Back to Details

azure-confidential-computing

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Azure Confidential Computing Skill

Azure Confidential Computing 技能

This skill provides expert guidance for Azure Confidential Computing. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.
本技能为Azure Confidential Computing提供专业指导，涵盖故障排除、最佳实践、决策制定、架构与设计模式、限制与配额、安全性、配置、集成与编码模式以及部署。它结合了本地快速参考内容和远程文档获取功能。

How to Use This Skill

如何使用本技能

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., 
L35-L120
), use 
read_file
with the specified lines. For categories with file links (e.g., 
[security.md](security.md)
), use 
read_file
on the linked reference file
IMPORTANT for Agent: If 
metadata.generated_at
is more than 3 months old, suggest the user pull the latest version from the repository. If 
mcp_microsoftdocs
tools are not available, suggest the user install it: Installation Guide
This skill requires network access to fetch documentation content:
  • Preferred: Use 
    mcp_microsoftdocs:microsoft_docs_fetch
    with query string 
    from=learn-agent-skill
    . Returns Markdown.
  • Fallback: Use 
    fetch_webpage
    with query string 
    from=learn-agent-skill&accept=text/markdown
    . Returns Markdown.
Agent注意事项：使用下方的分类索引定位相关章节。对于带有行范围的分类（例如
L35-L120
），使用
read_file
读取指定行内容。对于带有文件链接的分类（例如
[security.md](security.md)
），使用
read_file
读取链接的参考文件
Agent注意事项：如果
metadata.generated_at
已超过3个月，建议用户从仓库拉取最新版本。如果
mcp_microsoftdocs
工具不可用，建议用户安装该工具：安装指南
本技能需要网络访问权限以获取文档内容：
  • 推荐方式：使用
    mcp_microsoftdocs:microsoft_docs_fetch
    ，查询字符串为
    from=learn-agent-skill
    ，返回Markdown格式内容。
  • 备用方式：使用
    fetch_webpage
    ，查询字符串为
    from=learn-agent-skill&accept=text/markdown
    ，返回Markdown格式内容。

Category Index

分类索引

CategoryLinesDescription
TroubleshootingL37-L41Troubleshooting AKS confidential node issues: common errors, limitations, configuration and deployment problems, and FAQs about setup, security, and workload compatibility.
Best PracticesL42-L46FAQ and guidance on using Azure confidential VMs: supported scenarios, security guarantees, limitations, performance, pricing, and operational best practices.
Decision MakingL47-L59Guidance on choosing Azure confidential computing options: VMs (AMD/Intel), containers, GPUs, deployment models, capabilities, products, and use cases for secure workloads.
Architecture & Design PatternsL60-L69Architectural patterns and design guidance for using Azure confidential VMs, SGX enclaves, AKS, and multi-party analytics to build secure AI and containerized workloads.
Limits & QuotasL70-L74Guidance on choosing sizes, quotas, and deployment limits for Intel SGX-enabled VMs in Azure, including capacity planning and scaling considerations.
SecurityL75-L90Attestation, vTPM, key/secrets handling, and hardening guidance to securely run and monitor Azure confidential VMs, SGX enclaves, AKS confidential containers, and clean rooms.
ConfigurationL91-L100Configuring Azure confidential VMs and AKS: SGX/device plugins, confidential containers, VMMD/metablob settings, secure key release policies, and rotating customer-managed encryption keys.
Integrations & Coding PatternsL101-L111Coding patterns and samples for building, running, and attesting Intel SGX/AMD SEV-SNP confidential apps and containers, including SKR flows, tools, and Fortanix/Key Vault integrations.
DeploymentL112-L122How to deploy and migrate Azure confidential VMs/VMSS and AKS (SGX and confidential node pools), create custom images, and set up Fortanix CCM using CLI and ARM templates.
分类行范围描述
故障排除L37-L41排查AKS机密节点问题：常见错误、限制、配置与部署问题，以及关于设置、安全性和工作负载兼容性的常见问题。
最佳实践L42-L46Azure机密虚拟机的常见问题与使用指南：支持的场景、安全保障、限制、性能、定价和运维最佳实践。
决策制定L47-L59选择Azure机密计算选项的指导：虚拟机（AMD/Intel）、容器、GPU、部署模型、功能、产品以及安全工作负载的用例。
架构与设计模式L60-L69使用Azure机密虚拟机、SGX隔离区、AKS和多方分析构建安全AI与容器化工作负载的架构模式与设计指导。
限制与配额L70-L74Azure中Intel SGX启用型虚拟机的规格选择、配额与部署限制指导，包括容量规划和扩展注意事项。
安全性L75-L90证明、vTPM、密钥/机密处理以及加固指导，以安全运行和监控Azure机密虚拟机、SGX隔离区、AKS机密容器和洁净室。
配置L91-L100配置Azure机密虚拟机和AKS：SGX/设备插件、机密容器、VMMD/元数据Blob设置、安全密钥发布策略以及轮换客户管理的加密密钥。
集成与编码模式L101-L111构建、运行和证明Intel SGX/AMD SEV-SNP机密应用与容器的编码模式和示例，包括SKR流程、工具以及Fortanix/Key Vault集成。
部署L112-L122如何部署和迁移Azure机密虚拟机/虚拟机规模集以及AKS（SGX和机密节点池）、创建自定义镜像，以及使用CLI和ARM模板设置Fortanix CCM。

