Hi folks, Matt McSpirit here, Program Manager
at Microsoft, working with our customers
and partners around the new Azure
Kubernetes Service on Azure Stack HCI,
and in this session, I'm going to take
you through everything you need to know
to get started with AKS on Azure Stack HCI.
Now, unless you've been hiding under a rock,
you've likely heard of Kubernetes,
but for those of you that haven't,
what is it?
Well, as application development moves
towards a container-based approach,
the need to orchestrate and manage
resources is incredibly important.
Now Kubernetes is the leading platform
for providing reliable scheduling
of fault-tolerant application
workloads and AKS in Azure is a
managed Kubernetes offering that
further simplifies container based
app deployment and management and
has a number of key benefits.
Firstly, as a managed service,
not only do you benefit from the simplicity,
but you also benefit from all the
learnings of Microsoft engineers
building AKS, thousands of engagements
with enterprise organizations and
deep integration with the open
source community in the form of
comprehensive best practices,
recommendations and more, for running
AKS-based applications and services.
Now, security is part of AKS
by design with multiple layers
of hardening and isolation,
and in addition we've published
a security baseline for AKS
which contains recommendations
that will help you improve the
security posture of your deployment.
AKS is also fully supported
by Microsoft support,
which is made up of certified Kubernetes
experts who can help diagnose and
troubleshoot any issues you might run into.
And finally,
you can manage your AKS resources
side by side with non Azure-based
Kubernetes resources all from
the Azure portal enabling you to
manage applications consistently,
apply governance and policy and more.
Now that brings us nicely onto
AKS on Azure Stack HCI.
The solution naturally has been designed
with consistency and hybrid front
and center for your key workloads,
running on both Linux and Windows
platforms, all with the highest
levels of ingrained security.
So let's dive into each of those
in a little bit more depth.
And then we'll look at it in action.
So firstly, AKS on Azure Stack
HCI brings everything you need to
start running your containerized
workloads in an easy to deploy solution.
It takes the best of the proven open
source software of Kubernetes and
adds in Microsoft's enhancements for
running on the Azure Stack HCI platform.
Now,
for those of you out there
have ever tried to deploy a raw
Kubernetes infrastructure,
it's hard, and that's where one of
the key benefits of AKS-HCI comes in,
as we'll see in a few minutes. Two simple,
quick and easy deployment options,
one with PowerShell,
or one with Windows Admin Center,
meaning familiarity and ease of use.
are top of mind here, building on the
existing IT pro skills you've already got.
Now, what do we mean when we say
AKS-HCI is hybrid by design?
Well firstly,
AKS-HCI natively
integrates with a number of Azure
based technologies such as Azure Arc,
Azure Monitor and more, and with it being
an Azure service, you pay for what you
use. With it being consistent with Azure
and Kubernetes in general, it means
you can easily move your workloads
between environments and at the same
time benefit from a consistent user
and developer experience.
Now for those of you with
heterogeneous environments,
the beauty of AKS-HCI is that it's not
just limited to Linux container hosts.
AKS-HCI provides leading support for
running Windows apps side by side
with Linux apps, all in one place.
No need for separate clusters
for separate workloads,
which leads to a better utilization of
underlying resources, and also, all of
the support is centralized and streamlined.
And finally, we've made significant
investments in security.
AKS-HCI has been built with security ingrained.
We harden the container host images,
both Linux, running on Mariner OS and
Windows, and we continue to provide
updated images as we go forward,
maintaining stringent security standards.
We've enabled integration with Active
Directory and have an in-built zero touch
CA to handle cert-enrollment and renewal.
And finally AKS-HCI, like all Microsoft
products is engineered with security as
a core principle, and on top, this easily
integrates with solutions like the
Azure Security Center for threat monitoring,
detection, assessments, and more.
But what is actually going to get deployed?
