DEV Community: Nelson Akpa

Deploying An Azure Virtual Machine Scale Set Using Terraform.

Nelson Akpa — Wed, 08 Oct 2025 14:57:27 +0000

Table Of Contents.

Introduction
VMSS and its components.
What is Terraform?
Prerequisites
Prepare environment & authenticate to Azure.
Create a local Terraform project with modular .tf files.
Initialize / Plan / Apply (local)
Verify
Conclusion

🚀 Introduction
Deploying an Azure Virtual Machine Scale Set Using Terraform

In today’s cloud-first world, scalability and automation are non-negotiable. This article explores how to deploy Azure Virtual Machine Scale Sets using Terraform, a powerful Infrastructure as Code (IaC) tool that enables consistent, repeatable, and efficient cloud provisioning. Whether building resilient applications or optimizing resource management, this guide walks you through the essentials of defining, deploying, and managing VM scale sets with Terraform, unlocking the full potential of Azure’s elastic compute capabilities.

🚀VMSS and its components
Virtual Machine Scale Sets (VMSS) allow you to create and manage a group of identical,
load-balanced virtual machines (VMs). Think of them as a way to automatically increase or
decrease computing power based on demand—similar to how supermarkets bring in more cashiers
when there are many customers, and fewer when the store is quiet.
Example: Imagine a movie theater. On a normal weekday afternoon, only one or two
ticket counters may be open. But on Friday night, when crowds rush in, more counters open
automatically. VM Scale Sets work in the same way—automatically adding or removing 'counters'
(VMs) depending on the number of 'customers' (requests) arriving.

Key Benefits of VM Scale Sets:

Automatic Scaling: Handles traffic spikes without manual intervention.
Load Balancing: Ensures no single VM is overloaded.
High Availability: Keeps your app running even if some VMs fail. - **Cost Efficiency: You only pay for what you use.

Another Analogy: Think of VM Scale Sets like ride-hailing services (e.g., Uber). During peak
hours, more drivers appear on the road (scaling out). Fewer drivers are available at night when demand is low (scaling in). This ensures efficiency and availability without wasting resources.

In summary, Virtual Machine Scale Sets are like having a flexible team that grows or shrinks
automatically, ensuring smooth operations and optimized costs—whether you're running a small
website or a large-scale application.

What is Terraform?
Terraform is an open-source Infrastructure as Code (IaC) tool developed by HashiCorp. It allows you to define and provision cloud infrastructure using declarative configuration files. Instead of manually creating resources through a cloud portal, you write code that describes the desired infrastructure state, and Terraform handles the deployment and updates.

Why Terraform?
We use Terraform to deploy a Virtual Machine Scale Set (VMSS) in Azure because it offers:

🔁 Repeatability: You can deploy identical environments (e.g., dev, test, prod) using the same configuration.
⚙️ Automation: Terraform automates the creation, scaling, and management of VM instances.
📦 Version Control: Infrastructure changes are tracked in source control (e.g., GitHub), enabling collaboration and rollback.
📈 Scalability: VMSS can automatically adjust the number of VMs based on demand, and Terraform makes configuring autoscale rules seamless.

Let’s turn infrastructure into code—and scale like a pro.

🚀 Prerequisites
The following are the prerequisites needed for this task.

VsCode
Azure subscription and permissions to create resources (or ask an admin).
Azure CLI installed (az) and logged in, or Service Principal credentials.
Terraform CLI (>= 1.4 recommended).
Git and (optionally) GitHub CLI (gh).
An SSH key pair for VM admin access (~/.ssh/id_rsa.pub).

🚀 Prepare environment & authenticate to Azure.
A. Authenticate to Azure
Interactive (dev machine)
Open your VSCode, create your project name first as "VMSS"

mkdir vmss-terraform #this creates a directory.

cd vmss-terraform #this gets you into the root directory

Then, log in to Azure
az login #this pops your AZ account.

B. Service Principal (recommended for CI)
Run the following, and replace the with yours.
az ad sp create-for-rbac --name "http://tf-vmss-sp" \
--role "Contributor" \
--scopes "/subscriptions/"

Save the output (appId, password, tenant).

{
  "appId": "6d509bb1-981f-4193-ad42-05bf45e72f12",
  "displayName": "http://tf-vmss-sp",
  "password": "epe8Q~hRGUg7f5hrBK_Pl~4N3wml1PutgPSiqaMn",
  "tenant": "01d4fe9c-2658-4141-be2f-b1f11eca9673"
}

Then export env vars for Terraform by replacing them with the actual values, and run them collectively in the terminal.

export ARM_SUBSCRIPTION_ID="14e8ed5c-bc41-4d1b-b5b7-ff9419e2f0d6"
export ARM_CLIENT_ID="6d509bb1-981f-4193-ad42-05bf45e72f12"
export ARM_CLIENT_SECRET="epe8Q~hRGUg7f5hrBK_Pl~4N3wml1PutgPSiqaMn"
export ARM_TENANT_ID="01d4fe9c-2658-4141-be2f-b1f11eca9673"

🚀Create a local Terraform project with modular .tf files.

Create project directory & layout setup-backend.sh vmss-terraform/ ├─ setup-backend.sh ├─ backend.tf ├─ frontend.tf ├─ main.tf # provider + top-level resources (or split) ├─ variables.tf ├─ network.tf ├─ compute.tf ├─ autoscale.tf ├─ outputs.tf ├─ user-data.sh # cloud-init to install nginx (optional) ├─ versions.tf └─ .gitignore

touch setup-backend.sh (paste the script below into it)

!/bin/bash

------------------------------------------------------------------

setup-backend.sh

Creates an Azure Storage backend for Terraform remote state

------------------------------------------------------------------

====== CONFIGURABLE VARIABLES ======

RESOURCE_GROUP_NAME="terraform-state-rg"
LOCATION="westus3"
STORAGE_ACCOUNT_NAME="tfstate$(openssl rand -hex 3 | tr -d '\n' | tr '[:upper:]' '[:lower:]')" # ensures uniqueness
CONTAINER_NAME="tfstate"
KEY_NAME="vmss.terraform.tfstate"

====================================

echo "🔍 Checking Azure CLI login..."
if ! az account show >/dev/null 2>&1; then
echo "❌ You are not logged in to Azure CLI. Run: az login"
exit 1
fi

SUBSCRIPTION_ID=$(az account show --query id -o tsv)
echo "✅ Using Azure Subscription: $SUBSCRIPTION_ID"

echo "🚀 Creating resource group if not exists..."
az group create --name "$RESOURCE_GROUP_NAME" --location "$LOCATION" >/dev/null

echo "💾 Creating storage account: $STORAGE_ACCOUNT_NAME ..."
az storage account create
--name "$STORAGE_ACCOUNT_NAME"
--resource-group "$RESOURCE_GROUP_NAME"
--location "$LOCATION"
--sku Standard_LRS
--encryption-services blob >/dev/null

echo "📦 Creating blob container: $CONTAINER_NAME ..."
az storage container create
--name "$CONTAINER_NAME"
--account-name "$STORAGE_ACCOUNT_NAME" >/dev/null

Print summary

ACCOUNT_KEY=$(az storage account keys list
--resource-group "$RESOURCE_GROUP_NAME"
--account-name "$STORAGE_ACCOUNT_NAME"
--query "[0].value" -o tsv)

echo ""
echo "✅ Terraform backend storage created successfully!"
echo ""
echo "🧩 Use the following values in your backend.tf file:"
echo "---------------------------------------------------"
echo "resource_group_name = "$RESOURCE_GROUP_NAME""
echo "storage_account_name = "$STORAGE_ACCOUNT_NAME""
echo "container_name = "$CONTAINER_NAME""
echo "key = "$KEY_NAME""
echo "---------------------------------------------------"
echo ""
echo "🔑 Storage Account Key (keep secret):"
echo "$ACCOUNT_KEY"
echo ""
echo "💡 Example: Run 'terraform init -reconfigure' after updating backend.tf."

