Skip to content

Application Gateway Deployment

Operator runbook for the deployment of an approved and merged change to the Application Gateway or to a WAF policy. Both are in the connectivity layer. Read it with Application Gateway.

1. Before you start

  • The pull request is approved and merged to main.
  • For an HTTPS listener, the certificate is in the Key Vault of the gateway.
  • You have access to the pipelines of the right platform and to the ticket.

2. Run the pipeline for canary

  1. Open the pipelines and select the hub pipeline (hub).
  2. Run it from main. Where your entry pipeline lets you choose, select the environment canary, the layer connectivity and the region of the change (for example weu).
  3. Read the plan. Only the connectivity layer may change, as an update in place of the gateway (and the WAF policy if you changed one).
  4. Approve it and follow the run until it ends.
  5. Verify the apply (see below).

3. Verify the apply

A green apply stage does not prove that the requested change is in place, especially for a complex resource such as an Application Gateway.

  1. Open the log of the apply step.
  2. Look for the requested change: the new pool, listener, setting, rule or certificate.
  3. If it is not in the output, do not resolve the ticket. Investigate, and ask a second engineer if needed.
  4. In the portal, open the gateway and check Backend health: the new pool is Healthy (Verify).

4. Run the pipeline for prod

Repeat steps 2 and 3 for prod. The production plan waits for the approval of a second engineer. Read it again before you approve it.

A WAF pull request can have only prod files

A pull request for a WAF policy can have files for prod only, or for canary and prod. Run the pipeline for the environments that have changes, and say why in the ticket when canary is skipped.

5. Close the ticket

  1. Tell the requester that the change is deployed. Say what they can test (for example the URL and the certificate).
  2. Open the ticket. Add a line that the change is deployed, assign it to the author of the pull request or the requester, and move it to Resolved.

Roll back

Revert the pull request and run the pipeline again (Roll back).