From a9ce596977db065e79ed972558ad492188870aaf Mon Sep 17 00:00:00 2001 From: Simon Gallagher Date: Mon, 9 Nov 2026 18:33:05 +0000 Subject: [PATCH] Refresh root README with sample chooser and latest additions Signpost confidential Container Apps, native Functions, Service Bus, validation and cleanup guidance. Remove stale duplicate guidance and correct the Backup sample link. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 54 ++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 44 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 734c897..3f2d3d6 100644 --- a/README.md +++ b/README.md @@ -7,11 +7,15 @@ languages: - C++ - PowerShell - AzureCLI +- javascript products: - azure-confidential-computing - azure-kubernetes-service - azure-attestation-service - azure-container-instances +- azure-container-apps +- azure-functions +- azure-service-bus - azure-virtual-machines description: "Azure Confidential Computing Samples" urlFragment: confidential-computing-samples @@ -33,6 +37,31 @@ Confidential computing is the protection of data-in-use through isolating comput > 📚 **Want to learn more?** See the official Azure Confidential Computing documentation at [`https://aka.ms/accdocs`](https://aka.ms/accdocs). +## Start here: choose a sample + +Follow the selected guide's prerequisites, deployment, verification, and cleanup +steps. Not every sample requires every tool listed below. + +| I want to... | Start with | What to expect | +|---|---|---| +| Deploy a simple web container on confidential managed compute | [Container Apps hello world](azure-container-apps-sample/container-apps-acc/README.md#start-here) | Public HTML endpoint on a dedicated DC4 workload profile in UAE North; no image build required. | +| Run an HTTP-triggered function on confidential compute | [Native Functions on Container Apps](azure-container-apps-sample/functions-on-azure-container-apps/README.md#start-here) | Node.js 24 JSON API, managed identity, fresh ACR builds, and private Blob host storage; start by deploying the sibling confidential environment. | +| Check that those Container Apps actually select confidential compute | [DC4 placement verification](azure-container-apps-sample/README.md#validate-confidential-compute-placement) | Read-only PowerShell and portal checks for each app's environment/profile binding and revision health; not independent hardware attestation. | +| Send and receive messages through a confidential managed service | [Service Bus Premium](service-bus-examples/README.md) | New confidential-enabled namespace, passwordless messaging, and exact message read-back checks. | +| Explore attestation in a container | [Visual attestation v2 on ACI](aci-samples/visual-attestation-demo-v2/README.md) | Direct Microsoft Azure Attestation calls and a Confidential-versus-Standard comparison. | +| Deploy a confidential VM or H100 confidential GPU VM | [VM samples](vm-samples/README.md) | AMD SEV-SNP, Intel TDX, and H100 paths with sample-specific attestation and prerequisites. | +| Keep partner datasets separate while computing shared results | [Federated multi-party analytics](multi-party-samples/advanced-app-federated/README.md) | Each partner processes its own data in its own TEE and returns aggregates. | +| Explore confidential video processing | [Automotive machine vision](automotive-machine-vision/README.md) | Confidential ACI video redaction with HTTPS, CCE policy, and an attestation gate. | + +For the full catalog, see [Sample Categories](#sample-categories). To understand +validation and CI, see [Validation Automation](docs/VALIDATION-AUTOMATION.md). + +**Before deploying:** check regional support, quota, permissions, and your +organization's policies. Samples can create billable resources. Cleanup behavior +varies: the Container Apps examples retain resources until you explicitly remove +them, whereas some other demos automatically clean up. Public demo endpoints +must not be used to send sensitive data. + ## ⚠️ Disclaimer **IMPORTANT:** This repository contains sample code for educational and demonstration purposes only. @@ -51,7 +80,15 @@ Confidential computing is the protection of data-in-use through isolating comput | Addition | Description | |---|---| -| **[Confidential Azure Container