We want to use the key vault extension to handle getting new certs onto our batch nodes. I was wondering if what's the preferred way to install Azure VM extensions onto azure batch nodes since the machines don't appear as regular VMs in the azure portal or cli that we can interact with. It seems using the key vault extension seems like the best way to update certificates on a machine? We are currently using an base image for the batch nodes but I read that it's a bad practice to have extensions pre-installed on base images? What's the best way to go about this?
Thanks!