deploying-demo

Deploying the Demo

Prerequisites Check

Run these and install anything missing:

• az version — need 2.60+
• azd version — need 1.9+
• pwsh -v — need 7.4+
• Azure permission: Owner, User Access Administrator, or equivalent Microsoft.Authorization/roleAssignments/write at subscription scope. The template grants the agent runtime identity subscription Reader for correlation context and removes it during azd down.
• The responsible owner and expiry date, using the tag keys required by the target subscription. If deployment policy does not apply them, tag the resource group immediately after azd up.

Note: kubectl is not required on your local workstation. The cluster is private. Operator scripts in this repo go through az aks command invoke (wrapped by scripts/_aks-helpers.ps1). The SRE Agent uses its built-in RunKubectlReadCommand and RunKubectlWriteCommand tools instead.

Phase 1: Azure Deployment

1. Check if user has a subscription: az account show
2. Set azd environment: azd env set AZURE_SUBSCRIPTION_ID <sub-id> and azd env set AZURE_LOCATION swedencentral
3. Run azd up --no-prompt
4. Wait for completion (~25 min). Monitor progress. The post-provision hook handles image build, k8s manifest apply (via command invoke), workload identity federation, and SRE Agent data-plane sync.

Phase 2: Verify Deployment

The AKS API server is private (enablePrivateCluster: true) — local kubectl will not work. Human operators use the Azure-proxied command-invoke path:

. .\scripts\_aks-helpers.ps1
$ctx = Resolve-AksContext
$r = Invoke-AksCommand -ResourceGroup $ctx.ResourceGroup -ClusterName $ctx.ClusterName `
    -Command "kubectl get svc -n ingress-nginx ingress-nginx-controller -o jsonpath='{.status.loadBalancer.ingress[0].ip}'" -Quiet
$ip = ($r.logs -replace '[^\d\.]','').Trim()
"Storefront: http://$ip"

1. Open http://<ip>/ in a browser — verify products load, status shows healthy.
2. Hit the health endpoint from your local workstation: Invoke-RestMethod "http://<ip>/api/health" (the storefront LoadBalancer IP is public; only the cluster API server is private).
3. If the LB IP is not reachable from your machine (corporate VPN, etc.), verify from inside the cluster instead:

   Invoke-AksCommand -ResourceGroup $ctx.ResourceGroup -ClusterName $ctx.ClusterName `
       -Command "kubectl exec -n zava-demo deploy/zava-api -- wget -qO- http://localhost:3001/api/health"