Čítať v angličtine Upraviť

Zdieľať cez

Tutorial: Deploy an event-driven job with Azure Container Apps

  • Článok

Azure Container Apps jobs allow you to run containerized tasks that execute for a finite duration and exit. You can trigger a job execution manually, on a schedule, or based on events. Jobs are best suited to for tasks such as data processing, machine learning, resource cleanup, or any scenario that requires serverless ephemeral compute resources.

In this tutorial, you learn how to work with event-driven jobs.

  • Create a Container Apps environment to deploy your container apps
  • Create an Azure Storage Queue to send messages to the container app
  • Build a container image that runs a job
  • Deploy the job to the Container Apps environment
  • Verify that the queue messages are processed by the container app

The job you create starts an execution for each message that is sent to an Azure Storage queue. Each job execution runs a container that performs the following steps:

  1. Gets one message from the queue.
  2. Logs the message to the job execution logs.
  3. Deletes the message from the queue.
  4. Exits.

Dôležité

The scaler monitors the queue's length to determine how many jobs to start. For accurate scaling, don't delete a message from the queue until the job execution has finished processing it.

The source code for the job you run in this tutorial is available in an Azure Samples GitHub repository.

Prerequisites

Setup

  1. To sign in to Azure from the CLI, run the following command and follow the prompts to complete the authentication process.

    Azure CLI 
    az login

  2. Ensure you're running the latest version of the CLI via the upgrade command.

    Azure CLI 
    az upgrade

  3. Install the latest version of the Azure Container Apps CLI extension.

    Azure CLI 
    az extension add --name containerapp --upgrade

  4. Register the Microsoft.App, Microsoft.OperationalInsights, and Microsoft.Storage namespaces if you haven't already registered them in your Azure subscription.

    Azure CLI 
    az provider register --namespace Microsoft.App
az provider register --namespace Microsoft.OperationalInsights
az provider register --namespace Microsoft.Storage

  5. Now that your Azure CLI setup is complete, you can define the environment variables that are used throughout this article.

    Azure CLI 
    RESOURCE_GROUP="jobs-quickstart"
LOCATION="northcentralus"
ENVIRONMENT="env-jobs-quickstart"
JOB_NAME="my-job"

Create a Container Apps environment

The Azure Container Apps environment acts as a secure boundary around container apps and jobs so they can share the same network and communicate with each other.

  1. Create a resource group using the following command.

    Azure CLI 
    az group create \
    --name "$RESOURCE_GROUP" \
    --location "$LOCATION"

  2. Create the Container Apps environment using the following command.

    Azure CLI 
    az containerapp env create \
    --name "$ENVIRONMENT" \
    --resource-group "$RESOURCE_GROUP" \
    --location "$LOCATION"

Set up a storage queue

The job uses an Azure Storage queue to receive messages. In this section, you create a storage account and a queue.

  1. Define a name for your storage account.

    Bash 
    STORAGE_ACCOUNT_NAME="<STORAGE_ACCOUNT_NAME>"
QUEUE_NAME="myqueue"

    Replace <STORAGE_ACCOUNT_NAME> with a unique name for your storage account. Storage account names must be unique within Azure and be from 3 to 24 characters in length containing numbers and lowercase letters only.

  2. Create an Azure Storage account.

    Azure CLI 
    az storage account create \
    --name "$STORAGE_ACCOUNT_NAME" \
    --resource-group "$RESOURCE_GROUP" \
    --location "$LOCATION" \
    --sku Standard_LRS \
    --kind StorageV2

    If this command returns the error:

    (SubscriptionNotFound) Subscription <SUBSCRIPTION_ID> was not found.
Code: SubscriptionNotFound
Message: Subscription <SUBSCRIPTION_ID> was not found.

    Be sure you have registered the Microsoft.Storage namespace in your Azure subscription.

    Azure CLI 
    az provider register --namespace Microsoft.Storage

  3. Save the queue's connection string into a variable.

    Bash 
    QUEUE_CONNECTION_STRING=$(az storage account show-connection-string -g $RESOURCE_GROUP --name $STORAGE_ACCOUNT_NAME --query connectionString --output tsv)

  4. Create the message queue.

    Azure CLI 
    az storage queue create \
    --name "$QUEUE_NAME" \
    --account-name "$STORAGE_ACCOUNT_NAME" \
    --connection-string "$QUEUE_CONNECTION_STRING"

Create a user-assigned managed identity

To avoid using administrative credentials, pull images from private repositories in Microsoft Azure Container Registry using managed identities for authentication. When possible, use a user-assigned managed identity to pull images.

  1. Create a user-assigned managed identity. Before you run the following commands, choose a name for your managed identity and replace the \<PLACEHOLDER\> with the name.

    Bash 
    IDENTITY="<YOUR_IDENTITY_NAME>"
    Azure CLI 
    az identity create \
    --name $IDENTITY \
    --resource-group $RESOURCE_GROUP

  2. Get the identity's resource ID.

    Azure CLI 
    IDENTITY_ID=$(az identity show \
    --name $IDENTITY \
    --resource-group $RESOURCE_GROUP \
    --query id \
    --output tsv)

Build and deploy the job

To deploy the job, you must first build a container image for the job and push it to a registry. Then, you can deploy the job to the Container Apps environment.

  1. Define a name for your container image and registry.

    Bash 
    CONTAINER_IMAGE_NAME="queue-reader-job:1.0"
CONTAINER_REGISTRY_NAME="<CONTAINER_REGISTRY_NAME>"

    Replace <CONTAINER_REGISTRY_NAME> with a unique name for your container registry. Container registry names must be unique within Azure and be from 5 to 50 characters in length containing numbers and lowercase letters only.

