Skip to content

Latest commit

 

History

History
426 lines (300 loc) · 17.1 KB

2-Configure_your_DevOps_Environment.md

File metadata and controls

426 lines (300 loc) · 17.1 KB

Lab 2 - Configure your DevOps Environment

Back to all modules

Lab Description This lab covers the configurations and environment creation for DevOps deployments.
Estimated Time to Complete 30 minutes
Key Takeaways 1. Create resource group in Azure for deployment automation
2. Establish RBAC permissions for resource creation
3. Setup permissions and service principals for continuous deployments in Azure DevOps environment
By the end of this lab, you should have: Resource Groups, Service Principal, Azure DevOps Environment, Artifacts needed to complete this workshop
Author Shirley MacKay
Frank Garofalo

Purpose

This lab will create the environment for the CI/CD process. Service Principals are leveraged to allow permission to deploy or update resources in certain environments for a specific purpose. The Service Connection uses a Service Principal's permissions which are based off of RBAC. It gives Administrators better control over their environment while allowing the engineers the ability to focus on their code.

Summary

Exercise - Setup Azure Environment

Create Azure Resource groups

Perform the tasks below either via the Portal or PowerShell. Create two resource groups one for Dev and Prod Example naming convention: {name}-prod, {name}-dev

Prerequisites

  1. Active Azure Subscription
    1. TRIAL SUBSCRIPTIONS ARE NOT SUPPORTED FOR THIS WORKSHOP
  2. Live workshops may have an Azure Pass Promo Code
    1. Redeem your Promo Code for activating your Azure Subscription, go to the following link: Click here
  3. Azure DevOps account
    1. If you do not have an account Sign up for free using Windows Live ID or Github

Portal

  1. Login to https://portal.azure.com
  2. Select Resource Groups from the main menu

Create resource groups, SuperchargeSQL-dev and SuperchargeSQL-prod with the steps below:

  1. Click + Add
    1. Select the Subscription
    2. Enter the Resource Group name
    3. Select the Region
    4. Click Review + create
    5. Click Create
  2. Click Refresh in the portal to see the new resource group

PowerShell

💡 Recommend using the VS Code IDE for PowerShell script development

Create SuperchargeSQL-dev and SuperchargeSQL-prod resource groups with the PowerShell Script below:

  1. Open VS Code
  2. Create a new file
  3. Change the default environment to PowerShell. In the bottom corner of VS Code, click on "Plain Text" and type "PowerShell"

❗ Execute the script below for each resource group

#You only need to use Login-AzAccount once if you use the same session
#IMPORTANT: The signin window may show up BEHIND the application. Minimize windows to view the signin window.
Login-AzAccount #For Azure Government use: #Login-AzAccount -Environment AzureUSGovernment

#For 1st script execution update $rg value with: SuperchargeSQL-dev 
#For 2nd script execution update $rg value with: SuperchargeSQL-prod
$rg = "<Your Resource Group Name>" 

#You can use the following cmdlet to obtain the region (location)
#Get-AzLocation
$location = "<Location>" #Example: eastus2 

#You can use the following cmdlet to obtain the subscription id
#Get-AzSubscription
Select-AzSubscription –Subscription "<Id>"

New-AzResourceGroup -Name $rg -Location $location
Get-AzResourceGroup -Name $rg

Create Service Principal

Perform the tasks below either via the Portal or PowerShell.

💡 This lab uses one Service Principal. Typically, a Service Principal is used for each environment: Development, Staging, Production.

Portal

  1. Login to https://portal.azure.com

  2. Select Azure Active Directory from the main menu or from More Services

  3. Select the App Registrations blade

  4. Select + New registration

    1. Enter the Name: {your alias}-SuperchargeSQL-SP
    2. Leave the defaults
    3. Click Register

On the App Registrations - {Your App Name} blade

  1. Select the Certificates & secrets blade
    1. Select the + New client secret
    2. Enter the Description
    3. Click Add
    4. Copy the Value

❗ Copy the new client secret value and Application Id (Overview blade). You won't be able to retrieve it after you perform another operation or leave this blade. Generate a new secret if it is lost it or expires. We recommend using the portal steps to generate a new client secret.

PowerShell

💡 Use the below PowerShell script in a PowerShell file with VS Code. Make sure to update the parameter values.

