4/16/2019 2:13 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

How to reduce DevOps risks with Azure Resource Manager 4/16/2019 2:13 AM BRK3390 How to reduce DevOps risks with Azure Resource Manager Gaurav Bhatnagar – Senior Program Manager David Tepper – Principal Program Manager © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Agenda Intro to Azure Resource Manager Current challenges with complex deployments Intro to Azure Deployment Manager Deep dive on Azure Deployment Manager concepts Demo

Azure Resource Manager - Basic concepts of deployment Subscriptions Resource Groups Regions Resource Providers/Resource Types Template/Parameter files Resources to be deployed – template file Input needed from user – parameter file

Sample Azure Resource Manager Template "$schema": "https://schema.management.azure.com/schemas/2015-01- 01/deploymentTemplate.json#", "contentVersion": "", "parameters": {}, "variables": {}, "resources": [{ "apiVersion": "2016-01-01", "type": "Microsoft.Storage/storageAccounts", "name": "mystorageaccount", "location": "westus", "sku": { "name": "Standard_LRS" }, "kind": "Storage", "properties": { } }]

Benefits of using ARM - Declarative Deployments Infrastructure as Code Declarative, repeatable, idempotent deployments Automate deployments to dev, test and prod Plug into any existing CI-CD pipeline like VSO, Jenkins etc. Resource Group (RG1) Resource Group (RG1) Group (RG2)

Typical scenario: Service segmentation based on region Resource Group (RG1) Group (RG2) Region 1 Region 2 Resource Group (RG1) Resource Group (RG2) Resource Group (RG1) Resource Group (RG2) Region 3

Current Challenges Global deployment across regions 4/16/2019 2:13 AM Current Challenges Global deployment across regions Detect unhealthy deployments before impacting multiple regions Service level view, footprint, and structure Orchestrating higher level dependencies Ability to update services without downtime © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure Deployment Manager

Azure Deployment Manager 4/16/2019 2:13 AM Azure Deployment Manager Staged rollouts of ARM resources Schematized deployment for multiple services Enables safe deployment practices Easy multi-region deployments Deployment Manager Completely Free! Highly scalable Stop unhealthy deployments in their tracks © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Cool! How do I use it?

Things you need to perform a deployment: A place to store your deployment files ARM Templates/Parameters defining what you want to deploy Binaries or resource files (e.g. sfpkg files) An idea of what the topology of your resources look like May span multiple services, regions, and/or configurations An ordering for how (and when) your resources should be deployed

1. A place for your files

1. A place for your files Azure Storage to the rescue 4/16/2019 2:13 AM 1. A place for your files Azure Storage to the rescue Create a Blob storage account Upload the files Provide the SAS URI to the files Done Have a separate storage location for your templates and your binaries? No problem, natively supported Do your directories change with daily builds or versions? © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

artifactSource { "name": "templateArtifactSource", "apiVersion": "2018-09-01-preview", "type": "Microsoft.DeploymentManager/artifactSources", "location": "East US 2", "properties": { "sourceType": "AzureStorage", "authentication": { "type": "sas", "sasUri": "https://my.blob.core.windows.net/container/sasToken" }, "artifactRoot": “daily_builds/9.28.18" }

2. A topology for your resources

2. A topology for your resources A service topology is just a group of related services A service itself is typically composed of multiple parts: Front end (user interactable) Back end (storage, compute, etc.) Management Etc. We call these service units Service units are composed of ARM resources

2. A topology for your resources - Service Units

2. A topology for your resources - Service Units e.g. “Service 1 Front End” Resource Group Deployment Mode Service Unit 2 e.g. “Service 1 Back End” Resource Group Deployment Mode

2. A topology for your resources - Services Service Unit 1 e.g. “Service 1 Front End” Resource Group Deployment Mode Service 1 e.g. “Contoso Search (WUS)” Subscription Location – West US Service Unit 2 e.g. “Service 1 Back End” Resource Group Deployment Mode

2. A topology for your resources - Services Service Unit 1 e.g. “Service 1 Front End” Resource Group Deployment Mode Service 1 e.g. “Contoso Search (WUS)” Subscription Location – West US Service Unit 2 e.g. “Service 1 Back End” Resource Group Deployment Mode

2. A topology for your resources - Services “Service 1 Front End” Service 1 e.g. “Contoso Search (WUS)” Subscription Location – West US “Service 1 Back End” “Service 2 Front End” Service 2 e.g. “Contoso Search (NUS)” Subscription Location – North Central US “Service 2 Back End”

