AZ-500 Microsoft Azure Security Engineer Associate Topic: Containers and Security
December 14, 2022

1. Demo: Install Docker and Git for Windows

Before we can jump into the containers themselves, we do need to have a mechanism for running containers on our operating system. So we’re going to go ahead and install Docker as well as Kit for Windows. So, let us go to our web browser, and in our browser I’m already at the website heredocks.docker.com, Docker for Windows, and this is a tutorial that you can browse through about getting started with Docker for Windows. But if we go ahead and click on Install Docker Desktop for Windows, this prompts us to download from Docker Hub, so we select that you do need to sign in in order to download.

So go ahead and register for an account if you don’t already have one with Docker. Otherwise, just proceed to log in to download, and then once you’re logged in, simply click “Get Docker desktop for Windows for free,” and that will begin for you. While that’s downloaded, we do also need to go ahead and get a hold of Git, and we can go over to GitSem.com, where you’ll see download version 2.20.1 for Windows. You can just get the latest release. That will be fine. Go ahead and download that as well, and that will begin downloading. We’ll fast-forward while these download and come back to you. And as you can see, they’ve both been downloaded successfully. We’ll go and install git. First of all, feel free to change the options here. I’m just going with the defaults for everything here.

 So I’m going to skip through this pretty quickly, and that will begin installing Git on the computer. Git has been completed. Now we’ll go over Docker again. We’re just going to accept all the defaults and download and install them. Now we’ll create a shortcut on your desktop, and the first time you run it, it will prompt you to sign out and sign back in again as well. So I’ll fast-forward again while everything completes. You return to you in a split second and show you that prompt, and then you notice it. We just have to close and log out. And once we log back in, we can see that Docker Desktop is available for us. Now if we go ahead and double-click it, you’ll see a little Docker icon appear. If you click the little “show hidden icons” button, you’ll see Docker desktop is starting, and then what will happen is you’ll see these prompt hyper-V container features are not enabled. Do you want to enable them for Docker to be able to work properly? Go in and click OK, and you will be prompted for another restart as well. OK. And as you can see, our final restart is complete.

And if I click the little show hidden icons button at the bottom here, you’ll know Dockers are running in when the Docker desktop has finished booting up. But while it’s doing that, I can right-click, and you can look and see the switch to Windows containers. Now, I don’t want to use Windows containers; I’m going to use Linux containers for this demonstration. But if you ever wanted to run Windows containers in Docker for Windows, I know it sounds interesting. Why is the default behaviour Linux? A lot of Docker containers today are on Linux.

And so if you want to run them in Windows, you actually have to switch to that as your default behaviour because the default behaviour is to run them as Linux containers in Docker for Windows. It’s just something worth noting. And once that’s completed, we can just click the little Docker icon here, which says Docker Desktop is running. We’re now going to go ahead and open up a PowerShell window. So we’ll launch that as an administrator.

So we’ll click Start, type in PowerShell, right-click it, and run it as administrator. A PowerShell window pops up, and let’s go ahead with these demonstrations that I’m going to follow and create a new directory. So we’re going to just go to the root of C. I’m going to make a directory called AZ demo, and I’ll just expand this out so it’s easier to see. And once we’re in there, we’ll just CD into an empty AZ demo directory, as you can see. And now let’s just make sure Docker is actually running by running Docker version, which shows Docker is running 18.9 and 1. And let’s also make sure Get is running well. So we got Get version, and we can see Get version 2201 for Windows is running. So we are now ready for the subsequent demonstrations.

2. Demo: Prepare Application for Azure Kubernetes Service

Before we can jump into the containers themselves, we do need to have a mechanism for running containers on our operating system. So we’re going to go ahead and install Docker as well as Kit for Windows. So, let us go to our web browser, and in our browser I’m already at the website heredocks.docker.com, Docker for Windows, and this is a tutorial that you can browse through about getting started with Docker for Windows. But if we go ahead and click on Install Docker Desktop for Windows, this prompts us to download from Docker Hub, so we select that you do need to sign in in order to download.

So go ahead and register for an account if you don’t already have one with Docker. Otherwise, just proceed to log in to download, and then once you’re logged in, simply click “Get Docker desktop for Windows for free,” and that will begin for you. While that’s downloaded, we do also need to go ahead and get a hold of Git, and we can go over to GitSem.com, where you’ll see download version 2.20.1 for Windows. You can just get the latest release. That will be fine. Go ahead and download that as well, and that will begin downloading. We’ll fast-forward while these download and come back to you. And as you can see, they’ve both been downloaded successfully. We’ll go and install git. First of all, feel free to change the options here.

