DOCSEARCHbyAlgolia
Submit Docs

Azure Stack Documentation

repository·main·Indexed 42 days ago

https://github.com/microsoftdocs/azure-stack-docs

Documentation for the Azure Stack product portfolio, including Azure Local, AKS on Azure Local, Azure Stack Hub, and Azure Stack Edge. Provides guidance on distributed infrastructure, containerized workloads, and compliance standards such as HIPAA and ISO/IEC 27001:2022, covering network security, identity management, data encryption, and disaster recovery.

Tokens
277.6K
Snippets
391
Records
1K
Agent score
49%

What's inside Azure Stack

  1. What is Azure Operator Nexus?

    main

    Azure Operator Nexus is a carrier-grade hybrid cloud platform designed for telecommunication operators to run network-intensive workloads and mission-critical applications. It provides an integrated platform for compute, network, and storage, automating the lifecycle management (LCM) of both the underlying infrastructure (bare-metal hosts, network fabric, storage) and tenant workloads (Containerized Network Functions - CNFs and Virtualized Network Functions - VNFs).

    Operators interact with the platform via a self-service model using:

    • Azure portal
    • Azure CLI
    • SDKs
    • Other Azure management tools

  2. Overview of Azure Local, AKS on Azure Local, and Azure Stack

    main

    This repository contains documentation for three primary distributed infrastructure and container platform solutions:

    • Azure Local: A distributed infrastructure solution enabled by Azure Arc. It allows you to run virtual machines, containers, and selected Azure services.
    • AKS on Azure Local: An enterprise-grade Kubernetes container platform. It provides Microsoft-supported core Kubernetes, a purpose-built Windows container host, and a Microsoft-supported Linux container host, designed for simple deployment and lifecycle management.
    • Azure Stack: A portfolio of products extending Azure services to datacenters, edge locations, and remote offices. The portfolio includes:
      • Azure Stack Hub
      • Azure Stack Edge

  3. Monitoring capabilities: Metrics and Alerts in Azure Local

    main

    Azure Local integrates with Azure Monitor to provide infrastructure insights and proactive notifications.

    Metrics

    Azure Local provides out-of-the-box infrastructure metrics at no extra cost. These include:

    • CPU and memory usage
    • Storage performance: IOPS, latency, and throughput
    • Network throughput

    You can view these via predefined charts in Azure Monitor or create custom charts for specific visualization needs.

    Alerts

    Azure Local uses Azure Monitor Alerts to proactively notify administrators of issues. Alerts can be triggered by:

    • Predefined health faults from the OS health service.
    • Custom thresholds based on collected metrics or logs.

    Alert responses can include text/email notifications to administrators or automated processes to correct error conditions.

  4. Update the Azure Stack Hub SQL resource provider

    main

    The SQL resource provider (RP) manages SQL Server resources on Azure Stack Hub. While the existing provider continues to work when Azure Stack Hub is updated, you should update to the latest build as soon as possible.

    Important Notes:

    • Updating the resource provider does not update the hosting SQL Server itself.
    • Always review the release notes for the specific version to check for minimum Azure Stack Hub version requirements, new functionality, and known issues.

    Version Compatibility Matrix:

    Supported Azure Stack Hub versionSQL RP versionWindows Server OS
    2206, 2301, 2306, 23112.0.13.xMicrosoft AzureStack Add-on RP Windows Server 1.2009.0
    2108, 22062.0.6.xMicrosoft AzureStack Add-on RP Windows Server 1.2009.0

  5. Deploy a Windows N-tier application on Azure Stack Hub

    main

    This reference architecture describes how to deploy a multi-tier Windows application on Azure Stack Hub using SQL Server for the data tier. The architecture utilizes a virtual network segmented into specific subnets for each tier to ensure security and isolation.

    Architecture Components

    • Subnets: Separate subnets should be created for each tier (e.g., Application Gateway, Management, Web tier, Business tier, Data tier, and Active Directory).
    • Load Balancing:
      • Since Application Gateway is not available on Azure Stack Hub, use Layer 7 alternatives from the Marketplace (e.g., f5 Big-IP Virtual Edition or A10 vThunder ADC).
      • Use Azure Load Balancer to distribute traffic between tiers (Web to Business, and Business to SQL Server).
    • Security: Use Network Security Groups (NSGs) to restrict traffic between subnets (e.g., preventing the Web tier from communicating directly with the Data tier).
    • Data Tier High Availability: Implement SQL Server Always On Availability Groups using Windows Server Failover Cluster (WSFC) technology.
    • Identity: Use Active Directory Domain Services (AD DS) for domain membership and cluster object management.

  6. Compare container orchestrators for Azure Local small form factor deployments

    main

    Small form factor deployments of Azure Local use containers as an application isolation layer to minimize resource consumption (CPU/RAM) compared to traditional VMs. You can choose between three primary orchestration options based on your management preference and workload complexity:

    • AKS (Azure Kubernetes Service): A fully managed, bare-metal Kubernetes service. Best for users who want Azure to handle the entire lifecycle (creation, upgrades, deletion) via the Azure portal or templates. It is Arc-enabled by default.
    • K3s: A lightweight, CNCF-certified Kubernetes distribution. Best for users who want to manage their own Kubernetes cluster but need a low resource footprint (~512 MB RAM). It can be connected to Azure Arc-enabled Kubernetes manually.
    • Docker: A simple container runtime. Best for single-application deployments or teams that do not require Kubernetes orchestration. It has the lowest overhead but lacks advanced features like self-healing, service discovery, and Azure Arc integration.

