8.4. Exploration: an Automated Deployment Bash Script¶

8.4.2.1. Provision Resources Script Steps¶

This script does quite a few things. Most of them are related to our Azure resources:

1. Declare variables
2. Configure the default location
3. Provision resource group
4. Configure the default resource group
5. Provision virtual machine & capture output information in variables
6. Extract data from VM output into useable variables: $vm_id and $vm_ip
7. Open port 443 on the VM
8. Configure the default virtual machine
9. Provision a Key Vault
10. Create a new secret in the Key Vault with a description, name, and value
11. Attach a new access policy to the Key Vault granting the VM access
12. Send three separate Bash scripts to the VM using az vm run-command invoke
13. Print out the public IP address of the VM

8.4.2.2. Script Goal¶

This script is responsible for setting up and configuring the resources using the Azure CLI.

Take note of the second-to-last step in the list: “Send three separate Bash scripts to the vm using az vm run-command invoke”. It is passing three additional Bash scripts to be run by the VM using the RunCommand tool we worked with in the Azure Portal.

We need to do this because we have additional VM configuration steps that we cannot accomplish with just the Azure CLI. However, we can access RunCommand from the Azure CLI which allows us to run any additional scripts on the VM that are needed.

8.4.2.3. Provision Resources Script¶

Let’s take a look at the script and then talk about what it’s doing:

#! /usr/bin/env bash

set -e

# --- start ---

# variables

student_name="student"

rg_name="${student_name}-cli-scripting-rg"

# -- vm
vm_name="${student_name}-cli-scripting-vm"

vm_admin_username=student
vm_admin_password='LaunchCode-@zure1'

vm_size=Standard_B2s
vm_image=$(az vm image list --query "[? contains(urn, 'Ubuntu')] | [0].urn" -o tsv)

# -- kv
kv_name="${student_name}-cli-scripting-kv"
kv_secret_name='ConnectionStrings--Default'
kv_secret_value='server=localhost;port=3306;database=coding_events;user=coding_events;password=launchcode'

# set az location default

az configure --default location=eastus

# RG: provision

az group create -n "$rg_name"

# set az rg default

az configure --default group=$rg_name

# VM: provision

# capture vm output for splitting
vm_data=$(az vm create -n $vm_name --size $vm_size --image $vm_image --admin-username $vm_admin_username --admin-password $vm_admin_password --authentication-type password --assign-identity --query "[ identity.systemAssignedIdentity, publicIpAddress ]" -o tsv)

# vm value is (2 lines):
# <identity line>
# <public IP line>

# get the 1st line (identity)
vm_id=$(echo "$vm_data" | head -n 1)

# get the 2nd line (ip)
vm_ip=$(echo "$vm_data" | tail -n +2)

# VM: add NSG rule for port 443 (https)

az vm open-port --port 443

# set az vm default

az configure --default vm=$vm_name

# KV: provision

az keyvault create -n $kv_name --enable-soft-delete false --enabled-for-deployment true

# KV: set secret

az keyvault secret set --vault-name $kv_name --description 'connection string' --name $kv_secret_name --value $kv_secret_value

# KV: grant access to VM

az keyvault set-policy --name $kv_name --object-id $vm_id --secret-permissions list get

# VM setup-and-deploy script

az vm run-command invoke --command-id RunShellScript --scripts @configure-vm.sh @configure-ssl.sh @deliver-deploy.sh

# finished print out IP address

echo "VM available at $vm_ip"

# --- end ---

8.4.3.1. Declare Variables¶

The Bash script first declares a suite of variables:

• student_name
• rg_name
• vm_name
• vm_admin_username
• vm_admin_password
• vm_size
• vm_image
• kv_name
• kv_secret_name
• kv_secret_value

These variables are used throughout the script. Most of the variables are used as the parameters for provisioning our Azure resources.

student_name=student

rg_name="${student_name}-cli-scripting-rg"

vm_name="${student_name}-cli-scripting-vm"

vm_admin_username=student
vm_admin_password='LaunchCode-@zure1'

vm_size=Standard_B2s
vm_image=$(az vm image list --query "[? contains(urn, 'Ubuntu')] | [0].urn" -o tsv)

kv_name="${student_name}-cli-scripting-kv"
kv_secret_name='ConnectionStrings--Default'
kv_secret_value='server=localhost;port=3306;database=coding_events;user=coding_events;password=launchcode'

All of the name variables use the underlying student_name variable to create a consistent naming pattern. This allows us to easily spin up a new stack by changing this one variable; it is a single source of truth.

8.4.3.2. Provision Resource Group¶

After our variables we start provisioning our Azure resources using the Azure CLI.

az group create -n "$rg_name"

The resource group must be provisioned first because it is the container that holds all the other resources. To provision a new resource group, we need to provide the name. These names must be unique to your subscription.

8.4.3.3. Provision Virtual Machine¶

After the resource group we have some flexibility.

We could spin up the Key Vault or Virtual Machine first, however consider the dependencies of these resources. We will eventually need to set an access policy on our Key Vault that includes information about our Virtual Machine.

For this reason, it makes more sense to provision the Virtual Machine first.

vm_data=$(az vm create -n $vm_name --size $vm_size --image $vm_image --admin-username $vm_admin_username --admin-password $vm_admin_password --authentication-type password --assign-identity --query "[ identity.systemAssignedIdentity, publicIpAddress ]" -o tsv)

# get the 1st line (identity)
vm_id=$(echo "$vm_data" | head -n 1)

# get the 2nd line (ip)
vm_ip=$(echo "$vm_data" | tail -n +2)

az vm open-port --port 443

8.4.3.4. Provision Key Vault¶

We now have a VM and all the information we need to create an access policy for a Key Vault. So let’s provision a Key Vault:

az keyvault create -n $kv_name --enable-soft-delete false --enabled-for-deployment true

az keyvault secret set --vault-name $kv_name --description 'connection string' --name $kv_secret_name --value $kv_secret_value

az keyvault set-policy --name $kv_name --object-id $vm_id --secret-permissions list get

8.4.3.5. Send Bash Scripts to VM Via RunCommand¶

Now that all of our infrastructure has been provisioned, we need to finish configuring our VM.

The VM still needs:

• Software dependency installations
• Web server configurations
• Database
• Database user
• Source code
• Deployed application

To accomplish these final steps additional Bash scripts will be sent to the VM using the az vm run-command invoke command.

az vm run-command invoke --command-id RunShellScript --scripts @configure-vm.sh, @configure-ssl.sh, @deliver-deploy.sh

When you are writing your own automated deployment script, in a future chapter, these bash scripts will be provided for you.

However you should look over them and read the comments that describe what they are doing. Many of the tasks they accomplish go beyond the scope of this course, but are a necessary part of this deployment.

8.4.3.6. Print Public IP Address to STDOUT¶

As a final step, the script prints the public IP address to the console. This shows exactly where to access the deployed application.

echo "VM available at $vm_ip"

8.4.3.7. VM RunCommand Scripts¶

It is important that the three VM RunCommand scripts run in a specific order. We have defined their order in our az vm run-command invoke command. These scripts must run in this order:

1. configure-vm.sh: Installs dotnet, MySQL, and creates the database and user that our application needs
2. configure-ssl.sh: Installs and configures the NGINX web server
3. deliver-deploy.sh: Delivers, builds, and deploys source code

The configure-vm.sh script should look familiar, since it’s a collection of the steps we have used multiple times throughout this class.

The configure-ssl.sh script is outside the scope of this class. In a nutshell, it downloads and configures the NGINX web server our application uses to enable TLS and HTTPS so that our app can be used with AADB2C.