#You only need to use Login-AzAccount once if you use the same session
#IMPORTANT: The signin window may show up BEHIND the application. 
Login-AzAccount #For Azure Government use: #Login-AzAccount -Environment AzureUSGovernment

#You can use the following cmdlet to obtain the subscription id
#Get-AzSubscription
Select-AzSubscription –Subscription "<Id>"


$spName  = "{your alias}-SuperchargeSQL-SP"
$id = (New-Guid).Guid
$secret = (New-Guid).Guid

$cred = New-Object Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential
$cred.StartDate = Get-Date
$cred.EndDate = (Get-Date).AddYears(1)
$cred.KeyId = $id
$cred.Password = $secret
New-AzADServicePrincipal -DisplayName $spName -PasswordCredential $cred

#IMPORTANT: Save the value for $secret, it will be used later
$secret

❗ Copy and save the Service Principal Name, Application Id and Secret. You won't be able to retrieve it after you perform another operation or leave this blade. Generate a new secret if it is lost it or expires. We recommend using the portal steps to generate a new client secret.

Exercise - Setup Permissions

Access Control (IAM) for the Resource Group(s)

Perform the tasks below either via the Portal or PowerShell.

Portal

❗ Do the following steps for both resource groups created earlier:

  1. Go to the resource group
  2. Click on the Access control (IAM) blade
  3. Click on + Add
  4. Click on Add role assignment
    1. Select the Owner role
    2. Enter your Service Principal name in the Select box to search
    3. Click Save
  5. Click on Role Assignments to verify

PowerShell

❗ Use the below PowerShell Script in a PowerShell file in VS Code, executing it twice, once for each resource group. Make sure to update the parameter values

#You only need to use Login-AzAccount once if you use the same session
#IMPORTANT: The signin window may show up BEHIND the application. 
Login-AzAccount #For Azure Government use: #Login-AzAccount -Environment AzureUSGovernment

#You can use the following cmdlet to obtain the subscription id
#Get-AzSubscription
Select-AzSubscription –Subscription "<Id>"

#For 1st script execution update $rg value with: SuperchargeSQL-dev 
#For 2nd script execution update $rg value with: SuperchargeSQL-prod
$spName  = '<Service Principal Name>'
$rg = "<Your Resource Group Name>"

$app = (Get-AzADServicePrincipal -DisplayName $spName).ApplicationID
New-AzRoleAssignment -ApplicationID $app -ResourceGroupName $rg -RoleDefinitionName 'Owner'

Exercise - Setup Azure DevOps Environment

Azure DevOps Organizations

  1. Sign in https://dev.azure.com/
  2. Navigate to Azure DevOps after signing in
  3. Click on New Organization
    1. Confirm and Enter an organization name
      • The organization name is a DNS name therefore it must be globally unique.
    2. Choose a Location
  4. After creation, navigate to your organization https://dev.azure.com/{yourorganization}

Azure DevOps Project - Clone Project Repo

  1. Enter your Project name
  2. Enter Description (optional)
  3. Select Private
  4. Expand the Advanced options
  5. Select Git and Basic for version control and work item process, respectively.
  6. Click on + Create project
  7. Project name: SuperchargeSQLDeployments
  8. Description: Supercharge SQL Deployments

❗ To prevent any confusion later on in the lab it is strongly recommend to name your DevOps project SuperchargeSQLDeployments. If you name your project something else make note that some of the lab instructions may not match your path(S)

  1. Click on Repos

  1. Click on Initialize
    Default settings to include Add a README

Branching

There are many options for a branching strategy and Git gives you the flexibility in how you use version control to share and manage code. It's an important part of DevOps and your strategy is something that your team should come up with. For more information about branching strategies please review Adopt a Git branching stategy docs page. For this workshop we are going to work with just a dev and master branch.

  1. Click on Repos to expand the Repos submenu
  2. Click on submenu Branches
    Notice that your Repo only has a master branch, by default new Git Repos only have a master branch

  1. Click New branch
  2. Enter Name: dev
  3. Click Create
  4. Click on the ellipse on the master branch to expose more options
  5. Click Branch policies

  1. You are now going to set a policy to Protect your master branch
    This is to keep people from accidentally checking dev code into master/prod branch
  2. Select Require a minimum number of reviewers
  3. Change the minimum number of reviewers to 1
  4. Select Requestors can approve their own changes
  5. Save changes

  1. Click on Branches
  2. Notice that your master branch, now has a Branch Policy icon on it.

DevOps Service Connection with Azure Resource Manager

  1. Select the Project Settings

  1. Select Service Connections under Pipelines
  2. Create a new Service Connection
  3. Select Azure Resource Manager and Next
  4. Select Service Principal (Manual) and Next

Enter the following:

  1. Enter Service connection name: Supercharge SQL Service Connection
  2. Select Environment
  3. Select Scope level Subscription
  4. Enter Subscription Id
    Get-AzSubscription
#Returns Subscription Name, Id, TenantId and State
  5. Enter Subscription Name (Found in Resource Group > Overview blade)
  6. Enter Service Principal Id (Value noted earlier)
  7. Select Credential Service principal key
  8. Enter Service principal key (Value noted earlier)
  9. Enter Tenant ID (Found in Azure Active Directory > properties blade)
  10. Click on Verify
  11. Click on Verify and Safe

Exercise - Push files to your Repo

Your repository is currently empty, except for the default README.md file that was created to initialize your repo. In this exercise you are going to use Git commands to clone down the source files needed for this lab and push them up to your repo.