Apps samples](azure-container-apps-sample/README.md)** | UAE North DC4 hello world and a tested [native Azure Functions walkthrough](azure-container-apps-sample/functions-on-azure-container-apps/README.md#start-here) with Node.js 24, fresh ACR builds, managed identity, private Blob host storage, placement/health verification, and portal/API access instructions. Resources are retained until explicitly cleaned up. | +| **[Confidential Container Apps hello world](azure-container-apps-sample/container-apps-acc/README.md#start-here)** | Deploy Microsoft's HTML quickstart using ARM and PowerShell, explicitly bound to a dedicated DC4 confidential workload profile in UAE North. | +| **[Native Azure Functions on confidential Container Apps](azure-container-apps-sample/functions-on-azure-container-apps/README.md#start-here)** | Tested Node.js 24 `GET /api/hello` JSON endpoint with fresh ACR builds, immutable image deployment, managed identity, and private Blob host storage. Includes local Azurite testing, host-health checks, and portal/API access instructions. | +| **[Explicit confidential-compute validation](azure-container-apps-sample/README.md#validate-confidential-compute-placement)** | Read live app/environment resources, match the selected profile to DC4, and check active/healthy revisions. Includes expected output and portal cross-checks, with a clear distinction from cryptographic attestation. | + +### Previously (October 2026) + +| Addition | Description | +|---|---| +| **[Confidential Service Bus Premium](service-bus-examples/README.md)** | Deploy a new confidential-enabled Premium namespace and queue, assign scoped Sender/Receiver roles, and verify three JSON messages using passwordless Entra authentication. The guide covers Korea Central/UAE North availability, configuration evidence, and cleanup. | ### Previously (September 2026) @@ -97,7 +134,11 @@ adds Azure CLI and role-assignment permissions; local development uses Node.js - [Docker Desktop](https://www.docker.com/products/docker-desktop/) (for confidential container policy generation) - [Python 3.11+](https://www.python.org/downloads/) (for local development/testing) -### Quick Setup +### ACI policy tooling setup + +Only follow this setup if your selected sample requires the Azure CLI `confcom` +extension for confidential container policy generation. It is not a prerequisite +for the Container Apps or Service Bus examples. ```powershell # Install required Azure CLI extension @@ -216,13 +257,6 @@ three sample JSON messages, and verify them on read-back using passwordless Entr authentication. Tries Korea Central first, then UAE North on regional availability failures. -### [Azure Container Apps Samples](azure-container-apps-sample/README.md) -Deploy Microsoft's hello-world container with HTTPS ingress on an explicitly -selected **DC4 confidential workload profile** in **UAE North**. Includes ARM -infrastructure, PowerShell deployment and placement checks, and customer setup -instructions. Also includes a Node.js Functions-on-Container-Apps hello-world -example and a placeholder for a future App Services example. - ### Utility Snippets Reusable PowerShell snippets for common confidential computing tasks: - `snippet-createDES.ps1` - Create Disk Encryption Set for Confidential VMs @@ -231,7 +265,7 @@ Reusable PowerShell snippets for common confidential computing tasks: ### [Sovereign Examples](/sov-examples/README.md) 🆕 Confidential VM deployments with data-sovereignty and compliance focus: - **[Citizen Registry](sov-examples/README.md)** - Full-stack sovereign data demo: Confidential ACI container with SQL Server on a Confidential VM, connected through a private VNet with Application Gateway. Features remote attestation, Secure Key Release, ephemeral credentials, and API-based citizen record seeding. -- **[CVM with Azure Backup](sov-examples/cvm-backup/README.md)** - Windows CVM with Azure Backup (Recovery Services Vault), Customer Managed Keys, and confidential disk encryption +- **[CVM with Azure Backup](cvm-backup/README.md)** - Windows CVM with Azure Backup (Recovery Services Vault), Customer Managed Keys, and confidential disk encryption ### [SKR Examples](/skr-examples/README.md) 🆕 Standalone Secure Key Release demonstration: