Azure Architecture reference template for web applicationS

1 Azure Architecture reference template FOR WEB applicationS Subramanian Veerappan, Senior Enterprise Architect D & A Practice, HCL Technologies May 2020 Azure Architecture reference template FOR WEB applicationS 1 Contents Objective .. 5 Scope .. 5 Azure Architecture Considerations .. 5 Content Flow .. 5 Architecture Styles .. 6 N-Tier Architecture .. 6 Microservices .. 6 Event Driven Architecture .. 6 Web-Queue-Worker .. 6 Cloud Design Pattern Considerations .. 7 Key Design Principle Considerations .. 9 Architecture components for a Basic Web Application .. 10 App Service plan .. 11 SQL Database .. 11 Region .. 11 Scalability considerations .. 11 Scaling the App Service app .. 11 Recommendations for scaling a web app .. 12 Scaling SQL Database .. 12 Availability considerations .. 12 Backups .. 12 Manageability considerations.

2 13 Deployment .. 13 Configuration .. 13 Security considerations .. 14 SQL Database auditing .. 14 Deployment slots .. 14 Logging .. 14 SSL .. 14 Authentication .. 14 Architecture components for a Web application with High Availability .. 16 Architecture .. 16 Recommendations .. 17 Azure Architecture reference template FOR WEB applicationS 2 Regional pairing .. 17 Resource groups .. 17 Front Door configuration .. 17 SQL Database .. 18 Cosmos DB .. 18 Availability considerations .. 18 Azure Front Door .. 18 SQL Database .. 19 storage .. 19 Manageability considerations .. 20 Cost considerations .. 20 Azure Front Door .. 20 Azure Cosmos DB .. 20 Components for a Complex Web Application with High Availability .. 21 Architecture .. 21 Recommendations .. 22 Regional pairing .. 22 Traffic Manager configuration .. 23 Configure SQL Server Always On Availability Groups.

3 23 Availability considerations .. 24 Manageability considerations .. 25 Cost considerations .. 25 Virtual machine scale sets .. 25 SQL server .. 26 Load balancers .. 26 Traffic Manager pricing .. 26 Architecture components for a Serverless Web application .. 27 Architecture .. 28 Recommendations .. 29 Function App plans .. 29 Function App boundaries .. 30 Function bindings .. 30 Scalability considerations .. 30 Disaster recovery considerations .. 31 Azure Architecture reference template FOR WEB applicationS 3 Security considerations .. 31 Authentication .. 31 Authorization .. 32 CORS .. 32 Enforce HTTPS .. 33 Lock down the function 33 Protect application secrets .. 33 DevOps considerations .. 34 Front-end deployment .. 34 Back-end deployment .. 34 API versioning .. 34 Cost considerations .. 35 Azure Functions .. 35 Azure Cosmos DB.

4 35 Content Delivery Network .. 36 Multi-tier web application with HA and DR on Azure .. 37 Architecture .. 37 Components .. 38 Alternatives .. 39 Other considerations .. 39 Scalability .. 39 Security .. 39 Pricing .. 39 Microservices Architecture on AKS .. 40 Architecture .. 40 Components .. 40 Design considerations .. 42 Microservices .. 42 API gateway .. 42 Data storage .. 42 Service object .. 42 Ingress .. 43 TLS/SSL encryption .. 44 Namespaces .. 44 Azure Architecture reference template FOR WEB applicationS 4 Autoscaling .. 44 Pod autoscaling .. 45 Cluster autoscaling .. 45 Health probes .. 45 Resource 46 Role based access control (RBAC) .. 46 Secrets management and application credentials .. 48 Pod and container security .. 49 Deployment (CI/CD) 49 Container best practices .. 49 Helm charts .. 50 Helm Revisions .. 51 Azure DevOps Pipeline for Microservices on Kubernetes.

