Azure Disk Encryption for SF - Performance, Downtime, Key Vault Authentication & Request Rate

Jaspreet Singh 6 Microsoft Employee

Hi team,

We're trying to enable the Azure Disk encryption extension for our SF clusters.

I've few doubts if you could answer-

Will there be any performance impact after these changes on the compute and boot time?
Will there be any downtime while enabling the Azure Disk Encryption?
What will be approx number of requests to Key vault to access the encryption keys?
What will be authentication mechanism to access the Key Vault? Do we need to add any other access policies to it also?
Do we need to enable the encryption for both the primary and secondary node types?

Prrudram-MSFT 21,886 Reputation points

2022-12-14T09:31:56.97+00:00

Hi @Jaspreet Singh ,

As discussed internally with you, I would suggest you perform experiments with a test cluster to check if there is any performance impact on your workload and how often it accesses KeyVault. For general estimates the Azure Disk Encryption team is the domain expert.

All questions except maybe the last one can be asked to the Azure Disk Encryption team. Suggest you raise a support request with ADE team.

Concerning the last question of whether you need to encrypt both node types: no, it is not a requirement. Your SF cluster can run as a mixture of node types that are encrypted and node types that are not. SF does not aware if the disk has been encrypted or not. The decision to encrypt should be made from your threat modeling team who surely will always recommend it unless there’s a perf impact (my team has seen none) and whether your VM SKU supports disk encryption. You may need to change your VM SKU to one that supports disk encryption.
Prrudram-MSFT 21,886 Reputation points

2022-12-14T09:32:09.913+00:00

@Jaspreet Singh ,

{
"code": "VMExtensionProvisioningError",
"message": "Long running operation failed with status 'Failed'. Additional Info:'VM has reported a failure when processing extension 'AzureDiskEncryption'. Error message: \"[2.2.0.44] Failed to enable Azure Disk Encryption on the VM with the following exception details:
Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.BitlockerFailedToSendEncryptionSettingsException: The fault reason was: ' 0xc1425072 RUNTIME_E_KEYVAULT_SET_SECRET_FAILED Failed to set secret to KeyVault '.\r
at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.WireProtocol.WireProtocolMessage.SendEncryptionSettingsToHost() in C:\__w\1\s\src\BitLocker\BitlockerIaasVMExtension\WireProtocol\WireProtocolMessage.cs:line 210\r
at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.BitlockerExtension.SendEncryptionSettingsToHostV3(VmEncryptionSettings vmSettings) in C:\__w\1\s\src\BitLocker\BitlockerIaasVMExtension\BitlockerExtension.cs:line 877\"\r
\r

For the above error, have you created your Azure Key Vault using PowerShell ? Also, are you using the same account to access the key vault as you have used to create the Key vault. Can you try adding the access policy using PowerShell cmldets -
Set-AzureRmKeyVaultAccessPolicy -VaultName <keyvaultname> -UserPrincipalName <upn> -PermissionsToKeys all -PermissionsToSecrets all

Similar issue: https://github.com/MicrosoftDocs/azure-docs/issues/96093
JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2023-01-04T20:48:05.657+00:00

@Jaspreet Singh
Thank you for your post and I apologize for the delayed response!

When it comes to your Azure Disk Encryption for Service Fabric questions, I just wanted to check in and see if you were able to get the answers you needed after working with our support team?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.