Make it executable by running the code below
chmod +x setup-backend.sh

Run it with the code below;
./setup-backend.sh

Update your backend.tf file with the actual values below;
(resource_group_name = terraform-state-rg
storage_account_name = tfstatee0133f
container_name = tfstate
key = vmss.terraform.tfstate)

touch backend.tf (paste the script below into it)

terraform {
backend "azurerm" {
resource_group_name = "terraform-state-rg"
storage_account_name = "tfstatee0133f"
container_name = "tfstate"
key = "vmss.terraform.tfstate"
}
}

Run 'terraform init -reconfigure' after updating backend.tf

Re-run
chmod +x setup-backend.sh && ./setup-backend.sh

The script has some formatting issues with line breaks in the Azure CLI commands. Let's manually create the storage account with the name it generated (tfstateb3ecc2):
az storage container create --name tfstate --account-name tfstateb3ecc2

Now, let's create the container
az storage container create --name tfstate --account-name tfstateb3ecc2

Run the code below
terraform init -reconfigure

touch frontend.tf (paste the code below into it)

frontend.tf

resource "azurerm_public_ip" "frontend_pip" {
name = "vmss-frontend-pip"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
allocation_method = "Static"
domain_name_label = "vmss-frontend-${random_string.fqdn.result}"
sku = "Standard"
tags = var.tags
}

resource "azurerm_lb" "frontend_lb" {
name = "vmss-frontend-lb"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
sku = "Standard"

frontend_ip_configuration {
name = "PublicFrontendIP"
public_ip_address_id = azurerm_public_ip.frontend_pip.id
}

tags = var.tags
}

resource "azurerm_lb_backend_address_pool" "frontend_bepool" {
loadbalancer_id = azurerm_lb.frontend_lb.id
name = "FrontendBackendPool"
}

resource "azurerm_lb_probe" "frontend_probe" {
loadbalancer_id = azurerm_lb.frontend_lb.id
name = "http-probe"
protocol = "Tcp"
port = var.application_port
}

resource "azurerm_lb_rule" "frontend_rule" {
loadbalancer_id = azurerm_lb.frontend_lb.id
name = "http-rule"
protocol = "Tcp"
frontend_port = var.application_port
backend_port = var.application_port
frontend_ip_configuration_name = "PublicFrontendIP"
backend_address_pool_ids = [azurerm_lb_backend_address_pool.frontend_bepool.id]
probe_id = azurerm_lb_probe.frontend_probe.id
}

touch main.tf (paste the code below into it)
provider "azurerm" {
features {}
}
resource "random_string" "fqdn" {
length = 6
upper = false
special = false
numeric = false
}

touch variables.tf (paste the code below into it)
variable "resource_group_name" {
type = string
default = "terraform-vmss-rg"
}
variable "location" {
type = string
default = "westus3"
}
variable "admin_user" {
type = string
default = "azureuser"
}
variable "ssh_public_key_path" {
type = string
default = "~/.ssh/id_rsa.pub"
}
variable "instances" {
type = number
default = 2
}
variable "vm_size" {
type = string
default = "Standard_DS1_v2"
}
variable "application_port" {
type = number
default = 80
}
variable "tags" {
type = map(string)
default = {
env = "dev"
project = "vmss-demo"
}
}
touch network.tf (paste the code below into it)
resource "azurerm_resource_group" "rg" {
name = var.resource_group_name
location = var.location
tags = var.tags
}

resource "azurerm_virtual_network" "vnet" {
name = "vmss-vnet"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
address_space = ["10.0.0.0/16"]
tags = var.tags
}

resource "azurerm_subnet" "subnet" {
name = "vmss-subnet"
resource_group_name = azurerm_resource_group.rg.name
virtual_network_name = azurerm_virtual_network.vnet.name
address_prefixes = ["10.0.2.0/24"]
}

resource "azurerm_public_ip" "vmss_pip" {
name = "vmss-public-ip"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
allocation_method = "Static"
domain_name_label = "vmss-demo-${random_string.fqdn.result}"
tags = var.tags
}

resource "azurerm_lb" "lb" {
name = "vmss-lb"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name

frontend_ip_configuration {
name = "PublicIPAddress"
public_ip_address_id = azurerm_public_ip.vmss_pip.id
}

tags = var.tags
}

resource "azurerm_lb_backend_address_pool" "bpepool" {
loadbalancer_id = azurerm_lb.lb.id
name = "BackEndPool"
}

resource "azurerm_lb_probe" "http_probe" {
loadbalancer_id = azurerm_lb.lb.id
name = "http-probe"
port = var.application_port
}

resource "azurerm_lb_rule" "http" {
loadbalancer_id = azurerm_lb.lb.id
name = "http"
protocol = "Tcp"
frontend_port = var.application_port
backend_port = var.application_port
frontend_ip_configuration_name = "PublicIPAddress"
backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id]
probe_id = azurerm_lb_probe.http_probe.id
}
touch compute.tf ( paste the code below into it)
resource "azurerm_virtual_machine_scale_set" "vmss" {
name = "tf-vmss"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
upgrade_policy_mode = "Manual"

sku {
name = var.vm_size
tier = "Standard"
capacity = var.instances
}

storage_profile_image_reference {
publisher = "Canonical"
offer = "UbuntuServer"
sku = "22_04-lts"
version = "latest"
}

storage_profile_os_disk {
caching = "ReadWrite"
create_option = "FromImage"
managed_disk_type = "Standard_LRS"
}

os_profile {
computer_name_prefix = "vmss"
admin_username = var.admin_user
# NOTE: for demo simplicity MS sample uses a password. For production, prefer SSH keys or orchestrated VMSS with ssh keys.
admin_password = "ReplaceThisWithASecurePassword123!"
}

os_profile_linux_config {
disable_password_authentication = false
}

network_profile {
name = "terraformnetworkprofile"
primary = true

ip_configuration {
  name                                   = "IPConfiguration"
  subnet_id                              = azurerm_subnet.subnet.id
  load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id]
  primary                                = true
}

}

tags = var.tags
}
touch autoscale.tf (paste the code below into it)
resource "azurerm_monitor_autoscale_setting" "autoscale" {
name = "vmss-autoscale"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
target_resource_id = azurerm_virtual_machine_scale_set.vmss.id
enabled = true

profile {
name = "autoscale"

capacity {
  default = var.instances
  minimum = 1
  maximum = 5
}

rule {
  metric_trigger {
    metric_name        = "Percentage CPU"
    metric_resource_id = azurerm_virtual_machine_scale_set.vmss.id
    operator           = "GreaterThan"
    statistic          = "Average"
    time_aggregation   = "Average"
    time_window        = "PT2M"
    time_grain         = "PT1M"
    threshold          = 75
  }

  scale_action {
    direction = "Increase"
    type      = "ChangeCount"
    value     = "1"
    cooldown  = "PT5M"
  }
}

rule {
  metric_trigger {
    metric_name        = "Percentage CPU"
    metric_resource_id = azurerm_virtual_machine_scale_set.vmss.id
    operator           = "LessThan"
    statistic          = "Average"
    time_aggregation   = "Average"
    time_window        = "PT2M"
    time_grain         = "PT1M"
    threshold          = 25
  }

  scale_action {
    direction = "Decrease"
    type      = "ChangeCount"
    value     = "1"
    cooldown  = "PT5M"
  }
}

}
}

touch outputs.tf (paste the code below into it)
output "public_ip" {
description = "The public IP address of the load balancer"
value = azurerm_public_ip.vmss_pip.ip_address
}
touch .gitignore (paste the code below into the file)

Terraform

.terraform/
*.tfstate
*.tfstate.backup
*.tfvars
crash.log
override.tf
override.tf.json
.terraform.lock.hcl

OS generated files

.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db

IDE files

.vscode/
.idea/
*.swp
*.swo
*~

Environment variables

.env
.env.local
.env.*.local
touch versions.tf (paste the code below into it)
terraform {
required_version = ">= 1.4.0"

required_providers {
azurerm = {
source = "hashicorp/azurerm"

"~> 3.0" means any 3.x version — 3.0 through <4.0

version = "~> 3.0"
}

random = {
source = "hashicorp/random"
version = "~> 3.0"
}

}
}

(NB; Remove the duplicate public IP and load balancer blocks from the network.tf (they’re now in frontend.tf).
In compute.tf, change this reference line:
load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id]
TO;
load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.frontend_bepool.id]

🚀Initialize / Plan / Apply (local)

initialize providers by running

terraform init -upgrade

review plan by running

terraform plan -out main.tfplan

apply (use the plan you reviewed)

terraform apply main.tfplan
This returned an error, as seen in the screenshot

In your compute.tf file, update the image reference to use a valid Ubuntu 22.04 LTS image below;
storage_profile_image_reference {
publisher = "Canonical"
offer = "0001-com-ubuntu-server-focal"
sku = "20_04-lts-gen2"
version = "latest"
}

Run terraform apply

Copy and save your public IP
(public_ip = "4.227.9.177")

🚀Verify
Azure CLI: Run the code below;
az vm list --resource-group --output table
Replace with your resource group
az vm list --resource-group terraform-state-rg --output table

The command returned no results, meaning no VMs exist in the terraform-state-rg resource group. This resource group likely only contains your Terraform state storage account.
Now, run
az vm list --resource-group terraform-vmss-rg --output table
— You should see VM instances created by the VMSS.

