Aspiring Architect

Top 15 Docker Runtime Issues - Reproduce - Resolve

2026-06-08T20:37:46.197-07:00

In this post we will go through top 15 runtime issues you might face in managing docker containers. Re-create those issues on your docker environment , debug step by step and resolve them.

For this i have created a Github repo which got a docker-compose file which will re-create the issue and a README file which will describe what exactly the issue we created, and step by step guide to debug the issue, and how to fix it. We got 15 folders one for each runtime issue.

Github Repo : https://github.com/pratappilaka24/Top-15-Docker-Runtime-Issues

Below are the Runtime issues we will be looking at.

OOM (Out-of-Memory) Killer
CPU Throttling
Disk IO Exhaustion
DNS Resolution Failure
Volume Permission Denied
Port Binding Conflicts
Health Check & Restart Loops
Docker Socket Exposure
Zombie Processes
Container Logs Exhaustion
Network MTU Mismatch
Environment Variable Secret Leakage
Timezone Mismatch Inside Containers
Open File Limit Exhaustion
SELinux Blocking Container Operations

I have a RHEL 10 vm which i am using as host and mounted the shared drive with all the samples on it.

Lets start recreating the runstime issues one by one.

01. OOM (Out-of-Memory) Killer — Container Killed by Kernel

The Linux OOM (Out-of-Memory) Killer terminates processes (or containers) when the system or cgroup memory limit is exhausted. In production, this manifests as containers suddenly disappearing with exit code **137** (SIGKILL). This is one of the most common and impactful production incidents.

Reproduce by navigating to the said folder and run "Docker-compose up".

You can see that container momory gradually allocated for a single data operation. Finally killing the container due to 137 exit code whch is famously known as OOM Killer.

Resolution: Implemnt memory soft limit on the container thus always limiting the memory use of operatons within the container. Please reffer to README file for best parctices and more ways to handle the issue.

02. CPU Throttling — Container Starved of CPU Causing Latency Spikes

CPU throttling occurs when a container's CPU usage exceeds its assigned quota (set via `cpus` or `cpu_period`/`cpu_quota`). The Linux CFS (Completely Fair Scheduler) throttles the container, causing tasks to queue up. In production this appears as **sudden latency spikes**, **slow API responses**, or **timeouts** even when the host has plenty of idle CPU

We have implemnted a good and bad containers with CPU limits being too constarint on bad one. You can literally see difference in the latency for a batch operation in both.

you see theone with out bounds on CPU responded in 6 milli seconds, the one on bounds responded in 98 milli seconds.

Resolution: Its good to set bounds , only by understanding the optimum value for it. Please reffer to README file for best parctices and more ways to handle the issue.

03. Disk I/O Exhaustion — Container Saturating Storage

A container performing unbounded disk writes (log flooding, bulk data processing, database dumps) can saturate the storage subsystem, causing I/O wait to spike across the entire host. Other containers and host processes become slow or unresponsive. This is a classic "noisy neighbor" problem in shared production environments.

You can see the I/O spike causing the response time spiking in io_hog container goint up to 1.31 seconds while normal continer being 10 milli seconds.

Resolution: Setup bulkIO mimits while defining the container, so that the spike doesnt impact guest or host responsiveness. Please reffer to README file for best parctices and more ways to handle the issue.

04. DNS Resolution Failure Inside Containers

Containers fail to resolve hostnames — either external domains (e.g., `google.com`) or internal service names (e.g., `db`, `redis`). This causes connection errors, timeouts, and application failures. Common causes include: wrong DNS server configured, `/etc/resolv.conf` issues, broken Docker network DNS, SELinux/firewall blocking DNS traffic, or systemd-resolved conflicts.

DNS settings arew rongly set in resolv.conf.

Issue 1: Ext servers are configured to 192.0.2.1 whch is a fake TEST-NET address in broken container, while it was set to 8.8.8.8 which is google.com in working one.

Issue 2: search is configured to internal.example.com on broken container. This would have worked if we have local domain setup with that name. But its not the case here, so it doesnt work and i cannot reach any other apps like DB, deployed on this container. The DNS is corrcet on working container so it can reach google.com or the localy deployed DB instance successfully.

05. Volume Permission Denied — Container Cannot Write to Mounted Volume

Containers fail with `Permission denied` when accessing bind-mounted directories. On RHEL 10, this is almost always caused by:

1. **SELinux label mismatch** — host directory has wrong security context

2. **UID/GID mismatch** — container process user doesn't match host directory owner

3. **Host directory permissions** — too restrictive (e.g., mode 700)

Step1: creating necessary mount points on host.

but remeber that we are creating the mount points as root and nginx-data-nolabel has both r-x permissions for user and app-data-root has all access to only root.

Now run "docker compose up -d" and check the logs.

We hosted the containers app-uid-mismatch and app-correct with UID 1001, where as the mounts has only no write permissions for user. Thus both of them get PERMISSION DENIED error while writing the files.

Resolution: Correct the mermissions for the mount points , use 644 instead of 755 and 700 for the mount points. Also make sure you dint mount those on caontainer with :ro (read-only) access. Its a best practice to mount the volumes with :z for shared mounts and :Zif you want to isolate the volumes for just one container. Please reffer to README file for best parctices and more ways to handle the issue.

06. Port Binding Conflicts — Container Fails to Start (Address Already in Use)

A container fails to start because another process or container is already listening on the same host port. This produces the error: `bind: address already in use`. Extremely common in production when deploying multiple versions, after a failed deploy leaves a zombie container, or when system services use the same port.

Run "docker compose up -d" and you see below error.

Instance 2 failed to start because the host port is already used for one of the other instance.

Resolution: Make sure you use seperate host ports in docker container definitions. Please reffer to README file for best parctices and more ways to handle the issue.

07. Health Check Failures & Container Restart Loops

Containers enter a restart loop when health checks consistently fail. This can happen due to: incorrect health check commands, endpoints not responding, insufficient `start_period` for slow-starting apps, or actual application failures. Restart loops waste resources, generate noise in logs, and can cascade into broader failures.

Run "docker compose up", you see

We intentionally made the unhealthy_app contianer send a fault 8 out of 10 chances, thus causing the faulty health check. Slow_app will start after a delay of 30 seconds, but the health check is set to start after 5 seconds, thus following health checks will mark it as unhealthy, eventhogh the conatiner is healthy.

see, the health check was coming bac with 200 for slow_start_app, but the health check meanwhile marked as unhealthy.

Resolution: Choose the start period and intervals appropriately , so that your health checks kick-in before the container is ready to serve. Please reffer to README file for best parctices and more ways to handle the issue.

08. Docker Socket Exposure — Critical Container Security Vulnerability

Mounting `/var/run/docker.sock` into a container gives that container **full, unrestricted root-level access to the host**. Any process in the container can start new containers, mount host directories, execute commands as root on the host, and escape the container entirely. This is one of the most severe container security misconfigurations in production.

move to 08 folder and run "docker compose up -d"

and then follow the comands as shown below.

From socker_exposed_app container, guest has un restricted access to host root namespace. Guest can check other containers, mount volumes at thier will and can perform any malacious actions.

Resolution: Be very cautious of socket exposure. Altenratively use dind_alternative runs " docker inside a docker " image where an privelaged guest container cannot see host containers and environment.

Please reffer to README file for best parctices and more ways to handle the issue.

10. Log Flooding — Container Logs Exhausting Host Disk Space

By default, Docker stores container logs in JSON files at `/var/lib/docker/containers/<id>/<id>-json.log` with **no size limit**. A single verbose container can fill the entire host disk, causing all containers to fail, the host to become unresponsive, and data corruption. This is a silent killer in production — systems run fine for weeks then suddenly all fail simultaneously.

cd 10 folder, run "docker compose up -d log-flooder", wait for 2 mins and then run "docker exec log_flooder df -h /var" command.

you will see already 41% of space is flooded with logs, if we dint stop it in time, it will fully flood /var/ and that will create issues like user cannot login, nor sudo.

Resolution: Setup log-rotation options in the container definition. Please reffer to README file for best parctices and more ways to handle the issue.

12. Environment Variable Secret Leakage

Storing secrets (passwords, API keys, tokens) in environment variables is a **critical security anti-pattern**. Secrets in env vars are exposed via:

- `docker inspect` — any user with Docker socket access can read them

- `/proc/<pid>/environ` — readable by root and container processes

- Docker Hub/registry if baked into images via `Dockerfile ENV`

- Log files if accidentally printed to stdout

- CI/CD system logs if echoed during debugging

cd 12 folder, run below commands as shown

you can see the secret values like passwords are visible in clear text when you used insecure way of storing the secrets in the container definition.

Resolution: you can use a seperate secrets file and not make it part of container definition, thus the secrets wont be visible in docker inspect.

Please try the rest of scenarios and follow the README file for the steps to debug and remediate the issues by yourself.

Github Repo : https://github.com/pratappilaka24/Top-15-Docker-Runtime-Issues

Azure Disk Encryption Is Retiring in 2028 — Everything You Need to Know

2026-05-11T03:06:00.000-07:00

The Big Picture

Azure gives you five overlapping ways to encrypt VM disk data. They sound similar, use some of the same terminology, and the Azure portal mixes them all together in the "Encryption" blade — which makes choosing correctly genuinely confusing. Then in late 2025, Microsoft announced that one of the most commonly used options — Azure Disk Encryption (ADE) — is being retired. If you have ADE-encrypted VMs and you do nothing before September 15, 2028, your disks will fail to unlock after any reboot.

Retirement alert: Azure Disk Encryption After September 15, 2028, ADE-enabled workloads will continue to run — but encrypted disks will fail to unlock after VM reboots, causing service disruption. All ADE-enabled VMs (including backups) must migrate before this date. There is no in-place migration path; you must rebuild the VM.

This article covers what each option actually does, where it operates in the stack, detailed pros and cons, and a clear decision guide — plus the full migration picture.

Diagram 1 shows where each encryption option operates in the Azure stack.

SSE with PMK is the Azure default. Azure manages the key lifecycle and encryption happens at the storage cluster level after data leaves the VM and host. It uses AES-256 on every managed disk, snapshot, and image. It is transparent and cannot be turned off.

Pros: zero configuration, no cost overhead, Microsoft handles key rotation and lifecycle, works with every disk type including Ultra Disk and Premium SSD v2, and no operational burden.
Cons: Microsoft holds the keys, no customer control, no audit trail of key access, does not satisfy compliance requirements needing key control, temp disks and disk caches are not encrypted, and data is unencrypted in transit between VM host and storage cluster.

SSE with CMK is the option when you want to supply and manage your own keys. You store a key in Azure Key Vault and create a Disk Encryption Set (DES) that links the key to managed disks. Azure generates a unique Data Encryption Key (DEK) per disk, wraps it with your CMK, stores the wrapped DEK with the disk, and unwraps it on access. Revoking the CMK locks all linked disks.

Diagram 2 shows SSE with CMK and Disk Encryption Set architecture.

Pros: full key lifecycle control, satisfies HIPAA/PCI-DSS/ISO 27001/FedRAMP key control needs, Key Vault audit logs give a complete access trail, instant access revocation is possible, supports BYOK, works with Ultra Disk and Premium SSD v2, and is compatible with Encryption at Host.
Cons: temp disks and disk caches are still not encrypted without Encryption at Host, transit between host and storage is not encrypted, switching to CMK is one-way, VMs must be deallocated to assign disks to a DES, Key Vault setup adds operational overhead, and Key Vault availability is now in the critical path for VM operations.

Encryption at Host is the recommended long-term option. It encrypts at the VM host level, covering temp disks, OS/data disk caches, and the transit channel from host to storage. It does this in host hardware, so there is no measurable CPU impact on the VM. It can work with either PMK or CMK.

Feature registration required: register the EncryptionAtHost feature on your subscription with Azure before enabling it.

Pros: true end-to-end encryption, zero VM CPU overhead, works with PMK and CMK, supports Ultra Disk and Premium SSD v2, Microsoft recommended replacement for ADE, supported on most current VM sizes, and can be enabled at VM creation or after deallocation.
Cons: requires subscription-level feature registration, not supported on all older VM SKUs, cannot be combined with ADE, and not available for VMs that have ever had ADE enabled.

Azure Disk Encryption (ADE) encrypts at the OS layer using BitLocker on Windows or dm-crypt on Linux. That means the OS performs encryption and the encrypted data path extends from the VM through storage. ADE was attractive for some compliance scenarios because it gave OS-layer encryption that appeared to cover transit before data left the VM.

The problem is the complexity. ADE requires the VM to be running to enable it. It conflicts with SSE+CMK. It cannot be used with Encryption at Host. It does not support newer disk types like Ultra Disk or Premium SSD v2. It imposes CPU overhead on the VM. It creates a UDE metadata flag on disks that persists after ADE is disabled, which makes migration more involved than a simple switch.

Do not enable ADE on any new VM. Microsoft says use Encryption at Host for new deployments. ADE should only remain in use on existing VMs that have not yet migrated, and only until September 15, 2028.

Pros (historical): full data path encryption including OS-layer transit, BitLocker/dm-crypt are well understood and auditable technologies, encrypts temp disk when VolumeType=All is set, and satisfied strict in-transit compliance requirements.
Cons: retiring September 15, 2028, incompatible with SSE+CMK and Encryption at Host, does not support Ultra Disk or Premium SSD v2, not supported on Basic/A-series/v6+ VM sizes, VM must be running to enable it, UDE flag persists after decryption, cannot encrypt failover cluster VMs, significant VM CPU overhead, and there is no in-place migration path to Encryption at Host.

The Retirement means that ADE-enabled workloads will continue to run, but encrypted disks will fail to unlock after VM reboots. That means any planned or unplanned reboot after September 15, 2028, will leave disks locked and VMs unable to start. This is a hard service disruption on a known date, not a soft deprecation.

Diagram 3 shows the ADE retirement timeline and migration path.

Decision guide: For new VM deployments, if you do not need customer-controlled keys then SSE + PMK is the simplest default. If compliance needs customer key control, use SSE + CMK with Disk Encryption Set. If you need true end-to-end coverage for temp disk, cache, and transit, choose Encryption at Host. Never enable ADE on new VMs; it is retiring and has no new-workload path.

Diagram 4 helps choose the right Azure disk encryption option for your situation.

Full comparison summary SSE + PMK is the default and low-cost option with no VM CPU overhead, but it does not offer customer key control and it leaves temp disk, cache, and host-to-storage transit unencrypted. SSE + CMK adds customer key control through a Disk Encryption Set, though it still does not encrypt temp disk, cache, or transit. Encryption at Host provides true end-to-end coverage and can work with PMK or CMK. ADE covers OS and data disk encryption but is retiring, incompatible with SSE + CMK and Encryption at Host, and has significant VM overhead.

Migration steps from ADE to Encryption at Host cannot be done in place. Back up all data and document VM configuration. Disable ADE and wait for full OS-level decryption to complete before proceeding. Create new disk objects using the Upload method instead of Copy so you do not keep the UDE flag. Build a new VM with Encryption at Host enabled and attach the clean disks. For Linux OS disks, ADE disable is unsupported; you must create a fresh VM with a clean OS disk and migrate data disks separately.

The bottom line For new VMs, use Encryption at Host + CMK for full end-to-end coverage with customer key control. If you do not need CMK, Encryption at Host with PMK still gives complete coverage with minimal operational overhead. For existing ADE VMs, start planning your migration now. The rebuild requirement means this is a multi-sprint project for large VM estates, not a one-day task.

Docker Containers Troubleshooting - Debug , Fix , Run , Scale

2026-05-02T16:55:00.000-07:00

Yeah i know, I will ask my Gen AI agent to write , debug, fix my code.

Thats what many of us think now a days. What if your AI agent dint see some issue before hand and you need to fix its mistakes. What if you need to review the fix before you roll out to prod environment.

Being a developer never stops, may that be working with your old school IDEs writing your own code, or working with your code writen by a Gen AI agent. Always you should know what you are doing.

