1- Provides an abstraction layer from the underlying infrastructure layer.

That gives organizations the flexibility of moving their workloads easily and host them in different infrastructure anytime whether it is on-premises or in the cloud. So, you are not locked-in to a specific cloud provider nor to your own on-premises datacenter.

2- Gives you the ability to optimize the usage of your infrastructure by increasing the density of your workloads

3- It’s a great architecture for implement continuous integration, continuous deployment pipeline.

To deploy a Docker EE cluster, you need the following

1. Azure subscription
2. Azure Application principal
3. RSA SSH Key

Azure subscription

Azure Application principal

• Principal name --> User Name
• App principal ID or (App ID) --> User ID
• App Secret --> Password

Why do we need an App Principal for a Docker cluster?

RSA SSH Key

Steps to deploy a Docker EE cluster

1. Create an Azure resource group
2. Create an App Principal
3. Assign the App Principal from step #2 a permission on the group created on step #1
4. Create your DockerEE cluster using the app principal created in step #2 and select the resource group created in step #1

First: Create a resource group

1- Go to https://Portal.Azure.com

2- Click on the + sign from the left nav to add a new resource | select or type resource group

3- Provide Resource group name, Subscription and Resource group location

Create resource group [Azure CLI]

ahmed@Azure:~$ az group create -n DockerEECDemo --location southcentralus

Second: Create an App principal

1. Go to https://Portal.Azure.com
2. Click (or search for) the Azure Active Directory icon from the left nav | select or type App registration | New application registration
3. Provide a Name, leave the default settings of Application type = “Web app/API” and provide any random URL at Sign-on URL field
4. Press Create

1. Click on Settings | Keys
2. Type a Description for the key and choose the Expires time | Press Save
3. Copy the Application ID = [Principal App ID] & Key Value = [Principal App Secret] to somewhere safe as you will need to use them later

Third: Assign permission to the new App Principal to the resource group

This step is forgotten by most people. If this step is not performed and your App principal doesn’t have inherited contribute permissions on the resource group, your DTR portal provisioning will silently fail and will never load.

1. Go to the resource group you have created | Click on Access Control (IAM) from the left nav | Add
2. Select the role Contributor | find the created app principal using the field Select | select the right one from the list of results
3. Press Save

Forth: Create DockerEE cluster

• Swarm Name: dockerswarm
• Service Principal App ID: You should have that from the earlier steps
• Service Principal App Secret: You should have that from the earlier steps
• SSH public key: Your RSA SSH public Key
• Subscription: Your azure subscription name
• Resource group: The resource group created in the steps above
• Location: Select which Azure region you want your cluster deployed to. Usually this defaults to the location settings of the resource group.

Common questions

1. How can I find out what the DTR URL is?

$ docker run -ti docker4x/create-sp-azure sp-name [rg-name rg-region]

Then this using the Azure CLI you run this command:

$ az group create  --name DockerGroup --location centralus --deployment-name docker.template --template-file <templateurl>

Common issues

1. You get the following error at the homepage of the DTR portal “Warning: Unlicensed copy. Please register your license on the Settings page”

Resolution

This means your license key is invalid. You need to update the license key as follows:

Navigate to the settings page | General tab| Press on Apply new license

https://DTR_URL/admin/settings

Select the new license key (*.lic) file and press Open

Once its loaded successfully, it should look like this:

3. Trying to load the DTR portal but its not working (getting timeout error)

Resolution

Make sure you have waited at least 15 mins after the cluster has been deployed to allow Docker to provision and configure the load balancer and IP config for the DTR endpoint.

If it still doesn’t work, make sure you have granted access the App principal used in creating the cluster to the resource group where the cluster has been provisioned.

If not, you can fix the permissions and redeploy a new cluster. Check the steps above for provisioning a new Docker cluster.

4. The Docker cluster deployment job failed due to a VM didn’t start on time

This happens when a VM takes longer than expected to start so the deployment job timesout.

Resolution

If that happens I would suggest deleting the cluster and re-deploying a new one. Obviously, you can go a restart the VM (that failed to start on time), however, from my experience that results on issues in configuring DTR. So it’s better to re-deploy.