Troubleshooting

故障排除

TopicURL
FAQ for AKS confidential computing nodeshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-faq
主题URL
AKS机密计算节点常见问题https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-faq

Best Practices

最佳实践

TopicURL
Azure confidential VM FAQ and usage guidancehttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-faq
主题URL
Azure机密虚拟机常见问题与使用指导https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-faq

Decision Making

决策制定

TopicURL
Select Azure confidential container offeringshttps://learn.microsoft.com/en-us/azure/confidential-computing/choose-confidential-containers-offerings
Choose Azure confidential computing deployment modelshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-deployment-models
Understand Azure confidential container optionshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers
Overview of confidential containers on Azurehttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers
Understand and choose Azure confidential VM capabilitieshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview
Use Azure confidential GPUs for secure compute offloadhttps://learn.microsoft.com/en-us/azure/confidential-computing/gpu-options
Select Azure confidential computing productshttps://learn.microsoft.com/en-us/azure/confidential-computing/overview-azure-products
Choose Azure confidential computing use caseshttps://learn.microsoft.com/en-us/azure/confidential-computing/use-cases-scenarios
Select Azure confidential VM options on AMD or Intelhttps://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-options
主题URL
选择Azure机密容器产品https://learn.microsoft.com/en-us/azure/confidential-computing/choose-confidential-containers-offerings
选择Azure机密计算部署模型https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-deployment-models
了解Azure机密容器选项https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers
Azure机密容器概述https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers
了解并选择Azure机密虚拟机功能https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview
使用Azure机密GPU进行安全计算卸载https://learn.microsoft.com/en-us/azure/confidential-computing/gpu-options
选择Azure机密计算产品https://learn.microsoft.com/en-us/azure/confidential-computing/overview-azure-products
选择Azure机密计算用例https://learn.microsoft.com/en-us/azure/confidential-computing/use-cases-scenarios
选择AMD或Intel的Azure机密虚拟机选项https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-options

Architecture & Design Patterns

架构与设计模式

TopicURL
Apply confidential computing to AI workloads on Azurehttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-ai
Design solutions with Azure confidential computing optionshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-solutions
Use SGX enclave nodes in AKS workloadshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview
Design enclave-aware container applications on AKShttps://learn.microsoft.com/en-us/azure/confidential-computing/enclave-aware-containers
Understand Azure confidential VM guest attestation designhttps://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-confidential-virtual-machines-design
Architect multi-party analytics on Azure confidential computinghttps://learn.microsoft.com/en-us/azure/confidential-computing/multi-party-data
主题URL
在Azure上将机密计算应用于AI工作负载https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-ai
使用Azure机密计算选项设计解决方案https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-solutions
在AKS工作负载中使用SGX隔离区节点https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview
在AKS上设计感知隔离区的容器应用https://learn.microsoft.com/en-us/azure/confidential-computing/enclave-aware-containers
了解Azure机密虚拟机客户证明设计https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-confidential-virtual-machines-design
在Azure机密计算上构建多方分析架构https://learn.microsoft.com/en-us/azure/confidential-computing/multi-party-data