Just like everyone else i asked Claude to create me a sample Docker compose project and it did a great job.

It started with a simple arhcitecture diagram, explined me what different components are doing.

Then it spit out the code , and in first glance it all looks so perfect. I moved the code to my RHEL10 VM on Virtualbox to test it out.

If you wanna try it by your self, here is the code hosted on Github. https://github.com/pratappilaka24/Docker-Compose-Troubleshooting

I am excited and ran it. It started fine

then this happened.

My App container provisioning failed its health check. Its showing unhealthy

Checked the logs and logs seems fine.

Next step is to inspect the container to see why the health check is failing.

Here is the issue. Claude suggested i use "python:3.12-slim" image to run my app container, but dint realized, it dint come with curl installed. From above inspect command we find the missing dependency.

Let me fix it by adding the curl installation in Dockerfile.

We chnaged the definition of our App container image.

For this to work, you need to stop app container, remove app container and remove app image.

Thus next compose run, docker will recreate new image based on updated definition, and create app container based on it.

Here we go again.

My app container failed to start again. What AI dint know is that i am already running httpd service on my RHEL vm, where posrts 80 and 443 are pre allocated.

So now we change nginx.conf and docker-compose files to run the app on a different port.

After all these fixes, we were able to deploy all App, DB, Redis and DB containers successfully.

Testing the app by curl http://localhost.

Its an 500 internal service error. Something to do with our code. Lets check the logs.

Lets start with nginx container logs. this doesnt show much information apart form there is a 500 internal server error. this means app is crashing.

Next step is to check app container logs.

Wait a second, why does app container logs says Visits table in postgres db doesnot exists.

But if you check in our code , db-init.sql script is creating the table when postgres db container is provisioned.

After some research , found out the db-init.sql, also called seed script runs only once when the volume is created. but when we decomissioned containers , the voulme is left behind.

When we run Docker compose again, the containers were recreated and due to existing volume , the seed script never ran, thus failing to run the seed script creating the required postgres table.

So this time we take down all the containers including the volume.

Now we will recreate the contianers using docker compose and test our app.

Vallah , the containers deployed and the user hits on the app and the db is registering the user hits, and redis is caching the count. If you look at the output, you can see the count is being fetched from cache for cuncurrent hits.

Now look at how we can scale up the app containers. Initial Docker compose ps shows 1 of app, db, nginx and redis containers. Now scale up app to 3 and you can see 3 app containers serving the user hits in union.

Now scaling down one app container.

At last by digging through the logs and figuring out issues and fixing things is what makes us Engineers and Developers, not just writing code.

Authenticating Azure Foundry OpenAI Using Managed Identity

2026-04-02T21:32:00.000-07:00

In earlier post we have tested 30+ features of various Azure Foundry Open AI services.

Post: https://pratapreddypilaka.blogspot.com/2026/04/azure-ai-services-complete-guide-to.html

Most of the code have saved all the Open AI service keys in an environment file following Python best practice. But this is done only for practice purpose, just to get familiar with Open AI services and how to access those services using Python code.

Saving the Access keys in code is the worst possible security blunder you can do. Access keys will completely bypass all the RBAC controls and give complete access to anyone.

What are the ways to authenticate Azure Open AI services without exposing the keys?

System Assigned Managed Identity — Auto-created identity tied to an Azure resource (VM, App Service, Functions)
User Assigned Managed Identity — Standalone identity you create and attach to one or more Azure resources
Service Principal + Client Secret — App registration with a secret, works anywhere including on-prem
Service Principal + Certificate — Same as above but uses a certificate instead of secret, more secure
Azure CLI Credential — Uses the logged-in az login identity, ideal for local dev/testing
Interactive Browser Credential — Pops a browser login window, good for desktop tools
Device Code Credential — Prints a code to enter at a URL, useful for headless servers
DefaultAzureCredential — Tries multiple methods automatically in order, recommended for most cases
Workload Identity — Federated keyless auth for pods running in Azure Kubernetes Service (AKS)
Federated Identity Credential — Allows external IdPs like GitHub Actions or GitLab to authenticate without any secrets

Managed Identity is the preferred method for Azure workloads to access Open AI services.

In this article we will have a look at how we can authenticate using Managed Identity.

For this we need a VM up on which we will enable system managed Identity.

I created a Linux VM, and enabled the managed identity.

Now, go to Foundry, go to Access control, and Add a new role assignment for the managed identity we created earlier with role being "Cognitive Services OpenAI User".

Now create the rules for NSG to open the communication between OpenAI services. This is necessary if you are using a private endpoint for the OpenAI instance.

Now in order to test the connectivity, I am installing Python and Azure-Identity.

# Python & pip
sudo apt update && sudo apt install python3-pip -y

# Required packages
pip3 install openai azure-identity

Once all the dependencies are installed, we will create a file with the below code.

from azure.identity import ManagedIdentityCredential
from openai import AzureOpenAI
import os

# ── Config ──────────────────────────────────────────────
AZURE_OPENAI_ENDPOINT = "https://prata-mhl58p7n-eastus2.cognitiveservices.azure.com/"
DEPLOYMENT_NAME       = "gpt-5-chat"   # e.g. gpt-4o
API_VERSION           = "2024-02-01"
# ────────────────────────────────────────────────────────

# 1. Obtain a token via Managed Identity (no keys!)
credential = ManagedIdentityCredential()
token       = credential.get_token("https://cognitiveservices.azure.com/.default")

# 2. Build AzureOpenAI client using the bearer token
client = AzureOpenAI(
    azure_endpoint = AZURE_OPENAI_ENDPOINT,
    api_version    = API_VERSION,
    azure_ad_token = token.token,       # <-- token-based, not key-based
)

# 3. Call the model
response = client.chat.completions.create(
    model    = DEPLOYMENT_NAME,
    messages = [
        {"role": "system", "content": "You are a helpful assistant."},
        {"role": "user",   "content": "Hello! Tell me more about Managed identity authentication without using access keys for Azure Open AI"}
    ]
)

print("✅ Response:", response.choices[0].message.content)

Now run the python file python3 chat.py

You will get the response from your gpt-5-chat model, without using access keys.

Azure AI Services - A Complete Guide to Building Intelligent Applications with Azure AI Foundry

2026-04-02T15:45:00.000-07:00

A while ago i started exploring Azure AI Foundry and ended up going down a rabbit hole of 30+ implementations covering everything from GPT-5 chat to live speech transcription. In this post i will walk you through all the major Azure AI services, what they do, how to implement them, and when to use them — so you don't have to figure it all out the hard way like i did.

You can download git repo and start embedding your Azure OpenAI Service keys in.env file and start executing them as we go along.

README: https://github.com/pratappilaka24/Azure-Foundry-Samples?tab=readme-ov-file#readme

REPO: https://github.com/pratappilaka24/Azure-Foundry-Samples

Our objective is to understand the complete Azure AI Services ecosystem and how you can combine them to build enterprise-grade intelligent applications.

Azure OpenAI - GPT-5 Chat, Vision and Code

This is where most people start, and for good reason. Azure OpenAI gives you access to GPT-5 with enterprise-grade security, regional deployment and SLAs — unlike calling OpenAI directly.

The basic setup is straightforward. You initialize an AzureOpenAI client with your endpoint and API key, define a system role (something like "you are a helpful travel assistant"), pass in user messages and configure temperature and top_p for response behavior. That's it, you are doing conversational AI.

from openai import AzureOpenAI
from azure.core.credentials import AzureKeyCredential
from dotenv import load_dotenv
import os

load_dotenv()
client = AzureOpenAI(
    azure_endpoint=os.getenv("AZURE_OPENAI_ENDPOINT"),
    api_key=os.getenv("AZURE_OPENAI_KEY"),
    api_version="2024-12-01-preview"
)

What makes it more interesting is Vision. You can encode an image to base64, pass it as image_url in the message content, and GPT-5 will analyze and explain it — diagrams, screenshots, anything. I used this for code explanation too. Point it at a source file with a "you are a teacher" system prompt and let it stream the explanation back. Really useful for documentation generation and code reviews.

Chat Output:

Image Reading Output:

DALL-E 3 - Generating Images from Text

This one is fun. DALL-E 3 connects to a separate Azure endpoint and lets you describe an image in plain English and get back a 1024x1024 image in seconds. Just provide a detailed text prompt, set your quality and size parameters and download the result.

result = client.images.generate(
    model="dall-e-3",
    prompt="A futuristic cityscape at sunset with Azure cloud symbols",
    size="1024x1024",
    quality="standard",
    n=1
)

Good for marketing materials, UI mockups, design concepts. The more detailed your prompt, the better the output.

Image Generation Output:

Structured Output - Extracting JSON from Documents

This one is underrated. Using OpenAI's function calling capability, you can take something like an unstructured invoice and get back perfectly structured JSON — invoice number, date, vendor, line items, totals, payment method. All of it.

You define a function schema with your properties, pass the function definitions to the chat completion API and the model returns data that matches your schema exactly. No hallucination, no parsing headaches. Perfect for financial processing and form automation workflows.

Azure Computer Vision - OCR, Object Detection and Brand Recognition

Computer Vision gives you deep image understanding without training any models yourself. You load an image as binary content, initialize ImageAnalysisClient and specify which visual features you want — READ for text extraction (OCR), TAGS for classification, CAPTION for description, OBJECTS, PEOPLE, SMART_CROPS.

from azure.ai.vision.imageanalysis import ImageAnalysisClient
from azure.ai.vision.imageanalysis.models import VisualFeatures

client = ImageAnalysisClient(endpoint=endpoint, credential=credential)
result = client.analyze(
    image_data=image_data,
    visual_features=[VisualFeatures.READ, VisualFeatures.TAGS, VisualFeatures.CAPTION]
)

There is also a Brand Recognition mode specifically for detecting logos in images — it returns the brand name and a confidence score. Great for marketing analytics, competitive intelligence and shelf monitoring in retail.

Object detection Output:

Brand Recognition Output:

Azure Face API - Facial Detection and Attributes

The Face API detects human faces in images and extracts attributes like head pose, whether the person is wearing glasses, exposure levels and more. You pass in your image, specify which features you want detected, and get back structured facial attribute data.

Use cases range from access control and security to retail analytics and media analysis. The API generates face IDs in a privacy-respecting way and supports batch processing.

Azure Custom Vision - Train Your Own Classifier

This is where it gets really powerful for domain-specific problems. Custom Vision lets you train your own image classification model without needing any deep ML expertise. You collect images, tag them in the Custom Vision portal, train the model, deploy it to a prediction endpoint, and then call it from your code.

from azure.cognitiveservices.vision.customvision.prediction import CustomVisionPredictionClient

predictor = CustomVisionPredictionClient(endpoint, credentials)
results = predictor.classify_image(project_id, model_name, image_data)

for prediction in results.predictions:
    if prediction.probability > 0.90:
        print(f"{prediction.tag_name}: {prediction.probability:.2%}")

I tested this with a pet classification model and a food/object model. With enough good training images you can hit 95%+ accuracy and sub-100ms inference. No infrastructure to manage, just train and deploy.

Azure Document Intelligence - Invoice and Receipt Processing

This is a game changer for anyone doing document processing. Document Intelligence has pre-built models for invoices, receipts and other document types. You point it at a document URL, it processes it asynchronously, and you get back structured field-level data — vendor name, invoice number, line items, tax, totals — all of it.

from azure.ai.documentintelligence import DocumentIntelligenceClient

client = DocumentIntelligenceClient(endpoint=endpoint, credential=credential)
poller = client.begin_analyze_document("prebuilt-invoice", document_url)
result = poller.result()

95%+ extraction accuracy on standard invoice formats. This kind of thing used to take weeks to build, now you are up and running in an afternoon.

Document Intelligence Output:

Azure Language Service - Text Intelligence

The Language Service is a whole suite of NLP capabilities under one client.

Language Detection identifies which of 120+ languages your text is in. Useful for multi-language applications and routing pipelines.

Key Phrase Extraction pulls out the main topics from any text. Feed it an article and it tells you the key concepts. Good for SEO, content categorization and trend analysis.

Sentiment Analysis goes beyond just positive/negative. It does sentence-level breakdown, opinion mining, and returns confidence scores per sentiment category. You can even do aspect-based sentiment — so for a restaurant review you can get separate sentiment scores for food, service and ambience.

Entity Extraction identifies people, places, organisations, dates, amounts, and job titles in your text. Great for populating CRM data from unstructured sources or building advanced search.

Conversational Language Understanding lets you define custom intents and entities, train a model, and then extract structured information from conversational input. For example:

Utterance: "I need to book a flight from London to Bangalore on 10th December for 4 adults in economy"

Extracted:
- Intent: BookFlight
- From: London
- To: Bangalore  
- Date: 10th December
- Passengers: 4
- Class: Economy

This is the backbone of any chatbot or voice assistant workflow.

Sentiment Analysis Output:

Azure Translator - 100+ Languages

The Translator service is simple and incredibly powerful. One API call, multiple target languages, done.

documents = [InputTextItem(text="早上好，你好吗?")]
response = client.translate(content=documents, to=["en", "it", "fr"], from_parameter="zh-Hans")

Supports 100+ languages, auto-detection, transliteration and custom terminology for enterprise use. If you are building a global application this is the fastest path to multilingual support.

Translation Output:

Azure Speech Service - TTS, STT and Live Transcription

Text-to-Speech uses neural voice synthesis to convert text to natural-sounding audio. You pick a voice (there are 400+ across 140+ languages), configure your speech settings and call it. The en-US-AndrewMultilingualNeural voice is surprisingly natural.

For even more control you use SSML (Speech Synthesis Markup Language) — this lets you control pitch, rate, volume, add pauses, set speaking style (cheerful, professional, etc.) and even specify phoneme-level pronunciation. Full studio-quality control.

Speech-to-Text goes the other direction — audio file in, transcribed text out. Under 5% word error rate on clean audio. Supports real-time recognition and continuous recognition for ongoing streams.

Live Transcription is continuous speech recognition in real time — low latency, partial results as you speak, final results on pause. Good for live captioning, accessibility and interactive voice applications.

Azure Content Safety - Moderation at Scale

Content Safety detects harmful content in both images and text. It covers four categories — self-harm, violence, hate speech and sexual content — and returns a severity score for each. You set your own threshold and build your moderation workflow from there.

request = AnalyzeImageOptions(image=ImageData(content=image_file.read()))
response = safetyClient.analyze_image(request)

request = AnalyzeTextOptions(text=input_text)
response = safetyClient.analyze_text(request)

For any platform dealing with user-generated content this is essential. Reduces manual moderation load significantly.

Content Saftey Output:

Putting It All Together

The real power of Azure AI Services is in combining them. A simple example: Speech → Text → Language Understanding → Trigger Workflow. That is a fully voice-driven automation pipeline built entirely from managed services with no ML infrastructure.

Authentication across all services follows the same pattern:

from azure.core.credentials import AzureKeyCredential
from dotenv import load_dotenv
import os

load_dotenv()
endpoint = os.getenv("AZURE_SERVICE_ENDPOINT")
key = os.getenv("AZURE_SERVICE_KEY")
credential = AzureKeyCredential(key)

Always store keys in .env files, never hardcode them. In production use managed identities instead of API keys altogether.

The 30+ implementations i built in this AIFoundry project cover all of the above end to end. Everything is pay-per-use, auto-scales, no infrastructure to manage and all come with 99.9% SLA. The recommended approach is to start with Azure OpenAI for your foundational needs, layer on the specialised services as required, and combine them for compound intelligence workflows.

Learning and Sharing !

Azure FinOps using Terraform and Infracost - Finding the hourly or monthly cost before Azure DevOps Deployments

2023-11-27T02:08:00.000-08:00

A while ago i created a demo for Azure VWAN using terraform and Azure DevOps. I dive headfirst without realizing that i am using premium SKU for firewalls and my Dev teant is shutdown for a month in few days due to my billing cap of 230 NZD.

Next time when i create a demo for APIM instances, i dint realize Premium SKU costs 7500 NZD/month. Even before i finish my POC, the teant again shutdown in few hours this time.