Correct - terraform-state-rg only contains your Terraform state storage account. Your actual VMs/VMSS are in a different resource group.

List all resource groups to find where your VMs are deployed

az group list --output table

List all Virtual Machine Scale Sets

az vmss list --output table

Run az vmss list --resource-group terraform-vmss-rg --output table

Now let's check the actual instances running in your scale set:

az vmss list-instances --resource-group terraform-vmss-rg --name tf-vmss --output table

Check instance connection info:
az vmss list-instance-connection-info --resource-group terraform-vmss-rg --name tf-vmss --output table

The command returned no output, meaning no connection endpoints are configured.
Check if instances exist in the scale set:
az vmss list-instances --resource-group terraform-vmss-rg --name tf-vmss --output table

Great. We have one instance (tf-vmss_0) running successfully.

Use the public_ip output or curl the domain from azurerm_public_ip to see the nginx page. (public_ip = "4.227.9.177")

You can access the nginx page using the public IP address. Here are the ways to do it:
http://4.227.9.177 on a browser or curl --connect-timeout 15 -m 30 -v http://4.227.9.177 on your terminal.
Conclusion
Deploying an Azure Virtual Machine Scale Set using Terraform and pushing it to GitHub exemplifies modern DevOps excellence—combining infrastructure as code with version control for scalability, repeatability, and team synergy. With Terraform’s declarative power and GitHub’s collaborative backbone, you've laid the foundation for resilient cloud architecture and agile development workflows. This approach not only accelerates deployment but also ensures traceability, security, and continuous improvement across environments.

Procedures for Deploying .NET 9 App to Azure Kubernetes Service (AKS)

Nelson Akpa — Mon, 15 Sep 2025 13:17:22 +0000

🚀 Table of Contents

Introduction
Required software installations and verification.
Create the .NET Application
Containerize Your Application
Set Up Azure Infrastructure
Create Kubernetes Configuration
Set Up GitHub Actions CI/CD
Access Your Deployed Application
Test Continuous Deployment
Clean Up Resources (Optional)
Conclusion.

🚀 1. Introduction
Deploying a .NET 9 application to Azure Kubernetes Service (AKS) unlocks the full potential of cloud-native architecture with cutting-edge performance and scalability. This article outlines a streamlined deployment workflow—from containerizing your .NET 9 codebase to orchestrating it within AKS clusters. Whether you're modernizing legacy systems or launching new microservices, you'll gain practical insights to build, ship, and scale with confidence in the Azure ecosystem.

🚀 2. Required software installations and verification

Visual Studio Code - Download here
NET 8 SDK - Download here
Git - Download here
Docker Desktop - Download here
Important: Start Docker Desktop after installation
Azure CLI - Download here
kubectl - Download here
GitHub CLI (Optional) - Download here 🚀 3.0 CREATE THE .NET APPLICATION 3.1 Set Up Project Structure First, open your VSCode and set your files to "autosave. " Then, navigate to the file on your laptop and create a new folder named "DotNetApp." Create the new Folder DotNetApp or choose any name of your choice Open the new Folder Open the terminal, click on the top screen's view section, and then select terminal. Run the following code in VSCode as shown in the screenshots: mkdir weather-app-demo cd weather-app-demo mkdir WeatherApp cd WeatherApp 3.2 Initialize .NET Project Run dotnet new webapi -minimal 3.3. Add Required Dependencies Run the following separately: a. dotnet add package Microsoft.Extensions.Diagnostics.HealthChecks b. dotnet add package Swashbuckle.AspNetCore 3.4. Create the Application Code Replace the contents of Program.cs with the code below; using Swashbuckle.AspNetCore.SwaggerUI;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container
builder.Services.AddHealthChecks();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

// Configure Kestrel to listen on port 8080 (required for containers)
builder.WebHost.ConfigureKestrel(options =>
{
options.ListenAnyIP(8080);
});

var app = builder.Build();

// Configure the HTTP request pipeline
if (app.Environment.IsDevelopment() || app.Environment.IsProduction())
{
app.UseSwagger();
app.UseSwaggerUI(c =>
{
c.SwaggerEndpoint("/swagger/v1/swagger.json", "Weather API v1");
c.RoutePrefix = "swagger";
});
}

// Define API endpoints
app.MapGet("/", () => new
{
Message = "Welcome to the Weather App!",
Version = "1.0.0",
Environment = app.Environment.EnvironmentName,
Timestamp = DateTime.UtcNow
})
.WithName("GetWelcome")
.WithTags("General");

app.MapGet("/weather", () =>
{
var summaries = new[]
{
"Freezing", "Bracing", "Chilly", "Cool", "Mild",
"Warm", "Balmy", "Hot", "Sweltering", "Scorching"
};

var forecast = Enumerable.Range(1, 5).Select(index => new
{
    Date = DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
    TemperatureC = Random.Shared.Next(-20, 55),
    Summary = summaries[Random.Shared.Next(summaries.Length)]
})
.Select(temp => new
{
    temp.Date,
    temp.TemperatureC,
    TemperatureF = 32 + (int)(temp.TemperatureC / 0.5556),
    temp.Summary
});

return forecast;

})
.WithName("GetWeatherForecast")
.WithTags("Weather");

// Health check endpoint (required for Kubernetes)
app.MapHealthChecks("/health")
.WithTags("Health");

app.Run();

3.5. Test Locally
Run dotnet run

Open your browser and test these endpoints:
http://localhost:8080/ - Welcome message

http://localhost:8080/weather - Weather forecast

http://localhost:8080/swagger - API documentation

http://localhost:8080/health - Health check

Press Ctrl+C to stop the application.

🚀 4. CONTAINERIZE YOUR APPLICATION
4.1. Create a Dockerfile file (no extension) in the Weatherapp folder. Paste the code below into the file;

Multi-stage build for optimized image size

Build stage

FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src

✅ Copy csproj from current dir (Dockerfile context = Weatherapp/)

COPY ["Weatherapp.csproj", "./"]
RUN dotnet restore "Weatherapp.csproj"

Copy source code and build

COPY . .
RUN dotnet build "Weatherapp.csproj" -c $BUILD_CONFIGURATION -o /app/build

Publish stage

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "Weatherapp.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

Runtime stage

FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
WORKDIR /app
EXPOSE 8080
ENV ASPNETCORE_URLS=http://+:8080
ENV ASPNETCORE_ENVIRONMENT=Production

Install curl

RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*

Final stage

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WeatherApp.dll"]

4.2 Create .dockerignore
Create a .dockerignore file to exclude unnecessary files. Paste the file below into the Dockerignore file.

Build outputs

bin/
obj/
out/

IDE files

.vs/
.vscode/
*.user
*.suo

OS files

.DS_Store
Thumbs.db

Git

.git/
.gitignore

Documentation

README.md
*.md

Docker files

Dockerfile
Dockerfile.*
.dockerignore

Logs

.log
logs/

**4.3 Build and Test Container*
Run the following code;

Build the Docker image

docker build -t weather-app: local .

Run the container

docker run -d -p 8080:8080 --name weather-test weather-app:local

Test the containerized app

curl http://localhost:8080/

curl http://localhost:8080/weather

# Clean up
Run docker stop weather-test

docker rm weather-test

5. SET UP AZURE INFRASTRUCTURE
Run az login
This connects to your Azure account and opens up a list of subscriptions.

5.2 Select your subscription
Choose your subscription from the list of others, or simply run the following;

List available subscriptions

az account list --output table

Set the subscription you want to use

az account set --subscription "Your-Subscription-Name"
5.3. Create a resource group
Run the following code;
az group create --name student-demo --location eastus

5.4. Create a Container Registry

Replace 'studentdemo2024acr' with a unique name (add your initials/year)

az acr create \
--resource-group student-demo \
--name studentdemo2074acr \
--sku Basic

5.5. Build and Push Image Using ACR
From the folder that contains your Dockerfile, run:
az acr build \
--registry studentdemo2074acr \
--image weather-app:latest \
.