Well architecturally at a high level
of the base you've got Azure Stack
HCI running on the metal and on
top of that in virtual machines,
AKS-HCI deploys container hosts, both Windows.
and Linux,
which are ultimately going to run
your workloads. In the case of Linux,
this is Microsoft's Mariner OS.
Now, as we said earlier,
these are updated directly from Azure,
but obviously you control when
you apply those updates.
In addition,
Microsoft's built the integration
for Kubernetes to work effectively
with the underlying compute,
storage,
networking and clustered infrastructure
in Azure Stack HCI,
and this combines with the Kubernetes
open source software and that
bottom to top, is the AKS-HCI solution.
Then on top of that you can
run your Kubernetes.
applications, optionally managing
all of these, from Azure Arc.
Now we've mentioned Azure
Arc a couple of times,
but what actually is Azure Arc?
Well,
Azure Arc offers simplified management,
faster app development and consistent
Azure services and enables you to
standardize visibility, operations
and compliance across a wide range
of resources and locations by
extending the Azure control plane.
Now to get a little bit more
specific to Kubernetes,
firstly it provides a powerful
centralized way to organize,
manage and govern Kubernetes
resources at scale.
With powerful scripting tools,
the Azure Portal and API's. You can
bring modern cloud native development
techniques anywhere to build
iteratively on your choice of any
certified Kubernetes distribution,
of which AKS on ,
Azure Stack HCI is one, and on top of all
of that you can then run Azure Data
Services on-premises at the Edge and
in multi-cloud environments using
Kubernetes on the infrastructure
of your choice.
Now this could be Azure SQL Managed Instance
or Azure PostgreSQL Hyperscale, delivered
to your chosen Kubernetes environment,
orchestrated all through
Azure Arc. Now to dig one layer
deeper, when you deploy AKS-HCI, there
actually two major steps.
The first on the left here is
to deploy the management cluster.
This deploys a single VM that essentially
orchestrates and controls deployment
and management of your target clusters,
here on the right. Now your target
clusters are where you actually run
your applications and workloads.
Now when you deploy Kubernetes
target clusters,
AKS-HCI automatically deploys a set
of VM's to act as the control
plane for the target cluster,
including at least one load balancer.
So that's everything that gets deployed,
but what are your options for deployment?
Well,
you've got a couple of options
for running AKS on Azure Stack
HCI in production and then an
additional option if you've got
limited hardware and just want to
evaluate AKS on Azure Stack HCI.
So on the left here we have our
primary deployment option for
production environments and that's
running the new Azure Stack.
HCI 20H2 operating system on the metal.
Now if you're not familiar,
Azure Stack HCI 20H2 is a hyper
converged infrastructure solution,
that hosts
both traditional, virtualized
Windows and Linux workloads,
in a hybrid on-prem environment and
is the future of infrastructure
investments in compute, storage and
networking on-prem. Plus, it's also
available as a subscription, so fits
with your cloud billing approach.
Now Azure Stack HCI is also a great place
to run AKS-HCI and that combination is
our primary option from bottom to top
supported configuration in production.
Now, what if you've got existing hardware
on-prem, perhaps with SAN storage?
Well, Azure Stack HCI
20H2 is hyperconverged,
so won't work with SAN storage,
but if you prefer you can run a
Windows Server 2019 Hyper-V based
physical cluster connected to that
SAN storage and run AKS-HCI on top.
Now finally,
if you don't have much spare hardware,
or maybe you've just got a single physical node.
If that's the case, for evaluation purposes,
you can also run AKS-HCI on top of a
single Windows Server 2019 Hyper-V host.
Better still,
if you don't have any hardware at
all but have an Azure subscription,
you can even evaluate AKS-HCI nested
in a single Azure VM,
which is what we used to deploy AKS-HCI
in this demo. So let's jump in.
So we'll first deploy the AKS on Azure
Stack HCI management infrastructure
using Windows Admin Center.
So first we're going to system checks.
We'll provide some appropriate credentials
and then Windows Admin Center will
check the system to ensure everything
is set up correctly and will apply
those configuration changes if required.
