Azure Private Link Serverless - #7595
Conversation
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Elastic Docs Style Checker (Vale)Summary: 6 warnings found
|
| File | Line | Rule | Message |
|---|---|---|---|
| deploy-manage/security/private-connectivity-azure.md | 104 | Elastic.Spelling | 'australiaeast' is a possible misspelling. |
| deploy-manage/security/private-connectivity-azure.md | 105 | Elastic.Spelling | 'eastus' is a possible misspelling. |
| deploy-manage/security/private-connectivity-azure.md | 107 | Elastic.Spelling | 'germanywestcentral' is a possible misspelling. |
| deploy-manage/security/private-connectivity-azure.md | 108 | Elastic.Spelling | 'southeastasia' is a possible misspelling. |
| deploy-manage/security/private-connectivity-azure.md | 109 | Elastic.Spelling | 'spaincentral' is a possible misspelling. |
| deploy-manage/security/private-connectivity-azure.md | 110 | Elastic.Spelling | 'uaenorth' is a possible misspelling. |
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Docs review summary
Focus areas
- Style and clarity: Mostly clean edits (fixed a duplicated "to to", removed a stray "please" is unrelated/pre-existing). Left a nit on an inline-code formatting inconsistency in the shared limitations snippet.
- Jargon: No unexplained Elastic-internal jargon introduced by this diff;
{{serverless-short}}/{{serverless-full}}substitutions are used consistently and expand to full terms. - Frontmatter and applies_to: Found one concrete bug — the new
sub.example-phz-dnvalue inrestrictions-known-problems.md("vpce.us-east-1.aws.elastic-cloud.com in AWS") is malformed (has" in AWS"appended) and appears unused in the current diff; see inline comment. Otherapplies_to/productsadditions for serverless (azure, private-connectivity, ip-filtering) look consistent with existing patterns in the same files. - Content type fit: The expanded how-to/reference content (Requirements sections, region tables, API metadata retrieval) fits the existing page structure and content type for each file.
- Parent issue satisfaction: Not applicable — no linked issue; PR body describes the doc scope directly and the diff appears to cover the described Azure Serverless expansion, AWS service names, and "AWS only" → "AWS and Azure" corrections.
Notes
- Vale findings (
Elastic.MappedPageswarnings) are pre-existingmapped_pagesentries, not introduced by this PR, so not flagged individually. - Did not flag broken links/anchors, which the docs build validates separately.
Generated by Docs review agent for #7595 · sonnet50 86.3 AIC · ⌖ 3.95 AIC · ⊞ 15.6K
… into azure-pl-serverless
nikfot
left a comment
nikfot
left a comment
There was a problem hiding this comment.
First pass looks generally good. Some comments:
-
I do not see changes discussed here introduced in this pr, except if some other pr implemented them and I missed it
-
I added in this issue the PLS aliases and DNS that should also be included.
| products: | ||
| - id: cloud-hosted | ||
| sub: | ||
| example-phz-dn: "vpce.us-east-1.aws.elastic-cloud.com in AWS" |
There was a problem hiding this comment.
We should also add an azure example
There was a problem hiding this comment.
added
unfortunately, I can't use code formatting in this context because it is a variable inside of a snippet, but I'm preferring this method so we can single-source the limitations across all private connectivity tutorials
|
|
||
| As a workaround, you can [add an IP filter](/deploy-manage/security/ip-filtering-cloud.md) for the hosts that will use SSO through the {{ecloud}} console. | ||
|
|
||
| In {{ech}}, you can still SSO into private {{kib}} endpoints individually using the [SAML](/deploy-manage/users-roles/cluster-or-deployment-auth/saml.md) or [OIDC](/deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md) protocol from your own identity provider, just not through the {{ecloud}} console. Stack-level authentication using the {{es}} username and password also works with the private hosted zone URL for your deployment, for example, my-deployment-d53192.kb.{{example-phz-dn}}. |
There was a problem hiding this comment.
Same as above either mention this is azure or add an example for AWS
| In {{ech}}, you can still SSO into private {{kib}} endpoints individually using the [SAML](/deploy-manage/users-roles/cluster-or-deployment-auth/saml.md) or [OIDC](/deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md) protocol from your own identity provider, just not through the {{ecloud}} console. Stack-level authentication using the {{es}} username and password also works with the private hosted zone URL for your deployment, for example, my-deployment-d53192.kb.{{example-phz-dn}}. | |
| In {{ech}}, you can still SSO into private {{kib}} endpoints individually using the [SAML](/deploy-manage/users-roles/cluster-or-deployment-auth/saml.md) or [OIDC](/deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md) protocol from your own identity provider, just not through the {{ecloud}} console. Stack-level authentication using the {{es}} username and password also works with the private hosted zone URL for your deployment, for example in AWS, my-deployment-d53192.kb.{{example-phz-dn}}. |
There was a problem hiding this comment.
the variable is taking care of this for us. here's how it looks on the limitations page
and here's how it looks on the azure page - a URL customized for the page context:
this PR contains all of the fixes from that one (I used AI to cherry-pick) |
these are already present here, as pulled from the API. the API also returns |
| ```{include} _snippets/private-connectivity-limitations-ech.md | ||
| ``` | ||
|
|
||
| * **North Europe region:** {applies_to}`serverless:` Private Link is not available for {{serverless-full}} projects in the Azure `northeurope` region because of Azure capacity limitations. {{ech}} deployments in `northeurope` are not affected. |
There was a problem hiding this comment.
