knowledge-base

AZ-300 Study Notes

Various

• Global filter for subscription and (active) directory
• Every single resource specifies a region to be stored
• Azure hides more the concepts of zone’s (as in HA Zone)
• Zone’s are more explicit in “availability sets”
• Resource Groups are mandatory

Zones, Regions and High Availability

Primary Source

• Business Continuity is the business word for HA and Recovery.
• A zone can be one ore more data centers still.

• Each region has a min of 3 zones.

• Availability Sets
  • A group with 2+ VMs in the same Data Center.
  • Parameters
    • Fault Domain : Each fault domain has own hardware network switch and power source.
    • Update Domains : All VMs in same update domain restart together during planned maintenance.
  • So the Fault Domain is a hardware logical grouping, while the update domain is a software logical grouping.
  • Can’t add existing VMs to an availability set
  • This is all within one
  • 99.95% SLA
  • Protect from hardware failures and maintenance within data centers
  • Usually a set per tier
  • When you create a VM you can assign it to an Availability Set Resource
• Availability Zones
  • VMs are in different physical locations within a Region. (cross Zone)
  • 99.99% SLA
  • 2 Categories
    • Zonal Services : Add a resource to a specific zone (VMs, Disks, Ips…)
    • Zone-redundant services : Atu replication accross zones (e.g. for SQL DB)
  • Don’t support all VM sizes.
  • Protect from enitre data center failure (so a zone that goes down)
  • When you create a VM you can assign it to an Availability Zone number
• An Availability zone in an Azure region is a combination of a fault domain and an update domain.
  • Meaning, the fault domain and update domains are 100% isolated between zones. You can’t have 2 VMs in different zones being on a same fault and/or update domain.
• Disaster recovery approaches:
  • Sync replication of apps and data using : Availability Zones
  • Async replication of apps and data using : Region Pairs
    • Cross region
• Azure Management services are resilient from region-level failures.

Networking

• Virtual Network (aka VNet)

• Subnet
  • Can be designated/delegated to be used by a dedicated Azure Service (Like workspaces/volumes/…)
• A VM connects through a NIC which is assigned to the VM and connected to a subnet

• Azure provides implicitly a Internet Gateway, you don’t need to provision one like in AWS.

• Outbound connections for VMs

• Virtual Network Service Endpoints : Extend private address space and identity over a direct connection to Azure services.
  • Allow a direct network connection to your other Azure resources/services without leaving Azure backbone network.
  • Not available to all Azure services, but some examples : Storage, DB’s, Key Vault, Event relates services and App service.
  • More secure than to have VM call a Azure service and hopping over the public internet
  • Optimal Routing because of not making the internet hop
  • Less IP management (like NAT’s etc)
  • Azure service resources secured to Vnets are NOT reachable from on-premise. Because everything goes through Azure backbone network, so no public IPs as there is not internet hop.
    • To allow this, allow public IPs or use ExpressRoute
  • Can be connected to a specific subnet (so only the App tier can access service x)

• Better to define a username/password for a vm in a private tier, else the jump box needs to be configured with a *.pem file for ssh

• Network Security Group has stateless rules.

• Network Security Group vs. Application Security Group
  • (NSG) Network Security Group is the Azure Resource that you will use to enforce and control the network traffic with
    • Applied to a subnet or a virtual machine
    • Has default rules
  • (ASG) Application Security Group is an object reference within a Network Security Group.
    • Used within a Network Security Group
    • Apply a rule to specific workload or group of VMs
    • Such a rule has a “network object” and a explicit IP address
    • Seems that they are statefull, like the Security Group in AWS
    • No default rules
    • No rule order
    • Examples
      • Allow internet traffic (source internet) to destination Web tier (DMZ-ASG), ports 80 and 443
      • Allow DMZ traffic (source DMZ-ASG) to destination App tier (APP-ASG), ports xxx
      • …
• For a LB, you define independently a “Health Probe” which you can then refer to in a routing rule or other.

