>> Hello and welcome. In this demo, we'll be going
over Azure Policy on AKS.
Azure Policy helps to enforce
organizational standards and to
assess compliance at scale.
Common use cases for policy include;
implementing governance for a resource consistency,
regulatory compliance, security, cost and management.
Let's get into the demo.
As you see, we have an AKS cluster in the Azure portal.
We can go to the policies on
the left-hand side of the screen
and click "go to Azure
Policy" and then we can start assigning some policies.
The first policy we will assign is temp disks and cache
for agent node pools in
AKS clusters should be encrypted at host.
As you see, we type it into
the search box and it pops up.
We can select it and then press
"Review and Create" to assign it.
We'll now assign a second policy.
We'll again search with the policies
that are predefined and
choose Kubernetes cluster should
not allow privilege containers.
Again, we press "Review and Create" and assign it.
For the third policy,
we will search again like we have in
the previous steps and this time we
will search for Kubernetes clusters
containers should only use allowed images.
This time we'll click "Next" to bring up
the policy configuration that we need to change.
We can paste in our regular expression for
our internal container registry and then click "Create".
We can then go back to the main page
in the Azure portal for
AKS and go to workloads to see our pods running.
Let's do that right now.
As you see, all our pods
are running and our cluster is healthy.
Let's go into policies and see if anything has happened.
As you can see, we have one violation.
We can see that temp disks and cache
for agent node pools in the AKS clusters
should be encrypted at host has a policy violation.
We can click on it to get more information about it.
Now we are going to test out our other two policies.
Here's the YAML file that is going to deploy
unprivileged NGINX pod from a public repository.
We can switch our Kube config to point to
our production AKS cluster that
we applied those other policies to.
We can then run the Kube CTL,
get pods and all the namespaces command
to show that we have Azure Policy enabled.
Now we can switch over to another YAML
that has an NGINX pod that is privileged.
We can make sure that the security context
that is privileged to set to true.
When we then try to apply
that pod we can see what happens.
As you see, we get the error from
server message saying that
the privileged container is not allowed.
Our policy has just kicked in.
We can now try it with
the unprivileged pod and see what happens as well.
As you can see, this was also not allowed as
we are pulling this image from a public repository.
We can then change the image tag to
come from our internal container registry.
After we do that, we can run
the deployment again to see if it works.
As you see, the pod was created as this satisfied
our two policies and now it is deployed to our cluster.
If you want to learn more, go to Azure Policy on AKS,
please visit our documentation. Thank you for watching.