I’m just going with the defaults for everything here. So I’m going to skip through this pretty quickly, and that will begin installing Git on the computer. Git has been completed. Now we’ll go over Docker again. We’re just going to accept all the defaults and download and install them. Now we’ll create a shortcut on your desktop, and the first time you run it, it will prompt you to sign out and sign back in again as well. So I’ll fast-forward again while everything completes. You return to you in a split second and show you that prompt, and then you notice it. We just have to close and log out. And once we log back in, we can see that Docker Desktop is available for us. Now if we go ahead and double-click it, you’ll see a little Docker icon appear. If you click the little “show hidden icons” button, you’ll see Docker desktop is starting, and then what will happen is you’ll see these prompt hyper-V container features are not enabled. Do you want to enable them for Docker to be able to work properly? Go in and click OK, and you will be prompted for another restart as well. OK. And as you can see, our final restart is complete.

And if I click the little show hidden icons button at the bottom here, you’ll know Dockers are running in when the Docker desktop has finished booting up. But while it’s doing that, I can right-click, and you can look and see the switch to Windows containers. Now, I don’t want to use Windows containers; I’m going to use Linux containers for this demonstration. But if you ever wanted to run Windows containers in Docker for Windows, I know it sounds interesting. Why is the default behaviour Linux? A lot of Docker containers today are on Linux. And so if you want to run them in Windows, you actually have to switch to that as your default behaviour because the default behaviour is to run them as Linux containers in Docker for Windows. It’s just something worth noting. And once that’s completed, we can just click the little Docker icon here, which says Docker Desktop is running. We’re now going to go ahead and open up a PowerShell window.

So we’ll launch that as an administrator. So we’ll click Start, type in PowerShell, right-click it, and run it as administrator. A PowerShell window pops up, and let’s go ahead with these demonstrations that I’m going to follow and create a new directory. So we’re going to just go to the root of C. I’m going to make a directory called AZ demo, and I’ll just expand this out so it’s easier to see. And once we’re in there, we’ll just CD into an empty AZ demo directory, as you can see. And now let’s just make sure Docker is actually running by running Docker version, which shows Docker is running 18.9 and 1. And let’s also make sure Get is running well. So we got Get version, and we can see Get version 2201 for Windows is running. So we are now ready for the subsequent demonstrations.

3. Demo: Create Azure Container Registry

In this demonstration, we’re going to build upon what we did previously and create our own Azure Container Registry to push our container images into. Now, to begin, we are going to need the Azure CLI to run locally for this to work. So we’ll go ahead and download that. First of all, if we open up our browser, just type in “Azure CLI Download.” This will take us to the download link for the Azure CLI, and we can choose between Windows, Mac, etc. I’m going to do everything on Windows, as I have been throughout this lecture and demo, and we’ll go ahead and click Download the MSI installer that downloads, and it shouldn’t take too long; it’s a pretty small download, and then go ahead and install that. Now, just to point out, if you do have it installed previously, you can use your existing one.

There’s no reason to go back and do this particular step, but you do need to make sure you have version 2.0.53 or later for the items we’re going to run throughout this demonstration. Okay, now the installation wizard comes, and all we need to do is accept the terms and proceed with the installation. And now that’s complete, we can proceed. So let’s open up PowerShell again and just do an AZ login, which will open up our web browser to log into Azure. There it is. We’ll select our login and say we’re now logged into Azure. If you tap back to PowerShell, you can see we’re logged into the Visual Studio Enterprise subscription there. Okay, great. So now we need to go ahead and start making a resource group for us to use and put our container registry in. So we can just do everything from the command line now. We can do AZ group create name, and it will give us a name for our resource group.

So, RG, we’re going to do it. So that’s the resource group we’re going to create. We’ll give it a home, and we’ll put this one in the east as well. And that should only take a second to create, so that’s created. You get confirmation there. We can now just go over to the Azure Portal and verify everything is there, and we’ve logged into the portal. If I go to resource groups, I can see AZ Containers RG, and obviously nothing is in there yet because we haven’t created anything. So, let’s return to PowerShell and create AZACR, which stands for Azure Container Registry. Now keep this in mind. The container registry is a private registry for us to put our container images in, which we can then deploy from. As opposed to being in a public registry from which we wish to draw. This is private to us. We’re going to create our own registry, as that’s what we do. And we’re going to do a ZACR. Create a resource group, and everything will be placed in AZ containers; RG is the one we want everything placed in; this gives the ACR a new name, ACR for Azure Container Registry.

