Skip to content

Workshop agenda and facilitator guide

Formats

The timings below assume the prerequisites checklist was completed before the workshop, and that cluster creation runs during a break.

Session Time Modules
Day 1, part 1 0:00–0:30 Welcome, architecture, support assessment (Support & sources)
0:30–1:00 Module 1: preflight, cost, gate G1 (preview registration)
1:00–1:45 Module 2: networks + clusters (cluster creation takes about 10–15 min: explain CNI/overlay meanwhile)
1:45–2:00 Break
Day 1, part 2 2:00–2:30 Module 3: NetworkPolicy baseline
2:30–3:15 Module 4: onboard Application Network (gate G4 discussion)
3:15–4:00 Module 5: cross-cluster discovery
End of day 1 Decide: keep clusters overnight (about USD 12–15) or clean up and rebuild on day 2
Day 2, part 1 0:00–0:30 Module 6: mTLS and identity
0:30–1:00 Module 7: ingress + HTTPS
1:00–1:25 Module 8: L4 identity authorization
1:25–1:55 Module 9: L7 authorization and bypass testing
1:55–2:10 Break
Day 2, part 2 2:10–2:55 Module 10: layered NetworkPolicy + mesh
2:55–3:40 Module 11: JWT, traffic shifting, fault injection
3:40–4:10 Module 12: observability (free parts; monitoring gate optional) and lifecycle
4:10–4:30 Module 13: safe failure
4:30–4:50 Module 14: cleanup + leftover scan (mandatory)
Time Modules
09:00–09:45 Intro, support assessment, Module 1
09:45–10:30 Module 2 (clusters create during the explanation)
10:30–11:00 Module 3
11:00–11:45 Module 4
11:45–12:30 Module 5
12:30–13:15 Lunch
13:15–13:45 Module 6
13:45–14:15 Module 7
14:15–15:05 Modules 8 + 9
15:05–15:50 Module 10
15:50–16:35 Module 11
16:35–16:55 Modules 12 (free parts) + 13
16:55–17:15 Module 14 cleanup (mandatory)

Stopping clusters overnight

Stopping AKS clusters that are Application Network members (az aks stop) isn't covered by the Application Network docs, so this workshop doesn't recommend it. Either keep the clusters running or run the full cleanup and rebuild.

Learner prerequisites checklist (send one week before)

  • [ ] An Azure subscription where you can create resource groups and role assignments (Owner, or Contributor + Role Based Access Control Administrator)
  • [ ] Budget approval for about USD 25 per lab day, per learner
  • [ ] macOS or Linux (WSL2) with: Azure CLI ≥ 2.86.0, kubectl, kubelogin, jq, curl, openssl, perl
  • [ ] az extension add --name appnet-preview
  • [ ] git clone of this repository, then scripts/00-check-local-tools.sh passes
  • [ ] config/lab.env filled in, then scripts/01-preflight-azure.sh passes (read-only)
  • [ ] Optional but recommended: the subscription owner has approved gate G1 (preview registration) in advance, because registration can take a while
  • [ ] Know your public IP (curl -s https://api.ipify.org) for ALLOWED_CLIENT_CIDR

Facilitator checklist

Before the workshop

  • [ ] Run the whole lab end to end in the target region within the last two weeks. Preview behaviour changes.
  • [ ] Re-read the Application Network pages linked in Support & sources. Update the region list, supported versions and gaps if they changed.
  • [ ] Confirm the VM SKU is unrestricted in learners' subscriptions (preflight step 6).
  • [ ] Check az appnet list-versions and set ISTIO_VERSION / ISTIO_SAMPLES_REF in config/lab.env.example to match.
  • [ ] Run scripts/validate-lab-files.sh.

During the workshop

  • [ ] Present the support assessment before Module 4 and make gate G4 a conscious decision.
  • [ ] Insist on the evidence columns in Acceptance table: "HTTP 200" is never enough.
  • [ ] After each module, have learners run the module's reset step and scripts/verify-lab-state.sh.
  • [ ] Keep the How to read results table visible.

After the workshop

  • [ ] Everyone runs scripts/cleanup-1-kubernetes.sh, cleanup-2-azure.sh and cleanup-3-leftovers.sh.
  • [ ] Remind learners to check Cost Management over the next days.
  • [ ] Collect "Actual evidence" from acceptance tables. Divergent results feed the troubleshooting guide.

Discussion prompts

  1. Why does peering the VNets not make overlay pod IPs reachable, and what does carry cross-cluster traffic?
  2. In Module 8, which identity did ztunnel actually reject on the service path, and why?
  3. What did the impostor pod in Module 10 teach you about labels versus identities?
  4. Why is a 404 on the JWT gateway not proof that authentication is enforced?
  5. What would you need from Microsoft before running this combination in production?