5113/24, 10:49PM —_AZS00-AzureSecuriyTechnologies/Intnuctions/Labs/LAB_O4_ConfiguringandSecurngACRandAKS.MD at master Microsoftea MicrosoftLearning / ee ‘AZ500-AzureSecurityTechnologies a 8 <> Code © Issues 11 Pullrequests © Actions © Security [~ Insights AZS00-AzureSecurityTechnologies / Instructions / Labs a / LAB_04 ConfiguringandSecuringACRandAKS.MD (2 © sserling1962 Update LAB_04 ConfiguringandSecuringACRandAKSMD = Smonths ago 377 Lines (227 loc) + 16 KB (Preview ] code Blame raw OY) 2 ~ lab title module 04 - Configuring and Securing ACR and AKS — Module 01 - Secure compute, storage, « ————— EEE > Lab 04: Configuring and Securing ACR and AKS Student lab manual Lab scenario You have been asked to deploy a proof of concept with Azure Container Registry and Azure Kubernetes Service. Specifically, the proof of concept should demonstrate: * Using Dockerfile to build an image. * Using Azure Container Registry to store images. * Configuring an Azure Kubernetes Service, * Securing and accessing container applications both internally and externally. ntps:igthub.comMicrosofLeaming/AZS00-AzureSecurtyTechnologes/blobimasterlinstuctions/LabsiLAB_04_ConfiguringandSecuringACRandAK... 1/12513724, 10:49PM ——_AZ500-AzureSecurityTechnologis/instructions/Labs/LAB_04_ConfiguringandSecuringACRandAKS ND at Microsoftoe. For all the resources in this lab, we are using the East US region. Verify with your instructor this is the region to use for class. Lab objectives In this lab, you will complete the following exercise: * Exercise 1: Configuring and Securing ACR and AKS Configuring and Securing ACR and AKS diagram Exercise1, Task1 Exercise1, Task2 9 Docker File Exercise1, Task4 RQ AcrPull Exercise1, Task3 MyKubernetesCluster Exercise1, Task5, Task6, Task7, Task8 o 9 nginxexternal__nginxinternal ntps:igthub.comMicrosofeamingiAZS00-AzureSecurtyTechnologes/blobimasterlinstuctions/LabsiLAB_04_ConfguringandSecuringACRandAK.... 2/125119/24, 10:49PM —_AZS00-AzureSecuriyTechnologies/Instnuctions/Labs/LAB_O4_ConfiguringandSecurngACRandAKS MD at master Microsoftea Intructions Lab file + \Allfiles\Labs\09\nginxexternal yam © \Allfiles\Labs\09\nginxinternal yam! Exercise 1: Configuring and Securing ACR and AKS Estimated timing: 45 minutes For all the resources in this lab, we are using the East (US) region. Verify with your instructor this is region to use for you class. In this exercise, you will complete the following tasks: # Task 1: Create an Azure Container Registry # Task 2: Create a Dockerfile, build a container and push it to Azure Container Registry # Task 3: Create an Azure Kubernetes Service cluster * Task 4: Grant the AKS cluster permissions to access the ACR * Task 5: Deploy an external service to AKS * Task 6: Verify the you can access an external AKS-hosted service # Task 7: Deploy an internal service to AKS * Task 8: Verify the you can access an internal AKS-hosted service Task 1: Create an Azure Container Registry In this task, you will create a resource group for the lab an an Azure Container Registry. 1, Sign-in to the Azure portal https://portal.azure.com/ Note: Sign in to the Azure portal using an account that has the Owner or Contributor role in the Azure subscription you are using for this lab and the Global Administrator role in the Microsoft Entra tenant associated with that subscription. 2. In the Azure portal, open the Cloud Shell by clicking the first icon in the top right of the Azure Portal. If prompted, click Bash and Create storage. 3, Ensure Bash is selected in the drop-down menu in the upper-left corner of the Cloud Shell pane. hitpssigthub conMicrosoftLearning/AZS00-AzureSecury TechnologiesblobimastorinstruclionsiLabsiLAB_O4_ConfiguringandSecuringACRandAK... 3/12511924, 1049PM —_AZ500-AcureSecunyTachnologislnsnconslLabsLAB_O4_ConfguingandSecurngACRandAKS.MD st master - Mictosoi.e, 4. In the Bash session within the Cloud Shell pane, run the following to create a new resource group for this lab: az group create --name AZS@@LAB@9 --location eastus o 5. In the Bash session within the Cloud Shell pane, run the following to verify the resource group was created: az group list --query "[?name=="AZS5@0LAB@9']” -o table o 6. In the Bash session within the Cloud Shell pane, run the following to create a new. Azure Container Registry (ACR) instance (The name of the ACR must be globally unique): az acr create --resource-group AZS@@LAB@9 --name azS@@$RANDOM$RANDOM --ski eee >» 7. In the Bash session within the Cloud Shell pane, run the following to