This has to be unique within Azure itself, so let’s go ahead and call this the AZ Demo ACR, and then let’s go ahead and choose a SKU for it. So we’re just going to use the basic AzureContainer Registry SKU that will deploy it; it should take less than a minute to complete this one. effect already completed there, and if we go back over to the portal refresh, we now see we’ve got our container registry available for us there. OK, so now we want to log in to that registry. Let’s do AZ ACR login dash name, and our name is AZ Demo ACR, and that locks us into the Azure registry, and we should get a login succeeded message once that’s completed, and there we go. So everything looks good there. Now let’s just verify our local Docker images. So if we do Docker images, we can see that we still have those images from the previous demonstration, but to use the Azure Vote front container image with the Azure Container Registry, we need to tag that image with the login server address of our registry. So this tag is used for routing when pushing container images to an image registry, and so what we can do is do an azacrlist first of all to get our login server. So, if we bring this up, we can see that this is our actual login server.

Now what we need to do is tag our local Azure vote front image with this login server address of the container registry. So to indicate the version number, we’re going to go ahead and add V1 to the end of the image name. So let’s go ahead and do that. Let’s start with Docker Tag Azure Vote Front. We’re going to put in our login server now, so we’ll go ahead and grab our login server and paste that there, azurevotefrontcolon V 1. Okay, so now if we do Docker images again, we should see that an image here, version one, is tagged with the ACR instance address and that version number as well. So now what we want to do is push those images into the registry as well. So we built our image, we’ve tagged it, and now it’s time to push it up to the registry. So we do a Docker push for that, and we grab our login server again, the Azure Votefrontb one, and this is pushing it up to the registry. So there it goes, and as opposed to us pulling it down, we’re now sending those images up there.

As you can see, everything’s been completed successfully. Now let’s just verify they are actually in the registry, so we can go ahead and do our AZ ACR repository list, specify the name of our repository, which was AZ demo ACR, and just hit enter. and we should see our images listed there. And there it is. We can see Azure’s vote. The front is there as well. Now, if we also want to, we can go ahead and show the tags. We can do the Azacr Repository. Show tags; choose the name. So again, that’s the AZ demo ACR repository, which is Azure Vote Front. And let’s output that as a table. Easier reading. And there it goes. And we can see the outcomes. Version one is the tag assigned to that Azure Vote Front image. And with that, this concludes the demonstration. You now have a container image that is stored in a private Azure container registry instance. And this image is deployed from ACR to the Kubernetes cluster. In the next tutorial that we go through,

4. Demo: Run Application on Kubernetes

In this demonstration, We’re now going to take our application and run it on the Kubernetes cluster that we created in the previous demos. But let’s just quickly head over to the Azure Portal so you can see the Kubernetes node that is running there. And in the Azure Portal, if we go to our resource groups or by AZ Containers RG, you’ll see we’ve got our Azure Container registry there. And we also have the AZ demo AKS. That’s our Kubernetes service. If I click into that, you’ll see our overview section come up, and you can see on the right our Kubernetes version 1911.

Here is our API server address: Total cause: two; total memory: seven. On the left, you can see that this is also happening in the eastern United States. Now on the left-hand side, we can go and modify a few settings. We have our usual things like an activity log,  identity, and access management if we want to give people permissions, tags, et cetera. That’s all the normal stuff we’ve seen over and over again in Azure. But if we go to upgrade, this is where we can choose to increase the version of Kubernetes.

So we go from one dot nine to one dot ten to one dot twelve at the moment. And the upgrade does take about ten minutes per node. If we go to scale, this is where we can see the number of nodes that we have here. So I can go in there and choose two, and you can see that takes it from two cores and two virtual CPUs to four memory slots with capacities ranging from seven to fourteen gigabytes. So this is one area that you can scale. You can also do it from the command line, but you can also do it here as well. We also have dev spaces, and dev spaces allow us to share the cluster with our team if we want to collaborate in a dev space. It’s basically an area where you can develop your code in isolation for testing purposes. We’ve got our properties. Standard Azure properties We’ll just see our version’s DNS prefix, API address, and details around the node, et cetera. There are our usual resource locks that we’ve covered in other modules, and automation scripts that we’ve talked about in other modules.

