Azure PowerShell and Azure CLI

It’s impossible to memorize all commands in PowerShell and Azure CLI. Good news is that Microsoft follows a standard pattern

Open this page;

https://learn.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest

If we look at Azure CLI command for Virtual Machine, they follow this naming convention;

az vm list
az vm create
az vm delete

Azure CLI start with az vm and a verb. another example is;

az keyvault list
az keyvault create
az keyvault delete

for a more complicated example;

az network vnet list
az network vnet create
az network vnet delete

In above example vnet is a sub-component of netowrk. another example is;

az network vnet subnet list
az network vnet subnet create
az network vnt subnet delete

Where subnet is a sub-component of vnet and vnet is a sub-component of network.

Let’s go over PowerShell now;

https://learn.microsoft.com/en-us/powershell/module/az.keyvault/new-azkeyvault?view=azps-12.0.0

Get-AzVM
New-AzVM
Remove-AzVM

Verb is the first part of the word.

Get-AzVirtualNetwork
New-AzVirtualNetwork
Remove-AzVirtualNetwork
Get-AzVirtualNetworkSubnetConfig
New-AzVirtualNetworkSubnetConfig
Remove-AzVirtualNetworkSubnetConfig

Standard PowerShell that comes with windows doesn’t work. We need to upgrade it to PowerShell7 which is a cross-plateform scripting engine. There are 3 Azure specific modules for PowerShell that we need to install (We can avoid to install anything by using Azure Cloud shell);

For demo purpose, I am using Azure Cloud shell. The advantage is that i don’t need to login to my account because i am already logged in to Azure Portal. The response that i will get here is JSON formatted.

PowerShell

Microsoft has switched from old “Azure RM” to “Az” module. They don’t run side by side. To install a new AZ Module, run this command;

Run as administrator

Install-Module -Name Az-AllowClobber -Repository PSGallery -Force

To update module if you have already installed it;

Run as administrator
Update-Module -Name Az -AllowClobber -Repository PSGallery

To connect to Azure from workstation, use this command in PowerShell terminal;

connect-AzAccount -TenantId {GUID} (We don't need curly brackets)

To check latest version of PowerShell, follow this link;

To view installed Az module, use this command;

Get-InstalledModule -Name Az -AllVersions | Select-Object -Property Name, Version

This will list down Name and Version of Az Module. My list has Az Version 8.1.0 installed.

To list my web app, run this command in PowerShell terminal

Get-AzWebApp

To get a shorter version of output, run this command;

Get-AzWebApp | Select-Object Name, Location | ConvertTo-CSV -NoTypeInformation

Azure Core Service

There are 3 core services. This is the foundation of cloud; Every Azure service is built on one or all of these. for example, if we are learning Machine Learning, its a combination of Virtual Machine and Storage.

Virtual Machines

Windows or Linus OS. Can be created in few minutes. Can be remotely connected. Install whatever software you want.

Virtual Machine is a foundation on top of which other compute services provide service;

a) Azure Batch

b) Virtual Machine Scale Sets

It’s a way to have load-balancer where virtual machine are setup with some auto-scaling rules.

c) Azure Kubernetes Services (AKS)

Working on AKS cluster is basically working with VM. AKS is abstraction to underlying VM.

d) Service Fabric

A different paradigm to Virtual Machine is App Services.

1- App Services;

Web apps or container apps, Windows or Linux OS, fully-managed servers, no ability to remote control and others

Virtual Networking

Refer to this article.

Storage

a) Storage can be upto 5 pb, Storage types are Blobs, queues, tables, files – Various levels of replication including from local to global. Storage account charges are based on size of the storage (currently 1.8 cents per GB).

Storage tiers are hot, cool and archive

Azure Networking

Azure Networking can be broken in 4 categories;

Networking – Connectivity

Items under this category are;

a) Virtual Network (VNet)

These are cables, routers, switches in a physical network. In Azure, these are software services and it’s called Virtual Network because it’s all database entries. Microsoft has their own physical devices and they are not plugging/unplugging base of our commands.

b) Virtual WAN

Wide area Networks allow offices to connect to each other being Azure as the middleman.

c) Express Route

Express route is the fastest way to connec over the internet. It cost more but its encrypted and fast.

e) VPN Gateway

If Express route is not an option, then traditional VPN can be used. Their are point to site and site to site VPN. Helps to connect office computer to Azure network securely.

f) Azure DNS

Public and private domain can be managed in the name server in Azure.

g) Peering

Peering is a way for connecting multiple virtual networks together. This help to communicate one region service to a different region. By default, these services are cut off. You will need to configure these.

h) Bastion

This allows you to remote into a server without opening any ports. It’s a more secure version of RDP.

Networking – Security

To restrict unauthorized access, Items under this category are;

a) Network Security groups (NSG)

Very simple Access Control List Style e.g. We can restrict certain IP addresses to connect to Database or VM.

b) Azure Private Link

c) DDoS Protection

e) Azure Firewall

f) Web Application Firewall (WAF)

This can prevent cross site scripting or SQL injection attacks.

g) Virtual Network Endpoints

Networking – Delivery

This is traffic shaping and load balancing. Items under this category are;

a) CDN

b) Azure Front Door

Global load-balancer

c) Traffic Manager

d) Application Gateway

Application level load balancer – This is software level-6 gateway.

e) Load Balancer

Transport level load balancer – This is hardware level-4 device.