confirm that the new ACR was created: az acr list --resource-group AZ5@@LAB09 @ Note: Record the name of the ACR. You will need it in the next task. Task 2: Create a Dockerfile, build a container and push it to Azure Container Registry In this task, you will create a Dockerfile, buil image to the ACR. an image from the Dockerfile, and deploy the 1. In the Bash session within the Cloud Shell pane, run the following to create a Dockerfile to create an Nginx-based image: echo FROM nginx > Dockerfile o 2. In the Bash session within the Cloud Shell pane, run the following to build an image from the Dockerfile and push the image to the new ACR. Note: The trailing period at the end of the command line is required. It designates the current directory as the location of Dockerfile. -ntps:igthub.comMicrosofeaming/AZS00-AzureSecurtTechnologes/blobimasterlinstuctions/LabsiLAB 04 ConfiguringandSecuringACRandAK... 4/12511924, 1049PM —_AZ500-AcureSecunyTachnologislnsnconslLabsLAB_O4_ConfguingandSecurngACRandAKS.MD st master - Mictosoi.e, ACRNAME=$(az acr list --resource-group AZS@BLAB@9 --query ‘[].{Name:name}* (G az acr build --resource-group AZS@®LAB®9 --image sample/nginx:vi --registr —EEEEEEEEEE > Note: Wait for the command to successfully complete. This might take about 2 minutes. 3. Close the Cloud Shell pane. 4.In the Azure portal, navigate to the AZSO0Lab09 resource group and, in the list of resources, click the entry representing the Azure Container Registry instance you provisioned in the previous task. 5. On the Container registry blade, in the Services section, click Repositories. 6. Verify that the list of repositories includes the new container image named sample/nginx. 7. Click the sample/nginx entry and verify presence of the v1 tag that identifies the image version 8. Click the v1 entry to view the image manifest. Note: The manifest includes the sha256 digest, manifest creation date, and platform entries. Task 3: Create an Azure Kubernetes Service cluster In this task, you will create an Azure Kubernetes service and review the deployed resources. 1. In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Kubernetes services and press the Enter key. 2. On the Kubernetes services blade, click + Create and, in the drop-down menu, click + Create a Kubernetes cluster 3. On the Basics tab of the Create Kubernetes cluster blade, select Cluster preset configuration, select Dev/Test ($). Now specify the following settings (leave others with their default values): ntps:igthub.comMicrosofLeaming/AZS00-AzureSecurtyTechnologes/biobimasterlinstuctions/LabsiLAB_04_ConfguringandSecuringACRandAK....Si125119/24, 10:49PM —_AZS00-AzureSecuriyTechnologies/Intnuctions/Labs/LAB_04_ ConfiguringandSecurngACRandAKS.MD at master MicrosoftLea Setting Value the name of the Azure subscription you are using in Subscription P this lab Resource group AZS5OOLABO9 Kubernetes cluster MyKubernetesCluster name Region (US) East US Availability zones None Scale method Manual Node count 1 4, Click Next: Node Pools > and, on the Node Pools tab of the Create Kubernetes cluster blade, specify the following settings (leave others with their default values): Setting Value Enable virtual nodes cleared checkbox 5, Click Next: Access >, on the Access tab of the Create Kubernetes cluster blade, accept the defaults, and click Next: Networking >. 6. On the Networking tab of the Create Kubernetes cluster blade, specify the following settings (leave others with their default values) Setting Value Network configuration Azure CNI DNS name prefix Leave the default value Note: AKS can be configured as a private cluster. This assigns a private IP to the API server to ensure network traffic between your API server and your node pools remains on the private network only. For more information, visit Create a private Azure Kubernetes Service cluster page. 7. Click Next: Integrations > and, on the Integrations tab of the Create Kubernetes cluster blade, set Container monitoring to Disabled, nitpssigthub.conMicrosoftLearning/AZS00-AzureSecuryTechnologiesiblobimastorinstrucionsiLabsiLAB_O4_ConfiguringandSecuringACRandAK... 6/125713724, 1049 PM —_-AZ500-AzureSecuriyTechnologies/instructionsiLabs/L AB_04_ConfiguingandSecuringACRandAKS MD at master - MicrosoftLea Note: In production scenarios, you would want to enable monitoring. Monitoring is disabled in this case since it is not covered in the lab. 8, Click Review + Create and then click Create. Note: Wait for the deployment to complete. This might take about 10 minutes, 9. Once the deployment completes, in the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Resource groups and press the Enter key. 10. On the Resource groups blade, in the listing of resource groups, note a new resource group named MC_AZ500LAB09_MyKubernetesCluster_eastus that holds components of the AKS Nodes. Review resources in this resource group. 