@nikfot / @alxchalkias wonder if we should be adding brazilsouth and swedencentral to the limitations list for the short term
I believe those were launched just yesterday or roday so we said that we would (1) get them live without PL (2) announce PL GA (3) anounce those two regions with PL |
| ::: | ||
|
|
||
| There are no specific requirements for {{es-serverless}} projects or {{ech}} deployments. | ||
| There are no specific requirements for other {{serverless-short}} project types or {{ech}} deployments. |
There was a problem hiding this comment.
@shainaraskas should we document the "grandfathering" of projects created before the cut-off date or is this not something we typically do?
There was a problem hiding this comment.
is this all projects created before the cutoff, or only those using privatelink already? if the former, the audience might be big enough for a callout. if the latter, it's probably not really relevant + will just create support debt
| | **Hardware configuration** | Limited control | Managed | Hardware choices are managed by Elastic | | ||
| | **High availability** | ✅ | ✅ | Automatic resilience | | ||
| | **Network security** | ✅ [IP filtering](/deploy-manage/security/ip-filtering-cloud.md)<br><br>✅ [Private connectivity](/deploy-manage/security/private-connectivity.md) (VPCs, PrivateLink)<br><br>✅ [Published static IPs](/deploy-manage/security/elastic-cloud-static-ips.md) | ✅ [IP filtering](/deploy-manage/security/ip-filtering-cloud.md)<br><br>✅ [Private connectivity](/deploy-manage/security/private-connectivity.md) (VPCs, PrivateLink)<br><br>❌ Published static IPs | Private connectivity for Serverless projects is currently supported in AWS regions only.<br><br>For Observability projects, requires [Observability Complete](/solutions/observability/observability-serverless-feature-tiers.md).<br><br>For Security projects, requires [Security Analytics Complete](/solutions/security/security-serverless-feature-tiers.md).<br><br>{{serverless-short}} does not offer public static IP lists. Use private connectivity where supported. | | ||
| | **Network security** | ✅ [IP filtering](/deploy-manage/security/ip-filtering-cloud.md)<br><br>✅ [Private connectivity](/deploy-manage/security/private-connectivity.md) (VPCs, PrivateLink)<br><br>✅ [Published static IPs](/deploy-manage/security/elastic-cloud-static-ips.md) | ✅ [IP filtering](/deploy-manage/security/ip-filtering-cloud.md)<br><br>✅ [Private connectivity](/deploy-manage/security/private-connectivity.md) (VPCs, PrivateLink)<br><br>❌ Published static IPs | Private connectivity for Serverless projects is currently supported in AWS and Azure regions only.<br><br>For Observability projects, requires [Observability Complete](/solutions/observability/observability-serverless-feature-tiers.md).<br><br>For Security projects, requires [Security Analytics Complete](/solutions/security/security-serverless-feature-tiers.md).<br><br>{{serverless-short}} does not offer public static IP lists. Use private connectivity where supported. | |
There was a problem hiding this comment.
The notes column says "public static IP lists" but the ECH and serverless columns say "published static IPs". Are these the same thing? If they are, we should use the same terminology
|
|
||
| ## API reference | ||
|
|
||
| To learn more about these endpoints, refer to the reference for your deployment type: |
There was a problem hiding this comment.
| To learn more about these endpoints, refer to the reference for your deployment type: | |
| Learn more about these endpoints in the reference for your deployment type: |
Just to avoid "refer to the reference" ;)
| @@ -403,6 +464,9 @@ | |||
|
|
|||
| 1. To learn how to find the value for `azure_endpoint_name` and `azure_endpoint_guid` for type `azure_private_endpoint`, refer to [Find your private endpoint resource name](private-connectivity-azure.md#ec-find-your-resource-name) and [Find your private endpoint resource ID](private-connectivity-azure.md#ec-find-your-resource-id). This setting is supported only in Azure regions. | |||
There was a problem hiding this comment.