5.6 Create AKS Cluster with ACR integration.
Run this code
az aks create \
--resource-group student-demo \
--name student-aks-cluster \
--node-count 1 \
--node-vm-size Standard_B2s \
--attach-acr studentdemo2074acr \
--enable-managed-identity \
--generate-ssh-keys

5.7. Connect To Your Cluster

Download cluster credentials

az aks get-credentials \
--resource-group student-demo \
--name student-aks-cluster

# Verify connection
kubectl get nodes

5.8. Verify ACR Integration (Optional)

Get the managed identity client ID

Run the code;
CLIENT_ID=$(az aks show \
--resource-group student-demo \
--name student-aks-cluster \
--query "identityProfile.kubeletidentity.clientId" \
--output tsv)

echo "Kubelet Client ID: $CLIENT_ID"

# Verify the role assignment exists
az role assignment list \
--assignee $CLIENT_ID \
--scope $(az acr show --name studentdemo2074acr --query id --output tsv) \
--output table

You should see an AcrPull role assignment. If not, create it manually:

Only if the role assignment doesn't exist

Run;
az role assignment create \
--assignee $CLIENT_ID \
--role AcrPull \
--scope $(az acr show --name studentdemo2074acr --query id --output tsv)
6. CREATE KUBERNETES CONFIGURATION
6.1. Set Up Kubernetes Manifests Directory
Run the following code;
cd .. (# Back to weather-app-demo folder)

mkdir k8s
cd k8s

6.2. Create Deployment Configuration
Create deployment.yaml
paste the code below into the file;
apiVersion: apps/v1
kind: Deployment
metadata:
name: weather-app
namespace: default
labels:
app: weather-app
version: v1
spec:
replicas: 1
selector:
matchLabels:
app: weather-app
template:
metadata:
labels:
app: weather-app
version: v1
spec:
imagePullSecrets:
- name: acr-pull-secret
containers:
- name: weather-app
image: studentdemo2074acr.azurecr.io/weather-app:

      imagePullPolicy: Always
      ports:
        - name: http
          containerPort: 8080
          protocol: TCP
      env:
        - name: ASPNETCORE_ENVIRONMENT
          value: "Production"
      resources:
        requests:
          memory: "128Mi"
          cpu: "100m"
        limits:
          memory: "512Mi"
          cpu: "500m"
      livenessProbe:
        httpGet:
          path: /health
          port: http
        initialDelaySeconds: 30
        periodSeconds: 10
        timeoutSeconds: 5
        failureThreshold: 3
      readinessProbe:
        httpGet:
          path: /health
          port: http
        initialDelaySeconds: 10
        periodSeconds: 5
        timeoutSeconds: 3
        failureThreshold: 3
      startupProbe:
        httpGet:
          path: /health
          port: http
        initialDelaySeconds: 15
        periodSeconds: 5
        timeoutSeconds: 3
        failureThreshold: 30

Note: There's no need for imagePullSecrets because AKS with --attach-acr handles authentication automatically!
6.3. Create Service Configuration
Create service.yaml and paste the code below into the file.
apiVersion: v1
kind: Service
metadata:
name: weather-app-service
labels:
app: weather-app
spec:
type: LoadBalancer
selector:
app: weather-app
ports:

name: http port: 80 targetPort: 8080 protocol: TCP 6.4 Deploy to Kubernetes Run the codes individually. # Apply Kubernetes manifests kubectl apply -f deployment.yaml kubectl apply -f service.yml # Check deployment status kubectl get deployments kubectl get pods kubectl get services

Watch pods until they're running

kubectl get pods --watch

6.5. Troubleshoot if Needed
If you see ImagePullBackOff:

Check pod events

kubectl describe pod $(kubectl get pods -l app=weather-app -o jsonpath='{.items[0].metadata.name}')

Check if the image exists in ACR

az acr repository show-tags --name studentdemo2024acr --repository weather-app --output table

Force a new pull

kubectl rollout restart deployment/weather-app
7.0. SET UP GITHUB ACTIONS CI/CD
7.1. Initialize Git Repository
Run the following codes
cd .. (# Back to weather-app-demo folder)

Initialize Git repository

git init
git add .
git commit -m "Initial commit: Weather App with Docker and Kubernetes"

7.2. Create Azure Service Principal

Get your subscription ID

SUBSCRIPTION_ID=$(az account show --query id --output tsv)
echo "Subscription ID: $SUBSCRIPTION_ID"

Create service principal with contributor role

az ad sp create-for-rbac \
--name "weather-app-github-sp" \
--role contributor \
--scopes /subscriptions/$SUBSCRIPTION_ID/resourceGroups/student-demo \
--sdk-auth

Important: Copy the entire JSON output in the red box - you'll need it for GitHub secrets!
7.3. Create GitHub Repository

Create GitHub repository (using GitHub CLI)

gh auth login # Follow the prompts

gh repo create weather-app-demo --public --source=. --push

Alternative: Create the repository manually on GitHub.com and push your code.
7.4. Configure GitHub Secrets
Navigate to your GitHub repository:

Go to Settings → Secrets and variables → Actions
Click New repository secret and add these secrets:

Navigate to secrets and variables

Secret Name
Value
AZURE_CREDENTIALS
The JSON output from step 5.2
ACR_NAME
studentdemo2074acr (your ACR name)
RESOURCE_GROUP
student-demo
CLUSTER_NAME
student-aks-cluster

7.5. Create GitHub Workflow
Create the workflow directory and file by running the code below;
mkdir -p .github/workflows
touch .github/workflows/deploy.yml
name: Build and Deploy to AKS

on:
push:
branches: [main]
workflow_run:
workflows: ["CI - Build and Test"]
types: [completed]
branches: [main]

jobs:
build-and-deploy:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'push' }}

steps:
  - name: Checkout code
    uses: actions/checkout@v4

  - name: Setup .NET 9.0
    uses: actions/setup-dotnet@v4
    with:
      dotnet-version: '9.0.x'

  - name: Restore dependencies
    run: dotnet restore WeatherApp/WeatherApp.csproj

  - name: Build application
    run: dotnet build WeatherApp/WeatherApp.csproj --configuration Release --no-restore

  - name: Run tests
    run: dotnet test WeatherApp/WeatherApp.csproj --no-build --verbosity normal

  - name: Azure Login
    uses: azure/login@v1
    with:
      creds: ${{ secrets.AZURE_CREDENTIALS }}

  - name: Login to Azure Container Registry
    run: |
      az acr login --name ${{ secrets.ACR_NAME }}

  - name: Set IMAGE_NAME environment variable
    run: echo "IMAGE_NAME=weather-app" >> $GITHUB_ENV

  - name: Set NAMESPACE environment variable
    run: echo "NAMESPACE=default" >> $GITHUB_ENV

  - name: Build and push Docker image to ACR
    run: |
      IMAGE_TAG=${{ secrets.ACR_NAME }}.azurecr.io/$IMAGE_NAME:${{ github.sha }}
      docker build -t $IMAGE_TAG WeatherApp/
      docker push $IMAGE_TAG
      echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV

  - name: Test Docker image
    run: |
      docker run -d -p 8080:8080 -e ASPNETCORE_URLS=http://+:8080 --name test-container $IMAGE_TAG
      sleep 10
      docker logs test-container
      curl -f http://localhost:8080/health || exit 1
      docker stop test-container
      docker rm test-container

  - name: Deploy to AKS
    if: github.ref == 'refs/heads/main'
    run: |
      # Get AKS credentials
      az aks get-credentials \
        --resource-group ${{ secrets.RESOURCE_GROUP }} \
        --name ${{ secrets.CLUSTER_NAME }} \
        --overwrite-existing

      # Check if deployment exists, if not create it
      if ! kubectl get deployment/weather-app -n default > /dev/null 2>&1; then
        echo "Creating new deployment..."
        if [ -d "k8s/" ]; then
          kubectl apply -f k8s/ -n default
        else
          echo "No k8s/ directory found. Please create Kubernetes manifests."
          exit 1
        fi
      else
        echo "Updating existing deployment..."
        kubectl set image deployment/weather-app \
          weather-app=$IMAGE_TAG \
          -n default \
          --record
      fi

      # Wait for deployment to complete
      kubectl rollout status deployment/weather-app -n default --timeout=300s

      # Get service info
      kubectl get service weather-app-service -n default || echo "Service not found"

      # Verify pods
      kubectl get pods -n default -l app=weather-app

      # Simple smoke test
      kubectl port-forward service/weather-app-service 8080:80 -n default &
      sleep 5
      curl -f http://localhost:8080/health || echo "Health check failed"
      pkill -f "kubectl port-forward"

7.6. 5.6 Deploy Your Application
git add .
git commit -m "Add GitHub Actions CI/CD pipeline"
git push origin main