11. Navigate back to the Resource groups blade and click the AZSOOLABO9 entry. Note: In the list of resources, note the AKS Cluster and the corresponding virtual network. 12. In the Azure portal, open a Bash session in the Cloud Shell Note: Ensure Bash is selected in the drop-down menu in the upper-left corner of the Cloud Shell pane. 13. In the Bash session within the Cloud Shell pane, run the following to connect to the Kubernetes cluster: az aks get-credentials --resource-group AZS@0LAB@9 --name Mykubernetesclus (5) —————— >» 14. In the Bash session within the Cloud Shell pane, run the following to list nodes of the Kubenetes cluster: kubectl get nodes ea Note: Verify that the Status of the cluster node is listed as Ready. Task 4: Grant the AKS cluster permissions to access the ACR and manage its virtual network. In this task, you will grant the AKS cluster permission to access the ACR and manage its virtual network. ntps:igthub.comMicrosofLeaming/AZS00-AzureSecurtyTechnologes/blobimasterinstuctions/LabsiLAB 04 ConfiguringandSecuringACRandAK.... 7/12571324, 1049 PM __AZ500-ArureSceuriyTechnoogosinsrctonslabs/LAB_04_ConigungandSecurngACRandAKS.MD at masar:MicosoLoa 1. In the Bash session within the Cloud Shell pane, run the following to configure the AKS cluster to use the Azure Container Registry instance you created earlier in this lab ACRNAME=$(az acr list --resource-group AZS@@LAB@9 --query ‘[].{Name:namey* az aks update -n MyKubernetesCluster -g AZS@@LAB@9 --attach-acr $ACRNAME ——EEEEEEE > Note: This command grants the ‘acrpull’ role assignment to the ACR Note: It may take a few minutes for this command to complete. 2. In the Bash session within the Cloud Shell pane, run the following to grant the AKS cluster the Contributor role to its virtual network, RG_AKS=AZ5@0LABO9 oe RG_VNET=MC_AZ5@0LABO9_MyKubernetesCluster_eastus AKS_VNET_NAME=aks-vnet-30198516 AKS_CLUSTER_NAM lykubernetesCluster AKS_VNET_ID=$(az network vnet show --name $AKS_VNET_NAME --resource-group AKS_MANAGED_1! $(az aks show --name $AKS_CLUSTER_NAME --resource-group $R¢ az role assignment create --assignee $AKS_MANAGED_ID --role “Contributor” DD » Task 5: Deploy an external service to AKS In this task, you will download the Manifest files, edit the YAML file, and apply your changes to the cluster. 1. In the Bash session within the Cloud Shell pane, click the Upload/Download files icon, in the drop-down menu, click Upload, in the Open dialog box, naviate to the location where you downloaded the lab files, select \Allfiles\Labs\09\nginxexternal yam click Open. Next, select \Allfiles\Labs\09\nginxinternal.yam|, and click Open 2. In the Bash session within the Cloud Shell pane, run the following to identify the name of the Azure Container Registry instance: -ntps:igthub.comMicrosofeaming/AZS00-AzureSecurtyTechnologes/blobimasterlinstuctions/LabsiLAB_04_ConfiguringandSecuringACRandAK.... 8/12511924, 1049PM —_AZ500-AcureSecunyTachnologislnsnconslLabsLAB_O4_ConfguingandSecurngACRandAKS.MD st master - Mictosoi.e, echo $ACRNAME o Note: Record the Azure Container Registry instance name. You will need it later in this task. 3. In the Bash session within the Cloud Shell pane, run the following to open the nginxexternalyam| file, so you can edit its content. code ./nginxexternal.yaml e Note: This is the external yam! file. 4.In the editor pane, scroll down to line 24 and replace the placeholder with the ACR name, 5. In the editor pane, in the upper right corner, click the ellipses icon, click Save and then click Close editor. 6. In the Bash session within the Cloud Shell pane, run the following to apply the change to the cluster: kubect1 apply -f nginxexternal.yaml oe 7. In the Bash session within the Cloud Shell pane, review the output of the command you run in the previous task to verify that the deployment and the corresponding service have been created deployment.apps/nginxexternal created o service/nginxexternal created Task 6: Verify the you can access an external AKS-hosted service In this task, verify the container can be accessed externally using the public IP address. 