My GitHub repo shows how to set up a blue-green deployment environment for services hosted in a vNet & front-ended by Azure API Management(APIM). In this example, Azure FrontDoor is used to direct traffic to the correct regional APIM. APIM will route the traffic to Azure Traffic Manager to ensure that the traffic is distributed across multiple regions. The Azure Application Gateway is used to route traffic inside the vNet and to the Azure Functions to handle the API calls. If a regional AppGW refuses traffic (such as being down for upgrades), Traffic Manager will redirect traffic to the a different region.
Test Routing
To test this application, you will first hit the various endpoints of the application. Then, you will shut down the Application Gateway for the region that serves the initial requests (to simulate a blue-green deployment). Finally, you will hit the endpoints again and see that Traffic Manager is routing requests to the other region.
Initial requests
Run the following commands to see that the API is running & available. Note which region is serving your requests (in this example, SOUTHCENTRALUS).
FrontDoor
Command
curl --header "Ocp-Apim-Subscription-Key: 7876c011952240fd9061685ba1bb6ec0" https://fd-apimTrafficMgr-ussc-dev.azurefd.net/api/applicationOutput
Howdy from SOUTHCENTRALUS!
API Management
Command
curl --header "Ocp-Apim-Subscription-Key: 7876c011952240fd9061685ba1bb6ec0" https://apim-apimtrafficmgr-ussc-dev.azure-api.net/api/applicationOutput
Howdy from SOUTHCENTRALUS!
Traffic Manager
Command
curl https://tm-apimtrafficmgr-ussc-dev.trafficmanager.net/api/application?code=SuperSecretSecurePasswordOutput
Howdy from SOUTHCENTRALUS!
Application Gateway
Region 1
Command
curl https://ag-apimtrafficmgr-ussc-dev.southcentralus.cloudapp.azure.com/api/application?code=SuperSecretSecurePasswordOutput
Howdy from SOUTHCENTRALUS!
Region 2
Command
curl https://ag-apimtrafficmgr-eus-dev.eastus.cloudapp.azure.com/api/application?code=SuperSecretSecurePasswordOutput
Howdy from EASTUS!
Functions
Region 1
Command
curl https://func-apimtrafficmgr-ussc-dev.azurewebsites.net/api/application?code=SuperSecretSecurePasswordOutput
Howdy from SOUTHCENTRALUS!
Region 2
Command
curl https://func-apimtrafficmgr-eus-dev.azurewebsites.net/api/application?code=SuperSecretSecurePasswordOutput
Howdy from EASTUS!
Bring down a region for upgrades & redirect traffic
Stop Application Gateway
Run the following CLI command to stop the Application Gateway in the region that served the initial API requests so we can see Traffic Manager failover (in this example, SOUTHCENTRALUS).
Command
az network application-gateway stop -g rg-apimTrafficMgr-ussc-dev -n ag-apimTrafficMgr-ussc-devAfter stopping the AppGW, you can verify that Traffic Manager has detected the AppGW is down (in this example, instead of USSC, forward to EUS).
az network traffic-manager profile show -g rg-apimTrafficMgr-ussc-dev -n tm-apimTrafficMgr-ussc-dev --query "endpoints[].{name: name, endpointLocation: endpointLocation, endpointMonitorStatus: endpointMonitorStatus}" --output tableName EndpointLocation EndpointMonitorStatus -------------------------- ------------------ ----------------------- ag-apimTrafficMgr-ussc-dev South Central US Degraded ag-apimTrafficMgr-eus-dev East US Online
Rerun the initial requests & see that they are served from a different region
Command
curl --header "Ocp-Apim-Subscription-Key: 7876c011952240fd9061685ba1bb6ec0" https://fd-apimTrafficMgr-ussc-dev.azurefd.net/api/applicationOutput
Howdy from EASTUS!