Our objective is to find the cost of the IAC we are deploying even before we deploy.

In this post i will show how we can utilize Infracost a opensource plugin in both VSCode and how we can make it part of our Azure DevOps pipelines to manage cost of the resources we are going to deploy.

Like this :

or like this:

VS Code:

To use Infracost in VSCode, go to infracost.io and download the Infracost.exe and place it in c:\windows folder.

As soon as you did above step, reopen your VS Code and you can start seing the cost of individual components as shown above. But we want to see the cost of the whole deployment, not just resource by resource.

Now either use your own code base, or you can download my AzureVWAN codebase from my GitRepo. Dont worry i chnaged the SKUs to basic and we are not deploying anything. Our objective is to find cost even before deploying.

Open your TF source code in VS Code and open terminal and runn your tfplan command as shown below:

We need tfplan output into a file, because in VS Code the cost is generated based on the plan. Above command will generate the plan output into a file in current working folder.

Now run below command to authenticate InfraCost.

This will open the web browser for authentication with your Infracost account. This will autamtically get the API token from Infracost and save it in VScode settings.

Now run below command :

This will utilize the plan file generated earlier and will give you cost of each component and final mothly cost of your deployment as shown below.

When you are doing a multiple versions of build, you can use below command to find the difference of the costs based on your base build. More on this here.

Azure DevOps Pipeline

Unlike we cannot use interactive authentication in middle of your devOps pieline execution, we need a API token to authenticate Infracost API.

Once you done with Infracost.exe, signup on Infracost.io using your Github account or gmail account. Its free, opensource. Finishing signup it will send a Access token(Infracostaccesstoken) to your email Else log onto InfraCost.io and go to Organization settings and you can reteive your API key.

Go to your Azure DevOps organization settings and install InfraCost extension. If it is not installed earlier, go to "Browse marketplace".

then

Now take any existing Repo on Azure Devops, I am using the same AzureVWAN project on my devops repos.

Create a new pipeline => Azure repos Git => select current project => Starter Pipeline.

Copy paste below code:

# Starter pipeline

# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
- main

pool:
  vmImage: ubuntu-latest

stages:

########### Prod Deployment ###########  
    - stage: "terraform_cost_plan"
      displayName: "terraform-cost-plan"
      jobs:
        - job: infracost
          displayName: Run Infracost          
          steps:
          # If you use private modules, add a base 64 encoded secret
          # called gitSshKeyBase64 with your private key, so Infracost can access
          # private repositories (similar to how Terraform/Terragrunt does).
          # - bash: |
          #     ssh-agent -a $(SSH_AUTH_SOCK)
          #     mkdir -p ~/.ssh
          #     echo "$(echo $GIT_SSH_KEY_BASE_64 | base64 -d)" | tr -d '\r' | ssh-add -
          #     # Update this to github.com, gitlab.com, bitbucket.org, ssh.dev.azure.com or your source control server's domain
          #     ssh-keyscan github.com >> ~/.ssh/known_hosts
          #   displayName: Add GIT_SSH_KEY
          #   env:
          #     GIT_SSH_KEY_BASE_64: $(gitSshKeyBase64)

            # Install the Infracost CLI, see https://github.com/infracost/infracost-azure-devops#infracostsetup
            # for other inputs such as version, and pricingApiEndpoint (for self-hosted users).
            - task: InfracostSetup@2
              displayName: Setup Infracost
              inputs:
                apiKey: $(infracostApiKey)

            # Clone the base branch of the pull request (e.g. main/master) into a temp directory.
            - bash: |
                branch=$(System.PullRequest.TargetBranch)
                branch=${branch#refs/heads/}
                git clone $(Build.Repository.Uri) --branch="main" --single-branch /tmp/base --config http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)"
              displayName: Checkout base branch


            # Generate an Infracost cost estimate baseline from the comparison branch, so that Infracost can compare the cost difference.
            - bash: |
                infracost breakdown --path=/tmp/base/$(TF_ROOT) \
                                    --format=json \
                                    --out-file=/tmp/infracost-base.json
              displayName: Generate Infracost cost estimate baseline

            - bash: |
                sudo apt install jq
              displayName: Installing JQ to prettyfy output

            - bash: |
                jq . /tmp/infracost-base.json
              displayName: Printing Baseline cost estimate

            # Generate an Infracost diff and save it to a JSON file.
            - bash: |
                infracost diff --path=$(TF_ROOT) \
                              --format=json \
                              --compare-to=/tmp/infracost-base.json \
                              --out-file=/tmp/infracost.json
              displayName: Generate Infracost diff

            - bash: |
                      jq . /tmp/infracost-base.json

displayName: Printing cost difference estimate

Before you save the pipeline, click varaibles button on top right corner and add a variable with name "infracostapikey" and the value should be the API key you saved/generated/copied earlier from infracost organization settings.

Now save and run the pipeline.

Boom:

I have even embedded the code to give you the diff next time when you run with chnages to your build.

You can make this pipeline as a one of the build validation task everytime when main or master branch was updated and can create chnage management / goverance / FinOps arround your Azure DevOps deployments.

Azure DevOps Self-Hosted Agents Automation Using Packer and Terrafrom

2023-07-16T01:11:00.005-07:00

In Azure DevOps, "self-hosted agents" refer to agent machines that you set up and manage yourself, instead of using Microsoft-hosted agents. These self-hosted agents can be beneficial in various scenarios:

Security and Compliance: In some organizations, data security and compliance policies may require running build and deployment processes on infrastructure managed within their own network.

Access to Internal Resources: Your build and deployment processes may require access to internal resources (databases, network drives, etc.) that are not accessible from external Microsoft-hosted agents.

Performance and Customization: Self-hosted agents can be tailored to specific hardware configurations, which might be necessary for resource-intensive builds or specialized build environments.

Cost Management: Azure DevOps provides a certain number of free Microsoft-hosted parallel jobs, but if you have large-scale or resource-intensive projects, self-hosted agents can be more cost-effective in the long run.

Reducing Build Queue Times: When using Microsoft-hosted agents, you share resources with other users, which might result in longer build queue times. Self-hosted agents allow you to control the resources dedicated to your builds, potentially reducing waiting times.

Offline Environments: If you have environments without continuous internet access, self-hosted agents can be used to facilitate builds and deployments within those isolated networks.

In this post i will be:

Generating a Managed VM Image using Packer.
Saving the Managed image to a Image gallery within my tenant.
Create a Virtual Machine Scale Set(VMSS) from the said image.
Register the VMSS as DevOps Self-Hosted agents.
Run a time intensive project using self-hosted pool to see how VMSS will autoscale.
Then update the VM image with new build and see how we can update the existing Self-hosted agents.

Step 1: Download the code from SelfHosted-Devops-Agent-TF-and-Packer

Please know that the Linux custom Packer Image definition is not part of this repo. but dont worry, it will download all the required packer file and necessary installer scripts and packages automatically when you run the pipeline.

Below image will explain the contents of the repo.

Step 2: Update the Suscription id in the Setup.azcli script and run it. The script will give a final out put where you need to create DevOps library variable group based on the output values. More details are there in Readme file. Please fillow the variable names defined in readme file and the values can be found from out put of above setup script.

Step 3: Create Variables with values shown above in your DevOps project's Variable group.

Step 4: Now create a pipeline and point it to "buildagent-generation-template.yml" and run it.

Please know that i have used only a subset of packages from ones listed in this file LINK

Ususally this subet takes 45 mins to finish. If you want to build VM with full list of installer artifacts, try using "buildagent-generation-template-full.yml" instead. This will take 1.5 hours to finish creating VMSS.

Now try running the pipeline, and you will see below prompts.

Step 5: Now run it for creating a VMSS and then for Updating existing VMSS based on your packer image build.

Please note that, in this process a temporary resource group will be created with the build number and a VM with Public IP will be created. Now the Packer will download all the installer artifacts and install them and build the VM to gold standard. Now the .vhd file will be generated and saved to the storage account. Once this process is sucessfully finished, the temporary resource group will be deleted with all the content of it. This is the part reason why we gave SPN contributir access at subscription.

The resource group hosting VMSS will host other componenets required for VMSS, like a load balancer, a VNET public IP for load balancer and VMSS.

Step7: Now its time to see the VMSS in action. to do that go to DevOps organization settings and navigate to "Agent Pools".

Create a new agent pool and select the pool type as VMSS and authorize the Subscription and select the VMSS we created earlier. In settings i configured to have only 1 instance to be on standby and in case of any new jobs kicked in, the maximum number of instances to be 5. I also configured to shred the extra idle instances after 5 mins. In prod, this will be like 30 mins.

Now you will see the VMSS instances in the list of agents. If you couldnt, go to VMSS instances and select the instances and click upgrade. This will automatically run the required bash commands to make these VMSS instances avialable as agents.

Now you can see that as per our configuration there will be only one devops agent instance of VMSS available on standby mode.

Now we need to put some stress on it to see how it goes.

Step8: Create a dummy project and add a test yaml as shown below.

Just create duplicate Jobs with different job names.

trigger: none

pool:
    name: 'self-hosted'

jobs:
-   job: Job1
    steps:
    -   script: |
            echo "Hello from $HOSTNAME [$(date) ]"
            echo "Sleeping for 1 min [$(date) ]"
            sleep 60
            echo "Done with sleep [$(date) ]"

-   job: Job2
    steps:
    -   script: |
            echo "Hello from $HOSTNAME [$(date) ]"
            echo "Sleeping for 1 min [$(date) ]"
            sleep 60
            echo "Done with sleep [$(date) ]"

Now if you look carefully at the pieline, the pool: parameter usually have a image:ubuntu-latest. In this case we want to run this pipeline on the self-hosted agent pool we created earlier. so you need to chnage as shown above. Run this pipeline to see our self-hosted agent pool in action.

Step 9: I created the test pipeline with 9 jobs which print what self-hosting agent it is running from and wait for a min and then print a message done sleeping with time stamps.

I started the dummy pieline.

Now if you look at the VMSS instances , it will change from

to this

as soon as the instances were sucessfully provisioned, the number of jobs stated paralelly will also increase based on dependecies.

and you can also se the number of agents created in our self-hosted agent pool.

Step 10: Now lets say you have decided to update the artifacts that will be installed on gold image. For this you have updated the packer file and now all you need to do is, run this pipeline by selecting "update vmss" option.

If you look into the yaml file , you can see this repo is fecting the packer file and image dependecies from https://github.com/actions/runner-images.git

This is the MicroSoft git for runner images. But this is full set and will take 1.5 hours to build the VM image. Instead i made a packer file with subset of installer artifacts and hosted it at https://github.com/pratappilaka24/custom-image.git

This will only take 35 minutes to build VM and 45 mints to finish end to end deployment of VMSS.

Hope this helps and do let me know in case of any help needed.

Terraform Azure Application Landing Zone - TF AZ Bootstrap

2023-07-07T22:30:00.011-07:00

Objective: This post is to provide a kick strat your Azure DevOps journey by providing a Seed Repo for your Azure DevOps organization. Every time when a new application is about to be launched into Azure, you have to go through the provisioning of launchpad and Devops Repo and building the CI/CD pipelines. Below project will address all of those concerns.

Now i want to create similar thing and add couple of more steps and make it avilable for everyone.

Here is what you gona get.

Step 1: Download the repo from my github repos. TF AZ Bootstrap

Step 2: Run the AZCLI script and only 2 parameters you need to update are Subscription ID and App anme. Ask your adminstrator or customer to run it in Azure CLI / Bash.

Step 3: Now with the script ran, you can see a resource group created with the app name in it and you can see a Keyvault in it. Here is how all the information required for us in piplines is saved in Key Vault.

Step 4: Create a new project in Azure Devops and import the code directly from GitHub link.

Now go to pipelines, and go to library. Add a new Variable group with name "kv_variable_group" and enable Keyvault integration for Variables.

Now all the infomation generated by CLI script ia avilable for pipelines in form of variables and the exact variables names have been configured in the code.

Step 5: Go to pipelines, create a new pipeline from Git as source and pick existing YAML file for pipeline. Choose ./aure-pipelines/ci.yaml and name it CI.

Give it a go:

Step 6: Now do the same thing for ./azure-pipelines/cd.yaml and giev it a go.

If you run into any troubles, do let me know. I can help.

- Your fellow developer.

Deploying Virtual WAN using Terraform & Azure DevOps

2023-06-11T00:51:00.003-07:00

Let me summarize Azure networking options based on usecase:

You need network connectivity between resources across different virtual networks in same region, you need to implement VNet peering.
You need connectivity between resources in virtual networks spanned across different region, you need to implement Global VNet peering.
You need network connectivity between your Organization (On-Prem) and your azure tenant and you are ok to have the secure channels over the internet, You need to implement site to site VPN gateways.
You want network connectivity between your offices to azure tenancy with high throughput and not over internet, you need to implement Express Route.
You need individual users to use services hsoted in your Azure tenant, you will implemnet Point-to-site VPN gateway.

All the above implementations are different on thier configurations and they each cater for each use case in its own capacity.

Here is why you need to choose Virtual WAN if you are already using more than 2 capabilities mentioned above.

VWAN brings all of the above network connectivity implemntations under one centralized platform.
VWAN automatically deployes one hub in each choosen region which implements Hub-spoke network design by default.
Site-to-Site VPN gateways supports max of 10, 30 and 100 tunnels in Basic, Standard and HighPerformance SKUs. VWAN supports upto 1000 branch conncetions per VWAN hub, which can throuhput at 20GBps per hub.
Though private communication between VNets in both VNet Peering and VWAN are ecrypted over MS backbone network, Adding additional firewall security is way easier in VWAN comapred to VNet peering.
VWAN has most of the above services deployed across all avilability zones in a given region thus making it more relaible and scalable without any manual intervention.
Virtual WAN provides many functionalities built into a single pane of glass such as site/site-to-site VPN connectivity, User/P2S connectivity, ExpressRoute connectivity, virtual network connectivity, VPN ExpressRoute Interconnectivity, VNet-to-VNet transitive connectivity, Centralized Routing, Azure Firewall and Firewall Manager security, Monitoring, ExpressRoute Encryption, and many other capabilities. Pick and choose what you want.

More information is available on MS Documentation. All refrence links are provided at the end of the article.

Now the title of artice is no "Why VWAN?" it says "Deploying VWAN using Terrafrom & Azure Devops". So lets jump in to deployment.

My objective is to deploy Virtual WAN, VWAN Hubs across 2 different regions, connect 2 Virtual networks in these regions via VWAN Hubs, deploy 2 Linux VMs in these VNets, have a ping from one VM to other one over VNet connectivity of VWAN and Hubs.

I have burned heavily while implemnting this , once by deploying Preminum SKU for firewalls, other times deploying the bation services for these VMs , which i dont need for purpose of my POC.

But if you are interested the code is there in terraform files commented. You can uncomment before you deploy.

So the code i will be deploying no bation services for the VMs and used the standard version of VWAN hub firewall.

Step1: Create a Storage account with continer to manage your terrafrom state file.

Step2: Download the code from my Git repo.

https://github.com/pratappilaka24/Azure-VWAN

Azure DevOps is optional, as you can literally run terrafrom apply. But this needs installing terraform on your machine and AZ CLI or Azure shell for connectiing to your azure tenant.

Step 3: Create a Project in upload the code to your AZ repo.

Step 4: Create a 2 release pipelines , one for creating , the other for destroying.

Add Artifacts to depoy by adding the current project as working folder.

Step5: Start editing the stage1 by adding the below shown steps.

The only catch you might have here is that you need to point .tfvars file. It can be done by passing the name of tfvars file as a command line argument for apply and destroy steps.

Step 6: Deploy the apply release pipeline and you will see two resource groups one in AUE and USE regions. I have deployed below components as part of this project:

2 Resource groups in different regions
2 vnets
2 Linux VMs and supporting NSGs, NICs and OS Disks
1 Virtual WAN
2 VWAN Hubs one for each region
2 firewall policies and firewalls securing 2 HubsVNets
1 Keyvault saving the random password for the Linux VMs

Please note that the Linux VMs has SSH opened , use pasword login and have PIPs assigned to them, for easy of testing. In production envirment , aslways go for bastion and no open SSH.