Networking – Monitoring

Debug problems, Investigate traffic issues. Items under this list are;

a) Network Watcher

b) ExpressRoute Monitor

c) Azure Monitor

d) VNet Terminal Access Point

Copy live WordPress Site and Run inside Docker container

I am going to copy this site and run inside Docker Container.

STEPS

1-Pull WordPress and MySQL images using docker-compose, I am going to use docker-compose file.

version: '3.7'

services:
  db:
    # If you really want to use MySQL, uncomment the following line
    image: mysql:8.0.27
    command: '--default-authentication-plugin=mysql_native_password'
    container_name: wp-db
    volumes:
      - ./data/wp-db-data:/var/lib/mysql
    networks:
      - default
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: supersecretpassword
      MYSQL_DATABASE: db
      MYSQL_USER: dbuser
      MYSQL_PASSWORD: dbpassword

  wordpress:
    depends_on:
      - db
    image: wordpress:latest
    container_name: wordpress
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: db
      WORDPRESS_DB_USER: dbuser
      WORDPRESS_DB_PASSWORD: dbpassword
    volumes:
      - ./data/wp-content:/var/www/html/wp-content
      - ./data/wp-html:/var/www/html
    networks:
      - traefik-public
      - default
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wordpress.entrypoints=http"
      - "traefik.http.routers.wordpress.rule=Host(`wp.dk.tanolis.com`)"
      - "traefik.http.middlewares.wordpress-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.wordpress.middlewares=wordpress-https-redirect"
      - "traefik.http.routers.wordpress-secure.entrypoints=https"
      - "traefik.http.routers.wordpress-secure.rule=Host(`wp.dk.tanolis.com`)"
      - "traefik.http.routers.wordpress-secure.tls=true"
      - "traefik.http.routers.wordpress-secure.service=wordpress"
      - "traefik.http.services.wordpress.loadbalancer.server.port=80"
      - "traefik.docker.network=traefik-public"

volumes:
  db-data:
    name: wp-db-data

networks:
  traefik-public:

3-Open container wordpress site and install “All-in-One WP Migration” plugin.

4-Go to source wordpress site and install “All-in-One WP Migration” plugin.

5-Create a File backup on source site.

6-Try to restore backup on target site

7-You will see following error;

<<ERROR>>

Increase size for All in one plugin;

8-We need to increase restore size. Search for .htaccess file in your linux root file system;

# find / -type f -name .htaccess*

9-Use nano editor to open this file;

# nano .htaccess

place the following code in it after # END WordPress commentd line:

php_value upload_max_filesize 2048M
php_value post_max_size 2048M
php_value memory_limit 4096M
php_value max_execution_time 0
php_value max_input_time 0

10-Save file. Open plugin and you will see that you are allowed to restore 2GB data.

11-Open WordPress container site. Do a comparison with online site.

Congratulations! You’ve done it. You can now easily import any file you’d like using this amazing plugin. Migrating your sites are not a hassle anymore!

Video

References

How to increase the all-in-one-wp-migration plugin upload import limit

https://github.com/Azure/wordpress-linux-appservice/blob/main/WordPress/wordpress_migration_linux_appservices.md

Upgrade Debian from bullseye to bookworm and PVE7 to PVE8

Here is a short checklist to upgrade Debian to latest bookworm version;

Proxmox update goes with Debian Latest stable version. I am running BullEye and need to upgrade to BookWorm.

Run checklist (a small script that comes with Proxmox):

pve7to8

Fix errors and warnings reported by above script.

Next change repositories for Debian and Proxmos;

1. update the configured APT repositories
   apt update
   apt dist-upgrade
   pveversion

   This should report at least 7.4-15 or newer version.

2. CEPH
   nano /etc/apt/sources.list.d/ceph.list
   make sure there is just one entry.
	

3. Bulleye to BookWorm
   nano /etc/apt/sources.list
   or better, run this command to search and replace bullye to
   bookworm

   sed -i 's/bullseye/bookworm/g' /etc/apt/sources.list
   Output
   ------
   # security updates
   #deb http://security.debian.org bookworm-security main contrib

   # My repo changes
   deb http://deb.debian.org/debian/ bookworm main contrib non-free
   deb http://deb.debian.org/debian/ bookworm-updates main non-free contrib
   # security updates
   deb http://security.debian.org/debian-security bookworm-security main contrib non-free

   # PVE pve-no-subscription repository provided by proxmox.com,
   # NOT recommended for production use
   deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

4. APT Repositorys
   I don't have special repositories here. so don't worry about this.

Install this package if using EFI to boot box;

apt install grub-efi-amd64

To clear CEPH warnings, reset Ceph monitor on VM.

Remove any used packages with this command;

apt autoremove

Re-run scan;

pve7to8

Make sure to disable enterprise library if using evaluation version;

modify enterprise repo;

nano /etc/apt/sources.list.d/pve-enterprise.list

and add a # at the beginning. Save this file 

Restart your nodes one by one.

References

https://pve.proxmox.com/wiki/Upgrade_from_7_to_8

https://pve.proxmox.com/wiki/Ceph_Nautilus_to_Octopus