2. A topology for your resources – Service Topologies “Service 1 Front End” Service 1 e.g. “Contoso Search (WUS)” Subscription Location – West US “Service 1 Back End” … Service Topology e.g. “Contoso Search (US)” ArtifactSource (Templates) “Service 2 Front End” Service 2 e.g. “Contoso Search (NUS)” Subscription Location – North Central US “Service 2 Back End” … …

serviceUnit – Front End { "name": “service1FrontEnd", "apiVersion": "2018-09-01-preview", "type": "serviceUnits", "location": "East US 2", "tags": { "serviceType": "Front End" }, "properties": { "targetResourceGroup": "service1RG", "deploymentMode": "Complete", "artifacts": { "templateArtifactSourceRelativePath": "[concat('/templates/', 's1template.json']", "parametersArtifactSourceRelativePath": "[concat('/parameters/', 's1params.json']" "dependsOn": [ "[resourceId('Microsoft.DeploymentManager/serviceTopologies', 'serviceTopology')]" ] }

serviceUnit – Back End { "name": “service1BackEnd", "apiVersion": "2018-09-01-preview", "type": "serviceUnits", "location": "East US 2", "tags": { "serviceType": “Back End" }, "properties": { "targetResourceGroup": "service1RG", "deploymentMode": "Incremental", "artifacts": { "templateUri": "https://my.blob.core.windows.net/container/unit1Template.json", "parametersUri": "https://my.blob.core.windows.net/container/unit1Parameters.json" "dependsOn": [ "[resourceId('Microsoft.DeploymentManager/serviceTopologies', 'serviceTopology')]" ] }

service { "name": "service1", "apiVersion": "2018-09-01-preview", "type": "services", "location": "East US 2", "properties": { "targetSubscriptionId": "123e4567-e89b-12d3-a456-426655440000", "targetLocation": "NorthCentralUS" }, "dependsOn": [ "[resourceId('Microsoft.DeploymentManager/serviceTopologies', 'serviceTopology')]" ], . . . }

serviceTopology { "name": "serviceTopology", "apiVersion": "2018-09-01-preview", "type": "Microsoft.DeploymentManager/serviceTopologies", "location": "East US2", "properties": { "artifactSourceId": "[resourceId('Microsoft.DeploymentManager/artifactSources’, 'templateArtifactSource']" }, "dependsOn": [ "[resourceId('Microsoft.DeploymentManager/serviceTopologies', 'serviceTopology')]" ], ... }

3. Deployment ordering and timing

3. Deployment ordering and timing - Rollouts Deployments are done as part of Rollouts Rollouts are comprised of Step Groups Step Groups have 3 sections: Steps to take before the deployment A Service Unit deployment Steps to take after the deployment

3. Deployment ordering and timing - Steps Steps are re-usable actions Defined by Microsoft, customized by you Can run before or after any Service Unit deployment Allow you to control your deployment

3. Deployment ordering and timing – Step Examples Wait Wait a specified time before moving on Health Check* Monitor service health for a period of time, and only continue if healthy Integrates with your existing service monitoring providers Web Extension* Hit a custom web service (hosted by you) and wait for a return before moving on Shell Extension* Kick off a custom script and wait for a return before moving on More on the way… * - Coming soon after Ignite

3. Deployment ordering and timing – Steps

3. Deployment ordering and timing – Step Group

3. Deployment ordering and timing – Step Group

3. Deployment ordering and timing – Rollout Step Group 1 Rollout ArtifactSource (Binaries) Deployment Ordering Step Group 2

step { "name": "waitStep", "apiVersion": "2018-09-01-preview", "type": "Microsoft.DeploymentManager/steps", "location": "East US 2", "properties": { "stepType": "wait", "attributes": { "duration": "PT1M" } ISO 8601

rollout – part 1 ... { "name": "rollout", "apiVersion": "2018-09-01-preview", "type": "Microsoft.DeploymentManager/rollouts", "location": "East US 2", "identity": { "type": "userAssigned", "identityIds": [ "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', 'identityName')]" ] }, "dependsOn": [ "[resourceId('Microsoft.DeploymentManager/steps/', 'waitStep']” ], ... } © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

rollout – part 2 }] "properties": { "buildVersion": "1.0.0.0", "artifactSourceId": "[resourceId('Microsoft.DeploymentManager/artifactSources/', 'binaryArtifactSource']", "targetServiceTopologyId": "[resourceId('Microsoft.DeploymentManager/serviceTopologies/’, 'serviceTopology']", "stepGroups": [{ "name": "stepGroup2", "dependsOnStepGroup": "stepGroup1", "preDeploymentSteps":[], "deploymentTargetId": "[resourceId('/services/', 'service1'), '/serviceUnits/', 'service1BackEnd']", "postDeploymentSteps": [{ "stepId": "[resourceId('Microsoft.DeploymentManager/steps/', 'waitStep')]" }] }... }

DEMO Gaurav Bhatnagar

Sign-up for access today! http://aka.ms/admsignup

Resources Full Documentation Tutorials and Examples Feedback © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session Your feedback is important to us! 4/16/2019 2:13 AM Please evaluate this session Your feedback is important to us! Please evaluate this session through MyEvaluations on the mobile app or website. Download the app: https://aka.ms/ignite.mobileApp Go to the website: https://myignite.techcommunity.microsoft.com/evaluations © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/16/2019 2:13 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.