Even though we open SSH, the login password (random generated pasword) will be saved to a Keyvault created in AUE resource group.

Step7: Before we login to VMs, lets check VWAN. You will find it in AUE region as shown above. Open VWAN and you can see the Hubs deployed and supporting firewalls to secure the hubs.

Click on the View Topology link in overview to see the whole hub-spoke architecture you just deployed.

Step 8: Open Firewall-policy and you can see that these will allow the private communication from IP range of one VNets to other one.

This means i can define a common set of firewall policies and apply the firewall security to communication over hubs. Now you can centrally control the policies applied to all comms across your network.

Step 9: Lastly open one of the Hubs and click "Routing Intent and Routing Policies", here you can control policies applied for the traffic over the internet and the private traffic that runs on MS backbone.

Step 10: Finally go to Keyvault and grab the VM password.

Please know that i opened SSH and addd a public IP just for our testing purpose. Else you should use bastion. Code for bastion is also there in the project files. Just uncomment it.

I login to AUE VM and try pinging the private IP of USE VM.

Same goes from USE VM to AUE VM.

If i ping the public IP, this wont work. Reason being, the firewall policy currently allow only the communcation between the private IP range of the VNets.

There now run the destroy pipeline after your testing to save money on your dev subscription 😃

Refrences:

Article by Jake Walsh helped a lot to understand and formulate this project. Big thanks to him. Link

Best place to start after exploring VWAN to know how it is advantageous over other implementations. Link

The mother of all Link

How to build subscription based security around Azure functions

2022-03-26T18:55:00.002-07:00

Working in company which deals with hundreds of client azure tenants showed me how different it is working on your own tenant.

Recently i worked on a subscription based service and i want to show you how to build the secruity walls arround your azure functions.

Here is an example of subscriotion service which caters differently for each client based on thier type of subscription. Free or Paid or Premium.

Step 1: Lets start with creating a smiple azure function in Visual Studio. For the purposes of our example created two functions one with GET and one with POST methods.

Publish this function project to Azure tenant and see it run and test.

Step 2: Now lets implement OAuth on top of this Function App. To do this go to Function App and go to Authentication. Add an Identity Provider and pick Microsoft Idenity and make an App Registration.

Now there is a OAuth layer and you can see that the functions wont respond with out a OAuth token.

The will respond with "401 Unauthorized":"You do not have permission to view this directory or page."

Now lets get that OAuth token using a postman request.

Now lets fire that request using the Bearer token.

Ok now with Oauth in place, we got one layer of protection. But this doesnt differentiate Free, Paid or Premium clients. They all can access the Azure functionality the same after having that OAuth token.

Step 3: Now its time for building the subscription based security layer around the OAuth enabled AZ functions. This is how it looks like by end of our configuration.

Lets start with creating a Azure API Management Service. It will take more than 10 mins to provision this.

Once created go to APIs and create new one selecting FunctionApp template and choose the functions exposed over that API. I created 3 API endpoints one for Free with just GetFunction(), Paid endpoint with POSTMethod() and Premium with all Functions.

Now lets test the Premium API with OAuth authorization. and see the result.

Result:

Step 4: Creating AZ API Subscriptions for each client with set API access is a best practice. So lets start creating the Sub Keys for each client and select the API for which they paid for.

Each subscription will have a primary and secondary key for access request. so now we send those clients these Subscription Keys and they need both OAuth key and thier own subscription key to access the azure functions.

Now when we made a request to API with OAuth it clearly says it needs the Subscription Key to access.

Now lets try with both with OAuth tokens and Subscription key, it goes thorugh sucessfuly.

Objective of providing access to Azure functions based on subscriptions was acheieved.

React Js Modularity - Breaking a monolith react component into modular components

2022-03-11T21:45:00.005-08:00

Earlier in 2017, I have written a few articles on Basics of SharePoint Framework, Use of React JS and React JS component life cycle.

But Most of the SPFx web parts I created were task oriented and not application oriented. This means the size of the React components is small.

Now I am working on a product / application level components which are complex and big in size.

Here is a screenshot of a POC I am currently working.

There are 3 Tabs, in which some tabs has roughly 4 to 5 forms with numerous fields. Now with what ever experience you have with SPFx and ReactJS development, imagine how big this component will be.

If you are dealing with any react component with more than 300 lines of code, you need to think about breaking that monolith into small chunks.

Its just not about no. of lines of code. Its about principle of "Separation of Concerns". I can envision above application as below.

Now question comes to how you going to separate functionality into different ReactJS components still make it work together.

There are 3 ways of doing it.

1. Functions:

Functions are used to separate small but reusable code that can be called in multiple places. Typical example would be headers and footers that can be written as functions and called in every page. below is the code sample how you do it in React.

2. Sibling Components:

This means the the components are completely independent of their actions, and there is not data propagation between them. In the above example the components "Information" and "Membership" are sibling components. How do we embed them in UI Component?

Here are the definitions of both Information and Membership components.

Now lets import these components into the UI component.

then this how we embed them in UI markup.

Here is the out come.

3. Parent Child Components:

Now in Template component , I have a Taxonomy picker control. For it to work, I need the Webpart Context. But you cannot find webpart context in child component. I need to send it from UI component.

How do we do that?

Create a constructor in child component , which accepts the properties from parent.

Now pass that webpart Context to Taxonomy picker.

In UI Component, this is how we send the Webpart Context to child component.

Now look at the out put

This is how we break monolith React components modular components and increase maintainability of our applications.

Happy coding !

Azure PIM Provisioning and Configuration

2022-02-10T12:57:00.013-08:00

Setting up PIM Administrator

Global Admins enable PIM provisioning and create PIM Admin role assignment.

PIM Admin Account Pre-requisites:

PIM admin account need to have below 2 licenses assigned.

Azure AD Premium P2
Enterprise Mobility + Security (EMS) E5

PIM Admin Setup:

1. Login to Azure portal as Global admin, navigate to Azure Active Directory.

2. In Featured highlights, click on
3. Click on “Azure AD roles” in left pane=> Navigate to “Roles” by clicking on
4. Search for “privileged role administrator”.

5. Click on “Privileged Role Administrator” role. Click on
6. Follow below configuration

Field	Value	Reason
Selected Member(s)*	PIM Admin Account	This should be an account which will be permanently treated as PIM admin
Assignment type	Eligible	This means PIM admin account is always eligible, but not active. PIM admin need to activate this role every time the changes need to be made to PIM configuration
Permanently eligible	YES	Always eligible, but not active.

7. PIM Admin setup is finished.

PIM Provisioning

PIM Admin will be enabling which roles need to be enabled for PIM Access requests and which users are eligible for PIM requests.

Enabling PIM Admin Role

Setup:

1. Login to Azure portal as PIM Adin account. Navigate to Azure Active Directory.
2. In Featured highlights, click on
3. Click on “My Roles” in left pane.
Here you will see all the roles for which current user is eligible for. As per above configuration “Privileged Role Administrator” role should be available permanently.

4. Click “Activate” button. User need to validate his credentials via Authenticator app by clicking on

5. Now the Duration slider will be enabled, and user can select how many hours the PIM admin role need to be activated.

6. PIM Admin role is active now.

Configuring PIM constraints for AD Roles

In this document we intend to enable below mentioned AD Roles for PIM requests.

1. SharePoint Administrator
2. Teams Administrator
3. Exchange Administrator

Setup:

1.As PIM admin user log into Azure Portal, go to Azure Active Directory, navigate to “Privileged Identity Management”.
2. Click on “AD Roles” => Navigate to “Settings” in left pane.
3. Search for SharePoint Administrator role. Click on it. Now Click “Edit” Button to set the configuration.
4. Follow below configuration

Field	Value	Reason
Activation Maximum Duration (Hours)	4	PIM Role Activation will automatically be disabled after 4 hours
On Activation , require	Azure MFA	PIM role will not be activated without Authenticator MFA approval.
Require Justification on Activation	True / Yes	Will make Justification txt field mandatory
Require ticket information on activation	Ture/ Yes	Will make ticket / SR field mandatory
Require Approval to activate	False / No	No approvals necessary as of now
Allow Permanent eligibility assignment	False / No	We want eligibility assignment only for a year.
Expire Eligibility assignments after	1 Year	Eligibility assignment for this role will be valid for an year.
Allow Permanent active assignment	False / No
Expire active assignments after	15 Days	We need to limit direct active assignments to minimum value so that they don’t overstay its welcome.
Require Azure Multi-Factor Authentication on active assignment	True / Yes
Require Justification on active assignment	True / Yes
Notification	Enable all emails and add any additional email IDs if required.

5. Now repeat steps 3 and 4 for remaining roles “Teams Administrator” and “Exchange Administrator”.

6.PIM Parameters for Ad role configuration is completed.

Enabling PIM Access for Users / Groups

This step is performed by PIM Admin by adding AD Users / AD Groups for each individual AD Role.

Setup:

1.As PIM admin user log into Azure Portal, go to Azure Active Directory, navigate to “Privileged Identity Management”.
2. Click on “AD Roles” => Navigate to “Roles” => Search for “SharePoint Administrator”
3. Click on “Add Assignment”, follow below configuration

Field	Value	Reason
Scope type	Directory
Selected member(s)*	AzureSecurityGroupForPIMAccess	This AD security group contains all the _admin accounts which requires elevated privileges from time to time.
Assignment type	Eligible	The users in security group will be eligible for this role up on PIM access request. This doesn’t mean it is activated.
Assignment Starts	Current date and time / Start date and time
Assignment ends	1 year from now	1 year is maximum eligibility as per above configuration.

4.Now repeat steps 2 and 3 for remaining roles “Teams Administrator” and “Exchange Administrator”.

5. Adding eligible user for each AD role PIM access is completed.

PIM Usage

PIM User Request

This is the process followed by Users to raise Just-in-time privileged access for various AD roles.

Pre-requisite:

User should be part of the “AzureSecurityGroupForPIMAccess” AD security group.

Setup:

1.User log on to azure portal. Navigate to Azure Active Directory
2. In Featured highlights, click on
3. Click on “My Roles” in left pane. User will see all the roles for whom user is eligible for just-in-time elevated privileges.
4. Click “Activate” Button, User need to MFA authenticated to enable the activate pane. Below information should be provided to activate PIM access.

5. Just-in-time elevated privilege was activated successfully. This will be active for next 4 hours.

Data Persistence Models in Docker Containers

2021-05-24T08:23:00.001-07:00

A container has different layers starting with Minimal Subset of OS topped by Container Filesystem topped by Application layer topped by Hosting layer. All these layers are read-only.

There is a top layer called Container Runtime layer which will be in a Read/Write state.

The data on Container Runtime layer is persistent only when the container is stopped/started . If a continer is deleted, this data will be lost forever. Also this data is isolated only to that continer and cannot be shared with other containers.

So lets look at better data persistance models to share data between different containers on a Host.

Volume and Bind Mount are two ways of persistent data storage thats avilable on a Host, which can be accessed (read/write) by multiple containers.

Volume is the storage created and managed by Docker. This means no containers can go beyond the boundaries of docker while working with volumes.

Bind Mount is the storage directly from file system of the host file. So if there is a malicious code deployed in a container, it can break the host by manipulating the host filesystem.

By now looking at color coding you should have understood that Volume is a better/safer way of storing and sharing data between containers. Let me show you by a demonstration.

For below demonstration, i have Docker Desktop, Windows Subsystem for Linux 2.0, Ubuntu 18.04 LTS installed on my dev machine.

This will enable my windows machine to run a Linux machine which i will be using as a host.

Lets work with Volume first

Let me open the Linux server and check the docker version first.

Then i will create a volume and i will name it "sharedvolume". Even if there is no folders at this point, volume will create necessary folders inside docker space.

Then i will create a linux container named "sender" with the sharedvolume mounted as "/app" folder inside container

docker --version
docker volume create sharedvolume
docker container run -dit --name sender --mount type=volume,source=sharedvolume,target=/app ubuntu

Lets list the running containers with Docker Container ls command.

Make a note of the CONTAINER ID of the sender container.

Lets access the filesystem of the container and from inside the sender container i will create a text file with intent of storing some data in the volume(/app folder).

docker attach <starting 4 letters of container id>
cd /app
echo "This is the data i want to share with receiver container">volumedata.txt
ls
more volumedata.txt
exit

more volumedata.txt is a command to read the content of that file which is saved inside volume.

Now lets create the second linux container named "receiver" with the same sharedvolume mounted as "/app" folder inside container. Then access the receiver container's file system, go to mounted sharedvolume (/app folder) and see if we can find volumedata.txt file and its content.

docker container run -dit --name receiver --mount type=volume,source=sharedvolume,target=/app ubuntu
docker container ls
docker attach <first 4 letters of receiver container id>
cd /app
ls
more volumedata.txt

See the data saved from sender container was now accessible in receiver container.

Let me show the best part. If you open explorer on your windows dev machine and go to "\\wsl$\docker-desktop-data\version-pack-data\community\docker\volumes\sharedvolume\_data" path, you can see the volumedata.txt file here.

if you look at the path, you can clearly see that this data is created/stored insode the content of Docker.

Now lets stop both sender and receiver containers and delete them.

docker container stop sender receiver
docker container rm sender receiver

Lets work with Bind Mount now.

Unlike Volume, you Bond Mount will not create folders, so you need to use an existing path/folder on your Linux host to store data.

Frist step is to create a folder called "bindstorage".

Then create the sender container again, but this time with bind-mount as the data storage mapped to /app folder.

The i will access sender container filesystem, create a binddata.txt with some content inside /app folder in the sender container.

mkdir bindstorage
ls
docker container run -dit --name sender --mount type=bind,source="$(pwd)"/bindstorage,target=/app ubuntu
docker container ls
docker attach <first 4 letters of sender container>
cd app
echo "this is the data saved in bindmount">bindmountdata.txt
ls
more bindmountdata.txt
exit

Now lets create receiver container wiht same bind-mount storage to data sharing.

Then lets see if we can find bindmountdata.txt file and its content.

docker container run -dit --name receiver --mount type=bind,source=$(pwd)/bindstorage,target=/app ubuntu
docker container ls
docker attach <first 4 letters of receiver container id>
cd app
ls
more bindmountdata.txt
exit

The data saved from sender container can now be read in receiver container.

You may have a question "apart from some syntax changes, both seems like same? why is volume is preffered one?"

Let me show the worst part of Bind-Mount storage model.

If you open the file explorer on your windows dev machine, and go to "\\wsl$\Ubuntu-18.04\home\linuxusr\bindstorage" path, you can see the bindmountdata.txt file.

This means the storage used in on the file system of the Hosting machine and with a bit of tweaking, any malicious code in a container can mess-up the Linux host and can break all other containers on that host, even scan for the details of other images and containers on the host.

Check this dirtyCOW which is a famous container vulnerability back in the day.

Hope i am helpful to some fellow developers.

Containerize ASP.Net Core app on Azure Kubernetes Cluster

2021-05-22T21:39:00.000-07:00

In my earlier post, we have deployed ASP.Net Core application to a Container hosted by a Linux Server.

There are some problems with this approach.

What if the Host VM is stopped?
What if Container Instance is stopped?
How do we manage the deployment of any app changes?
Even when we stop Host VM, you still be paying for the Disk allocated. How we can avoid that?

This is where Azure Kubernetes comes into the picture.

Azure Kubernetes provide serverless CI/CD experience which also manages Health, Security, Auto-Scaling, Deployment and Governance aspects. More details can be found here.

In this article we will be:

Deploy a ASP.Net Core App to a Container
Create a Container Image from .Net Core Container
Push the Image to Azure Container Registry
Use Kubernetes to Pull that image and create mutliple instances of the container in Kubernete Pods.
Expose the .Net Core App via Azure Load-Balancer.

