An Azure Compute Gallery helps you build structure and organization around your Azure resources, like images and applications. An Azure Compute Gallery provides:
Global replication.1
Versioning and grouping of resources for easier management.
Highly available resources with Zone Redundant Storage (ZRS) accounts in regions that support Availability Zones. ZRS offers better resilience against zonal failures.
Premium storage support (Premium_LRS).
Sharing to the community, across subscriptions, and between Active Directory (AD) tenants.
Scaling your deployments with resource replicas in each region.
With a gallery, you can share your resources with everyone or limit sharing to different users, service principals, or AD groups within your organization. Resources can be replicated to multiple regions for quicker scaling of your deployments.
1 The Azure Compute Gallery service is not a global resource. For disaster recovery scenarios, it is a best practice to have at least two galleries in different regions.
Store an Image in Azure Compute Gallery
An image is a copy of either a full VM (including any attached data disks) or just the OS disk, depending on how it is created. When you create a VM from the image, a copy of the VHDs in the image is used to create the disks for the new VM. The image remains in storage and can be used over and over again to create new VMs.
If you have a large number of images that you need to maintain and would like to make them available throughout your company, you can use an Azure Compute Gallery as a repository.
When you use a gallery to store images, multiple resource types are created:
Resource | Description |
Image source | This is a resource that can be used to create an image version in a gallery. An image source can be an existing Azure VM that is either generalized or specialized, a managed image, a snapshot, a VHD or an image version in another gallery. |
Gallery | Like the Azure Marketplace, a gallery is a repository for managing and sharing images and other resources, but you control who has access. |
Image definition | Image definitions are created within a gallery, and they carry information about the image and any requirements for using it to create VMs. This includes whether the image is Windows or Linux, release notes, and minimum and maximum memory requirements. It is a definition of a type of image. |
Image Version | An image version is what you use to create a VM when using a gallery. You can have multiple versions of an image as needed for your environment. Like a managed image, when you use an image version to create a VM, the image version is used to create new disks for the VM. Image versions can be used multiple times. |
VM Apps
While you can create an image of a VM with apps pre-installed, you would need to update your image each time you have application changes. Separating your application installation from your VM images means there’s no need to publish a new image for every line of code change.
Regional Support
All public regions can be target regions, but certain regions require that customers go through a request process in order to gain access. To request that a subscription be added to the allowed list for a region such as Australia Central or Australia Central 2, submit an access request.
Limits
There are limits per subscription for deploying resources using Azure Compute Galleries:
100 galleries, per subscription, per region
1,000 image definitions, per subscription, per region
10,000 image versions per subscription per region
100 image version replicas per subscription per region. However, 50 replicas should be sufficient for most use cases
Any disk attached to the image must be less than or equal to 1TB in size
Scaling
Azure Compute Gallery allows you to specify the number of replicas you want to keep. This helps in multi-VM deployment scenarios as the VM deployments can be spread to different replicas, reducing the chance of instance creation processing being throttled due to overloading a single replica.
With Azure Compute Gallery, you can deploy up to 1,000 VM instances in a virtual machine scale set. You can set a different replica count in each target region based on the region's scale needs. Since each replica is a copy of your resource, this helps scale your deployments linearly with each extra replica. While we understand no two resources or regions are the same, here's our general guideline on how to use replicas in a region:
· For every 20 VMs that you create concurrently, we recommend you keep one replica. For example, if you are creating 120 VMs concurrently using the same image in a region, we suggest you keep at least 6 replicas of your image.
· For each scale set you create concurrently, we recommend you keep one replica.
We always recommend that to over-provision the number of replicas due to factors like resource size, content and OS type.
High Availability
Azure Zone Redundant Storage (ZRS) provides resilience against an Availability Zone failure in the region. With the general availability of Azure Compute Gallery, you can choose to store your images in ZRS accounts in regions with Availability Zones.
You can also choose the account type for each of the target regions. The default storage account type is Standard_LRS, but you can choose Standard_ZRS for regions with Availability Zones. For more information on the regional availability of ZRS, see Data Redundancy.
Replication
Azure Compute Gallery also allows you to replicate your resources to other Azure regions automatically. Each image version can be replicated in different regions depending on what makes sense for your organization. One example is to always replicate the latest image in multi-regions while all older image versions are only available in 1 region. This can help save on storage costs.
The regions that a resource is replicated to can be updated after creation time. The time it takes to replicate to different regions depends on the amount of data being copied and the number of regions the version is replicated to. This can take a few hours in some cases. While the replication is happening, you can view the status of replication per region. Once the image replication is complete in a region, you can then deploy a VM or scale-set using that resource in the region.
Sharing
There are three main ways to share images in an Azure Compute Gallery, depending on who you want to share with:
Share with: | Option |
Role-based access control (RBAC) lets you share resources with specific people, groups, or service principals on a granular level. | |
Direct shared gallery (preview) lets you share with everyone in a subscription or tenant. | |
The community gallery (preview) lets you share your entire gallery publicly with all Azure users. |
RBAC
As the Azure Compute Gallery, definition, and version are all resources, they can be shared using the built-in native Azure Role-based Access Control (RBAC) roles. Using Azure RBAC roles, you can share these resources to other users, service principals, and groups. You can even share access to individuals outside of the tenant they were created within. Once a user has access to the resource version, they can use it to deploy a VM or a Virtual Machine Scale Set. Here is the sharing matrix that helps understand what the user gets access to:
Shared with User | Azure Compute Gallery | Image Definition | Image Version |
Azure Compute Gallery | Yes | Yes | Yes |
Image Definition | No | Yes | Yes |
We recommend sharing at the Gallery level for the best experience. We do not recommend sharing individual image versions. For more information about Azure RBAC
Shared directly to a tenant or subscription
Give specific subscriptions or tenants access to a direct shared Azure Compute Gallery. Sharing a gallery with tenants and subscriptions gives them read-only access to your gallery.
Limitations
During the preview
You can only share subscriptions that are also in the preview.
You can only share 30 subscriptions and 5 tenants.
A direct shared gallery cannot contain encrypted image versions. Encrypted images cannot be created within a gallery that is directly shared.
Only the owner of a subscription or a user or service principal assigned to the Compute Gallery Sharing Admin role at the subscription or gallery level can enable group-based sharing.
You need to create a new gallery with the property sharingProfile.permissions set to Groups. When using the CLI to create a gallery, use the --permissions groups parameter. You can't use an existing gallery; the property can't currently be updated.
Billing
There is no extra charge for using the Azure Compute Gallery service. You will be charged for the following resources:
Storage costs of storing each replica. For images, the storage cost is charged as a snapshot and is based on the occupied size of the image version, the number of replicas of the image version and the number of regions the version is replicated to.
Network egress charges for replication of the first resource version from the source region to the replicated regions. Subsequent replicas are handled within the region, so there are no additional charges.
Comments