Limits & Quotas

限制与配额

TopicURL
Deploy and size Intel SGX VMs on Azurehttps://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-solutions-sgx
主题URL
在Azure上部署和规划Intel SGX虚拟机规格https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-solutions-sgx

Security

安全性

TopicURL
Configure attestation for Azure SGX enclaveshttps://learn.microsoft.com/en-us/azure/confidential-computing/attestation
Use attestation types for Azure confidential workloadshttps://learn.microsoft.com/en-us/azure/confidential-computing/attestation-solutions
Use Secure Key Release with Azure Key Vault and confidential computinghttps://learn.microsoft.com/en-us/azure/confidential-computing/concept-skr-attestation
Use Azure Confidential Clean Rooms for secure collaborationhttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-clean-rooms
Security model for AKS Confidential Containershttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-aks-security-policy
Configure guest attestation for Azure confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-confidential-vms
Secure confidential VMs with Defender for Cloud and guest attestationhttps://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-defender-for-cloud
Harden Linux images by removing Azure guest agenthttps://learn.microsoft.com/en-us/azure/confidential-computing/harden-a-linux-image-to-remove-azure-guest-agent
Harden Linux images by removing sudo users for confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/harden-the-linux-image-to-remove-sudo-users
Leverage vTPM features in Linux confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/how-to-leverage-virtual-tpms-in-azure-confidential-vms
Manage secrets and keys in Azure confidential computinghttps://learn.microsoft.com/en-us/azure/confidential-computing/secret-key-management
Use virtual TPMs in Azure confidential VMs securelyhttps://learn.microsoft.com/en-us/azure/confidential-computing/virtual-tpms-in-azure-confidential-vm
主题URL
为Azure SGX隔离区配置证明https://learn.microsoft.com/en-us/azure/confidential-computing/attestation
为Azure机密工作负载使用证明类型https://learn.microsoft.com/en-us/azure/confidential-computing/attestation-solutions
将安全密钥发布与Azure Key Vault和机密计算结合使用https://learn.microsoft.com/en-us/azure/confidential-computing/concept-skr-attestation
使用Azure机密洁净室进行安全协作https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-clean-rooms
AKS机密容器安全模型https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-aks-security-policy
为Azure机密虚拟机配置客户证明https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-confidential-vms
使用云 Defender和客户证明保护机密虚拟机https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-defender-for-cloud
通过移除Azure客户代理加固Linux镜像https://learn.microsoft.com/en-us/azure/confidential-computing/harden-a-linux-image-to-remove-azure-guest-agent
通过移除sudo用户加固机密虚拟机的Linux镜像https://learn.microsoft.com/en-us/azure/confidential-computing/harden-the-linux-image-to-remove-sudo-users
在Linux机密虚拟机中利用vTPM功能https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-leverage-virtual-tpms-in-azure-confidential-vms
在Azure机密计算中管理机密和密钥https://learn.microsoft.com/en-us/azure/confidential-computing/secret-key-management
在Azure机密虚拟机中安全使用虚拟TPMhttps://learn.microsoft.com/en-us/azure/confidential-computing/virtual-tpms-in-azure-confidential-vm

Configuration

配置

TopicURL
Configure Confidential Containers on AKS (preview)https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview
Configure AKS Intel SGX device plugin (confcom)https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-addon
Configure opt-out of VMMD blob for Azure Confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/disable-confidential-vm-metadata-blob
Rotate customer-managed keys for Azure confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/key-rotation-offline
Author Secure Key Release policies for Azure confidential TEEshttps://learn.microsoft.com/en-us/azure/confidential-computing/skr-policy-examples
Use Virtual Machine Metablob Disk with confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-metablob-disk
主题URL
在AKS上配置机密容器（预览版）https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview
配置AKS Intel SGX设备插件（confcom）https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-addon
配置Azure机密虚拟机的VMMD Blob退出选项https://learn.microsoft.com/en-us/azure/confidential-computing/disable-confidential-vm-metadata-blob
轮换Azure机密虚拟机的客户管理密钥https://learn.microsoft.com/en-us/azure/confidential-computing/key-rotation-offline
为Azure机密TEE编写安全密钥发布策略https://learn.microsoft.com/en-us/azure/confidential-computing/skr-policy-examples
将虚拟机元数据Blob磁盘与机密虚拟机结合使用https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-metablob-disk