Monitor the deployment:
Go to your GitHub repository
Click the Actions tab
Watch your workflow run in real-time

**8.0 Access Your Deployed Application
8.1 Access Your Deployed Application
Get External IP Address

Check service status

Run kubectl get service weather-app-service

Wait for EXTERNAL-IP (may take 2-5 minutes)

Run kubectl get service weather-app-service --watch

8.2. Test Your Live Application

Test the endpoints

curl http://YOUR-EXTERNAL-IP/
http://4.157.170.214

curl http://YOUR-EXTERNAL-IP/weather
http://4.157.170.214/weather

curl http://YOUR-EXTERNAL-IP/health
http://4.157.170.214/health

Or open in browser

open http://YOUR-EXTERNAL-IP/swagger # macOS
http://4.157.170.214/swagger

start http://YOUR-EXTERNAL-IP/swagger # Windows
9. Test Continuous Deployment
Make a Code Change
Edit WeatherApp/Program.cs and update the welcome message:
app.MapGet("/", () => new
{
Message = "Hurray! Welcome to the Updated Weather App! 🌤️",
Version = "1.1.0",
Environment = app.Environment.EnvironmentName,
Timestamp = DateTime.UtcNow,
DeployedBy = "GitHub Actions"
})

Deploy the Changes by running the following code
git add ../Weatherapp/Program.cs
git commit -m "Update welcome message and version"

# Test the endpoints on a browser
http://YOUR-EXTERNAL-IP/swagger
http://4.157.170.214

10. Clean Up Resources (Optional)
Option 1: Delete Individual Resources

Delete Kubernetes resources

kubectl delete -f k8s/

Delete AKS cluster

az aks delete --resource-group student-demo --name student-aks-cluster --yes

Delete Container Registry

az acr delete --name studentdemo2024acr --yes

Option 2: Delete Everything (Recommended)

Delete the entire resource group (removes all Azure resources)

az group delete --name student-demo --yes --no-wait

🚀 Conclusion: Seamless Deployment, Scalable Success
Deploying a .NET 9 application to Azure Kubernetes Service (AKS) is no longer a daunting task—it’s a streamlined process that empowers developers to harness the full potential of cloud-native architecture. You ensure a robust, scalable, and resilient deployment pipeline by following the outlined procedures—from containerizing the app to configuring YAML manifests and leveraging Azure CLI. With AKS and .NET 9 working in tandem, your applications are primed for performance, agility, and future growth.

Procedures for creating a sample resume and pushing it to GitHub Pages.

Nelson Akpa — Thu, 24 Apr 2025 04:57:33 +0000

Table of contents

Introduction
Download Git Bash
Configure Git Bash
Work with the configured environment
Clone your GitHub repo
Push to GitHub
Conclusion.

Introduction
Creating an online resume can effectively showcase your skills and experience to potential employers, while also demonstrating your proficiency in web technologies. In this guide, you'll learn how to craft a professional resume, format it for web presentation, and host it on GitHub Pages—a free and accessible platform for personal websites. Whether you're new to GitHub or looking to refine your online portfolio, this step-by-step approach will ensure your resume is well-structured and easily accessible to recruiters. Let's get started!

2.0 Downloading Git Bash
2.1. Go to the link git-scm.com and download the software for Mac if you're using macOS.

2.2. Install Homebrew by going to the website "brew.sh"

2.3. Please copy the link and paste it into your Mac terminal; then, press the Enter key.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

2.4. Input your computer password and click the Enter key

Click the Enter key again to continue

2.5. Run "brew help" to get started

2.6. Type "brew --version" and click Enter key

2.7. To install git, type brew install git and press the Enter key

If Git is already installed, you can type 'brew reinstall git' and press the Enter key.

To ensure git is installed, run 'git --version'

Open the link https://realcloudprojects.github.io/Git-lesson-101/#configure--gitbash in a separate tab and follow the steps.

3.0. Configure Git Bash
Run 'git config –global user.name “name”'. Here, you can input any name.

3.1. Run 'git config –global user.email “email”. Here, insert a valid email.

3.2. To verify, run 'git config --list'

4.0. Work with the configured environment
4.1. Run 'mkdir website'

Access the directory(website) by running 'cd website'

4.2. Initialize the directory by running 'git init'

4.3. Run 'git status' to confirm the empty directory.

4.4. Create a file by running 'touch index.html'

4.5. To fill in the empty index.html file, first open it with 'vim index.html'.

4.6. To start writing in it, press the 'I' key for Insert and then go to ChatGPT to copy a resume code. Then, paste it into the empty file.

4.7. Go to ChatGPT and type 'sample index.html resume', then copy and paste into your git.

4.8. Edit the name, email, and phone number in the resume.

4.9. Press the Shift + Esc key and then press the Shift + semicolon, enter wq ( w=save and q=quit), then press the Enter key. This returns you to the main page.

5.0. Clone your GitHub repo
5.1. Log in to your GitHub account and click on the + sign button to create a new repository.

5.2. Copy the code

5.3. Go back to your git bash and run 'git remote add origin https://github.com/Nelsinclair1/Git-class101.git

(You can type 'clear' in your git bash to create space, but your work is still saved)

6.0. Push to GitHub
6.1. First, try verifying git status

6.2. Run 'git add index.html' to track the file.

6.3. Run git commit -m “my first commit”

6.4. Run 'git push origin master'

6.5. Input your GitHub account password

6.6. Go to 'GitHub Personal Access Tokens settings' and generate a Personal Access Token (PAT). Then, please copy and paste it as your password.

The repository was successfully pushed to GitHub.

6.7. Go to your GitHub to compare the pull request

Nothing to compare as shown below

6.8. Locate the new repository and confirm that it contains the same file pushed from your Git Bash.

6.9. Click to open the file

6.10. Click on Settings

6.11. Click on pages

6.12. Deploy from the Main branch

6.13. Refresh the page after a minute and click on 'visit site'

Site displayed successfully.

Conclusion
This article provides a concise, step-by-step guide to creating an online resume and hosting it on GitHub Pages. It outlines the process of formatting your resume for web presentation, uploading the necessary files to GitHub, and deploying your site. By following these procedures, you'll not only present your professional information effectively but also showcase your technical skills to potential employers. This practical approach ensures your resume is both visually appealing and easily accessible to recruiters.

A step-by-step guide to providing storage for a new company app on the Azure portal.

Nelson Akpa — Thu, 10 Apr 2025 19:47:35 +0000

Table of contents

Introduction
Create the storage account and manage identity.
Secure access to the storage account with a key vault and key.
Configure the storage account to use the customer-managed key in the key vault
Configure a time-based retention policy and an encryption scope.4.

First, click on the link and follow the instructions from the cloud projects.
(https://microsoftlearning.github.io/Secure-storage-for-Azure-Files-and-Azure-Blob-Storage/Instructions/Labs/LAB_04_storage_web_app.html)
Introduction

Introduction
Setting up storage on the Azure portal is a crucial step when launching a new company app. This guide provides a clear, step-by-step process to configure storage that ensures your app's data is secure, scalable, and easily accessible. Whether you're managing user data or application resources, this guide equips you with the tools to support your app's success in a reliable cloud environment.

2.0. Create the storage account and managed identity.
2.1. Provide a storage account for the web app.
In the portal, search for and select Storage accounts.
Select + Create.

For the Resource group select Create New. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab and check the box for Enable infrastructure encryption.

Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create.

Wait for the resource to deploy and go to resource.

2.2. Provide a managed identity for the web app to use.
Search for and select Managed identities and Select Create.

Select your resource group.

Give your managed identity a name.

Select Review and Create.

Go to the Resource.

2.3. Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.
Search for and select your storage account **and **select the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity, and select the managed identity you created in the previous step **.
.
**Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.
.
3.0. Secure access to the storage account with a key vault and key.
3.1. To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.
In the portal, search for and select Resource Groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment.

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.
Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + Assign.

Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.
3.2. Create a key vault to store the access keys.
In the portal, search for and select Key Vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + Create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to the resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

3.3. Create a customer-managed key in the key vault.
Select the Keys blade in your key vault in the Objects section.

Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

4.0. Configure the storage account to use the customer-managed key in the key vault.
4.1. Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.
In the portal, search for and select Resource Groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment.

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

4.2. Configure the storage account to use the customer-managed key in your key vault.
Return to your storage account.

In the Security + networking section, select the Encryption blade.
Select Customer-managed keys.

Select a key vault and key then Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.

Select an identity.

Select your managed identity then select Add.

Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.
5.0. Configure a time-based retention policy and an encryption scope.
5.1. Navigate to your storage account.

In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable Blob storage section, select + Add policy.

For the Policy type, select time-based retention, set the retention period to 5 days, and Save your changes.

Please try to delete the file in the container and verify that you are notified that you failed to delete blobs due to policy.

5.2. The developers require an encryption scope that enables infrastructure encryption.
Navigate back to your storage account, in the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add and give your encryption scope a name.

The Encryption type is Microsoft-managed key and set Infrastructure encryption to Enable and then create the encryption scope.

Return to your storage account and create a new container.

Notice on the New container page, there is the Name and Public access level.

Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

In conclusion, providing storage for your new company app on the Azure portal is a straightforward process when broken into manageable steps. By leveraging Azure's powerful features and intuitive interface, you can ensure secure and efficient storage tailored to your app's needs. This guide aims to empower you to make informed decisions and optimize your cloud storage setup, setting a strong foundation for your app's success. Happy building!

Step-by-step guide on Providing shared file storage for the company offices on Azure Portal.

Nelson Akpa — Tue, 08 Apr 2025 02:18:01 +0000

Table of contents
1. Introduction
2. Create a storage account specifically for file shares.
3. Configure a file share and directory.
4. Configure snapshots and practice restoring files.
5. Configure restricting storage access to selected virtual networks and subnets.
6. Conclusion.

Introduction.
Setting up shared file storage on the Azure Portal enhances collaboration and streamlines access to files across company offices. This guide provides a straightforward, step-by-step approach to provisioning and configuring storage that ensures scalability, security, and ease of use for your organization's shared resources. Whether managing day-to-day operations or supporting team projects, this guide equips you with the tools to optimize file sharing within your company.

First, search the link and follow the instructions on the Azure cloud storage exercises (https://microsoftlearning.github.io/Secure-storage-for-Azure-Files-and-Azure-Blob-Storage/Instructions/Labs/LAB_03_storage_file_shares.html)

2.0. Create a storage account specifically for file shares
2.1. Create a storage account for the finance department’s shared files.
log in to the Azure portal, search for and select Storage accounts.
Select + Create.

For the Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements.

Set the Performance to Premium.

Set the Premium account type to File shares.

Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.

Select Go to the resource.

3.0. Create and configure a file share with directory.
3.1. Create a file share for the corporate office.
In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults.

Select Create

3.2. Add a directory to the file share for the finance department. For future testing, upload a file.
Select your file share and select + Add directory.

Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add a directory to further organize your file share.
Upload a file of your choosing.

4.0. Configure snapshots and practice restoring files.
Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.
4.1. Select your file share.

In the Operations section, select the Snapshots blade.

Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

4.2. Practice using snapshots to restore a file.
Return to your file share.

Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete.

Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore

Select the file and then select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

5.0. Configure restricting storage access to selected virtual networks
The tasks in this section require a virtual network with the subnet. In a production environment, these resources would already be created.
5.1. Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.

Take the defaults for other parameters, select Review + Create, and then Create.

Wait for the resource to deploy and select Go to the resource.

In the Settings section, select the Subnets blade.

Select the default subnet.

In the Service endpoints section choose Microsoft.Storage in the Services drop-down. Save your changes.

5.2. The storage account should only be accessed from the virtual network you just created.
5.1. Return to your files storage account.

In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual Networks section, select Add existing virtual network.

Select your virtual network and subnet, and select Add.
Be sure to Save your changes.

Select the Storage browser and navigate to your file share.

Verify the message is not authorized to perform this operation. You are not connecting from the virtual network.

Conclusion.
By completing this guide, you’ve successfully set up shared file storage on the Azure Portal to streamline collaboration across company offices. This scalable and secure solution ensures seamless access to shared resources, enhancing productivity and teamwork. Regular monitoring and updates will help you maintain an efficient and reliable file-sharing environment for your organization.

Step-by-step guide on providing private storage for internal company documents on Azure Portal.

Nelson Akpa — Mon, 07 Apr 2025 02:44:29 +0000

Table of contents.
1. Introduction.
2. Create a storage account for the company's private documents.
3. Configure redundancy for the storage account.
4. Create a private storage container for the corporate data
5. Configure a shared access signature so partners have restricted access to a file.
6. Configure storage access tiers and content replication.
7. Back up the public website storage.
8. Implement lifecycle management to move content to the cool tier.
9. Conclusion.

Introduction.
Setting up private storage for internal company documents on the Azure Portal is a vital step to ensure data security, accessibility, and organization. This guide offers a clear, step-by-step approach to creating and configuring storage tailored to your organization's needs. It enables secure document management in a scalable cloud environment, whether you're safeguarding sensitive data or optimizing collaboration. This guide simplifies the process to support your goals efficiently.

Before you proceed, search this link (https://learn.microsoft.com/en-us/training/modules/guided-project-azure-files-azure-blobs/) and follow through for Azure cloud projects.

2.0. Create a storage account for the company's private documents
2.1. In the portal, search for and select Storage accounts.
Select + Create.

2.2. Select the Resource group created in the previous lab*.
If the first storage exercise's resource group was deleted after use, you'll have to recreate it.

**2.3. Set the **Storage account* name to private. To ensure its uniqueness, add an identifier to the name. leave other settings as default.

2.4. Select Review, and then Create the storage account.

2.5. Wait for the storage account to deploy, and then select Go to the resource.

3.0. Configure the appropriate level of redundancy.
3.1. In the storage account, in the Data management section, select the Redundancy blade.

3.2. Ensure Geo-redundant storage (GRS) is selected and refresh the page.

3.3. Review the primary and secondary location information and save your changes.

4.0. Create a private storage container for the corporate data.
4.1. In the storage account, in the Data storage section, select the Containers blade.

Select + Container and ensure the name of the container is private.

Ensure the Public access level is Private (no anonymous access).
As you have time, review the Advanced settings, but take the defaults and select Create.

4.2. For testing, upload a file to the private container. The type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.
Select the container and select Upload.

Browse to files and select a file.

Upload the file.

Select the uploaded file.

On the Overview tab, copy the URL

Paste the URL into a new browser tab.

Verify the file doesn’t display and you receive an error.

5.0. An external partner requires read-and-write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).
5.1. Select your uploaded blob file and move to the Generate SAS tab.
In the Permissions drop-down, ensure the partner has only Read permissions.

Select Generate SAS token and URL.

Copy the Blob SAS URL to a new browser tab.

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.
.
6.0. Configure storage access tiers and content replication
6.1. To save on costs, after 30 days, move blobs from the hot tier to the cool tier.
Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data Management section, select the Lifecycle Management Blade.

Select Add rule.

Set the Rule name to move to cool.

Set the Rule scope to Apply the rule to all blobs in the storage account.

Select Next.

Ensure the 'Last modified' is selected.

Set More than (days ago) to 30.

In the Then drop-down select Move to cool storage.

As you have time, review other lifecycle options in the drop-down.
Add the rule.

7.0 The public website files need to be backed up to another storage account.
7.1. In your storage account, create a new container called backup. Use the default values.

7.2. Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.
In the Data management section, select the Object replication blade.

Select Create replication rules.

Set the Destination storage account to the private storage account.

Set the Source container to public and the Destination container to backup.

Create the replication rule.

Optionally, upload a file to the public container

Return to the private storage account and refresh the backup container

8.0. Implement lifecycle management to move content to the cool tier.
8.1. Navigate to your storage account in the Azure portal and enable access time tracking.
In the Data Management section of the menu, select Lifecycle Management.

Within the Lifecycle Management settings, look for the option to enable 'Access Time Tracking' and check the corresponding box

8.2. Create a Lifecycle Management Policy:
Go to the Lifecycle Management section in your storage account, add a new rule specifying conditions, such as the number of days since the blob was created or last modified.

Define the action to move blobs to the cool tier when the conditions are met.(refer to 6.1 of this article)
8.3 Apply Filters: Use blob prefixes or tags to target specific blobs or containers for the policy.

Activate the Policy: Ensure the rule is enabled and wait for it to execute automatically based on the defined conditions.

Conclusion
By following this guide, you’ve successfully set up private storage for internal company documents on the Azure Portal. This ensures your organization’s sensitive data is secure, accessible, and well-organized. With scalable and reliable storage solutions in place, your team can focus on collaboration and innovation while maintaining robust data protection.

Step-by-step guide on how to create a Windows 11 VM that is highly available on the Azure portal.