Step 1: Create a ASP.Net Core Web App.

I named it "DemoContainerApp".

Since we need to containerize and generate an image of that container with out provisioning a Host, you need to select Docker support while selecting additional properties.

This may ask you to download "Docker Desktop" and "WSL 2.0 for Linux". Do it.

Now you have your ASP.Net Core App created and try running on IIS Express.

Step 2: Creating Container Registry

Go to Azure Portal, start by creating a Resource group for Container Registry. I named it "ContainerRegistryRG". Now search for "Container Registry" and create new one.

I have created a Container Registry named "MyAppRegistry247".

Step 3: Deploy Container Image to Azure Container Registry

We will use the capabilities of Visual studio combined with Docker Desktop to create a Container hosting our App then extract an image of of that container and push it to ACR.

Now right click on the solution and select Publish, and select the Azure Container Registry you created in Step 2.

Now publish the Application. This will do the following:

Deploy the current .Net Core Web App, to a Docker Container Using Docker Desktop.
Extract the Image of that said container and push it to Azure Container Registry

To verify this, open the Docker Desktop and click on Images and you will see bot of the images.

Now open Azure portal and search for Container Registry and open "MyAppRegistry247". Go to "Respositories", you should see the container image for democontainerapp.

Step 4: Create Azure Kubernetes Service Cluster

Lets start by creating Resource Group for AKS. I named it "aksRG".

Before you create Kubernetes cluster , you need to understand about Service Principal.

To simply put, Service Principal is the AAD credentials used by Kubernetes to interact with Container Registry to pull the container image to create instances of it in kubernete pods.

If you havent dealth with next step properly, you may end up with some errors like below.

"Cannot find user or service principal in graph database for 'msi'. If the assignee is an appId, make sure the corresponding service principal is created with 'az ad sp create --id msi'"

Execute below code to create a new Service Principal that can be used for Kubernetes interaction with ACR.

az ad sp create-for-rbac --skip-assignment --name demoAKSClusterServicePrincipal

This will generate Service principal with all the details displayed like below.

Copy appId and password (client secret) for creating Kubernetes Cluster.

Execute below commands

#Creating Kubernetes Cluster with Service principal association
az aks create --resource-group aksRG --name demo-aks-cluster --node-count 1 --enable-addons monitoring --service-principal  --client-secret 
#Install Kubernetes command tools
az aks install-cli --install-location=./kubectl
#Update the Kubernetes config with the service principal details
az aks get-credentials --resource-group aksRG --name demo-aks-cluster

With above commands AKS Cluster is ready, but nothing has been deployed yet.

Step 5: Run Kubectl commands to create Container intances load balanced.

There are two parts to hosting containers on Kubernetes pods. App & Service

If you open AKS Cluster we created in step 4, you will see options "WorkLoad" and "Services" in left pane.

Workloads is defined by app.yml file which will have details of container image details and number of Pods you want to host the containers.

Services and Ingresses is defined by service.yml file have details of which workload should be hosted on what port.

Create 2 files app.yml and service.yml with below content.

app.yml Content

apiVersion: apps/v1
kind: Deployment
metadata:
  name: democontainerapp-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: democontainerapp
  template:
    metadata:
      labels:
        app: democontainerapp
    spec:
      containers:
      - name: democontainerapp
        image: myappregistry247.azurecr.io/democontainerapp
        ports:
        - containerPort: 5000

service.yml Content

apiVersion: v1
kind: Service
metadata:
  name: democontainerapp-service
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: democontainerapp

Open Azure Portal, open Azure Cloud Shell.

Upload both the app.yml and service.yml files.

Run below command to get the ClientID from the service principal associated to Kubernetes Cluster and create a Role based access to Container Registry so that container images can be accessed by AKS.

$AKS_RESOURCE_GROUP="aksRG"
$AKS_CLUSTER_NAME="demo-aks-cluster"
$ACR_RESOURCE_GROUP="ContainerRegistryRG"
$ACR_NAME="myappregistry247"


$CLIENT_ID=$(az aks show --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query "servicePrincipalProfile.clientId" --output tsv)
$ACR_ID=$(az acr show --name $ACR_NAME --resource-group $ACR_RESOURCE_GROUP --query "id" --output tsv)
az role assignment create --assignee $CLIENT_ID --role acrpull --scope $ACR_ID

Now run below kubectl commands to create both workloads and services using app.yml and service.yml file we uploaded earlier.

#Create workloads
kubectl apply -f app.yml
#Create service and ingress rules with ports and loadbalancers
kubectl apply -f service.yml
#Bring the External IP address of load balancers for the pods hosting containers
kubectl get service democontainerapp-service --watch

Now go to said workloads and Services and Ingresses in Kubernetes Cluster and see them for yourself.

Workloads

Services and Ingresses

Copy the External IP with port in a browser and now you can access ASP.Net core hosted in a container on Kubernetes Cluster.

In next article, we will automate the code deployment and Rolling deployments in Kubernetes using Azure DevOps Pipeline.

Hope i am helpful to fellow developers.

Containerizing ASP.Net Core Application on a Linux Host

2021-05-09T21:04:00.002-07:00

In this article we will see how to deploy a ASP.Net Core 3.1 Webapplication to a container hosted on a Linux Host.

Beofore we jump into implementation, we need to look at every component and know what it does.

1. Host: This can be a Linux or Windows server. Considering Linux servers have used from long time for contanerization, i picked it. But Windows is very close choice considering all the capabilities it acquired in last 2 years.

2. Docker: It is the engine we use to host our containers. It will package the application with its dependecies and run them in isolated containers on the host.

3 Reverse Proxy Server: This will be sitting behind the firewall and redirects the user requests to appropriate apps/containers. This will provide extra layer of abstraction and reduces the public exposure of the containers.

4. Kestrel Web Server: When you install a .Net Core SDK, it will internally create a webserver to act as a backend server for the .Net Application. Proxy server will be sending the client calls to Kestrel Web server and responds back with the output from .Net App.

5. App: .Net Core Application we deploy to be containerized.

Lets begin the implemntation.

Step1: Provisioning the Host

Its recommended that you start using Azure Key Vault for storing the Admin credentials, SSH keys and

Certficate Private keys. So i have my Linux Admin password in Key valut.

I am creating a Linux server using below CLI commands.

$psw=az keyvault secret show --vault-name AdminCreds  -n MyLinuxAdminPSW --query value

az vm create -g LinContainerRG -n LinuxHost --image UbuntuLTS --admin-username linuxadminuser --admin-password $psw

Once the Host is created, go to the virtual machine in zure portal, go to Networking and open Port 80 for TCP connections.

Step 2: Install Docker on the Host

For this we need Putty to connect to our linux host. Download it from this link, and install.

Go to Azure portal and copy the Public IP of the host. Open a new session connection to the host using Putty. You need Public IP of the host for this.

Once you try to open the session, it will prompt you for credentials, use the admin credentials for now.

Run below commands one by one to install Docker engine on your host.

sudo apt update
sudo apt install apt-transport-https ca-certificates curl software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable"
sudo apt update
sudo apt install docker-ce

Now we got docker installed on our host.

Step 3: Setup Reverse Proxy Server

A proxy server is a machine with its own IP, which makes web requests on behalf of other machines/users. These can provide badwidth, privacy and additional layer of sceurity.

There are two types of proxy servers, below picture speaks volumnes about it.

Now you know whay we are using Reverse Proxy server infront of our containers.

You can use IIS Express, Apache or NGINX as a proxy server.

We will setup the proxy server on Host, by executing below commands.

sudo docker pull nginx:1.17.0
sudo docker images
sudo apt-get install nginx
sudo apt update

At this point if you try to broswe for http://PublicIP of your LinuxHost, this is what you see.

Step 4: Create .Net Core Application

We are now creating a basic Asp.Net Core webapplication. Go to Visual Studio 2019 and create a "ASP.Net Core Web Application". Framework as .Net Core 3.1

I call it "DemoCoreApp".

There are 2 small changes you need to do in code.

1. Go to Startup.cs and replace this line "app.UseHttpsRedirection();" with below code.

app.UseForwardedHeaders(new ForwardedHeadersOptions
	{
		ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
	});

As our core app will not be receiing call in ragulat client server fasion (http), it has to use Forward headers to identify protocal and IP details of the client. The above lines of code will take care of it.

2. Go to solution and add a file with name "Dockerfile" without any extention. Add below code to it.

FROM mcr.microsoft.com/dotnet/core/sdk:3.1
WORKDIR /app
COPY  . .
ENV ASPNETCORE_URLS http://*:5000
EXPOSE 5000
ENTRYPOINT ["dotnet", "DemoCoreApp.dll"]

I will explain every line of this code in following step.

Right click on the Docketfile and go to properties, chnage Copy to Output Directory to "Copy always".

Now build the project and Publish to a Folder, the published content will be in "\bin\Release\netcoreapp3.1/Publish" folder. Check that Dockerfile is copied to Publish folder.

Step 5: Transfer the Published content o Host

Download "WinSCP" from this link. Install it and open WinSCP to transfer publish folder to Host.

Connect the Host using the PublicIP address and the user credentials.

Left side shows the local files and right side shows the Azure host's file system.

Navigate to "\bin\Release\netcoreapp3.1/" on left side and make sure you opened "/home/Username" directory on your host.

Now Drag and drop the publish folder.

Now go back to your Putty session, and run bwlow code.

cd /etc/nginx/sites-available
sudo chmod 667 default

This will grant you edit access to dafult NGINX routing file.

Remeber we taked about reverse proxy where the proxy server routes the calls to containers based on certain conditions. Now we are going to write those conditions in that default file.

Open WinSCP tool and now navigate to /etc/nginx/sites-available/ and edit the default file.

Paste below content replacing the line "try_files $uri $uri/ =404;"

proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection keep-alive;
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;

This will take care of forwarding our calls to the .Net Core container.

Save and close it.

Now go back to Putty session and run below command.

sudo nginx -s reload

In some cases you might get an error while reloading NGINX, saying

nginx: [error] open() "/run/nginx.pid" failed (2: No such file or directory)

There are many fixes on google for this which suites for PROD environment, where you cannot afford to restart. But here i can. So lets go to Azure portal and restart the Linux Host.

Now connect to Host using Putty and run above command.

Step 6: Setting up container for .Netcore App

As i promised earlier, lets have a look at the commands in docker file which we embedded in app.

Now go to Putty session and run below commands one after another.

cd publish
sudo docker build -t democoreapp .
sudo docker run -d -p 5000:5000 democoreapp

Above command will execute the content from Dockerfile in publish folder and create a container to host .Net Core App on port 5000 in kestrel webserver.

Now on your dev machine, if you browse for http://PublicIP of your Linux Host, this is what you see.

Now, how do we know that app is running from container and not from Host itself?

Run below command to see list of containers running.

sudo docker ps

This will show all the containers running, and we can stop the container by running below command.

sudo docker stop XXX

XXX being the first 3 digits of CONTAINER ID, highlighted in above screenshot.

Now the container is stopped , and try accessing the app now.

Now we know that App is hosted in its own container on a Linux Host.

Lets start it back,

sudo docker run -d -p 5000:5000 democoreapp

Its back online.

We have sucesfully deployed .Net Core App in a container on a Linux Host

Azure Service Bus - Queues and Topics - Part 2

2021-05-05T18:57:00.004-07:00

Use Case: Organization X has a large-scale distributed serverless application environment. There are some azure components that sends a private messages which need to be accessed only once by other components using RoleBasedAccessControls. There are some messages that need to Fan-Out(one-to-many) to large number of systems, where sender doesnt need to know the receiver's details. The message should stay until time out, for receiving components to consume when they are avilable.

In the earlier article, we have seen how we can use Azure Service Bus Queues for integration of serverless application environment. Now we will explore Service Bus Topic and how it will be used.

We have already created Azure service Bus in earlier article, you can reffer the link provoided at the top for details.

Step 1: Creating Azure Service Bus Topic

Go to azure portal, and open the Service Bus we created "DemoAZSvcBus". In left pannel under "Entities", click "Topics".

Create a new Topic, name it "CorpAnnouncements".

Once Topic is created, Open it. Now in left pannel, under "Entities", click on "Subscriptions".

Create a new Subscription , name it "NZSubscription".

Step 2: Get Connection string for Azure Service Bus Namespace.

It costs money to create a storage account in azure, especially when you are using free tier or experimenting on your own. Thats why i use Azure CLI on Powershell 7.

Open Power shell and run below commands. After first command, you may need to authenticate to Azure console via browser, then close the browser. Make sure you check update Resource group name and Service Bus name in your command.

az login 
az servicebus namespace authorization-rule keys list --resource-group DefaultRG  --name RootManageSharedAccessKey  --query primaryConnectionString  --output tsv  --namespace-name DemoAZSvcBus

This command will bring back the connection string which you need to keep it aside for following steps. It will be in this formatt.

Step 3: Create CorpMessageSender (Service Bus Topic Message Sender)

Lets start with a folder "ServiceBus". All the projects from here on will be created inside it.

Open Shell, navigate to "ServiceBus" folder. Run below commands one after another.

dotnet new console -n CorpAnnouncementSender
CD .\CorpAnnouncementSender\
dotnet add package Microsoft.Azure.ServiceBus
Code .

These command will create a new .Net Console application, then install Azure Service Bus package and open the project in VS Code.

Copy below code to program.cs. You may need to write similar code in your azure component which is sending out secured, transcation bound messages to other systems.

using System;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Azure.ServiceBus;

namespace CorpAnnouncementSender
{
    class Program
    {
        const string ServiceBusConnectionString = "Service Bus Connecttion string goes here";
        const string TopicName = "corpannouncements";
        static ITopicClient topicClient;

        static void Main(string[] args)
        {
            Console.WriteLine("Sending a message to the corporate annpuncements topic...");
            SendCorpAnnouncementAsync().GetAwaiter().GetResult();
            Console.WriteLine("Message was sent successfully.");
        }

        static async Task SendCorpAnnouncementAsync()
        {
            topicClient = new TopicClient(ServiceBusConnectionString, TopicName);

            try
            {
                string messageBody = $"Organization X going public IPO in Jan 2022";
                var message = new Message(Encoding.UTF8.GetBytes(messageBody));
                Console.WriteLine($"Sending message: {messageBody}");
                await topicClient.SendAsync(message);
            }
            catch (Exception exception)
            {
                Console.WriteLine($"{DateTime.Now} :: Exception: {exception.Message}");
            }

            await topicClient.CloseAsync();
        }
    }
}

Save program.cs file, open shell and run

dotnet build

and now navigate to "ServiceBus" folder, run below command.

dotnet run -p CorpAnnouncementSender

You will see the result like this.

Lets explore Azure portal to see if the message has arrived.

Go to Service Bus "DemoAZSvcBus", select Queues and open "CorpAnnouncements" Topic.

You can see that the message we sent has been pused to all Subscriptions. In our case "NZSubscription".

Unlike Queue, the messages in Topics will be tunnel to subscriptions and they will stay there for the subscribers to consume. They stay there until message timeout.

Step 4: Create CorpAnnouncementReceiver (Service Bus Topic Message Receiver)

Open Shell, navigate to "ServiceBus" folder. Run below commands.

dotnet new console -n CorpAnnouncementReceiver
CD .\CorpAnnouncementReceiver\
dotnet add package Microsoft.Azure.ServiceBus
Code .

