*Applicable when using Active Directory Federated Services (AD FS).
ACS (including blob, table, and queue storage). These certificates are provided by the Azure Stack Hub Operator, for the following services: This section covers rotation of certificates used to secure external-facing services. Baseboard management controller (BMC) credentials is also a manual process, covered later in this article. 
Value-add resource provider (RP) secrets is covered under seperate guidance:. 
This includes user and administrator account passwords, and network switch passwords.
Non-certificate secrets such as secure keys and strings must be done manually by the administrator. For operators using System Center Operations Manager to monitor Azure Stack Hub systems, placing a system in maintenance mode will prevent these alerts from reaching their ITSM systems, but will continue to alert if the Azure Stack Hub system becomes unreachable. Operators can verify the validity of these alerts using the Test-AzureStack PowerShell cmdlet. This behavior is expected and the alerts can be ignored. Maintenance operations may affect both user workloads and portal operations.ĭuring rotation of secrets, operators may notice alerts open and automatically close. Schedule normal maintenance windows, as much as possible, during non-business hours. Notify your users of planned maintenance operations. You should follow the instructions in the article Prepare for extension host for Azure Stack Hub to add extension host certificates. 
You don't need to rotate secrets to add extension host certificates.If you don't know whether secret rotation has been run on your environment, update to 1811 before performing secret rotation. Secret Rotation must be executed via the Privileged Endpoint and requires Azure Stack Hub Operator credentials. If secret rotation has already been performed, you must update to version 1811 or later before you perform secret rotation again.
0 kommentar(er)