1. In the Bash session within the Cloud Shell pane, run the following to retrieve information about the nginxexternal service including name, type, IP addresses, and ports, kubectl get service nginxexternal e ntps:igthub.comMicrosofLeamingiAZS00-AzureSecurtyTechnologes/blobimasterlinstuctions/LabsiLAB_04_ConfguringandSecuringACRandAK...Si125119/24, 10:49PM —_AZS00-AzureSecuriyTechnologies/Instnuctions/Labs/LAB_O4_ConfiguringandSecurngACRandAKS MD at master Microsoftea 2. In the Bash session within the Cloud Shell pane, review the output and record the value in the External-IP column. You will need it in the next step. 3, Open a new browser tab and browse to the IP address you identified in the previous step. 4, Ensure the Welcome to nginx! page displays. Task 7: Deploy an internal service to AKS In this task, you will deploy the internal facing service on the AKS. 1. In the Bash session within the Cloud Shell pane, run the following to open the nginxintenal yam! file, so you can edit its content. code ./nginxinternal.yaml e Note: This is the internal yam file. 2. In the editor pane, scroll down to the line containing the reference to the container image and replace the placeholder with the ACR name. 3. In the editor pane, in the upper right comer, click the ellipses icon, click Save and then click Close editor. 4. In the Bash session within the Cloud Shell pane, run the following to apply the change to the cluster: kubectl apply -f nginxinternal.yaml a 5. In the Bash session within the Cloud Shell pane, review the output to verify your deployment and the service have been created: deploynent.apps/nginxinternal created a service/nginxinternal created 6. In the Bash session within the Cloud Shell pane, run the following to retrieve n about the nginxinternal service including name, type, IP addresses, and kubectl get service nginxinternal oe -ntps:igthub.comMicrosofLeamingiAZS00-AzureSecurtyTechnologes/blobimasterlinstuctions/LabsiLAB_04 ConfguringandSecuringACRandA.... 10/12571324, 1049 PM __AZ500-ArureSceuriyTechnoogosinsrctonslabs/LAB_04_ConigungandSecurngACRandAKS.MD at masar:MicosoLoa 7.In the Bash session within the Cloud Shell pane, review the output. The External-IP is, in this case, a private IP address. Ifit is in a Pending state then run the previous command again Note: Record this IP address. You will need it in the next task. Note: To access the internal service endpoint, you will connect interactively to one of the pods running in the cluster. Note: Alternatively you could use the CLUSTER-IP address. Task 8: Verify the you can access an internal AKS-hosted service In this task, you will use one of the pods running on the AKS cluster to access the internal service 1. In the Bash session within the Cloud Shell pane, run the following to list the pods in the default namespace on the AKS cluster: kubectl get pods a 2. In the listing of the pods, copy the first entry in the NAME column, Note: This is the pod you will use in the subsequent steps. 3. In the Bash session within the Cloud Shell pane, run the following to connect interactively to the first pod (replace the placeholder with the name you copied in the previous step): kubect exec -it -- /bin/bash oe 4.In the Bash session within the Cloud Shell pane, run the following to verify that the nginx web site is available via the private IP address of the service (replace the placeholder with the IP address you recorded in the previous task): curl http: // ea 5. Close the Cloud Shell pane. Result: You have configured and secured ACR and AKS. Clean up resources -ntps:igthub.comMicrosofLeaming/AZS00-AzureSecurtyTechnologes/blobimasterlinstuctions/LabsiLAB_04_ ConfiguringandSecuringACRandAK.... 11/12571324, 1049 PM —_AZ600-AzureSceuriyTochnoogosinsrctonsabs/LAB_04_ConigurngandSecurngACRandAKS.MD at masa: MicosoLoa Remember to remove any newly created Azure resources that you no longer use. Removing unused resources ensures you will not incur unexpected costs. 1. In the Azure portal, open the Cloud Shell by clicking the first icon in the top right of the Azure Portal, 2. In the upper-left drop-down menu of the Cloud Shell pane, select PowerShell and, when prompted, click Confirm 3. In the PowerShell session within the Cloud Shell pane, run the following to remove the resource groups you created in this lab: o Remove-AzResourceGroup -Name "AZS@@LAB@9" -Force -AsJob 4, Close the Cloud Shell pane. -ntps:igthub.comMicrosofLeamingiAZS00-AzureSecurtyTechnologes/blobimasterlnstuctions/LabsiLAB_04 ConfguringandSecuringACRandA.... 12/12