Nelson Akpa — Sat, 05 Apr 2025 23:10:58 +0000

Table of contents

Introduction
Create a Windows 11 VM that's highly available.
Conclusion.

Introduction
Creating a highly available Windows 11 virtual machine (VM) on the Azure portal is essential for ensuring reliability and continuous access to your applications. Creating a highly available Windows 11 virtual machine (VM) implies that the setup is designed to minimize downtime and ensure reliability, even in the event of hardware or software failures. This typically involves leveraging features like availability zones (placing VMs in different physical locations/zones within a region to prevent a single point of failure), load balancing, and redundant resources. It ensures that the VM can continuously provide its intended services or applications, making it ideal for critical workloads where uninterrupted accessibility is essential.
This step-by-step guide walks you through setting up and configuring a Windows 11 VM with features that enhance availability and fault tolerance. Whether for development, testing, or operational use, this guide equips you with the tools to build a resilient cloud environment tailored to your needs.

2.0. Create a Windows 11 VM that's highly available.
2.1. Login to the Azure portal, navigate to the Virtual machine, and select Create.

2.2 Fill in the project details and create a new resource group.

2.3. Fill in the instance details.

2.4. Navigate to the administrator section, and create a preferred username, and password. Also, choose the RDP(3389) inbound port.

Ensure Licensing is checked.

2.5. Go to the Networking section and create a load balancer.

2.6. Navigate to the monitoring section and disable diagnostics.

2.7. Go to the Tag section, and add the name and value.

Review and Create

2.8. Click on Create

2.9. Click on Go to Resource

2.10. Click on public IP address to extend Idle time out and save

2.11. Click on Connect.

Click on Select to Configure RDP file

Download the RDP file.

2.12. Install Microsoft remote desktop if not already installed and then open the downloaded Windows 11 RDP file.

Conclusion
By completing this guide, you've successfully created a highly available Windows 11 virtual machine on the Azure portal. This setup ensures reliability, scalability, and continuous access to your applications, even in unexpected disruptions. Regular maintenance and monitoring will help you optimize performance and keep your cloud environment resilient to evolving challenges.

Step-by-step guide on how to provide storage for the public website on the Azure portal.

Nelson Akpa — Fri, 04 Apr 2025 07:59:30 +0000

Table of contents

Introduction.
Create a storage account with high availability.
Create a blob storage container with anonymous read access.
Practice uploading files and testing access.
Configure soft delete
Configure blob versioning.

Introduction
Providing storage for a public website on the Azure portal is a straightforward and efficient way to manage and deliver content to a broad audience. This guide will walk you through setting up and configuring Azure storage to ensure your website is scalable, secure, and optimized for performance. Whether you're hosting static files or dynamic content, this step-by-step guide simplifies the process and equips you with the tools to make your website accessible and reliable.
First, go to your browser and paste the link https://learn.microsoft.com/en-us/training/modules/guided-project-azure-files-azure-blobs/

Click on the marked project

2.0. Create a **storage account with high availability.
2.1. In the Azure portal, search for and select storage accounts

2.2. Fill up the project details.

2.3. Fill in the instance details set the storage account name to publicwebsite10245 and take the defaults for other settings

2.4. Select Review and then Create.

Wait for the storage account to deploy, and then select Go to the resource.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Read-access Geo-redundant storage is selected and review the primary and secondary location information.

In the storage account, in the Settings section, select the Configuration Blade.

Ensure the Allow blob anonymous access setting is Enabled.
Be sure to Save your changes.

3.0. Create a blob storage container with anonymous read access.
3.1. In your storage account, in the Data storage section, select the Containers blade.

Select +Container and ensure the name of the container is public then select Create.

3.2. Select your public container.
On the Overview blade, select Change Access Level.

Ensure the Public access level is Blob (anonymous read access for blobs only).
Select OK.

4.0. Practice uploading files and testing access.
4.1. Ensure you are viewing your container.
Select Upload.

Browse to files and select a file. Browse to a file of your choice.
Select Upload.

Close the upload window, Refresh the page, and ensure your file was uploaded.

4.2. Select your uploaded file.
On the Overview tab, copy the URL.

Paste the URL into a new browser tab.
If you have uploaded an image file it will display in the browser.

5.0. Configure soft delete
5.1. Go to the Overview blade of the storage account.
On the Properties page, locate the Blob service section.
Select the Blob soft delete setting.

Ensure the Enable soft delete for blobs is checked

Change the Keep deleted blobs for (in days setting is 21.
Notice you can also Enable soft delete for containers.
Don’t forget to Save your changes.

5.2. If something gets deleted, you need to practice using soft delete to restore the files.
Navigate to the container where you uploaded a file.
Select the file you uploaded and then select Delete.
Select OK to confirm deleting the file.

On the container Overview page, toggle the slider to show deleted blobs. This toggle is to the right of the search box.
Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Refresh the container and confirm the file has been restored.

6.0. Configure blob versioning
6.1. Go to the Overview blade of the storage account.
In the Properties section, locate the Blob service section.
Select the Versioning setting.

Ensure the Enable versioning for the blobs checkbox is checked.
Notice your options to keep all versions or delete versions after.
Don’t forget to Save your changes.

6.2. As you have time experiment with restoring previous blob versions.
Upload another version of your container file. This overwrites your existing file.
Your previous file version is listed on the Show Deleted Blobs page.

Conclusion
By completing this guide, you've successfully set up storage on the Azure portal to support your public website's needs. This ensures your content is accessible, secure, and optimized for performance, allowing your audience to enjoy a seamless experience. Regularly monitor and maintain your storage to keep your website running efficiently and adapt to growing demands.

Step-by-step guide on how to provide storage for the IT department testing and training on the Azure portal.

Nelson Akpa — Wed, 02 Apr 2025 05:34:19 +0000

Table of contents.

Introduction.
Create and deploy a resource group.
Create a storage account on the Azure Portal.
Configure basic settings for security and networking.
Conclusion.

Introduction.
Providing storage on the Azure portal is critical for empowering IT departments in their testing and training endeavors. This guide offers a streamlined approach to setting up storage solutions tailored to meet the dynamic needs of technical testing environments. Whether managing workflows or preparing for training sessions, this step-by-step guide ensures your Azure storage setup is efficient, secure, and ready to support your IT team's objectives.

First, go to your browserand paste the link https://learn.microsoft.com/en-us/credentials/applied-skills/secure-storage-azure-files-azure-blob-storage/

Click on the guided project

Scroll down, and click on the exercise guides as shown in the image below.

Click on the launch exercise.

Follow the instructions chronologically.

2.0. Login to your Azure portal, create and deploy a resource group to hold all your project resources.
Search for and select Resource group and click on create

2.1. Choose the Resource group name and select a region(Use this region throughout the project)

2.2 Add Tags and then, review and create.

2.3. Click on Go to Resources

Resource group created successfully.

3.0. Create and deploy a storage account to support testing and training.
3.1. Navigate to the storage account session and click on create

3.2. Follow the following procedure

On the Basics tab, select your Resource group.
Provide a Storage account name. The storage account name must be unique in Azure.
Set the Performance to Standard.
Select Review, and then Create. Wait for the storage account to deploy and then Go to the resource Click on create Go to resource once the storage account is deployed. 4.0 Configure simple settings in the storage account. 4.1. In your storage account, in the Data management section, select the Redundancy blade. Select Locally-redundant storage (LRS) in the Redundancy drop-down. Be sure to Save your changes. Refresh the page and notice the content only exists in the primary location. 4.2. The storage account should only accept requests from secure connections. In the Settings section, select the Configuration blade. Ensure the Secure transfer required is Enabled. 4.3. Developers would like the storage account to use at least TLS version 1.2. In the Settings section, select the Configuration Blade. Ensure the Minimal TLS version is set to Version 1.2. 4.4. Until the storage is needed again, disable requests to the storage account. In the Settings section, select the Configuration Blade. Ensure that the Allow storage account key access is Disabled. Be sure to Save your changes. 4.5. Ensure the storage account allows public access from all networks. In the Security + networking section, select the Networking blade. Ensure Public network access is set to Enabled from all networks. Be sure to Save your changes. Conclusion Following this guide, you've successfully provisioned and configured storage on the Azure portal to support your IT department's testing and training needs. This setup ensures scalability, security, and efficiency, enabling your team to focus on innovation and learning. To align with your organization's evolving requirements, regularly review and optimize your storage solutions.

A step-by-step guide to creating an EC2 instance in AWS (using Ubuntu server as the image) to install nginx.

