apim-traffic-mgr

This repo shows how to set up a blue-green deployment environment for services hosted in a vNet & front-ended by Azure API Management(APIM). In this example, Azure FrontDoor is used to direct traffic to the correct regional APIM. APIM will route the traffic to Azure Traffic Manager to ensure that the traffic is distributed across multiple regions. The Azure Application Gateway is used to route traffic inside the vNet and to the Azure Functions to handle the API calls. If a regional AppGW refuses traffic (such as being down for upgrades), Traffic Manager will redirect traffic to the a different region.

Disclaimer

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Prerequisites

• Azure CLI
• Dotnet CLI
• curl
• Azure subscription & resource group

Deployment

1. Update the /infra/env/dev.parameters.json file as needed.

2. Execute the following Azure CLI command to deploy the infrastructure (change the email addresses & secret as needed).

   az deployment group create -g rg-apimTrafficMgr-ussc-dev --template-file ./infra/main.bicep --parameters ./infra/env/dev.parameters.json --parameters apiManagementServicePublisherName=dwightschrute apiManagementServicePublisherEmail=dwight.k.schrute@dunder-mifflin.com functionAppKey="SuperSecretSecurePassword" --query "properties.outputs"

   The command will output the various endpoints you will call to interact with the deployed infrastructure.

3. Build & create the deployment package for the Azure Function.

   dotnet publish --configuration Release --output ./app/publish ./app
   Compress-Archive -DestinationPath ./app.zip -Update ./app/publish/*

4. Deploy the Azure Function code.

   NOTE: This example assumes you are on the same network as the Azure Functions (such as with a VPN Gateway or ExpressRoute). The Azure Functions have their inbound traffic routed via private endpoint and are not publically accessible.

   az functionapp deployment source config-zip -g rg-apimTrafficMgr-ussc-dev -n func-apimTrafficMgr-ussc-dev --src ./app.zip

Test Routing

To test this application, you will first hit the various endpoints of the application. Then, you will shut down the Application Gateway for the region that serves the initial requests (to simulate a blue-green deployment). Finally, you will hit the endpoints again and see that Traffic Manager is routing requests to the other region.

Initial requests

Run the following commands to see that the API is running & available. Note which region is serving your requests (in this example, SOUTHCENTRALUS).

FrontDoor

Command

curl --header "Ocp-Apim-Subscription-Key: 7876c011952240fd9061685ba1bb6ec0" https://fd-apimTrafficMgr-ussc-dev.azurefd.net/api/application

Output

Howdy from SOUTHCENTRALUS!

API Management

Command

curl --header "Ocp-Apim-Subscription-Key: 7876c011952240fd9061685ba1bb6ec0" https://apim-apimtrafficmgr-ussc-dev.azure-api.net/api/application

Output

Howdy from SOUTHCENTRALUS!

Traffic Manager

Command

curl https://tm-apimtrafficmgr-ussc-dev.trafficmanager.net/api/application?code=SuperSecretSecurePassword

Output

Howdy from SOUTHCENTRALUS!

Application Gateway

Region 1

Command

curl https://ag-apimtrafficmgr-ussc-dev.southcentralus.cloudapp.azure.com/api/application?code=SuperSecretSecurePassword

Output

Howdy from SOUTHCENTRALUS!

Region 2

Command

curl https://ag-apimtrafficmgr-eus-dev.eastus.cloudapp.azure.com/api/application?code=SuperSecretSecurePassword

Output

Howdy from EASTUS!

Functions

Region 1

Command

curl https://func-apimtrafficmgr-ussc-dev.azurewebsites.net/api/application?code=SuperSecretSecurePassword

Output

Howdy from SOUTHCENTRALUS!

Region 2

Command

curl https://func-apimtrafficmgr-eus-dev.azurewebsites.net/api/application?code=SuperSecretSecurePassword

Output

Howdy from EASTUS!

Bring down a region for upgrades & redirect traffic

Stop Application Gateway

Run the following CLI command to stop the Application Gateway in the region that served the initial API requests so we can see Traffic Manager failover (in this example, SOUTHCENTRALUS).

Command

az network application-gateway stop -g rg-apimTrafficMgr-ussc-dev -n ag-apimTrafficMgr-ussc-dev

After stopping the AppGW, you can verify that Traffic Manager has detected the AppGW is down (in this example, instead of USSC, forward to EUS).

az network traffic-manager profile show -g rg-apimTrafficMgr-ussc-dev -n tm-apimTrafficMgr-ussc-dev --query "endpoints[].{name: name, endpointLocation: endpointLocation, endpointMonitorStatus: endpointMonitorStatus}" --output table

Name                        EndpointLocation    EndpointMonitorStatus
--------------------------  ------------------  -----------------------
ag-apimTrafficMgr-ussc-dev  South Central US    Degraded
ag-apimTrafficMgr-eus-dev   East US             Online

Rerun the initial requests & see that they are served from a different region

Command

curl --header "Ocp-Apim-Subscription-Key: 7876c011952240fd9061685ba1bb6ec0" https://fd-apimTrafficMgr-ussc-dev.azurefd.net/api/application

Output

Howdy from EASTUS!

Links

• Azure FrontDoor
• Azure API Management
• Azure Traffic Manager
• Azure Application Gateway
• Azure Functions