We'll then ensure that Windows
Admin Center can connect to the
environment correctly using CredSSP.
And we'll move on to setting up
our host. We'll define our storage location
for our images and our virtual machines.
We'll define our network settings,
in this case DHCP, and apply an
IP address range that will be
used by our Kubernetes clusters.
Then we'll configure the Azure registration,
which will pull in my login
credentials from Windows Admin Center.
I'll define a subscription,
create a new resource group,
that's going to hold our
registration information in Azure.
And a region in Azure that's going
to contain that resource group.
We'll review our settings that we've made.
Ensure everything is correct
and apply that configuration and
that's going to take a few moments.
Once that's complete, we can move on
to the deployment of AKS on Azure
Stack HCI's management infrastructure.
As you can see in this case, took around
12 minutes and with that completed,
we can see all the information about our
AKS on Azure Stack HCI infrastructure and
we're ready to move on to deploying new
Kubernetes clusters to run our workloads.
With our management infrastructure deployed,
we're back in Windows Admin Center
ready to start deploying our first
Kubernetes cluster to run our workloads.
So I'm going to start by providing
some basic information.
I can optionally integrate with
Azure Arc for management, security,
and governance of our Kubernetes
clusters from the Azure portal.
I'll provide some basic information here.
Subscription, Resource Group and a region.
I'm going to scroll down and provide
some credentials to connect to our
AKS-HCI management infrastructure.
That's going to do some validation.
It's going to present us with
some version options.
I'm going to enter the name of my cluster,
that I'm going to deploy,
and I can also define sizes
for my primary node pool.
Now for our actual workload clusters,
we're going to define two node pools,
a Linux pool,
with a single Linux worker node
of a certain size that we can define,
and I'm going to repeat that process
to create a Windows pool as well.
Again, we're just a single node at this time.
We can optionally choose to
integrate with Active Directory.
In this case, I'm going to skip
that part. And under networking,
we've now got flexibility to choose
between Flannel and Calico network
options and select or add a new
virtual network that we wish to
deploy our Kubernetes cluster into.
With all that configured,
we can start the creation
process to create this cluster.
And as you can see, it didn't take too long,
and we're now ready to start deploying our
Kubernetes workloads into this environment.
Back on the dashboard page,
we can also connect directly to Azure,
in particular, this new Azure Arc
instance of this Kubernetes cluster
ready to start integrating with
GitOps, Azure Policy and more.
Now to deploy AKS on Azure Stack HCI's
management infrastructure using PowerShell,
you're going to first want to install a
few dependencies, so Az.Accounts,
Az.Resources and the AzureAD
PowerShell modules to begin with.
Once those are installed,
we're going to need to register
a couple of Resource Providers
for your Azure subscription.
So first you're going to want to
log into Azure and then run these
registration commands which are
going to activate and enable those
Resource Providers for Kubernetes
against this particular subscription.
Then you can go ahead and import the
PowerShell module for AKS-HCI.
And in this case we're going to display
all the commands as part of that as well,
and you'll see there's a number of different
commands that we're going to work with
as part of the deployment.
The first one we're going to
use is this initialize command,
where this is going to get your node or
your cluster ready to deploy AKS
on Azure Stack HCI.
So, a few initialization steps
are performed in the background there.
Once that's complete,
we are going to go ahead and we'll clear
the screen,
makes things a little bit easier to read,
and we're going to lock in some
of our network settings.
You'll see we're defining the name
of a virtual network, a vswitch,
we're defining a range of IP
addresses that Kubernetes is going
to use throughout the deployment,
and then we're going to apply
this configuration,
including information about location
of images and other related files.
So once that configuration has been applied,
which just takes a few moments.
There's a step in Azure that we
need to perform in terms of creating
a new Resource Group.
If you've got one already,
then this step will be required.
We're going to create a new one here
and then we're going to register
this environment,
so we're going to set up the
registration ready for installation.