And then we can also go in and look at monitoring. We’ve got insights, and metrics are now in preview. This is a service they recently announced where containers go into Azure Monitor. Basically, it was officially supported, and hopefully this will be pretty soon. But this is where you can go and get your AKS resource, choose your namespace, and then choose your metrics. So, number of pods by phase, total amount of available memory. You can start to pull metrics just like you can for things like OSS and host-based metrics as well. But with that, let’s go ahead and deploy our application. And to do that, let’s go to the folder we created on our C drive. You can also see me in this PC local disc C AZ demo. We’ve got our Azure Voting app redistributed there. And now we must edit our Kubernetes manifest, which is this file, azurevote all-in-one redis YAML.

So if we double-click that file and if we scroll down, the important part that we need to change is this section right here, which is the container image. It says “Microsoft Azure.” Vote front. V one. We need to change that and basically update the manifest file to basically point to our ACR login server name. If you’re not sure how to get that, go back to PowerShell and type Azacrlistresource Group, which was Azcontainersrg, and you’ll see our login server name. So let’s grab that, copy it, go back to Visual Studio where I’m editing my YAML file, update this part right in front, and you can see that’s our AZ demo Azure Container Registry and we’re still deploying the Azure Vote Front version one container. So we’ll go ahead and save that and come out of this. We’ll CD to that folder, and we will do a cubectl apply folder in one redis YAML, and you can see the deployment of Azure Vote Back created. That’s our back end there, and our voting front has been created. Now what we want to do is check the progress on this. Let’s do a cubectl. Get service. Azure, vote in front. and let’s just watch it. and you can see it’s waiting for an external IP. It’s going to basically use a load balancer with a public IP address on it. And right now we’re just watching it, waiting for Microsoft to provision that external IP. And once that is available, we can connect to the service and see that the external IP is there.

So let’s go ahead and grab that, put it in a web browser, and then we can see our Azure Voting app is up and running. I can click the cats, click the dogs, and reset. That is all working just like it worked locally, except now we push the image to the registry, and now we’ve deployed the container on top of the Azure Kubernetes service. Finally, before we conclude this demonstration of the Azure Kubernetes service, how do we scale out the number of pods that are actually running? So, if we return to the command line and run cubectl get pods, we can see that we have one front end run in and one back end run in. We can also scale this out so that additional containers are basically spun up for us if we do cube CTL scale and replicas equal to five in deployment Azure Vote Frontend, which will scale out the front end. If we do get pods again, we need them now. We can see that pretty much all of them are running. One is still creating in there. Let’s do it again. They do happen very, very quickly, and you can see all of those are running. We could do the same for the backend if we wanted to.

You can also do auto-scaling on pods as well. So if you want to automatically scale them up and down, perhaps based on a CPU metric or something like that, you can do that. And there’s documentation on the Microsoft website for that. We don’t need to know specifically how to do it for the exam. Just know that an orderly scale of pods does exist there for you. And you can do it based on requests to the CPU. You could say that when requests are at 00:25 CPU, you can set a limit of half a CPU. There are different sorts of metrics you can play around with there. In addition, we can also scale out the cluster itself. However, in this case, we use the AZ-AKS scale. So you can see the difference. When we’re in the pods, we’re in the Cube CTL. When we want to scale out the cluster itself, we’re back in the Azure CLI.

So we do the AZ-AKS scale, and we do resource groups. Containers AZ, RG, and name So this is AZ demo AKS. And we just set the node count again. This is the node on which Kubernetes will run; again, these are the nodes on which the containers will run. As a result, node count three. Now, this does take a little bit of time because it has to spin up those additional VMs that ultimately are available for the containers to run on top of. But nothing is ready to be seen. Once it’s completed, it’ll just show you that there are three nodes running. We’ve basically concluded this demonstration, and you’ve learned how to create a container, how to use the container registry, how to run your application in Cuban et, and how to scale it up and down. That could be the pods or the nodes. The nodes are the underlying architecture that needs to support everything, and the pods themselves are the containers that are running on top of it. With that, this concludes the demonstration.

