OpenWhisk

Search the Azure Marketplace for Apache OpenWhisk, select the SecureAnyCloud publisher, and choose Create.

Configure the network security group to allow TCP 22 for administration and TCP 3233 from the hosts that call the API. Complete the wizard and create the VM.

RG="openwhisk-prod"; LOCATION="eastus"; VM_NAME="openwhisk-01" IMAGE_URN="sac1647283583153:openwhisk:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openwhisk:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the API port to the callers that need it:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 3233 --priority 1010

On first boot, a one-shot service generates this instance's own authentication key, starts the platform and records the details. SSH in as azureuser and read the root-only credentials file:

sudo cat /root/openwhisk-credentials.txt

Expected output. The key half is unique to your VM and is masked here:

# Apache OpenWhisk (Standalone) — Per-VM Credentials OPENWHISK_API_HOST=http://<your-vm-ip>:3233 OPENWHISK_GUEST_AUTH=5b636ff8-b85d-4fda-bff9-73306c885edf:********************************

The wsk CLI on the VM is already configured with this key, so you can start using the platform immediately. Confirm that the platform is up:

systemctl is-active docker openwhisk-standalone curl -s http://127.0.0.1:3233/ping wsk namespace list

The curl .../ping request returns pong. The wsk namespace list command returns your guest namespace, which confirms that the CLI is authenticated against the local platform with this instance's key.

Create a small Node.js action and invoke it. The result comes back from a real Docker action container that executes your function:

cat > hello.js <<'EOF' function main(params) { return { greeting: 'Hello, ' + (params.name || 'world') + '!', runtime: process.version }; } EOF wsk action delete hello 2>/dev/null || true wsk action create hello hello.js --kind nodejs:default wsk action invoke hello --result --param name sac

Expected output:

{ "greeting": "Hello, sac!", "runtime": "v20.19.0" }

You can also invoke actions over the REST API, expose them as public web actions (wsk action create --web true), and chain them into sequences. For event-driven execution, attach triggers and rules. See the Apache OpenWhisk documentation for the full action, trigger and rule model.

This image ships no usable default credential. A helper on the VM proves the round trip: this instance's own key authenticates, while the well-known upstream default key is rejected.

sudo /usr/local/sbin/openwhisk-cred-roundtrip.sh

Expected output:

OK

Every invocation is recorded as an activation. List the activations and the action-runtime containers that the platform spawned:

sudo docker ps --format '{{.Names}} {{.Image}} {{.Status}}' wsk activation list --limit 3

To drive the platform from your workstation or CI, install the wsk CLI and point it at your VM. Use the API host and key from /root/openwhisk-credentials.txt:

# Run this on your workstation, not the VM. Replace <vm-ip> and the auth key. wsk property set --apihost http://<vm-ip>:3233 --auth <OPENWHISK_GUEST_AUTH> wsk action list

The API is served over HTTP on port 3233, so expose it only to trusted networks. Alternatively, place a TLS-terminating reverse proxy in front of it and restrict the NSG source ranges accordingly.