Additional resources

• Docker EE best practices & considerations
• Application and service principal objects in Azure Active Directory
• Docker for Azure Setup & Prerequisites

Avoiding the error

 await context.PostAsync("I'm sorry I don't understand. Can you clarify please?");

 context.Done(true);

Fixing the error

 StateClient stateClient = activity.GetStateClient();
 await stateClient.BotState.DeleteStateForUserAsync(activity.ChannelId, activity.From.Id);

 case ActivityTypes.Message:
 try
 {
 await Conversation.SendAsync(activity, () => new ShoppingDialog());
 }
 catch(Exception Ex)
 {
 if (Ex.GetType() == typeof(InvalidNeedException))
 {
 ConnectorClient connector = new ConnectorClient(new Uri(activity.ServiceUrl));
 Activity reply = activity.CreateReply("Sorry, I'm having some difficulties here. I have to reboot myself. Lets start over.");
 await connector.Conversations.ReplyToActivityAsync(reply);
 StateClient stateClient = activity.GetStateClient();
 await stateClient.BotState.DeleteStateForUserAsync(activity.ChannelId, activity.From.Id);
 }
 }
 break;

Additional resources

• Bot Framework Template for Visual Studio
• Bot Framework Samples in GitHub
• Building a Conversational Bot: From 0 to 60
• Microsoft Cognitive Services: Give Your Apps a Human Side

**Please note: This post includes PowerShell scripts. To learn more about how to use Azure PowerShell scripts check this post here.

The definition consists of three main sections

• Role identifying information (Name, description …etc.)
• Included/Excluded actions
• Scope

Here is an example of a role definition JSON

{
   "Name": "Virtual Machine Manager",
   "Description": "Can restart virtual machines that can be view only.",
   "Actions": [
      "Microsoft.Compute/virtualMachines/start/action",
      "Microsoft.Compute/virtualMachines/restart/action"
   ],
   "NotActions": [
   ],
   "AssignableScopes": [
      "/subscriptions/FFBBA206-76CF-42CE-B97E-0CD948BACB69",
      "/subscriptions/FFBBA206-76CF-42CE-B97E-0CD948BACB69"
   ]
}

New-AzureRmRoleDefinition -InputFile C:\MycustomRole.json

Remove-AzureRmRoleDefinition -Id ROLE_DEFINITION_ID

Remove-AzureRmRoleDefinition -Name "ROLE_DEFINITION_Name"

$role = Get-AzureRmRoleDefinition -Name "ROLE_DEFINITION_NAME"
$role.AssignableScopes.Add("/subscriptions/NEW_SUBSCRIPTION_ID_GOES_HERE")   ##[[Repeat this step to add all the subscriptions you want to add]]
Set-AzureRmRoleDefinition -Role $role

Additional resources

• Get started with access management in the Azure portal
• Use role assignments to manage access to your Azure subscription resources
• RBAC: Built-in roles
• Custom Roles in Azure RBAC

Add-AzureRmAccount
Select-AzureRmSubscription -SubscriptionId [SUBSCRIPTION_ID_GOES_HERE]

PowerShell.exe
Import-Module 'C:\Program Files (x86)\Microsoft sdks\Azure\PowerShell\ServiceManagement\Azure\Azure.psd1'

• This article references a lot of PowerShell commands. Read this post to get up to speed on how to use Azure PowerShell module
• Long PowerShell scripts in this article have been wrapped to multiple lines to be readable, make sure you use a single line when you try to execute them
• Snapshots and scripts have been modified to remove account identifying information for security reasons

• Cloud services
• Subscription level

• Service administrator
• Co-administrator

• Location (US West, Germany Central …etc.)
• Level (Production, Test, Development …etc.)
• Workload (Web application, Data warehouse, BI …etc.)

• Owner: Full access
• Contributor: Full access but cannot grant others permissions
• Reader: View only access

Common issue

Root cause

get-AzureRmResourceProvider -ListAvailable |where {$_.Registrationstate -eq "Registered"}

Quick resolution

Long-term resolution

1. Preregister all providers in a subscription
2. Create a custom RBAC role to permit registration of resources providers to resource group owners

1- Preregister all providers in a subscription

If we have a limited number of subscriptions that doesn’t change often, we can run a PowerShell command to preregister all available providers to each subscription. The only downside here is that every time a new service is added to Azure including Azure marketplace you will need to run a PowerShell command to register the new providers for these new services.