Virtual Machines

• System assigned managed identity : Like assigning a role in AWS, so a VM can access services without auth in code.
• Cloud init : Script that runs when it boots the first time.

• You cannot put a VM in a Vnet which is located in another region.

• A VM can change it’s size after having been created
• You can give a VM a public IP and then only allow SSH access if you don’t want to use a jump box.

• When putting VM’s in a backend pool of a LB, and you want to SSH into it, create an Inbound NAT rule + double check inbound NSG.

• TODO : Multiple data disks, why ? (maybe one OS disk and one attached for temporary data storage, so when does that clear ? After reboot ?)

Azure Resource Manager Templates

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "projectName": {
      "type": "string",
      "metadata": {
        "description": "Specifies a name for generating resource names."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Specifies the location for all resources."
      }
    },
    "adminUsername": {
      "type": "string",
      "metadata": {
        "description": "Specifies a username for the Virtual Machine."
      }
    },
    "adminPublicKey": {
      "type": "string",
      "metadata": {
        "description": "Specifies the SSH rsa public key file as a string. Use \"ssh-keygen -t rsa -b 2048\" to generate your SSH key pairs."
      }
    }
  },
  "variables": {
    "vNetName": "[concat(parameters('projectName'), '-vnet')]",
    "vNetAddressPrefixes": "10.0.0.0/16",
    "vNetSubnetName": "default",
    "vNetSubnetAddressPrefix": "10.0.0.0/24",
    "vmName": "[concat(parameters('projectName'), '-vm')]",
    "publicIPAddressName": "[concat(parameters('projectName'), '-ip')]",
    "networkInterfaceName": "[concat(parameters('projectName'), '-nic')]",
    "networkSecurityGroupName": "[concat(parameters('projectName'), '-nsg')]"
  },
  "resources": [
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2018-11-01",
      "name": "[variables('networkSecurityGroupName')]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": [
          {
            "name": "ssh_rule",
            "properties": {
              "description": "Locks inbound down to ssh default port 22.",
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "22",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 123,
              "direction": "Inbound"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2018-11-01",
      "name": "[variables('publicIPAddressName')]",
      "location": "[parameters('location')]",
      "properties": {
        "publicIPAllocationMethod": "Dynamic"
      },
      "sku": {
        "name": "Basic"
      }
    },
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2018-11-01",
      "name": "[variables('vNetName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[variables('vNetAddressPrefixes')]"
          ]
        },
        "subnets": [
          {
            "name": "[variables('vNetSubnetName')]",
            "properties": {
              "addressPrefix": "[variables('vNetSubnetAddressPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "apiVersion": "2018-11-01",
      "name": "[variables('networkInterfaceName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]",
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vNetName'))]",
        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
      ],
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipconfig1",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "publicIPAddress": {
                "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]"
              },
              "subnet": {
                "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vNetName'), variables('vNetSubnetName'))]"
              }
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2018-10-01",
      "name": "[variables('vmName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]"
      ],
      "properties": {
        "hardwareProfile": {
          "vmSize": "Standard_D2s_v3"
        },
        "osProfile": {
          "computerName": "[variables('vmName')]",
          "adminUsername": "[parameters('adminUsername')]",
          "linuxConfiguration": {
            "disablePasswordAuthentication": true,
            "ssh": {
              "publicKeys": [
                {
                  "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]",
                  "keyData": "[parameters('adminPublicKey')]"
                }
              ]
            }
          }
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "Canonical",
            "offer": "UbuntuServer",
            "sku": "18.04-LTS",
            "version": "latest"
          },
          "osDisk": {
            "createOption": "fromImage"
          }
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]"
            }
          ]
        }
      }
    }
  ],
  "outputs": {
    "adminUsername": {
      "type": "string",
      "value": "[parameters('adminUsername')]"
    }
  }
}