Now copy below code in program.cs file.

using System;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Azure.ServiceBus;

namespace CorpAnnouncementReceiver
{
   class Program
    {

        const string ServiceBusConnectionString = "Service Bus Connection string here";

        const string TopicName = "corpannouncements";
        const string SubscriptionName = "NZSubscription";
        static ISubscriptionClient subscriptionClient;

        static void Main(string[] args)
        {
            MainAsync().GetAwaiter().GetResult();
        }

        static async Task MainAsync()
        {
            subscriptionClient = new SubscriptionClient(ServiceBusConnectionString, TopicName, SubscriptionName);

            Console.WriteLine("======================================================");
            Console.WriteLine("Press ENTER key to exit after receiving all the messages.");
            Console.WriteLine("======================================================");

            RegisterMessageHandler();

            Console.Read();

            await subscriptionClient.CloseAsync();
        }

        static void RegisterMessageHandler()
        {
            var messageHandlerOptions = new MessageHandlerOptions(ExceptionReceivedHandler)
            {
                MaxConcurrentCalls = 1,
                AutoComplete = false
            };
            subscriptionClient.RegisterMessageHandler(ProcessMessagesAsync, messageHandlerOptions);
        }

        static async Task ProcessMessagesAsync(Message message, CancellationToken token)
        {
            Console.WriteLine($"Received corp announcement message: SequenceNumber:{message.SystemProperties.SequenceNumber} Body:{Encoding.UTF8.GetString(message.Body)}");
            //Uncomment below line if you want to delete the message from subscription
            //await subscriptionClient.CompleteAsync(message.SystemProperties.LockToken);
        }

        static Task ExceptionReceivedHandler(ExceptionReceivedEventArgs exceptionReceivedEventArgs)
        {
            Console.WriteLine($"Message handler encountered an exception {exceptionReceivedEventArgs.Exception}.");
            var context = exceptionReceivedEventArgs.ExceptionReceivedContext;
            Console.WriteLine("Exception context for troubleshooting:");
            Console.WriteLine($"- Endpoint: {context.Endpoint}");
            Console.WriteLine($"- Entity Path: {context.EntityPath}");
            Console.WriteLine($"- Executing Action: {context.Action}");
            return Task.CompletedTask;
        }  
    }
}

Save program.cs file, open shell and run

dotnet build

and now navigate to "ServiceBus" folder, run below command.

dotnet run -p CorpMessageReceiverr

You will see the result like this.

The Message in subcription will not be deleted unless you delete them exclusively using your code.

I have commented the line of code which deletes the message. Your programatic choice.

Lets check azure portal is the message still there even after received by the subscriber components.

Typically your messages will not be a text message like mine, but in realtime, it will be a JSON message possibley with a data object embedded into it.

I will Attach the source code for all 4 projects here. Download

Azure Service Bus - Queues and Topics - Part 1

2021-05-05T10:52:00.008-07:00

In this article, we will learn what is Azure Service Bus, Service Bus Queues, Service Bus Topics, How to access them programatically using .Net. Once you do it practically following my instrctions, you will understand the theory behind it. So follow me.

Why Azure Service Bus?

Service Bus is a message broker which handles Integrity, Security, Communication protocols of Messages at Enterprise level.

It has both Queues and Topics for message transmission. We will see each of it using .Net Console apps as both sender and receiver.

Use Service Bus queues if you:

Need an At-Most-Once delivery guarantee.
Need a FIFO guarantee.
Need to group messages into transactions.
Want to receive messages without polling the queue.
Need to provide a role-based access model to the queues.
Need to handle messages larger than 64 KB but less than 256 KB.
Queue size will not grow larger than 80 GB.
Want to publish and consume batches of messages.

Step 1: Create Azure Service Bus

Go to Azure portal, always start with a resource group. I named it "DefaultRG".

Next Create a Service Bus, i named it "DemoAZSvcBus".

Once Service Bus is created, in the left pannel, under "Entities", click on Queues.

Create a new Queue, name it "CorpMessages".

This is the queue we will use to send the private messages to other intended receiving systems.

For all the following steps, you need to install Azure CLI, .Net, Powershell 7, VS Code on your dev machines.

Step 2: Get Connection string for Azure Service Bus Namespace.

It costs money to create a storage account in azure, especially when you are using free tier or experimenting on your own. Thats why i use Azure CLI on Powershell 7.

az login 
az servicebus namespace authorization-rule keys list --resource-group DefaultRG  --name RootManageSharedAccessKey  --query primaryConnectionString  --output tsv  --namespace-name DemoAZSvcBus

This command will bring back the connection string which you need to keep it aside for following steps. It will be in this formatt.

Step 3: Create CorpMessageSender (Service Bus Queue Message Sender)

Lets start with a folder "ServiceBus". All the projects from here on will be created inside it.

Open Shell, navigate to "ServiceBus" folder. Run below commands one after another.

dotnet new console -n CorpMessageSender
CD .\CorpMessageSender\
dotnet add package Microsoft.Azure.ServiceBus
Code .

These command will create a new .Net Console application, then install Azure Service Bus package and open the project in VS Code.

Copy below code to program.cs. You may need to write similar code in your azure component which is sending out secured, transcation bound messages to other systems.

using System;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Azure.ServiceBus;

namespace CorpMessageSender
{
    class Program
    {
        const string ServiceBusConnectionString = "Service Bus Connection string here";
        const string QueueName = "corpmessages";
        static IQueueClient queueClient;

        static void Main(string[] args)
        {
            Console.WriteLine("Sending a message to the Corporate Messages queue...");
            SendCorpMessageAsync().GetAwaiter().GetResult();
            Console.WriteLine("Message was sent successfully.");
        }

        static async Task SendCorpMessageAsync()
        {
	    //Creating Service Bus Queue client 
            queueClient = new QueueClient(ServiceBusConnectionString, QueueName);

            try
            {
                string messageBody = $"Private message from CEO: Q1 Results: $1bn Profit";
                var message = new Message(Encoding.UTF8.GetBytes(messageBody));
                Console.WriteLine($"Sending message: {messageBody}");
		//Sending the private message to Service bus Queue
                await queueClient.SendAsync(message);
            }
            catch (Exception exception)
            {
                Console.WriteLine($"{DateTime.Now} :: Exception: {exception.Message}");
            }
			
            await queueClient.CloseAsync();
        }
    }
}

Save program.cs file, open shell and run

dotnet build

and now navigate to "ServiceBus" folder, run below command.

dotnet run -p CorpMessageSender

You will see the result like this.

Lets explore Azure portal to see if the message has arrived.

Go to Service Bus "DemoAZSvcBus", select Queues and open "CorpMessages" Queue.

Step 4: Create CorpMessageReceiver (Service Bus Queue Message Receiver)

Open Shell, navigate to "ServiceBus" folder. Run below commands.

dotnet new console -n CorpMessageSender
CD .\CorpMessageSender\
dotnet add package Microsoft.Azure.ServiceBus
Code .

Now copy below code in program.cs file.

using System;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Azure.ServiceBus;

namespace CorpMessageReceiver
{
   class Program
    {

        const string ServiceBusConnectionString = "Service Bus Connection string here";

        const string QueueName = "corpmessages";
        static IQueueClient queueClient;

        static void Main(string[] args)
        {

            ReceiveCorpMessageAsync().GetAwaiter().GetResult();

        }

        static async Task ReceiveCorpMessageAsync()
        {

            queueClient = new QueueClient(ServiceBusConnectionString, QueueName);

            Console.WriteLine("======================================================");
            Console.WriteLine("Press ENTER key to exit after receiving all the messages.");
            Console.WriteLine("======================================================");

            RegisterMessageHandler();

            Console.Read();

            await queueClient.CloseAsync();

        }

        static void RegisterMessageHandler()
        {
            var messageHandlerOptions = new MessageHandlerOptions(ExceptionReceivedHandler)
            {
                MaxConcurrentCalls = 1,
                AutoComplete = false
            };
            queueClient.RegisterMessageHandler(ProcessMessagesAsync, messageHandlerOptions);
        }

        static async Task ProcessMessagesAsync(Message message, CancellationToken token)
        {
            Console.WriteLine($"Received message: SequenceNumber:{message.SystemProperties.SequenceNumber} Body:{Encoding.UTF8.GetString(message.Body)}");
            await queueClient.CompleteAsync(message.SystemProperties.LockToken);
        }

        static Task ExceptionReceivedHandler(ExceptionReceivedEventArgs exceptionReceivedEventArgs)
        {
            Console.WriteLine($"Message handler encountered an exception {exceptionReceivedEventArgs.Exception}.");
            var context = exceptionReceivedEventArgs.ExceptionReceivedContext;
            Console.WriteLine("Exception context for troubleshooting:");
            Console.WriteLine($"- Endpoint: {context.Endpoint}");
            Console.WriteLine($"- Entity Path: {context.EntityPath}");
            Console.WriteLine($"- Executing Action: {context.Action}");
            return Task.CompletedTask;
        }   
    }
}

Save program.cs file, open shell and run

dotnet build

and now navigate to "ServiceBus" folder, run below command.

dotnet run -p CorpMessageReceiverr

You will see the result like this.

Message received, and this message will be deleted from Service Bus Queue, since the intended receiver have consumed the message.

You may need to write similar code in your receiving component.

We have finished Azure Service Bus Queues. In nest article Part-2, we will programatically send and recieve messages to Azure Service Topics and observe thier behaviour.

Azure Messaging Models

2021-05-05T03:51:00.001-07:00

All of this is straight from Microsoft Documentation. I am just grouping them for better reference.

Every time i say, "This is what Microsoft says, and then i validate the theory with a practicle implementation". This time, this article is full of thoery, so this is all about what Microsoft says. I take no credit for this infromation.

What is a message?

In the terminology of distributed applications, messages have the following characteristics:

A message contains raw data, produced by one component, that will be consumed by another component.
A message contains the data itself, not just a reference to that data.
The sending component expects the message content to be processed in a certain way by the destination component. The integrity of the overall system may depend on both sender and receiver doing a specific job.

What is an event?

Events are lighter weight than messages, and are most often used for broadcast communications. The components sending the event are known as publishers, and receivers are known as subscribers.

Events have the following characteristics:

An event is a lightweight notification that indicates that something happened.
The event may be sent to multiple receivers, or to none at all.
Events are often intended to "fan out," or have a large number of subscribers for each publisher.
The publisher of the event has no expectation about the action a receiving component takes.
Some events are discrete units and unrelated to other events.
Some events are part of a related and ordered series.

Use Queue storage if you:

Need an audit trail of all messages that pass through the queue.
Expect the queue to exceed 80 GB in size.
Want to track progress for processing a message inside of the queue.

Use Service Bus topics if you:

Need multiple receivers to handle each message

Use Service Bus queues if you:

Need an At-Most-Once delivery guarantee.
Need a FIFO guarantee.
Need to group messages into transactions.
Want to receive messages without polling the queue.
Need to provide a role-based access model to the queues.
Need to handle messages larger than 64 KB but less than 256 KB.
Queue size will not grow larger than 80 GB.
Want to publish and consume batches of messages.

What is Azure Event Grid?

Azure Event Grid is a fully-managed event routing service running on top of Azure Service Fabric. Event Grid distributes events from different sources, such as Azure Blob storage accounts or Azure Media Services, to different handlers, such as Azure Functions or Webhooks. Event Grid was created to make it easier to build event-based and serverless applications on Azure.

There are several concepts in Azure Event Grid that connect a source to a subscriber:

Events: What happened.

Event sources: Where the event took place.

Topics: The endpoint where publishers send events.

Event subscriptions: The endpoint or built-in mechanism to route events, sometimes to multiple handlers. Subscriptions are also used by handlers to filter incoming events intelligently.

Event handlers: The app or service reacting to the event.

What is Azure Event Hubs?

Event Hubs is an intermediary for the publish-subscribe communication pattern. Unlike Event Grid, however, it is optimized for extremely high throughput, a large number of publishers, security, and resiliency.

Choose Event Hubs if:

You need to support authenticating a large number of publishers.
You need to save a stream of events to Data Lake or Blob storage.
You need aggregation or analytics on your event stream.
You need reliable messaging or resiliency.

Otherwise, if you need a simple event publish-subscribe infrastructure, with trusted publishers (for instance, your own web server), you should choose Event Grid.

Event Hubs lets you build a big data pipeline capable of processing millions of events per second with low latency. It can handle data from concurrent sources and route it to a variety of stream-processing infrastructures and analytics services. It enables real-time processing and supports repeated replay of stored raw data.

Azure Durable Functions - Starter, Orchestrator and Activity Fucntions

2021-05-03T23:01:00.009-07:00

Use Case: A user starts to book a trip, which consists booking a Flight and Hotel and then pay for complete trip.

Back in the day, the answer used to be a single server-side application which is complex enough to take care of everything. Now we call it Monolith application.

Now we use microservices architecture to seperate the concerns at domain level. With Function as a Service, it even evolved to a Serverless state, where you can provision the services even without using any infrastructure.

Azure Functions is one of the critical components of serverless designs, and here is what we know about them:

Even-Driven: Azure functions are invoked based on a trigger caused by events like making a http call (or) adding a message to a Queue (or) adding a object to a blob storage (or) adding a new record to CosmosDB and many others.

Short-Lived: Azure functions are meant to for short period of excutions and to address a simple tasks which makes it more suitable for Microservices part of the design. Keep it simple and seperated.

Stateless: Azure Functions doesnt save any state infirmation of objects, thus the trigger mechanism will have both inputs and outputs.

Now considering above facts, i have created a design for above Use Case.

Now the deisgn is pretty much simple and self-explanatory. But here is the catch.

Inorder to confrim booking to the user, both flight and hotel bokings need to be done to finalize the cost of the trip. This means "Confirm Booking" should execute only when both "Book Flight" and "Book Hotel" are sucessful.

Give a thought for a minute how you going to handle in your opinion.

Here are the problems:

1. Both "Book Flights" and "Book Hotel" functions might not be executed at the same millisecond. YOu are not sure which one will finish first.

2. One of the functions might not be avilable right away. Due to the fact Azure function instances were created for every 10 seconds based on demand.

3. What if one of the function gave an error.

4. How do you orchestrate the out put of two functions withholding data until both of them were finiched exceuting. Remeber Fucntions are stateless.

Durable Fucntions: Durable Functions is a library that brings workflow orchestration abstractions to Azure Functions. It introduces a number of idioms and tools to define stateful, potentially long-running operations, and manages a lot of mechanics of reliable communication and state management behind the scenes.

Says Microsoft, but let us implement one and show you what it means.

Step 1: Create a Azure Function App.

Durable Function is a open source package embraced by micrisoft azure. For this we need to install the package. For that we need to create "package.json" file. This file will hold information of all the packages installed.

Open the Function App and in left hand menu click on "Console" in "Development Tools" category.

Run below command.

This will create a new file "package.json". Now click on "App Files" in "Fucntions" category. Open the package.json file and add below code.

{  "name": "DuraFuctionDemo",
  "version": "1.0.0"
}

Save the chnages and go to overview and restart the Function App.

Step 2: Install required packages.

Open Console again and run "npm install durable-functions". This might generate a new file with name "package-lock.json". Go to "App files" again and copy the content of "package-lock.json" file and paste it to "package.json" file and save.

Go to Overview and restart the Fucntion App again.

Step 3: Create Fucntions.

Durable functions has 3 roles.

1. Starter Fucntion - Invocation to this function will be handed over to Orchestartor Function.

2. Orchestartor Function - This function will make calls to Activity Fucntions based on context.

3. Activity Function - This function will do actual excution of the task and send back the response back to Orchestartor Fucntion.

Create a function, select "Durable Functions HTTP starter" as the template.

Leave the code as is.

Create 1st Activity Function.

Paste below code in BookFlight function.

module.exports = async function (context) {    return `Flight Bookings for the trip have been -  ${context.bindings.name}!`;
};

Create 2nd Activity Function.

Paste below code in BookHotel function.

module.exports = async function (context) {    return `Hotel Bookings for the trip have been -  ${context.bindings.name}!`;
};

Create Orchestrator function.

Paste below code in "BookingOrchestrator" function.

const df = require("durable-functions");
module.exports = df.orchestrator(function* (context) {
    const outputs = [];

    // Asyncronously calls both activity functions.
    outputs.push(yield context.df.callActivity("BookFlight", "Confirmed"));
    outputs.push(yield context.df.callActivity("BookHotel", "Confirmed"));
    
    
    return outputs;
});

We all all set for execution.

Step 4: Test the functionality.

