through [session pools](./session-pool.md) that start the container in milliseconds, scale on demand, and maintain strong isolation. This makes them ideal for interactive workloads, running LLM generated scripts, and secure execution of custom code.
19
18
20
19
## Benefits
20
+
21
21
With sessions, you get:
22
22
23
23
-**Secure isolation**: Hyper-V isolation and optional network controls protect your environment. Sessions are isolated from each other and from the host environment, providing enterprise-grade security and isolation.
24
24
-**Sandboxed environments**: Each session runs in its own isolated environment, ensuring that workloads don't interfere with each other.
25
25
-**Instant Startup**: Prewarmed pools enable subsecond launch times for interactive workloads. New sessions are allocated in milliseconds thanks to pools of ready but unallocated sessions.
26
-
-**Scalable by Design**: Handle hundreds or thousands of concurrent sessions without manual intervention.
27
-
-**Managed lifecycle**: Sessions are automatically deprovisioned after use or after a configurable cooldown period, ensuring efficient resource usage.
28
-
26
+
-**Scalable by Design**: Handle hundreds or thousands of concurrent sessions without manual intervention.
27
+
-**Managed lifecycle**: Sessions are automatically deprovisioned after use or after a configurable cooldown period, ensuring efficient resource usage.
29
28
30
29
## Common Scenarios
31
-
Dynamic sessions are useful in a variety of situations, including:
30
+
31
+
Dynamic sessions are useful in various situations, including:
32
+
32
33
-**AI/LLM Workflows**: Safely execute AI-generated code in isolated environments without risking your production systems.
33
34
-**Interactive Development**: Provide developers with fast, disposable environments for testing scripts or prototypes without provisioning full apps.
34
35
-**Secure Code Execution**: Run untrusted or user-submitted code in a sandboxed environment with strong isolation.
35
36
-**Custom Compute Tasks**: Execute short-lived jobs that require custom dependencies or runtime environments without long startup times.
36
37
-**Burst Workloads**: Handle unpredictable spikes in demand by scaling sessions up and down automatically.
37
38
38
-
39
39
## Key Concepts
40
+
40
41
-**Session Pool**: A session pool is the foundation for dynamic sessions. It contains a set of prewarmed, ready-to-use sessions that enable near instant startup. When a request comes in, the system allocates a session from the pool instead of creating one from scratch, which dramatically reduces latency.
41
42
42
43
-**Session**: A session is the actual execution environment where your code or container runs. Sessions are ephemeral and isolated, designed for short-lived tasks. When you create a session, it's allocated from the session pool, ensuring fast startup. After the task completes or the cooldown period expires, the session is destroyed and resources are cleaned up.
@@ -49,8 +50,7 @@ Dynamic sessions are useful in a variety of situations, including:
49
50
-**Code interpreter session pools**: These use platform built-in containers that provide preconfigured environments for running code, including AI-generated scripts. Ideal for scenarios like LLM-driven workflows or secure code execution.
50
51
-**Custom container session pools**: Bring-your-own-container for custom workloads that require specific dependencies or runtime environments.
@@ -63,7 +63,6 @@ Dynamic sessions are useful in a variety of situations, including:
63
63
64
64
For more information, see [Usage](./sessions-usage.md).
65
65
66
-
67
66
## Supported regions
68
67
69
68
Dynamic sessions are available in the following regions. Both code interpreter and custom container sessions are supported in all listed regions.
@@ -89,12 +88,13 @@ Dynamic sessions are available in the following regions. Both code interpreter a
89
88
> Regional availability may change. To verify current availability, check the **Location** dropdown when creating a session pool in the Azure portal.
90
89
91
90
## Security
92
-
Dynamic sessions are designed to run untrusted code in isolated environments. For information about securing your sessions, see [Security](./sessions-usage.md#security).
93
91
92
+
Dynamic sessions are designed to run untrusted code in isolated environments. For information about securing your sessions, see [Security](./sessions-usage.md#security).
94
93
95
94
## Billing
96
-
Custom container sessions are billed based on the resources consumed by the session pool. For more information, see [Azure Container Apps billing](./billing.md#dynamic-sessions).
97
95
96
+
Custom container sessions are billed based on the resources consumed by the session pool. For more information, see [Azure Container Apps billing](./billing.md#dynamic-sessions).
98
97
99
98
## Related content
99
+
100
100
- Learn how to configure [session pools](./session-pool.md)
You also have the option of deploying a private DNS for your Container Apps environment. For more information see [Create and configure an Azure Private DNS zone](waf-app-gateway.md#create-and-configure-an-azure-private-dns-zone).
23
+
You also have the option of deploying a private DNS for your Container Apps environment. For more information, see [Create and configure an Azure Private DNS zone](waf-app-gateway.md#create-and-configure-an-azure-private-dns-zone).