  2. Create a container registry.

    Azure CLI 
    az acr create \
    --name "$CONTAINER_REGISTRY_NAME" \
    --resource-group "$RESOURCE_GROUP" \
    --location "$LOCATION" \
    --sku Basic

  3. Your container registry must allow Azure Resource Manager (ARM) audience tokens for authentication in order to use managed identity to pull images.

    Use the following command to check if ARM tokens are allowed to access your Azure Container Registry (ACR).

    Azure CLI 
    az acr config authentication-as-arm show --registry "$CONTAINER_REGISTRY_NAME"

    If ARM tokens are allowed, the command outputs the following.

    {
  "status": "enabled"
}

    If the status is disabled, allow ARM tokens with the following command.

    Azure CLI 
    az acr config authentication-as-arm update --registry "$CONTAINER_REGISTRY_NAME" --status enabled

  4. The source code for the job is available on GitHub. Run the following command to clone the repository and build the container image in the cloud using the az acr build command.

    Azure CLI 
    az acr build \
    --registry "$CONTAINER_REGISTRY_NAME" \
    --image "$CONTAINER_IMAGE_NAME" \
    "https://github.com/Azure-Samples/container-apps-event-driven-jobs-tutorial.git"

    The image is now available in the container registry.

  5. Create a job in the Container Apps environment.

    Azure CLI 
    az containerapp job create \
    --name "$JOB_NAME" \
    --resource-group "$RESOURCE_GROUP" \
    --environment "$ENVIRONMENT" \
    --trigger-type "Event" \
    --replica-timeout "1800" \
    --min-executions "0" \
    --max-executions "10" \
    --polling-interval "60" \
    --scale-rule-name "queue" \
    --scale-rule-type "azure-queue" \
    --scale-rule-metadata "accountName=$STORAGE_ACCOUNT_NAME" "queueName=$QUEUE_NAME" "queueLength=1" \
    --scale-rule-auth "connection=connection-string-secret" \
    --image "$CONTAINER_REGISTRY_NAME.azurecr.io/$CONTAINER_IMAGE_NAME" \
    --cpu "0.5" \
    --memory "1Gi" \
    --secrets "connection-string-secret=$QUEUE_CONNECTION_STRING" \
    --registry-server "$CONTAINER_REGISTRY_NAME.azurecr.io" \
    --mi-user-assigned "$IDENTITY_ID" \
    --registry-identity "$IDENTITY_ID" \
    --env-vars "AZURE_STORAGE_QUEUE_NAME=$QUEUE_NAME" "AZURE_STORAGE_CONNECTION_STRING=secretref:connection-string-secret"

    The following table describes the key parameters used in the command.

    Parameter Description
    --replica-timeout The maximum duration a replica can execute.
    --min-executions The minimum number of job executions to run per polling interval.
    --max-executions The maximum number of job executions to run per polling interval.
    --polling-interval The polling interval at which to evaluate the scale rule.
    --scale-rule-name The name of the scale rule.
    --scale-rule-type The type of scale rule to use.
    --scale-rule-metadata The metadata for the scale rule.
    --scale-rule-auth The authentication for the scale rule.
    --secrets The secrets to use for the job.
    --registry-server The container registry server to use for the job. For an Azure Container Registry, the command automatically configures authentication.
    --mi-user-assigned The resource ID of the user-assigned managed identity to assign to the job.
    --registry-identity The resource ID of a managed identity to authenticate with the registry server instead of using a username and password. If possible, an 'acrpull' role assignment is created for the identity automatically.
    --env-vars The environment variables to use for the job.

    The scale rule configuration defines the event source to monitor. It is evaluated on each polling interval and determines how many job executions to trigger. To learn more, see Set scaling rules.

The event-driven job is now created in the Container Apps environment.

Verify the deployment

The job is configured to evaluate the scale rule every 60 seconds, which checks the number of messages in the queue. For each evaluation period, it starts a new job execution for each message in the queue, up to a maximum of 10 executions.

To verify the job was configured correctly, you can send some messages to the queue, confirm that job executions are started, and the messages are logged to the job execution logs.

  1. Send a message to the queue.

    Azure CLI 
    az storage message put \
    --content "Hello Queue Reader Job" \
    --queue-name "$QUEUE_NAME" \
    --connection-string "$QUEUE_CONNECTION_STRING"

  2. List the executions of a job.

    Azure CLI 
    az containerapp job execution list \
    --name "$JOB_NAME" \
    --resource-group "$RESOURCE_GROUP" \
    --output json

    Since the job is configured to evaluate the scale rule every 60 seconds, it may take up to a full minute for the job execution to start. Repeat the command until you see the job execution and its status is Succeeded.

  3. Run the following commands to see logged messages. These commands require the Log analytics extension, so accept the prompt to install extension when requested.

    Azure CLI 
    LOG_ANALYTICS_WORKSPACE_ID=$(az containerapp env show --name $ENVIRONMENT --resource-group $RESOURCE_GROUP --query properties.appLogsConfiguration.logAnalyticsConfiguration.customerId --output tsv)

az monitor log-analytics query \
    --workspace "$LOG_ANALYTICS_WORKSPACE_ID" \
    --analytics-query "ContainerAppConsoleLogs_CL | where ContainerJobName_s == '$JOB_NAME' | order by _timestamp_d asc"

    Until the ContainerAppConsoleLogs_CL table is ready, the command returns an error: BadArgumentError: The request had some invalid properties. Wait a few minutes and try again.

Prepitné

Having issues? Let us know on GitHub by opening an issue in the Azure Container Apps repo.

Clean up resources

Once you're done, run the following command to delete the resource group that contains your Container Apps resources.

Výstraha

The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this tutorial exist in the specified resource group, they will also be deleted.

Azure CLI 
az group delete \
    --resource-group $RESOURCE_GROUP

Next steps

Container Apps jobs