And this is going to start the
integration process with Azure and
you'll see I'm choosing an existing
account that I'm already logged
in with in this case.
And with that done,
we're ready to clear the screen and
we can go ahead and install AKS
on Azure Stack HCI, simple as that,
and that's going to go ahead and
kick off the process,
which is just going to take a few minutes.
Once complete, easy as that,
we're ready to deploy our first
Kubernetes cluster to host our
workloads and applications.
Now before we deploy our first,
AKS-HCI Kubernetes cluster,
let's get the versions of Kubernetes
that are available to us and you'll
see we've got a selection across both
Linux and Windows Kubernetes versions,
so that's great to start with.
Then let's explore some of the
parameters associated with this
New-AksHciCluster command,
and you'll see we've got choices
around setting the size and number
of VMs we're going to deploy,
whether we want to integrate with Active
Directory, the Kubernetes version,
network plugins, and more.
But let's lock in this New-AksHciCluster
command, specifying a name,
one control plane node, one
Linux node and one Windows node,
and we're going to use Calico networking in
this case and that's going to kick off
deployment. And you'll see within just
a few short minutes we'll have our
new Kubernetes cluster up and running.
Once completed, we can then
retrieve the credentials of this
particular Kubernetes cluster.
And you'll see that downloads
the kubeconfig file that we can
then use to communicate and work
with that cluster going forward
and it stores it, in in this case,
in the local file directory.
With that deployed, we can now integrate this
cluster with Azure Arc for governance,
security and management and more.
So it's a simple command,
Enable-AksHciArcConnection,
Enable-AksHciArcConnection, and that's
going to go ahead and integrate this
particular cluster with Azure Arc
and it takes just a few minutes,
a number of pods are deployed down to
the cluster and once that's completed,
if we go to the Azure portal
and take a look here,
there's the management cluster
we deployed earlier and if we
click refresh, you'll see we now
have our new Kubernetes cluster
ready to run our workloads,
that's integrated with Azure Arc, where
we can go on and enable things like
GitOps, Azure Policy and more.
So now that we know how to deploy AKS-HCI,
when would you use it?
Well, as we said,
it's great for containerizing both
Linux and Windows apps on-prem.
Think about legacy .NET
applications in your environment.
These could be containerized and run on AKS-HCI.
It's also a great platform for developing
new applications built with the cloud
in mind and through our integration
with Azure Arc you can bring powerful
Azure services down to run on AKS-HCI,
one example being the Arc
enabled data services,
enabling you to run services
like Azure SQL Managed Instance
or Azure PostgreSQL Hyperscale,
on-prem, in your environment on Kubernetes.
So to wrap up,
let's reiterate that bottom
to top architecture,
starting at the bottom,
you've got that validated enterprise
class hardware with Azure Stack
HCI 20H2 running on the metal
providing a scalable high performance
platform for traditional VMs
that can be managed on-prem with
Windows Admin Center or from Azure,
with Azure Arc. You deploy AKS-HCI on top
and provide a platform for running
your containerized Windows and Linux
workloads and one layer higher,
you've got those Azure services
deployed down onto Kubernetes,
such as Arc enabled data services,
all managed from Azure. Top to bottom,
this is a powerful, scalable,
resilient solution for traditional
and modern applications and workloads
with one place to go for support.
So how to get started?
Well, download it,
try it out!
The links will be on the next slide,
but I can assure you getting
started with AKS on Azure Stack
HCI is quick and it's easy and
we've got options for those of you
who don't have any spare hardware,
by testing in Azure.
There's also a fantastic Azure
Arc Jumpstart site where you can
continue your learning around
Arc for Kubernetes and more.
And again,
the links are all on the next slide.
So here's a list of valuable resources.
There's links here to get started.
Guidance on running in Azure for evaluation,
the Azure Arc jumpstart,
as I mentioned, and more. And with
that, that concludes the session.
Thanks for watching and good luck with
your evaluation of AKS on Azure Stack HCI.