Open Starter Function, click on "Test/Run" and give the orchestrator function name as parameter.

or you can copy the function url from "Get Function URL" from overview and replce below highlighted function name with orchestrator name.

https://durafunctiondemo.azurewebsites.net/api/orchestrators/{functionName}?code=oPaGqBv7jRVOxQjuJkiEtA/caBxb6Py4IzHCW0iE/okQXfDEi1k9kw==

This is the response and the "statusQueryGetUri" will give the final response combining the responses of all activity functions.

Here is the final response from Orchestrator function.

Step 5: What if one of the activity functions is not avilable.

Lets Disable "BookHotel" activity function.

Now repeat the Step 4 but browsing the url https://durafunctiondemo.azurewebsites.net/api/orchestrators/{functionName}?code=oPaGqBv7jRVOxQjuJkiEtA/caBxb6Py4IzHCW0iE/okQXfDEi1k9kw==

and then browse the url from "statusQueryGetUri".

You can see that the Orchestrator function ran the "BookFlight" function, but due to the fact "BookHotel" function is unavilable, its holding its state waiting for the response from "BookHotel" function.

Question is where is the state information saved for time being.

Ans: Its in a Azure Queue with all related information. Let me show you.

Now, lets enable the "BookHotel" activity fucntion. and then the orchestrator function will pick where it left and process the final output.

Once you enabled the Activity function, the Message saved in Azure Queue by Durable function is cleared as the Orchestrator function will process the final output.

Finally lets talk about Billing.

Unlike Azure functions, Durable-Functions were billed based on number of calls+ time of execution.

But, Orchestrator function has a special feature "Stop-Resume" behavior. Once one of the fucntion yeild the result, instead of waiting (synchronously), Orchestrator function will stop and saves its state as a message in a Queue. Once the response from second function arrives, it will start again and finishes its job.

Hope i cclarified the concept of Durable-Functions.

Azure Functions Basics - Part 2

2021-04-30T17:50:00.003-07:00

In earlier post, we have built the green part of below app. Part-1

Now lets continue building red part of the design.

Step 4: Create Azure Queue

Go to Azure portal and search for "storage account".

If we refer to Step1, where we create our first Azure Function, there is a storage account created as part of it. Lets open and see it.

Here you can see all the files related to Function App are stored in this blob storage.

Now lets create a Queue with name "orderqueue".

Step 5: Update "Fn_Save_PurchaseOrder" function.

Open "Fn_Save_PurchaseOrder" function and go to "Integration" pane, add one more output. This time select it as Azure Queue storage. Give the detail and make sure you selected the Storageaccount in which we created the Queue and click ok.

Now, the "function.json" file will be updated with new binding pertaining to Azure Queue.

Switch to edit "index.js" file and update it with below code.

module.exports = async function (context, req) {    context.log('JavaScript HTTP trigger function processed a request.');

    //creating a JSON string from request data
    var newitem=JSON.stringify({
        "id": req.body.id,
        "item":req.body.item,
        "make":req.body.make,
        "model":req.body.model,
        "buyer":req.body.buyer,
        "address":req.body.address
    });

    //saving the new item to newpurchaseorder output, 
    //which is PurchaseOrders container in this case
    context.bindings.newpurchaseorder=newitem;

    //Save the order item to Azure queue
    context.bindings.neworderqueueitem=newitem;

    //confirming the save success
    context.res={
        status:200,
        body : "Purchase Order saved sucesfully.",
        headers: {
            'Content-Type': 'application/json'
        }
    }
}

Now lets test the functionality, using the same input form before.

{    "id": "1002",
    "item":"mobile",
    "make":"samsung",
    "model":"S21",
    "buyer":"Pratap",
    "address":"Wellington,NZ"
}

This time, it not only saves data to CosmosDB, but also adds a message ot Orderqueue.

Step 6: Create more conatiners in our Cosmos DB to handle available stock data and shipping order data. I have added these two containers to same DB, and have a look at these partition keys.

I am adding some sample items to "AvailableStock".

Step 7: Create a new Azure Function "Fn_ConfirmDelivery". Go to Function Apps, select "Purchase OrderDemo", add a new function. Rember Function App is a container of Functions, so you can have multiple functions defined in same Function App.

This time choose "Azure Queue Storage trigger", as we want this function to be triggered when ever there is a new item added to "orderqueue". Give the details accordingly.

Once the function is created, go to "Integration" pane. This function has to read information from "AvailableStock" container and confirm the delivery. So lets add a new input and new outputs.

Please note that input is from CosmosDB's AvailableStock container to read the avialbility and Output is to CosmosDB's ShippingOrders container for creating a new shipment.

Now go to index.js file and update the code to below block.

module.exports = async function (context, myQueueItem) {    context.log('JavaScript queue trigger function processed work item', myQueueItem);
    
    var avilablemodel=context.bindings.avilablestock.find(model => model = myQueueItem.model)    
    
    if(avilablemodel.availableunits>0)
    {
        var newitemdelivery= JSON.stringify({
            "id":myQueueItem.buyer+"-"+myQueueItem.model,
            "shiporderid":myQueueItem.buyer+"-"+myQueueItem.model,
            "address":myQueueItem.address,
            "item": avilablemodel.item+avilablemodel.model
        })

        context.bindings.neworderdelivery=newitemdelivery
        context.log("Requested Item is ready for shipping")
    }
        
};

Save the function and test run by giving below data.

{    "id": "1002",
    "item":"mobile",
    "make":"samsung",
    "model":"S21",
    "buyer":"Pratap",
    "address":"Wellington,NZ"
}

This will read the item availability and if avialable, it will create a record in ShippingOrders as we expected.

Great. Since we finished everything from design, lets give a go from end to end.

This starts with a Http invocation to first azure function, and that should add order details in first container, then add a new message to orderqueue. This should trigger second function, which checks for availability and logs a shipping order in third container.

I am triggering the first function with below test data, a new watch for me.

Now lets go to CosmosDB and check both "PurchaseOrders" , "ShipmentOrders" containers for the results.

Azure Functions Basics - Part 1

2021-04-30T06:54:00.007-07:00

Azure Function: Azure Functions is a serverless application platform. It allows developers to host business logic that can be executed without provisioning infrastructure. Functions provides intrinsic scalability and you are charged only for the resources used. You can write your function code in the language of your choice, including C#, F#, JavaScript, Python, and PowerShell Core. Support for package managers like NuGet and NPM is also included, so you can use popular libraries in your business logic.

Says Microsoft, now we will build some simple stuff shown below and understand basics while we do so.

Azure function is a peice of code exceuted by events called triggers. They are meant for short period exceutions and designed to reduce complexity of your business logic.

This triggers may be a http call (or) a timely repetetion (or) a new item added in a CosmosDB (or) a new message added to a Azure Queue storage (or) a new item uploaded to a blob storage. There are wide variety of triggers avilable, which we see going ahaead.

But, you should ask a question, "Why Azure function instead of an App Service?"

App service is used to host both web applications and APIs. So why dont we deploy our code in App Services?

App Services are PaaS, this means though you haven't deployed a dedicated server, App services will be hosted on bunch of servers managed by Microsoft. So you will be paying money for hosting, irrespective of the usage. Where as in Function Apps, you pay for the usage.

I am not saying Azure function is suitable for everything.

Here are some limitations:

1. Exceution time 10 mins: Not suitable for long running or complex business processes. Use WebJobs for long running process. If your code requires mutiple re-trys or communication with external resources try app services instead.

2. Exceution Frequency: Surely more Azure Function instances will be created every 10 seconds up to total 200 instances and each instance support many concurrent requests. Azure Functions are meant for short and on-demand calls. So if you have a functionality that should run 24/7 , better choose either App service or a service hosted on your dedictaed VM instance.

Step 1: Go to azure portal and serach for Function Apps.

Azure Function App is a container/wrapper for a set of functions.

Create a Function App. I choose Resource group as "SampleRG", Function Name as "PurchaseOrderDemo" and Language as "Node.JS".

Please note that a storageaccount will be created as part of this. We will use it in later steps.

Lets create a new function. You can go to "Functions" option on left pane and click it.

Add a new function using "+Add" button on top.

You will be presented with a bunch of triggers. For our first function, choose "Http Trigger".

Once you select trigger, you can name the function and select authorization.

If you select "Fucntion" as authorization, you need a key to invoke this function, which i will show in next step. Go ahead and create the function. Once the function is created , you will be taken to a page like this.

"Code+Test" is where you will write your code and do unit testing.

"Integration" is visual tool where we will add new inputs like reading data from other components like Queues and CosmosDB.

By default the function will be created with some sample code which we can exceute and see.

Lets see how it goes.

First understand the code. All it does is accept a Http request and fetch the "name" key-value pair from its body and write a response saying Hello to the name value we provided.

There will be 2 files associated to the function.

"Index.js" file will have all our code.

"function.json" file will have binding information. This code will be geneated from the triggers and inputs we configure in "Integration" part. You see more when we configure inputs for CosmosDB and Azure Queues.

Now click on that "Get Function URL" button and paste it in a new tab. It will be something like this.

Look at the highlighted part in URL, this is what you copied from the "Get Function URL" button. There is a code embeded there due to the fact we choose "Function" as authorization earlier. If you choose "Anonymous" as authorization, you need no code to invoke this function via http call.

I have added "&name=PRATAP" at the end, this is the body of the http call i passed as query string.

Thus by making a http call i invoked the function, and it responded to me by reading my name from the call.

This is what out of the box functionality does.

Step 2: Time to create a Cosmos db and containers for our purchase order data . A database account is required to create DB.

Once DB account it created you will be taken to a page, on the left pannel click "Data Explorer" option. It will be empty.

Lets create the Cosmos DB now. If you click the arrow next to "+New Container" , you can see "+New Database" option. Select it.

Once the DB is created, this is how Data Explorer will look like.

Now select "New Container" option. A cointainer is collection of Items. I choose "/id" as partition key.

Once container is created, lets test it by adding a item manually.

Remeber Cosmos DB is a NoSQL database designed to store non sturctured data like json.

Click on "New Item" button and enter our first data item record, and click "Save" button.

BOOM... new item information has been saved to Cosmos DB. Lets modify our "Fn_Save_PurchaseOrder" function to do the same, when it was invoked with right data.

Step 3: Open the function we have created and tested earlier "Fn_Save_PurchaseOrder".

Click on "Integration" from left menu. A visual flow will be displayed showing the triggers , inputs and outputs. We created this function to be a Http trigger, so that out mobile app can send a http call to trigger save operation.

Saving the purchase order information to CosmosDB should be the output of this function.

Click on the "+ Add Output" button and select "CosmosDB" and give the DB name, Collection name.

Now look at the "Document parameter name" field. The value we give in this field is registered in "function.json" file.

Now look at "Cosmos DB account name connection" field. Intially it will be empty. By clicking "New" button, you get to select the database account with which this DB is connected to.

Click "OK" and save it. Earlier i talked about "function.json" file. The code inside holds all the refrences to triggers and inouts and outputs. This is how it looks right now.

Now select index.js file and paste below code.

module.exports = async function (context, req) {    context.log('JavaScript HTTP trigger function processed a request.');

    //creating a JSON string from request data
    var newitem=JSON.stringify({
        "id": req.body.id,
        "item":req.body.item,
        "make":req.body.make,
        "model":req.body.model,
        "buyer":req.body.buyer,
        "address":req.body.address
    });

    //saving the new item to newpurchaseorder output, 
    //which is PurchaseOrders container in this case
    context.bindings.newpurchaseorder=newitem;

    //confirming the save success
    context.res={
        status:200,
        body : "Purchase Order saved sucesfully.",
        headers: {
            'Content-Type': 'application/json'
        }
    }
}

Now save "Index.js" file. Click "Test/Run" button to unti test our code.

Use below code in the body for unti testing.

{    "id": "1002",
    "item":"mobile",
    "make":"samsung",
    "model":"S21",
    "buyer":"Pratap",
    "address":"Wellington,NZ"
}

Select the post method and run the test.

Lets check the data in CosmosDB as well.

There it is. Data saved to DB sucessfully.

Now looking at the design again, we should ask why do we need second Azure function to confirm deliveries. Cant we just add that code in this function.

Answer: What if there is an exception generated in confirmation part, How do we handle it?

Azure functions are good at doing one thing "DOING ONE THING".

In this design we add a message to a Azure Queue, which will trigger another function, which checks avilability of items and create items in Ordershipments.

Lets say if the items are not available, then we add one more queue followed by another function which add the order details in Pending Orders container.

Usually people say there is no re-try capability in Azure functions, but by adding error handling and Azure Queues, we can even implement re-try functionality as well.

In the next article we will continue adding remining functionality which familiarizes us with hadling Azure Queues and both input and Output bindings of Azure Functions.

Hope i made it as simple as possible. Part-2 link is here.

Azure Policy and Compliance Management

2021-04-25T06:57:00.001-07:00

Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity.

Thats what Microsoft documentation says. Now let me say in my way.

I work in a bank and the regulatory compliance says, data of our bank shouldn't leave Autralia.

So if one of our developers deployed a production azure resource in any other AZ Regions, our organization has to pay big penalties for not complying with regulations.

How do we do it? Using Azure Policy Assignment.

Before we jump on to implemntation, you need to know about difference between Policy and Initiative.

To keep it simple, Policy is a rule and Initiave is a collcetion of policies which set a standard.

Eg: ISO(standard) is a Intiative, which comprises of many policies which makes that standard.

So you can assign either a policy or an initiative to a resource group or entire subscription to make your resources comply with regulations. You can create new policies or initiatives of your own that were tailored for your organizational needs.

Enough theory, lets implement.

I have created a resource group "DefaultRG". So as per my Organizational needs, i need to make sure any resources created in this resource group are located in same region "Australia-East".

Go to Azure portal and search for "Policy".

There are many policies that were already defined in azure which we can use in our case. Click on Assignments, where we will assign an existing policy to our resource group.

In Policy assignment screen, i choose to apply this policy to a resource group, instead of entire subscription.

In the "Parameters" and "Non Compliance Message" tabs, select the region you choose to deploy for your compliance and give the error message to display if someone try to defy the policy.

Review and Create.

Since the policy is in place , lets test it.

I am using a Azure CLI command in powershell to create a VM in association with DefaultRG, but in a different region (Europe-West).

vm create --resource-group DefaultRG --name myTestVM --location westeurope --image ubuntults --admin-username azureuser --admin-password AZpassword12345

Now, lets see what happens.

"Error Code: RequestDisallowedByPolicy

Message: Resource 'myTestVMVNET' was disallowed by policy. Reasons: 'Resources in DefaultRG should only be deployed to Australia-East region.'. See error details for policy resource IDs."

"MyTestLocationPolicy" assignment stopped me from creating a resource in a different region.

What happens if we applying a policy to an existing resources.

This time, i deleted the policy assignment and then created a new VM by keeping region as "Australia-East".

Now i will add a new data disk under same resource group but the location as "Europe-West".

Lets create the Policy assignment just like how we did earlier. After few minutes, the compliance status will be updated and it will show the non-compliance.

Note that, if a new policy is applied and if there is a no-compliant resource , it will not do anything, except riase non-compliance notification.

Hope i bring some clarity on Azure Policies and Compliance Management.

Adding Swagger to Existing .Net Core WEB API Project

2020-08-17T17:43:00.006-07:00

In this article we will see How we can add Swagger to an existing WebAPI project.

First why we need swagger here in this case?

Unlike SAOP based web sevrices or WCF Services, WebAPI are RESTFul. That means there is no WSDL in WebAPI. So Unless you prepare proper documentation about the methods, parameters and outputs, its hard to any consumer of the service to interpret them.

This is where swagger comes into the picture. If you use swagger and SwaggerUI in your WebAPI project, it pretty much takes care of the documentation part. It not only gives you the complete details of methods, parameters and outputs of the sevice, but also provides a UI component where consumers can test the service, without any third party tools.

For this example, i am using WebAPI project from one of the course on Linkedin Learning.

Here is the link for you to download and try it for yourself.

Download it and open the project and run it.