5. Demo: Create Kubernetes Cluster

In this demonstration, we’re now going to go about creating our Kubernetes cluster in Azure, and to begin, let’s head back over to our PowerShell client. To ensure you’re ready for this section, make sure you have Auricle version 200:53 or later; simply run the AZ version that will appear and confirm your version. If you scroll to the top, you will see your version number right here, and that’s what you need to make sure is correct. But with that, the first thing we need to do is go ahead and create a service principle. and this is to allow the AK cluster to interact with other Azure resources. And we covered service principles already in a previous module, so if you’re not too familiar with them, I highly encourage you to just jump back to that module and then come back here when you’re done with that. But to create our service principle, we do Azad SP for Service Principle Create for RBAC, and we’re going to skip the assignment for right now and hit Create.

And you’ll get a bunch of values onscreen that we’re going to basically just copy for ourselves right now and pop into Notepad. Now the next thing we need to do, and I’ve just cleared the screen here, is to go ahead and configure our Azure Container Registry for authentication. So we need to do an Anzac ACR Azure Container Registry show and select our resource group, which was AzcontainersRG, and then choose the name of our Azure Container Registry, which was AZ Demo ACR, and hit Enter. Okay, and this comes up, and you’ll see here a couple of things. We’ve got our login server that we previously found, but there’s another object just slightly above ID that we want to capture. So let’s go ahead and grab this ID, copy it, and paste it into Notepad as well. All right, now what we need to do is go ahead and grant the correct access for the AKS cluster to use the images stored in the Azure Container Registry. So we’re going to assign permissions to that service principle. So if we go ahead and do an AZ role assignment, choose the assignee, and that’s going to be our app ID that we had previously. So go back over to Notepad, grab the application ID, sometimes known as the client ID, and grab that. That’s our assignee.

Then we’re going to do Scope, which is the ACR ID. So let’s grab this ID, paste it in there, and give it the role of a reader. Okay, we got a small error there, so just double check that, and it looks like we just missed a dash right at the beginning. Let’s add that in under “Assignee.” I had to watch out for double dashes in the AZ versus single dashes and clicked Enter this time, and it worked. So now that’s completed, we can go ahead and create our Kubernetes cluster. And now we need to set up AZ AKS for the Azure Kubernetes Service. Create and choose the resource group AZ ContainersRG, the name of our AKS cluster. So we’ll call ourselves AZ demo AKS, the node count. So this is the number of nodes that are going to be provisioned that our containers can run on. So, for now, we’ll just do one, our service principle, and that is our app ID. Again, if we go ahead and go back to Notepad with this ID that we have right here and paste that one in, then we’ve got our client’s secret. So this is the password that was generated.

So again, if I go back here, you’ll see there’s also a password option here. That’s our secret. Paste that in, and the last thing we need to do is generate SSH keys as part of this. And this takes a few minutes, after which it will go ahead and provision our AKS cluster for us. As you can see, that’s been completed successfully. So now we want to connect to the Kubernetes cluster from our local computer, and we do need to use Cube CTL in order to do that. Now, if you are doing this from the Azure Cloud shell, cube CTL is already installed, but to install it locally, it’s pretty easy to do. Just do AZ AKS, install CLI, hit enter, and that will go ahead and install Cube CTL for you, which shouldn’t take very long at all. That has also been completed. And you’ll notice that it asks you to add the cubical path to your path, the environment path. and I usually do it with this one. I just grab the dollar EMP command path plus equals, so it’ll keep the existing path, and then just add up to the cubical part right here.

So copy that, just go ahead and paste that, and then you can do environment path and it will show you all the things that are in your path in Windows. And I can see this is the one I just added here as well. So with that, we can now go ahead and get some credentials so we can connect to our cluster. So we do AZ AKS, get credentials, select our resource group AZ Containers RG, and then our AKS cluster name, which was AZ demo AKS, and hit enter, and you can see that it has merged AZ demo AKS as the current context in our configuration. And now we can go ahead and run Cube CTL to get the nodes that are currently running, and we should just have the one that we deployed. So Cube CTL gets nodes, and we can see that we have that one node there running, and status is ready with that. This concludes this demonstration; our Kubernetes cluster is now up and running. And in the next demonstration, we’ll now take that application that we pushed up to the Azure Container Registry and run it on our Kubernetes node.

Leave a Reply

How It Works

img
Step 1. Choose Exam
on ExamLabs
Download IT Exams Questions & Answers
img
Step 2. Open Exam with
Avanset Exam Simulator
Press here to download VCE Exam Simulator that simulates real exam environment
img
Step 3. Study
& Pass
IT Exams Anywhere, Anytime!