Nelson Akpa — Tue, 01 Apr 2025 06:59:17 +0000

Table of contents

Introduction
Create an EC2 instance on AWS
Install Ubuntu nginx server
Conclusion

Introduction
Setting up an EC2 instance in AWS is crucial for deploying scalable and efficient applications. This guide will walk you through creating an EC2 instance using Ubuntu Server as the image. Once the instance is ready, you'll install Nginx, a powerful web server known for its speed and versatility. Whether you're new to AWS or a seasoned user, this guide ensures a smooth setup tailored to your needs.

2.0 Create an EC2 instance.
Log in to AWS, create a free account, and sign in.

Type EC2 in the search bar and click on it.

2.1. Click on Launch Instance

2.2. Type Nginx server in the Name & Tags session.

You can also add tags if you so desire.

2.3. Click on Application and OS images and select Ubuntu server.(Ensure you select the free tier Ubuntu server)

2.4. Go to the instance type and select t2.micro

2.5. Go to Key Pair(login),click and create a key(nginxserverkey)

2.6. Go to the network settings and allow SSH and HTTP

(Note that the configure storage session and advanced storage session remain the same).
2.7. Click on Launch instance

3.0. Installing Ubuntu(nginx) server
3.1. Click on Instance ID

3.2. Click on Connect

3.3. Navigate to the SSH Client session, and copy the link under the example(ssh -i "nginxserverkey.pem" ubuntu@ec2-18-130-8-197.eu-west-2.compute.amazonaws.com)

3.4. First, copy the downloaded file to your computer's home directory then, open your laptop terminal windows and type sudo space and paste the link you copied already (ssh -i "nginxserverkey.pem" ubuntu@ec2-18-130-8-197.eu-west-2.compute.amazonaws.com) and then click enter

3.5. Verify the Ubuntu nginx server
Navigate to the E2 instance connect and click connect

Congratulations! You've successfully created an EC2 instance in AWS, using Ubuntu Server as your base image, and installed Nginx to serve your applications. This setup empowers you with a scalable and efficient web server environment. Moving forward, ensure regular updates and monitoring to maintain security and performance for your instance and deployed applications.

Step-by-step Guide to Installing Solutions on your VM - Nginx, IIS web Server role

Nelson Akpa — Thu, 27 Mar 2025 05:09:03 +0000

Table of contents

Introduction
Create an Azure Linux VM
Setting Up Nginx on an Azure Linux VM Using SSH
Create an Azure IISVm
Install the IIS web server role via Powershell.
Conclusion.
INTRODUCTION
Setting up your virtual machine (VM) to host web applications is essential for delivering content efficiently and reliably. This guide provides a step-by-step approach to installing key solutions, such as Nginx, a high-performance web server, and the IIS Web Server role on your VM. Whether you're deploying a Linux-based or Windows-based server, this introduction ensures you’re prepared to configure your environment effectively.

2.0 Create an 'Azure Linux VM'
Login to your Azure account, navigate or search Virtual machines, and then click on Create and click on Azure Virtual Machine

2.1 Please, ensure you are on the right subscription and then create a new Resource group name.

2.2. Fill in the Instance details as shown in the images below;

2.3. Navigate to the administrator account as shown in the image below;

2.4. Go to the monitoring section and disable boot diagnostics.

2.5. Navigate to Tags and add your preferred tags.

2.6. Go to Review and Create and ensure validation is passed.

2.7. Click Create

2.8. Once deployment is complete, click "Go to Resource"

2.9. Linux VM successfully created. Click on public address, extend the idle timeout, and save.

.

3.0 Setting Up Nginx on an Azure Linux VM Using SSH
Open the terminal on your laptop and follow these steps;

ssh username@hostname_or_ip
🔹 username → The account you want to log in with.
🔹 hostname_or_ip → The IP address or domain name of the VM.
Which is ssh Alpharg@20.77.10.115

3.1 Enter "Yes"

3.2 Enter your Linux VM password

3.3. Type in "sudo su" and click enter

3.4 Type in apt update and click enter
It loads up the image below;

3.5. Type in apt install nginx and click enter.

3.6. Type Y and click enter.

3.7. Nginx web server successfully installed. Now open a tab on your browser to verify by searching for the public IP address before terminating your Terminal window

4.0. Create an Azure IISVm
Login to your Azure account, navigate to virtual machines, and click on Create.

4.1. Fill in the project details.

4.2. Fill in the instance details

4.3. Navigate to the Administrator account and input your preferred username and password.

4.4. Select inbound ports HTTP 80 and RDP(3389) afterward.

4.5. Go to licensing and tick the confirmation box.

4.6. Navigate to the Monitoring session and disable diagnostics.

4.7. Go to the Tags section and add any of your choices.

4.8. Click on the Review and create button and ensure validation is passed.

4.9. Click on the Create **button.

4.10. Go to **Resource.

Click on the public address and extend the idle timeout, then save afterward.
.
4.11. Click on Connect and click the Select button. Download the RDP file once the IIS VM is configured.

4.12. Open the IISVM using a downloaded Microsoft remote desktop.

Enter the password

Close the server manager page that would pop up.

5.0. Install the IIS web server role via Powershell.
5.1. Type PowerShell in the search bar, right-click, and then run as administrator.

5.2. Copy and paste 'Install-WindowsFeature -name Web-Server -IncludeManagementTools' and click the enter button.

IIS Vm successfully installed.

5.3. Verify this successful installation by copying the public IP address (20.51.111.129) and search it on any browser.

.
Conclusion
With Nginx and IIS successfully installed and configured, your virtual machine can now efficiently serve web applications. Whether you're leveraging Nginx for its performance or IIS for its seamless integration with Windows environments, this guide has provided the foundation for setting up a robust and reliable web server. Just to remind you, continuous monitoring and optimization are key to ensuring your server effectively meets your needs.

Step-by-Step Guide to Create a Virtual Machine(VM) IN Microsoft Azure Portal.

Nelson Akpa — Mon, 17 Mar 2025 03:54:09 +0000

Table of contents

Introduction
What is a Virtual Machine(VM)
Step by step guide to creating a VM in Ms Azure Portal.
Conclusion.

Introduction
This article explains the step-by-step process for creating a virtual machine in the Microsoft Azure portal. This web-based interface allows you to build, manage, and monitor everything from simple web apps to complex cloud applications in a single, unified console. It provides a graphical experience for managing Azure resources such as virtual machines, databases, and storage and offers tools for deploying, scaling, and monitoring your cloud infrastructure.

What is a Virtual Machine? (VM)
A virtual machine (VM) is like a computer inside your computer. It behaves like a separate computer, with its operating system and applications, but it runs on the hardware of your physical computer. Think of it as renting a fully equipped, temporary office space inside an enormous building—you get all the functionality you need, but you’re sharing the building’s infrastructure with others.

Step-by-step guide to creating a VM in Ms Azure.
Step 1: Navigate to *https://azure.microsoft.com * on your browser, create a free trial account, and sign in. (A free trial account provides a $200 Azure credit subscription.)

Signed in home page view

Step 2: In the search bar, type "Virtual machine" and click on it when it appears in the drop-down list of resources.

Step 3: Click "+Create" and select "Create a Virtual Machine hosted by Azure."

Step 4: As the VM creation page loads, update the project details, which includes ensuring the correct subscription displays,
create a new resource group(e.g AplphaRg) and then click 'ok'

Step 5: Update the Instance details which includes choosing a Virtual Machine name, selecting a region, availabilty zone,image(your operating system) and size(Ensure your size is available in the selected zone/region)

Step 6:Navigate to the administrator account and create a username and password.

Step 7: Go to the Inbound port roles section which includes;
Public inbound ports: click on Allow selected ports
Select inbound ports: select HTTP (80).

Step 8:Go to licensing,tick the license confirmation inbox and then click on'Next Disks'

Step 9: Here, you leave the** disk*, **networking, and **management* sections as default and go to the monitoring section. Under Diagnostics, go to boot diagnostics and click on disable.

Step 10: Leave the Advanced section as default and go to the Tag section then give it a name and value.

Step 11: Go to Review + create, click on create

Deployment complete

Successful VM Created(Home Page View)

Step 12: Connect to virtual machine

Click on Connect virtual machine.
Click on **select **and wait for the validation till it is configured.
Click on download RDP file
Connect to the VM: If you use a MAC operating system, download a Remote Desktop(RDP) to connect to your Windows VM. Input the username and password associated to the VM Alpha VM Connected to remote desktop

In conclusion, following the above steps makes creating a working virtual machine relatively easy and enables one to navigate the Azure portal and explore all available resources effectively.