  7. Azure benefits available via Azure VM verification

    main

    Azure verification enables several workloads that are typically exclusive to Azure to run on Azure Local:

    • Extended Security Updates (ESUs): Free security updates for end-of-support SQL and Windows Server VMs. Requires enabling Legacy OS support and installing Latest Servicing Stack Updates.
    • Azure Virtual Desktop (AVD): Allows AVD session hosts to run on Azure Local.
      • Windows 11 multi-session: Automatically activated with 4B update (22H2: KB5036893 or later).
      • Windows 10 multi-session: Requires Legacy OS support and 4B update (21H2: KB5036894 or later).
    • Windows Server Datacenter: Azure Edition: Enables exclusive Windows Server innovations. Automatically activated for Windows Server Azure Edition 2022 with 4B update (KB5036909 or later).
    • Azure Update Manager (AUM): SaaS-based software update management provided at no cost. Available automatically for VMs created through the Azure Arc resource bridge on Azure Local.
    • Azure Machine Configuration: (formerly Azure Policy Guest Configuration) Enables auditing and configuring OS settings as code via IMDS. Requires Legacy OS support and Arc agent version 1.39 or later.

  8. Meet ISO/IEC 27001:2022 requirements with Azure Local

    main

    Azure Local provides technical capabilities to help organizations satisfy security controls in Annex A of the ISO/IEC 27001:2022 standard. This guidance covers technical implementations across nine domains: Network security, Identity and access management, Data protection, Logging, Monitoring, Secure configuration, Threat protection, Backup and recovery, and Scalability and availability.

    Note: This guidance covers technical requirements only. Security operations (the human/process side) are out of scope and must be managed by your organization. Not all controls are mandatory; perform a risk assessment to determine which controls are necessary for your specific environment.

  9. Use SQL databases on Azure Stack Hub

    main

    The SQL resource provider allows Azure Stack Hub operators to offer SQL databases as a service. Once the resource provider is installed and connected to SQL Server instances, users can create SQL databases for cloud-native applications and web applications.

    Key Limitations

    • Database Management: Users can only manage individual databases. Access to database server instances (e.g., master, Temp DB) is not available to end users. This may impact compatibility with applications requiring dynamic database management or system database access.
    • Management Responsibility: The operator is responsible for deploying, updating, securing, configuring, and maintaining the SQL database servers and hosts. The Resource Provider (RP) does not manage hosts or server instances.
    • Isolation: Databases from different users/subscriptions may reside on the same server instance. The RP does not provide mechanisms to isolate databases on different hosts or instances.
    • Reporting & Monitoring: The RP does not provide tenant usage reporting or monitor SQL server health.
    • Subscription Movement: While SQL hosting servers can be moved to different subscriptions in global Azure, Azure Stack Hub does not support moving a SQL hosting server to another subscription.
    • Access Control: There is no access control on SQL Server system databases. For standalone SQL servers (non-HA), the RP uses SQL logins for user access to their own databases, but these logins do not restrict access to system databases (e.g., a user might see all backup histories in the msdb database).

  10. New features in App Service on Azure Stack Hub 2022 H1

    main

    The 2022 H1 release introduces several architectural and functional changes:

    • OS Update: All roles now use Windows Server 2022 Datacenter.
    • Platform Isolation: Administrators can isolate the platform image by setting the SKU to AppService.
    • Network Improvements: Updated network design for worker Virtual Machine Scale Sets to address SNAT port exhaustion and increased the number of outbound addresses for all applications.
    • Deployment Prefix: Administrators can set a three-character deployment prefix for individual instances in each Virtual Machine Scale Set.
    • Deployment Center: The Deployment Center is now enabled for tenants, replacing the Deployment Options experience.
      • IMPORTANT: Operators must reconfigure deployment sources because Redirect URLs have changed. Tenants must reconnect apps to their source control providers.

  11. Deploy SQL Server on Azure Local version 23H2

    main

    Azure Local (version 23H2) provides a highly available and cost-efficient platform for running SQL Server workloads, including Online Transaction Processing (OLTP), Data Warehousing, Business Intelligence, and AI/Advanced Analytics.

    SQL Server can be deployed on virtual machines (VMs) running either Windows Server or Linux. The platform supports workload consolidation and integration with Azure hybrid services for disaster recovery and data protection.

  12. Key features of Azure Operator Nexus

    main

    Azure Operator Nexus provides several specialized capabilities for telecommunications workloads:

    • Azure Linux: A lightweight, secure Linux distribution (formerly CBL-Mariner) running on bare-metal hosts to minimize resource consumption and attack surface.
    • Bare Metal and Cluster Management: Capabilities to provision, restart, shut down, or reimage bare-metal hosts, including a cluster manager for Kubernetes lifecycle management.
    • Network Fabric Automation: Enables zero-touch provisioning (ZTP) and workflow-driven API models for managing carrier-grade network fabrics.
    • Network Packet Broker: Part of the network fabric that allows monitoring and replicating every packet, applying dynamic filters, and sending data to multiple destinations for security or performance monitoring.
    • Nexus Kubernetes: An on-premises version of AKS optimized for tenant network function workloads, managed via Azure CRUD operations.
    • NFVI (Network Functions Virtualization Infrastructure) Capabilities:
      • Compute: NUMA-aligned VMs with dedicated cores (SMT siblings) and huge pages.
      • Networking: Supports SR-IOV and DPDK for low latency/high throughput, with API-controlled access to VFs and trunk ports.
      • Storage: High-performance file system storage for CNFs.
    • Observability: Automatic streaming of infrastructure and tenant (VNF) metrics and logs to Azure Monitor and Log Analytics.