azurecli

name	azurecli
description	Referência e guia de uso do Azure CLI (az) para gerenciar recursos Azure: autenticação, resource groups, AKS, ACR, Key Vault, App Service, PostgreSQL gerenciado e networking. Use quando: provisionar ou gerenciar recursos Azure via linha de comando, scripts de automação ou pipelines CI/CD.
user-invocable	true

Azure CLI — Gerenciamento de Recursos Azure

Quando Usar

• Provisionar ou gerenciar recursos Azure sem Terraform (scripts rápidos, bootstrap)
• Autenticar e configurar acesso a clusters AKS
• Empurrar imagens para Azure Container Registry (ACR)
• Gerenciar segredos no Key Vault
• Scripts de automação em Bash para pipelines CI/CD

---

Instalação e Autenticação

# Instalar Azure CLI
# Linux (apt)
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# macOS
brew install azure-cli

# Verificar
az version           # >= 2.60 recomendado

# Autenticação interativa (dev local)
az login
az login --tenant <tenant-id>        # tenant específico

# Autenticação por Service Principal (CI/CD)
az login --service-principal \
  --username $ARM_CLIENT_ID \
  --password $ARM_CLIENT_SECRET \
  --tenant $ARM_TENANT_ID

# Listar e selecionar subscriptions
az account list --output table
az account set --subscription "Nome ou ID da subscription"
az account show

# Configurar output padrão
az configure --defaults output=table
az configure --defaults group=meu-resource-group location=brazilsouth

---

Resource Groups

# Criar
az group create \
  --name rg-DevKit-prod \
  --location brazilsouth \
  --tags Environment=production Project=DevKit

# Listar
az group list --output table

# Verificar se existe
az group exists --name rg-DevKit-prod

# Deletar (⚠️ remove TODOS os recursos dentro)
az group delete --name rg-DevKit-prod --yes --no-wait

# Obter ID
az group show --name rg-DevKit-prod --query id --output tsv

---

AKS — Azure Kubernetes Service

# Criar cluster AKS
az aks create \
  --resource-group rg-DevKit-prod \
  --name aks-DevKit-prod \
  --node-count 3 \
  --node-vm-size Standard_D4s_v3 \
  --min-count 2 \
  --max-count 10 \
  --enable-cluster-autoscaler \
  --kubernetes-version 1.29 \
  --network-plugin azure \
  --load-balancer-sku standard \
  --enable-managed-identity \
  --generate-ssh-keys \
  --tags Environment=production

# Obter kubeconfig
az aks get-credentials \
  --resource-group rg-DevKit-prod \
  --name aks-DevKit-prod \
  --overwrite-existing

# Listar clusters
az aks list --output table

# Ver versões disponíveis
az aks get-versions --location brazilsouth --output table

# Atualizar versão do cluster
az aks upgrade \
  --resource-group rg-DevKit-prod \
  --name aks-DevKit-prod \
  --kubernetes-version 1.30

# Escalar node pool manualmente
az aks scale \
  --resource-group rg-DevKit-prod \
  --name aks-DevKit-prod \
  --node-count 5

# Adicionar node pool
az aks nodepool add \
  --resource-group rg-DevKit-prod \
  --cluster-name aks-DevKit-prod \
  --name workerpool \
  --node-count 2 \
  --node-vm-size Standard_D8s_v3 \
  --mode User

# Parar / iniciar cluster (economizar custo em dev)
az aks stop  --resource-group rg-DevKit-prod --name aks-DevKit-dev
az aks start --resource-group rg-DevKit-prod --name aks-DevKit-dev

# Deletar cluster
az aks delete \
  --resource-group rg-DevKit-prod \
  --name aks-DevKit-prod \
  --yes --no-wait

---

ACR — Azure Container Registry

# Criar registry
az acr create \
  --resource-group rg-DevKit-prod \
  --name acrDevKit \
  --sku Standard \
  --admin-enabled false

# Autenticar Docker no ACR
az acr login --name acrDevKit

# Build direto no ACR (sem Docker local)
az acr build \
  --registry acrDevKit \
  --image myapp:$GIT_SHA \
  .

# Listar images e tags
az acr repository list --name acrDevKit --output table
az acr repository show-tags --name acrDevKit --repository myapp --output table

# Integrar ACR ao AKS (permissão de pull)
az aks update \
  --resource-group rg-DevKit-prod \
  --name aks-DevKit-prod \
  --attach-acr acrDevKit

# Purgar images antigas (manter apenas últimas 10 tags)
az acr run \
  --registry acrDevKit \
  --cmd "acr purge --filter 'myapp:.*' --keep 10 --ago 7d" \
  /dev/null

---

Key Vault

# Criar Key Vault
az keyvault create \
  --resource-group rg-DevKit-prod \
  --name kv-DevKit-prod \
  --location brazilsouth \
  --enable-rbac-authorization true

# Dar acesso a um Service Principal
az role assignment create \
  --role "Key Vault Secrets Officer" \
  --assignee $APP_OBJECT_ID \
  --scope $(az keyvault show --name kv-DevKit-prod --query id --output tsv)

# Secrets
az keyvault secret set \
  --vault-name kv-DevKit-prod \
  --name DATABASE-PASSWORD \
  --value "senha_secreta"

az keyvault secret show \
  --vault-name kv-DevKit-prod \
  --name DATABASE-PASSWORD \
  --query value \
  --output tsv

az keyvault secret list \
  --vault-name kv-DevKit-prod \
  --output table

az keyvault secret delete \
  --vault-name kv-DevKit-prod \
  --name DATABASE-PASSWORD

# Keys (para criptografia)
az keyvault key create \
  --vault-name kv-DevKit-prod \
  --name mykey \
  --kty RSA \
  --size 2048

---

PostgreSQL Flexível (Managed)

# Criar servidor PostgreSQL
az postgres flexible-server create \
  --resource-group rg-DevKit-prod \
  --name psql-DevKit-prod \
  --location brazilsouth \
  --admin-user pgadmin \
  --admin-password "$DB_ADMIN_PASSWORD" \
  --sku-name Standard_D4s_v3 \
  --tier GeneralPurpose \
  --storage-size 128 \
  --version 16 \
  --high-availability Enabled

# Criar banco de dados
az postgres flexible-server db create \
  --resource-group rg-DevKit-prod \
  --server-name psql-DevKit-prod \
  --database-name DevKit

# Regra de firewall (permitir AKS)
az postgres flexible-server firewall-rule create \
  --resource-group rg-DevKit-prod \
  --name psql-DevKit-prod \
  --rule-name AllowAKS \
  --start-ip-address 10.0.1.0 \
  --end-ip-address 10.0.1.255

# Conectar via CLI
az postgres flexible-server connect \
  --name psql-DevKit-prod \
  --admin-user pgadmin \
  --database-name DevKit

---

Networking

# Criar VNet e subnet
az network vnet create \
  --resource-group rg-DevKit-prod \
  --name vnet-DevKit-prod \
  --address-prefix 10.0.0.0/16

az network vnet subnet create \
  --resource-group rg-DevKit-prod \
  --vnet-name vnet-DevKit-prod \
  --name subnet-aks \
  --address-prefix 10.0.1.0/24

az network vnet subnet create \
  --resource-group rg-DevKit-prod \
  --vnet-name vnet-DevKit-prod \
  --name subnet-db \
  --address-prefix 10.0.2.0/24

# Network Security Group
az network nsg create \
  --resource-group rg-DevKit-prod \
  --name nsg-aks

az network nsg rule create \
  --resource-group rg-DevKit-prod \
  --nsg-name nsg-aks \
  --name AllowHTTPS \
  --priority 100 \
  --protocol Tcp \
  --destination-port-ranges 443 \
  --access Allow

---

Service Principal para CI/CD

# Criar SP com escopo de resource group
az ad sp create-for-rbac \
  --name sp-DevKit-cicd \
  --role Contributor \
  --scopes /subscriptions/$SUBSCRIPTION_ID/resourceGroups/rg-DevKit-prod \
  --output json

# Saída — armazenar como secret no GitHub/Azure DevOps:
# {
#   "appId": "...",        → AZURE_CLIENT_ID
#   "displayName": "...",
#   "password": "...",     → AZURE_CLIENT_SECRET
#   "tenant": "..."        → AZURE_TENANT_ID
# }

# Listar SPs
az ad sp list --display-name sp-DevKit-cicd --output table

# Resetar credenciais
az ad sp credential reset --id $APP_ID

---

Consultas Úteis com JMESPath

# Listar apenas resource groups na region brazilsouth
az group list --query "[?location=='brazilsouth'].name" --output tsv

# IP público de um recurso
az network public-ip show \
  --resource-group rg-DevKit-prod \
  --name pip-lb \
  --query ipAddress \
  --output tsv

# Todos os pods em running no AKS (via kubectl após get-credentials)
kubectl get pods --all-namespaces --field-selector=status.phase=Running

# Custo estimado de um resource group
az consumption usage list \
  --billing-period-name $(date +%Y%m) \
  --query "[?resourceGroup=='rg-DevKit-prod']" \
  --output table

---

Output Esperado

1. Comandos organizados por recurso para o ambiente alvo
2. Service Principal criado e configurado para CI/CD
3. AKS com kubeconfig atualizado localmente
4. ACR integrado ao AKS com permissão de pull
5. Key Vault com RBAC configurado para a aplicação