5 51 Cost considerations .. 52 Azure Kubernetes Service (AKS) .. 52 Azure Load 53 Azure DevOps Services .. 53 Azure Monitor .. 53 Exclusions .. 53 Conclusion .. 53 References .. 53 Acknowledgement .. 53 Azure Architecture reference template FOR WEB applicationS 5 Objective Objective of this document is to provide guidance on various Azure Architecture styles and considerations for various application models within those styles. Scope Scope of this document is to cover Azure Web application Architecture including High availability, N-tier Architecture . Azure Architecture Considerations <<Mention key drivers/ NFR requirements for proposing given Architecture >> Scalability Reliability Availability Resiliency Performance Security Data Quality Usability Resilience Content Flow Want to know about key design principles to be considered => Key design principles Want to know about Architectural considerations for Simple Web application => Simple Web App Web application with High Availability => Web App with HA Complex Web application with HA => Complex Web App with HA Multi-tier Web App with HA and DR => Multi-tier Web App with HA and DR Micro services Architecture on AKS => Microservices on AKS Serverless Web Application => Serverless Web App Azure Architecture reference template FOR WEB applicationS 6

6 Architecture Styles <<Mention which of the below Arch. Style will be followed >> <<Following challenges need to be considered before proposing a specific Arch. Style: Complexity Messaging and eventual consistency Inter-service communication Manageability >> N-Tier Architecture <<Note: This arch. Style is best fit for appls. That uses mix of IaaS and managed services, appls. Which already uses layered Architecture >> Microservices <<Note: Propose this Architecture style for applicationS which have complex domains and which demands a mature development and DevOps process>> Event Driven Architecture <<Note: Best fit for applicationS that ingest and process large volume of data with very low latency. This type of Architecture is also useful when different subsystems need to perform different types of processing on same data>> Web-Queue-Worker <<Note: Propose this Architecture style applicationS with relatively simple domain with some resource intensive tasks>> Azure Architecture reference template FOR WEB applicationS 7 Cloud Design Pattern Considerations Pattern What is this pattern for?

7 Ambassador Create helper services that send network requests on behalf of a consumer service or application. Anti-Corruption Layer Implement a fa ade or adapter layer between a modern application and a legacy system. Asynchronous Request-Reply Decouple backend processing from a frontend host, where backend processing needs to be asynchronous, but the frontend still needs a clear response. Backends for Frontends Create separate backend services to be consumed by specific frontend applicationS or interfaces. Bulkhead Isolate elements of an application into pools so that if one fails, the others will continue to function. Cache-Aside Load data on demand into a cache from a data store Choreography Let each service decide when and how a business operation is processed, instead of depending on a central orchestrator. Circuit Breaker Handle faults that might take a variable amount of time to fix when connecting to a remote service or resource.

8 Claim Check Split a large message into a claim check and a payload to avoid overwhelming a message bus. Compensating Transaction Undo the work performed by a series of steps, which together define an eventually consistent operation. Competing Consumers Enable multiple concurrent consumers to process messages received on the same messaging channel. Compute Resource Consolidation Consolidate multiple tasks or operations into a single computational unit CQRS Segregate operations that read data from operations that update data by using separate interfaces. Event Sourcing Use an append-only store to record the full series of events that describe actions taken on data in a domain. External Configuration Store Move configuration information out of the application deployment package to a centralized location. Federated Identity Delegate authentication to an external identity provider.

9 Azure Architecture reference template FOR WEB applicationS 8 Gatekeeper Protect applicationS and services by using a dedicated host instance that acts as a broker between clients and the application or service, validates and sanitizes requests, and passes requests and data between them. Gateway Aggregation Use a gateway to aggregate multiple individual requests into a single request. Gateway offloading Offload shared or specialized service functionality to a gateway proxy. Gateway Routing Route requests to multiple services using a single endpoint. Geodes Deploy backend services into a set of geographical nodes, each of which can service any client request in any region. Health Endpoint Monitoring Implement functional checks in an application that external tools can access through exposed endpoints at regular intervals. Index Table Create indexes over the fields in data stores that are frequently referenced by queries.

10 Leader Election Coordinate the actions performed by a collection of collaborating task instances in a distributed application by electing one instance as the leader that assumes responsibility for managing the other instances. Materialized View Generate prepopulated views over the data in one or more data stores when the data isn't ideally formatted for required query operations. Pipes and Filters Break down a task that performs complex processing into a series of separate elements that can be reused. Priority Queue Prioritize requests sent to services so that requests with a higher priority are received and processed more quickly than those with a lower priority. Publisher/Subscriber Enable an application to announce events to multiple interested consumers asynchronously, without coupling the senders to the receivers. Queue-Based Load Leveling Use a queue that acts as a buffer between a task and a service that it invokes in order to smooth intermittent heavy loads.