| 1. To learn how to find the value for `azure_endpoint_name` and `azure_endpoint_guid` for type `azure_private_endpoint`, refer to [Find your private endpoint resource name](private-connectivity-azure.md#ec-find-your-resource-name) and [Find your private endpoint resource ID](private-connectivity-azure.md#ec-find-your-resource-id). This setting is supported only in Azure regions. | |
| 1. To learn how to find the values for `azure_endpoint_name` and `azure_endpoint_guid` for type `azure_private_endpoint`, refer to [Find your private endpoint resource name](private-connectivity-azure.md#ec-find-your-resource-name) and [Find your private endpoint resource ID](private-connectivity-azure.md#ec-find-your-resource-id). This setting is supported only in Azure regions. |
| ' | ||
| ``` | ||
|
|
||
| 1. To find the value for `source` for type `gcp_private_service_connect_endpoint`, check [Find your Private Service Connect connection ID](private-connectivity-gcp.md#ec-find-your-psc-connection-id). This setting is supported only in GCP regions. |
There was a problem hiding this comment.
| 1. To learn how to find the value for `source` for type `gcp_private_service_connect_endpoint`, refer to [Find your Private Service Connect connection ID](private-connectivity-gcp.md#ec-find-your-psc-connection-id). This setting is supported only in GCP regions. |
for consistency with the others
| Follow the [Azure instructions](https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal#create-a-private-endpoint) for details on creating a private endpoint to an endpoint service. | ||
|
|
||
| Use [the service aliases for your region](#ec-private-link-azure-service-aliases). Select the **Connect to an Azure resource by resource ID or alias** option. For example for the region `eastus2` the service alias is `eastus2-prod-002-privatelink-service.64359fdd-7893-4215-9929-ece3287e1371.eastus2.azure.privatelinkservice` | ||
| Use [the service aliases for your region](#ec-private-link-azure-service-aliases). Select the **Connect to an Azure resource by resource ID or alias** option. For example, for resources in `eastus2`: |
There was a problem hiding this comment.
| Use [the service aliases for your region](#ec-private-link-azure-service-aliases). Select the **Connect to an Azure resource by resource ID or alias** option. For example, for resources in `eastus2`: | |
| Use [the service aliases for your region](#ec-private-link-azure-service-aliases). Select the **Connect to an Azure resource by resource ID or alias** option. | |
| For example, for resources in `eastus2`: |
| } | ||
| ``` | ||
|
|
||
| The connection is established, and a valid certificate is presented to the client. Elastic responds, in the case of the {{es}} endpoint, with basic information about the cluster. |
There was a problem hiding this comment.
| The connection is established, and a valid certificate is presented to the client. Elastic responds, in the case of the {{es}} endpoint, with basic information about the cluster. | |
| The connection is established, and a valid certificate is presented to the client. In the case of the {{es}} endpoint, Elastic responds with basic information about the cluster. |
| 1. Set up Private Link Endpoint in region 1 for a deployment or project hosted in region 2. | ||
|
|
||
| 1. Create your Private Link Endpoint using the service alias for region 2 in the region 1 VNet (let’s call this VNet1). | ||
| 2. Create a Private Hosted Zone for region 2, and associate it with VNet1 similar to the step [Create a Private Link endpoint and DNS](#ec-private-link-azure-dns). Note that you are creating these resources in region 1, VNet1. |
There was a problem hiding this comment.
| 2. Create a Private Hosted Zone for region 2, and associate it with VNet1 similar to the step [Create a Private Link endpoint and DNS](#ec-private-link-azure-dns). Note that you are creating these resources in region 1, VNet1. | |
| 2. Create a Private Hosted Zone for region 2, and associate it with VNet1 similar to the [Create a Private Link endpoint and DNS](#ec-private-link-azure-dns) step. Note that you are creating these resources in region 1, VNet1. |
| ::: | ||
|
|
||
| ### Remove a private connection policy from your deployment [remove-private-connection-policy] | ||
| ### Remove a private connection policy from your deployment or project [remove-private-connection-policy] |
There was a problem hiding this comment.
| ### Remove a private connection policy from your deployment or project [remove-private-connection-policy] | |
| ### Remove a private connection policy [remove-private-connection-policy] |
Feels a bit repetitive + this way it's consistent with the other headings
| ### Delete a private connection policy [delete-private-connection-policy] | ||
|
|
||
| If you need to remove a policy, you must first remove any associations with deployments. | ||
| If you need to remove a policy, you must first remove any associations with deployments or projects. |
There was a problem hiding this comment.
| If you need to remove a policy, you must first remove any associations with deployments or projects. | |
| If you need to delete a policy, you must first remove any associations with deployments or projects. |
Maybe? "remove" is confusing because of the previous section
There was a problem hiding this comment.
Reading this makes me think this section will explain how to remove the associations. Is that different from deleting?
Summary
northeuropegap)ecloud-securitysnippet)cluster-communication-networksnippet)cluster-comparisonsnippet)Todo
Generative AI disclosure