Using Slots to Manage Virtual Network Connections in Azure Web Apps during Slot Swaps.

Question

Pulumi · Accepted Answer

### Pulumi and Azure Web App Slots

In Azure, a Web App can have multiple deployment slots. These slots are live web apps with their own hostnames. Deployment slots allow you to stage new versions of your app, test them in a live environment, validate app changes in a staging deployment slot before swapping it with the production slot, and roll back the version if anything goes wrong.

One common use of slots is to manage virtual network connections, especially during slot swaps, ensuring that new settings, like those for a virtual network, are swapped along with the code.

In this Pulumi program, we'll create an Azure Web App within an App Service Plan (which defines a set of compute resources for the app to run). We'll then create a deployment slot for this web app, link it to a virtual network, and configure slot swapping behavior.

### The Pulumi Resources

We'll use the following Pulumi resources from the `azure-native` provider:
- `WebApp`: Represents the Azure Web App.
- `WebAppSlot`: Represents a slot within the Azure Web App.
- `WebAppVnetConnectionSlot`: Manages a virtual network connection for an Azure Web App deployment slot.
  
These resources collectively help set up the Web App, the slot, and the virtual network connection that can be used during a slot swap.

Now, let's proceed with the program:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure-native";

// Define the resource group
const resourceGroup = new azure.resources.ResourceGroup("my-resource-group");

// Create an App Service Plan
const appServicePlan = new azure.web.AppServicePlan("my-app-service-plan", {
    resourceGroupName: resourceGroup.name,
    kind: "App",
    // Choose the pricing tier
    sku: {
        name: "F1",
        tier: "Free",
    },
});

// Create the web app with initial production code
const webApp = new azure.web.WebApp("my-web-app", {
    resourceGroupName: resourceGroup.name,
    serverFarmId: appServicePlan.id,
    location: resourceGroup.location,
});

// Create a deployment slot for staging
const stagingSlot = new azure.web.WebAppSlot("staging", {
    name: webApp.name,
    resourceGroupName: resourceGroup.name,
    location: webApp.location,
    // Optional settings e.g. always on
    siteConfig: {
        alwaysOn: true,
    },
});

// Associate the staging slot with a Virtual Network connection
const slotVnetConnection = new azure.web.WebAppVnetConnectionSlot("mySlotVnetConnection", {
    name: webApp.name,
    slot: stagingSlot.name,
    resourceGroupName: resourceGroup.name,
    // Specify the VNet properties
    vnetName: "myVNetName", // Name of the Virtual Network
    vnetResourceId: "/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Network/virtualNetworks/{vnet-name}", // Resource ID of the VNet
});

// Export the hostname of the web app and the staging slot
export const webAppHostname = webApp.defaultSiteHostname;
export const stagingSlotHostname = stagingSlot.defaultSiteHostname;
```

### Explanation

1. We start by importing the necessary Pulumi modules and defining an Azure resource group to house our resources.
2. An App Service Plan is created, which specifies the underlying compute resources our web app will utilize. We've selected a "Free" pricing tier for demonstration purposes.
3. A `WebApp` resource is created as our primary app.
4. We create a `WebAppSlot` named `staging`, which is where we'll deploy new versions of our app for testing.
5. We set up a virtual network connection for our `staging` slot with `WebAppVnetConnectionSlot`. This connection is to a virtual network called "myVNetName" (this would need to exist or be created separately).
6. Finally, we export the hostnames for the web app and the staging slot so they can be accessed publicly.

When you're ready to perform a slot swap, you can either trigger it manually from the Azure portal or programmatically through the Azure management APIs or SDKs. This will swap the settings including the virtual network connections between the slots, promoting your staging environment to production.

Remember that this Pulumi program will need to be deployed with the Pulumi CLI and assumes that your Pulumi and Azure configurations are correctly set up. The example assumes the virtual network "myVNetName" exists - in a real-world scenario, you'd need to replace this with the name of your actual VNet, and ensure it's already been set up or include it in your Pulumi program.

This is a very basic introduction to a potentially complex operation. Azure has extensive features that can be adjusted to suit your needs, and Pulumi enables you to script out these settings which can be useful for setting up consistent environments.