 To get a list of all available resource providers run the following PowerShell command:

get-AzureRmResourceProvider -ListAvailable | select ProviderNamespace

To register all available resource providers in the current subscription run the following PowerShell command:

get-AzureRmResourceProvider -ListAvailable | foreach-object{Register-AzureRmResourceProvider -ProviderNamespace $_.ProviderNamespace}

To register a resource provider (e.g. the one required for provisioning IoT Hub resources) run the following command:

Register-AzureRmResourceProvider -ProviderNamespace Microsoft.Devices

2- Create a custom RBAC role to permit registration of resources providers to resource group owners

This solution will leverage a custom RBAC role to enable resource group owners to have the ability to register resource providers to subscriptions. The custom RBAC role will grant *ONLY* registration rights on the subscription, this role should be assigned in-addition to the resource group owner built-in role:

Here is the definition of the custom role:

{
"Name": "Register Microsoft providers",
"Description": "Can register Microsoft providers",
"Actions": [ "*/register/action" ],
"AssignableScopes": [ "/subscriptions/[SUBSCRIPTION1_ID_GOES_HERE]",
"/subscriptions/[SUBSCRIPTION2_ID_GOES_HERE]",
"/subscriptions/[SUBSCRIPTION3_ID_GOES_HERE]" ]
}

Replace ‘[SUBSCRIPTION1_ID_GOES_HERE], [SUBSCRIPTION2_ID_GOES_HERE] …etc.’ with all subscription ids that you would like this role to be associated to.

** Please note that custom role definition objects span subscriptions and sit on the AAD tenant level. That means you can only have uniquely named custom roles defined across all subscriptions in a single tenant. So make sure you include all the subscriptions ids you want to include in the above custom role definition in the assignable scopes section.

Here is how to create a custom role using PowerShell:

First save the custom role definition listed above in a file called MycustomRole.json then run the following command:

New-AzureRmRoleDefinition -InputFile C:\MycustomRole.json

Now you can go to the portal and assign this custom role to users or security groups (in our case to resource owners):

In future, newly added subscriptions will not have the custom role associated to them. To make the new custom role you created above available and applies to new subscriptions, run the following PowerShell script to update the existing custom role to include the new subscriptions:

$role = Get-AzureRmRoleDefinition -Name "Register Microsoft providers"
$role.AssignableScopes.Add("/subscriptions/[NEW_SUBSCRIPTION_ID_GOES_HERE]")   ##[[Repeat this step to add all the subscriptions you want to add]]
Set-AzureRmRoleDefinition -Role $role

Additional resources:

• Use role assignments to manage access to your Azure subscription resources
• Custom Roles in Azure RBAC
• Register-AzureRmResourceProvider
• Get-AzureRmResourceProvider
• New-AzureRmRoleDefinition
• Set-AzureRmRoleDefinition
• Remove-AzureRmRoleDefinition

1. Microsoft Azure Storage Explorer (UI tool)
2. AzCopy (Command-line tool)

Microsoft.WindowsAzure.Storage.DataMovement.TransferException: Unable to connect to the remote server
 ---> Microsoft.WindowsAzure.Storage.StorageException: Unable to connect to the remote server ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 13.88.145.72:443
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.GetResponse()
   at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext)
   --- End of inner exception stack trace ---
   at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext)
   at Microsoft.WindowsAzure.Storage.AzCopy.EnumerationHelpers.AzureBlobLocation.<ValidateDestination>b__0()
   at Microsoft.WindowsAzure.Storage.AzCopy.LocationHelper.ValidateAzureDestination(Action existCheck)
   --- End of inner exception stack trace ---
   at Microsoft.WindowsAzure.Storage.AzCopy.AzCopy.ExecuteTransfer(Exception& listFilesException)

<configuration>
   <system.net>
     <defaultProxy>
        <proxy proxyaddress="http://PROXY_ADDRESS:PORT_NUMBER" bypassonlocal="true" />
     </defaultProxy>
   </system.net>
 </configuration>

PROXY_ADDRESS: Is the proxy address used to connect to the internet, e.g. myproxy.company.com

PORT_NUMBER: Is the port number used to connect to the proxy, e.g. 8080