You will see this. With out any documentation, how anyone could interpret this.

Lets start with the swagg.

Step 1: Open Existing WebAPI project in Visual studio. Go to Tools and open "Nuget Package Manager" and click on "Manage Nuget Packages for the Solution".

Now browse for "Swashbuckle.ASP.Net Core", install it by selecting the WebAPI project.

This will install both Swagger and Swagger UI refreneces in your project.

Step2: Open Startup.cs file. This file handles all the regsitration of the controllers we use in WebAPI and the request pipelines. If you read default comments provided by framework itself, you will understand.

There are 2 methods in that file.

1. ConfigureServices(): This is where you need to register all the controllers you expose in your service.

2. Configure(): This is where you will register request pipeline like handlers,authorization and routing.

Add assembly reference of "Microsoft.OpenAPI.Models"

Add below code in ConfigureServices() method.

services.AddSwaggerGen(c=> {
     c.SwaggerDoc("v1", new OpenApiInfo { 
                            Title="HPlus Sports",
                            Version="1.0",
                            Description="Product API for HPlus Sports."                   
                });
            });

Add below code in Configure() method.

app.UseSwagger();
app.UseSwaggerUI(c=> {
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "HPlus Sports");
            });

With this we requested to generate SwaggerDoc and also regietred it with endpoint "/swagger/v1/swagger.json".

Also we requested SwaggerUI to use the above endpoint for its testing purpose.

Step 3: Lets build the solution and test it.

Run the project and you will see this as earlier.

Now change the url form "https://localhost:44321/api/product" to "https://localhost:44321/swagger/v1/swagger.json" and you see the json of the service revealing all the details required for invoking methods with proper parameters.

On top of this if you change the url to "https://localhost:44321/swagger/index.html", Service consumers can access SwaggerUI to run tests on the service to understand the output of the service calls, without using any third party tools.

let me know if it helps. Thank you.

Azure DevOps 101 - Creating your first Build and Release Pipelines for automated deployments to DEV, QA and PROD

2020-08-15T08:12:00.017-07:00

DevOps: I cannot do justice to DevOps in a single article. Its an Ocean. But for our purposes here is what i would say if some one asks me about it.

"DevOps is a practice in which all the stakeholders were actively involved in entire lifecycle of product from Development , Testing, Productionizing and Production Support."

Core values of DevOps defined by CAMS - Culture, Automation, Measurement and Sharing.

This is eagle eye view of the core values.

Lets talk about second core value, Automation. Its not about just automation of everything in software life cycle.

Automation: It talks about fastening stages of SDLC with continuous integration and delivery thus reducing effort and time to roll new changes. Multiple changes getting tested and deployed in a day - make people's life a lot better. Please keep in mind "Automation" in DevOps means giving prefference to "People over Process over Tools".

Please reffer to various guides or gurus for deep dive into DevOps.

Our objective here is to implement CI/CD (Continuous Integration / Continues Delivery) in Azure and learn how to cofigure your first Azure Devops Build and Release pipelines. Using which we will push our code to various stages DEV, QA and PROD.

Pre-Requisites: You should have Azure subscription ; Visual Studio and Git installed on your machine.

Step 1: First i am logging in to Azure console and creating 3 WebApps with DEV, QA and PROD attached in thier names. I am using .Net Core 2.1 code , so i am using same framework for the Azure WebApps.

Great. There is nothing deployed to these app services yet.

Step 2: Open Visual studio and create a .Net Core web application targetting Core 2.1 Framework.

I am using VS2019 here. Please make cure you installed Git on dev machine before you create this project.

Choose "ASP.Net Core Webapplication" in templates and then Choose "Web Application" and Framework 2.1 as shown below.

Great. Project is sucessfully created. Press F5 to see the output. Look at the Url.

Step 3: Lets deploy this to Azure WebApp in DEV.

Right click on solution and click publish. If you are using the same account for both visual studio and Azure subscription, Visual studio will automatically display your subscription and available webapps to deploy. If not you may need to configure a dpeloyment profile in which you need to give subscription details.

Now once the deployment is finished , browse your dev version of App Service with name "AZWebApp-Dev" and here is the out put. Look at the url.

Wait we talked about Automation, CI/CD , Azure DevOps. But what we did is a manual deployment.

This is not ideal. So lets automate this.

Step 4: Go to Visual Studio where the project is opened currently. Open terminal from "View" menu.

Now you see that all of your project files are committed to your local git repository.

To view your local git repo, go to "Team Explorer", click on the bottom Git symbol, you will see local repos. But initially your new repo wont be shown, so add it as shown below and give the project folder path and it will show up.

Now once it is added, click on "AZWebApp" repo, you see both your default repo and the new one. Double click on new "AZWebApp" repo and close the VisualStudio and reopen and open project. This is what you will see.

You can remove the default repo and make sure the current repo is highlighted as shown below.

Step 5: Go to Azure console and search for "Azure DevOps Organizations", and click on it.

You may need to create an organization, which is registering a unique organization assciation with your subscription. Here is mine.

Create an Organization and its time to create a Project under that. Click on the link "New Project".

I created my Project with name "Demo" and selected Git as the source control for this. I kept it a private project as i dont bother to share it with anyone.

Once the project si created, you will be taken to a page where you see various Icons which were shown below.

On your project summary page , in the left side pannel, click on Repos. Now it will say that "Demo os empty add some code to it."

Click on the "+" button and add a new repository. I names it "AZWebAppRepo" and choose Git Ignore as Visul Studio, as i want unnecessary files form VS to be checked in.

Once created, you can see there will be only 2 files. ReamMe text file and a gitignore file.

Its time to push our code to this repo.

Step 6: Go to Visual studio and open the project and go to "Team Explorer". Click on "Manage Connections" and select "Connect to a Project" option. A window will be opened with your azure DevOps Organizations listed. Click on Organization (in my case "Demo") and click Connect.

Now you will see like shown below in your "Team Explorer". Select your Azure Devops organization name and click on the drop arrow highlighted. Now click on "Sync" option. By this we are asking to synch the local Git repo to the Repo on our Azure Devops organization.

It should comeup with a window like this. Dont worry if it doesnt. Some times you may need to re-open the project one more time from Visual studio with out closing the IDE after connecting to Azure Organization.

Publish the current local repo to Azure Devops Repo by clicking the highlighted button. now you have to select the Organization, the Project and the Repo we created in Step 5. Here is mine.

Publish repository and you get a sucess message.

You might get an error message saying

"Error encountered while pushing branch to the remote repository: rejected Updates were rejected because the remote contains work that you do not have locally. This is usually caused by another repository pushing to the same ref. You may want to first integrate the remote changes before pushing again."

This is because of the conflicts you trying mutiple times to publish and some conflicts between local and Azure repos. Use below command and it will be done.

git push -f origin master

Now go back to Azure Repo we created in Step 5. You can find all the code published to Azure Repo.

Step 7: We have created Repo, now we need to go for Build Pipeline.

Go to Azure portal and open your Azure Project. You see a rocket shaped icon which says "Pipeline". Click on it. We havent configured any pipelines yet so lets start by clicking Create new Pipeline.

Now if you are a pro in Yaml configuration, please go ahead and create your pipeline. But for first time please click the link which says "Use the classic editor" Which will take us to this.

Next step is to select which template we want to use. Select ASP.Net Core (.Net Framework) and lcick apply.

Now you will see a GUI to configure various tasks. First rename the Pipeline, and the Agent which i have highlighted below. You many need to add various tasks based on additional dependecies and Nuget packages you have installed. But in our case ours is vanilla code. So we rename the Build pipeline and gaent and save.

Now click on trigger section. and select "Enable Continious Integration" checkbox. By doing this we are saying rollout a build everytime i check in the code to Azure Repo.

Click Save and give appriproate comments. With this our build pipeline has been configured.

Step 8: Lets create a "Release Pipeline". On Azure portal, go to Project page and in the same Pipeline menu on left side pannel, click on "Releases" this time. Click on "Create New Release Pipeline" button.

once you applied "Azure App Service Deployment" template, rename the the stage to "Development".

Now click on "1 job, 1 task" link and it will take you to Tasks pane.

Here you need to select the Azure subscription, and Authenticate. Once authentication is sucessful, you will see available App Sevrices to which you can deploy. I select "AZWebApp-Dev" as this is Development stage.

Save it and come back to PipeLine tab. We have configured to which WebApp it has to deploy. Now we have to configure what has to be deployed and from where. Click on "Artifact" icon. This will give some options and we have to choose the Build pipe line option and select the Build pipeline we created in Step 7.

Add the Build pipeline to artifact and save the Release pipeline. Now pay close attention to little lightning icon on our artifact. Its a trigger. Click on it.

On your right hand side you see a toggle for enabling continious delivery. this means everytime we have a new build form our Build pipeline, we want a new release to be rolled out.

Edit the release pipeline name and save it.

With this we have configured both our Build and Release pipelines for a basic vanila ASP.Net Core webapplication.

Step 9: Lets modify the code in our ASP.Net Core application. Open Visual Studio and open the project.

I want to make a small chage to code by editing the ./Pages/Shared/_Layouts.cshtml and changing the "AZWebApp" name to "AZWeApp_Update".

Save it and now go to "Team Explorer". Bottom you see a small Pencil Icon showing number of files changed. Click on it. Now you see "_Layouts.cshtml" file as one of them. Right click on the file and sleect Stage. This means we are trying to make this file as part of next commit. Now "_Layouts.cshtml" file will be shown under staged files.Give the proper Comment as this will be displayed toughout your automated deployment.

Please understand that we have commited the change to Local Git Repo, not the Azure Repo.

Inorder to do that, in Team Explorer, there is a small "Plug" icon with in connection manager. Click on it and no select Azure Repo and click on the down arrow shown below and select "Sync".

Now you san see the Push Option enabled as there is a Local Git Repo Commit available that is not commited to Azure repo. Click Push. With this we checked in the code change to Azure Repo.

Now go to Azure portal and open Azure Devops Project we created "Demo". Click on "Pipeline" on left side pannel. You can see an automated build was rolledout due to ou code check-in.

Now go to Releases and you will see a automated build was released to Development stage, which is still in-progress here.

Wait until it is completed and now click on the Release task and you will see this.

Lets browse our Azure App Sevice "AZWebApp-Dev". Here is the new code running in Azure WebApp dployed using Azure DevOps CI/CD.

Its not yet over. But we are close. Now we need to configure two other stages, QA and PROD.

Step 10: Open Azure Devops Project and navigate to Release pipeline we created earlier.

Repeat everything we done in Step 8 and select App Service "AZWebApp-QA" for QA stage and "AZWebApp-Prod" for Production stage.

Unlike DEV, We dont want to roll out every change to QA and PROD. So pay attention to little icon in front of QA and PROD stages.

When you click that Icon representing "Pre-Deployment Conditions", there is an option to enable Approvals over what to be deployed. Add the right users to the approval group and do the same for PROD as well.

Now we are all set for an End to End deployment using basic Azure DevOps CI/CD.

Repeat Step 9, changing the code. Now i am changing "AZWebApp_Update" to "AZWebApp_Finale". Staged the chnage and checking in the code. This should trigger automated deployment.

You can see an ongoing build in Build Pipeline.

Once Build is sucesfully rolledout, lets go to Release Pipeline.

Once Dev is Completed, you will see QA is pending with our Approval.

QA Deployment is finished and now PROD release is waiting for my Approval. After Approval, the PROD release starts.

Finally PROD deployment is also finished.

Lets check the final output on PROD App Service.

Ok, now we are done. Happy Learning.

Terraform - Provisioning Infrastructure level Security in AWS

2020-07-27T02:13:00.001-07:00

A year ago I have created an article showing how to create infrastructure-level security in AWS step by step. Now its time to automate the provisioning process using Octopus and terrafrom.

We have done it manually from AWS Management console.

Here is the link for the earlier article.

Here are the components we intend to create using terrafrom.

We will be creating VPC, Public and Private Subnets, RoutTables, Security Groups, Inbound / Outbound rules for communication channels on each of the security groups.

First i would recommend creating all this components manually so that you know in and out of the significance of each component and know the dpeendecies of each of those components on others.

Read the above mentioned article for manual process and indetail explanation of each of the components.

Now coming to Terrafrom, i hope you have read the "IaC Infrastructure as Code using Terraform - Basics" and "IaC - Terraform Automation using Octopus Deploy" articles from earlier. These articles will give basic understanding and implementation of Octopus integration with terrafroms from scratch.

By now if you follow above articles you should be able to create Octopus projects and create deployment steps as part of process and able to deploy componenets (S3 Bucket) to AWS.

We will add two additional steps to process to deal with creation and deletion of all the components shown above.

Now lets deal with code required to create the components shown in above picture.

terraform {
    backend "s3" {
        bucket = "#{terraformstates3bucket}"
        key = "#{terraformvpcstatekey}"
        region = "#{awsregion}"
    }
}

provider "aws" {
  region="#{awsregion}"
}

resource "aws_vpc" "tf_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags {
    Name = "My Octo AWS VPC"
  }
}

resource "aws_internet_gateway" "tf_internet_gateway" {
  vpc_id = "${aws_vpc.tf_vpc.id}"

  tags {
    Name = "My Octo AWS IGW"
  }
}

resource "aws_route_table" "tf_public_rt" {
  vpc_id = "${aws_vpc.tf_vpc.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.tf_internet_gateway.id}"
  }

  tags {
    Name = "My Octo AWS Pub RT"
  }
}

resource "aws_default_route_table" "tf_private_rt" {
  default_route_table_id  = "${aws_vpc.tf_vpc.default_route_table_id}"

  tags {
    Name = "My Octo AWS Pri RT"
  }
}

resource "aws_subnet" "tf_public_subnet" {
  count                   = 1
  vpc_id                  = "${aws_vpc.tf_vpc.id}"
  cidr_block              = "10.0.0.0/24"
  map_public_ip_on_launch = true
  availability_zone       = "us-west-2a"

  tags {
    Name = "My Octo AWS Pub SubNet"
  }
}
resource "aws_subnet" "tf_private_subnet" {
  count                   = 1
  vpc_id                  = "${aws_vpc.tf_vpc.id}"
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-west-2b"

  tags {
    Name = "My Octo AWS Pri SubNet"
  }
}

resource "aws_route_table_association" "tf_public_assoc" {
  count          = "${aws_subnet.tf_public_subnet.count}"
  subnet_id      = "${aws_subnet.tf_public_subnet.id}"
  route_table_id = "${aws_route_table.tf_public_rt.id}"
}
resource "aws_route_table_association" "tf_private_assoc" {
  count          = "${aws_subnet.tf_private_subnet.count}"
  subnet_id      = "${aws_subnet.tf_private_subnet.id}"
  route_table_id = "${aws_default_route_table.tf_private_rt.id}"
}

resource "aws_security_group" "tf_public_sg" {
  name        = "My Octo AWS Pub SG"
  description = "Used for access to the public instances"
  vpc_id      = "${aws_vpc.tf_vpc.id}"

  #SSH
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  #HTTP

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "tf_private_sg" {
  name        = "My Octo AWS Pri SG"
  description = "Used for access to the private instances"
  vpc_id      = "${aws_vpc.tf_vpc.id}"

  #SSH
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    security_groups = ["${aws_security_group.tf_public_sg.id}"]
  }

  #HTTP
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    security_groups = ["${aws_security_group.tf_public_sg.id}"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Add above source code to both

1. Create AWS VPC step which is a Terraform-Apply step

2. Delete AWS VPC step which is a Terraform-Destroy step

Now i deployed the build and choose to run Create AWS VPN step.

Here is the output.

You can see that irrespctive of the order i mentioned resources , terraform being a good provisioning tool, it interprets what need to be created first and which component creation should follow.

I have taken individual snapshots of all the components created in AWS and pasted in a single screenshot.

When you run the "Delete AWS VPN" step, terraform will identify the dependencies between components and delete them in right order.

Thus we can provision infrastructure level security boundaries in AWS using Octopus and Terrafrom.