Integrations & Coding Patterns

集成与编码模式

TopicURL
Use development tools for Intel SGX enclaves on Azurehttps://learn.microsoft.com/en-us/azure/confidential-computing/application-development
Run confidential containers with Intel SGX enclaveshttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-enclaves
Build Intel SGX enclave apps with OSS toolshttps://learn.microsoft.com/en-us/azure/confidential-computing/enclave-development-oss
Use guest attestation sample app with confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-example
Run apps with Fortanix CCM and Node Agenthttps://learn.microsoft.com/en-us/azure/confidential-computing/how-to-fortanix-confidential-computing-manager-node-agent
Implement SKR with confidential containers on Azure Container Instanceshttps://learn.microsoft.com/en-us/azure/confidential-computing/skr-flow-confidential-containers-azure-container-instance
Implement SKR from Key Vault to AMD SEV-SNP confidential VMshttps://learn.microsoft.com/en-us/azure/confidential-computing/skr-flow-confidential-vm-sev-snp
主题URL
在Azure上使用Intel SGX隔离区开发工具https://learn.microsoft.com/en-us/azure/confidential-computing/application-development
运行带有Intel SGX隔离区的机密容器https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-enclaves
使用OSS工具构建Intel SGX隔离区应用https://learn.microsoft.com/en-us/azure/confidential-computing/enclave-development-oss
将客户证明示例应用与机密虚拟机结合使用https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-example
运行带有Fortanix CCM和节点代理的应用https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-fortanix-confidential-computing-manager-node-agent
在Azure容器实例上为机密容器实现SKRhttps://learn.microsoft.com/en-us/azure/confidential-computing/skr-flow-confidential-containers-azure-container-instance
从Key Vault向AMD SEV-SNP机密虚拟机实现SKRhttps://learn.microsoft.com/en-us/azure/confidential-computing/skr-flow-confidential-vm-sev-snp

Deployment

部署

TopicURL
Deploy AKS cluster with SGX enclave nodes via CLIhttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-enclave-nodes-aks-get-started
Use confidential VM node pools in AKShttps://learn.microsoft.com/en-us/azure/confidential-computing/confidential-node-pool-aks
Create custom images for Azure confidential VMs with CLIhttps://learn.microsoft.com/en-us/azure/confidential-computing/how-to-create-custom-image-confidential-vm
Deploy Fortanix CCM as Azure managed apphttps://learn.microsoft.com/en-us/azure/confidential-computing/how-to-fortanix-confidential-computing-manager
Migrate nested Azure confidential VMs across regionshttps://learn.microsoft.com/en-us/azure/confidential-computing/migrate-nested-confidential-vms
Deploy Azure confidential VMs with ARM templateshttps://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-arm
Deploy Azure confidential VMs using Azure CLIhttps://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-azure-cli
Deploy VM scale sets with hardened Linux imageshttps://learn.microsoft.com/en-us/azure/confidential-computing/vmss-deployment-from-hardened-linux-image
主题URL
通过CLI部署带有SGX隔离区节点的AKS集群https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-enclave-nodes-aks-get-started
在AKS中使用机密虚拟机节点池https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-node-pool-aks
通过CLI为Azure机密虚拟机创建自定义镜像https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-create-custom-image-confidential-vm
将Fortanix CCM部署为Azure托管应用https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-fortanix-confidential-computing-manager
跨区域迁移嵌套Azure机密虚拟机https://learn.microsoft.com/en-us/azure/confidential-computing/migrate-nested-confidential-vms
使用ARM模板部署Azure机密虚拟机https://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-arm
使用Azure CLI部署Azure机密虚拟机https://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-azure-cli
使用加固的Linux镜像部署虚拟机规模集https://learn.microsoft.com/en-us/azure/confidential-computing/vmss-deployment-from-hardened-linux-image