  1. Using the TERMINAL in VS Code or Git Bash
  2. Run the following Git command to clone this Github Repo
git clone https://github.com/microsoft/SuperchargeAzureSQLDeployments.git c:/SuperchargeAzureSQL
  1. In a browser navagate to your Azure DevOps Project that you created above.
    1. Click on Repos
    2. Click Files
    3. Click the Clone button


  1. Copy the Command line HTTPS URL for your repo by clicking on the copy icon

  1. Back in VS Code hit the F1 key to open the command pallet
  2. Type Git: Clone and hit enter
  3. Paste the Repository URL for your Azure DevOps Repo > Press Enter on your keyboard
  4. Navigate to your C:\ drive
  5. Click the Select Repository Location button
    1. You may be asked to provide your Microsoft account
    2. Use your Microsoft account used to login to Azure DevOps
    3. Open that repository in VS Code, if prompted

  1. Using windows explore navigate to the the source directory in the cloned GitHub repo
    • C:\SuperchargeAzureSQL\source\

  1. Copy both directories: DatabaseProjects & Deployments
  2. Using windows explore navigate to your cloned Azure DevOps repo
    • C:\SuperchargeSQLDeployment
  3. Paste the copied directories from step 11 into your cloned Azure DevOps repo
  4. The above steps should result with the following:

  1. Copy the .gitignore file from:

    • C:\SuperchargeAzureSQL\

      ❗ Note that SuperchargeAzureSQL is the name of your project in Azure DevOps, you do not create this directory when you clone a repo. Git creates the directory as the root of your local repository. It uses the name of your project from Azure DevOps. If you named your project something different, your path will be: C:\{your DevOps Project name}

If you do not see the file enable: File name extensions and Hidden items from the View menu in explorer

  1. Paste the file into:
    • C:\SuperchargeSQLDeployments

Performing your initial Commit using VS Code

  1. In VS Code from the menu click File > Open Folder
  2. Navigate to your Cloned Azure DevOps Repo: C:\SuperchargeSQLDeployments (If not already in this directory)
  3. Click on the Git icon from the left side menu
    1. Notice that is shows a number on the icon
    2. This is the number file files that have not been committed to your local Git repository for your Azure DevOps project
  4. Make sure your are working off of the Dev branch
    1. Click on master from the bottom left of VS Code

  1. Select dev
    1. If you haven’t previously selected the dev branch you may need to choose origin/dev

  1. You should now be in your dev branch

  1. Click on the + that shows up when you hover over CHANGES
    • This will stage all changes in your repo to be committed
    • You can also pick and choose which files you want to stage, for this workshop we want all of the initial files staged to be committed

  1. Type a message for the initial commit in the Message box (ie. initial commit)
  2. Click the Check mark to perform the commit.

❗ If you receive an error message Make sure you configure your 'user.name' and 'user.email' in git. Click Cancel on the error message

  • Open the Terminal in VS Code

  • Run the following commands, filling in your own name and email address

    git config --global user.name "Your Name"
    git config --global user.email "[email protected]"

  • Run your commit again (Step 6.)

  1. You now have commited all of the changes to your local Git Repo, notice that the Git icon in the left side menu does not show any numbers.
  2. Notice that you have changes to push up to your remote Git repo (Azure DevOps Repo

  1. Click on the sync icon in the bottom left to perform a Git pull & Git push
    • You can also run the following Git command

    git push

  2. You may see a Visual Studio Code pop up window that says: This action will push and pull commits to and from 'origin/dev'.
    • Click OK

  1. After the push completes you may receive the following message dialog:

  • This is an option setting, when working on a team with multiple developers it is recommend to set this to Yes
  1. Using a browser navigate to your Azure DevOps project
  2. Click on Repos > Files
  3. You should now see all of the files in your repo
    1. You may need to select the ‘dev’ branch to see the new files

Azure subscriptions

TRIAL SUBSCRIPTIONS ARE NOT SUPPORTED FOR THIS WORKSHOP