24
24
25
-
####Create a virtual network
25
+
## Create a virtual network
26
26
27
27
> [!NOTE]
28
28
> To use a VNet with Container Apps, the VNet must have a dedicated subnet with a CIDR range of `/27` or larger when using the default workload profiles environment, or a CIDR range of `/23` or larger when using the legacy Consumption only environment. To learn more about subnet sizing, see the [networking architecture overview](./custom-virtual-networks.md#subnet).
29
29
30
30
1. Select the **Networking** tab.
31
31
1. Select **Yes** next to *Use your own virtual network*.
32
-
1. Next to the *Virtual network* box, select the **Create new** link and enter the following value.
32
+
1. Next to the *Virtual network* box, select the **Create new** link and enter the following value:
33
33
34
34
| Setting | Value |
35
35
|--|--|
36
36
| Name | Enter **my-custom-vnet**. |
37
37
38
38
1. Select the **OK** button.
39
-
1. Next to the *Infrastructure subnet* box, select the **Create new** link and enter the following values:
39
+
1. Next to the *Subnet* box, select the **Create new** link and enter the following values:
When using the Workload profiles environment, you need to update the VNet to delegate the subnet to `Microsoft.App/environments`. Do not delegate the subnet when using the Consumption-only environment.
149
+
When using the Workload profiles environment, you need to update the VNet to delegate the subnet to `Microsoft.App/environments`. Don't delegate the subnet when using the Consumption-only environment.
150
150
151
151
# [Bash](#tab/bash)
152
152
@@ -204,7 +204,7 @@ The following table describes the parameters used with `containerapp env create`
204
204
|---|---|
205
205
|`name`| Name of the Container Apps environment. |
206
206
|`resource-group`| Name of the resource group. |
207
-
|`logs-workspace-id`| (Optional) The ID of an existing Log Analytics workspace. If omitted, a workspace is created for you. |
207
+
|`logs-workspace-id`| (Optional) The ID of an existing Log Analytics workspace. If omitted, a workspace is created for you. |
208
208
|`logs-workspace-key`| The Log Analytics client secret. Required if using an existing workspace. |
209
209
|`location`| The Azure location where the environment is to deploy. |
210
210
|`infrastructure-subnet-resource-id`| Resource ID of a subnet for infrastructure components and user application containers. |
When using the legacy Consumption-only environment, there are three optional networking parameters you can choose to define when calling `containerapp env create`. Use these options when you have a peered VNet with separate address ranges. Explicitly configuring these ranges ensures the addresses used by the Container Apps environment don't conflict with other ranges in the network infrastructure.
352
352
353
353
> [!NOTE]
354
-
> These parameters are only applicable to the legacy Consumption-only environment type. The default workload profiles environment type does not require these parameters.
354
+
> These parameters are only applicable to the legacy Consumption-only environment type. The default workload profiles environment type doesn't require these parameters.
355
355
356
-
You must either provide values for all three of these properties, or none of them. If they aren’t provided, the values are generated for you.
356
+
You must either provide values for all three of these properties or none of them. If they aren’t provided, the values are generated for you.
357
357
358
358
# [Bash](#tab/bash)
359
359
@@ -363,7 +363,7 @@ You must either provide values for all three of these properties, or none of the
363
363
|`platform-reserved-dns-ip`| An IP address from the `platform-reserved-cidr` range that is used for the internal DNS server. The address can't be the first address in the range, or the network address. For example, if `platform-reserved-cidr` is set to `10.2.0.0/16`, then `platform-reserved-dns-ip` can't be `10.2.0.0` (the network address), or `10.2.0.1` (infrastructure reserves use of this IP). In this case, the first usable IP for the DNS would be `10.2.0.2`. |
364
364
|`docker-bridge-cidr`| The address range assigned to the Docker bridge network. This range must have a size between `/28` and `/12`. |
365
365
366
-
- The `platform-reserved-cidr` and `docker-bridge-cidr` address ranges can't conflict with each other, or with the ranges of either provided subnet. Further, make sure these ranges don't conflict with any other address range in the VNet.
366
+
- The `platform-reserved-cidr` and `docker-bridge-cidr` address ranges can't conflict with each other or with the ranges of either provided subnet. Further, make sure these ranges don't conflict with any other address range in the VNet.
367
367
368
368
- If these properties aren’t provided, the CLI autogenerates the range values based on the address range of the VNet to avoid range conflicts.
369
369
@@ -390,7 +390,7 @@ If you're not going to continue to use this application, you can delete the **my
390
390
::: zone pivot="azure-cli"
391
391
392
392
>[!CAUTION]
393
-
> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they will also be deleted.
393
+
> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they'll also be deleted.
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments