(orchestral music)
Coming up!
We are going to have a look on how you can leverage Azure
as a single control plane using Azure Arc to manage,
organize, and govern your hybrid cloud resources.
I'm here with Loir,
our cloud solution architect at Microsoft
and the author of the Azure Arc Jumpstart.
Hi Lior.
Obviously we want to leverage Azure
as a control plane for our resources inside Azure, but also
for our resources on premises and all the cloud providers
and even at actual locations.
you know that Azure can do that.
Can you tell me a little bit more about that?
Yeah, of course.
Thanks for having me, Thomas.
So, you know, everything in Azure represented
inside a resource provider and a resource provider is
basically the connection between a unit of resource
into our control plane, which is Azure Resource Manager.
So, when you're using Azure and you're deploying a
virtual machine or a storage account or a virtual network
any resource for that matter, you are leveraging a resource
provider behind the scene.
Now with Azure Arc, what we did, we created resource
providers for resources that are deployed outside of Azure.
So, in that way you can basically project resources
that are deployed outside of Azure, and those resources
will have the same look and feel as first-class
native Azure resources.
And that's what we're going to show today.
Oh, that sounds pretty cool
because I got a lot of requests
obviously when we talk to customers, especially when we talk
to the cloud architects and their IT teams
but obviously they want to leverage that
and you're telling me, basically
I can now simply connect my resources outside
of Azure and basically use Azure Arc to bridge resources
into the Azure control plane.
So that sounds pretty cool.
Exactly, exactly.
And what I want to show you today is the differences
how things look like with, and without Azure.
So I'm here in my Azure portal and as you can see
I have a resource group
and that's a standard resource group.
If you are using Azure
you know that you're deploying resources
everything go into a resource group
and those resources are represented as objects.
And that's what you see here.
So what we see here is a pretty straightforward, reasonable.
If we have a couple of virtual machines with some
we have some virtual networks discs, we also
have a Kubernetes cluster using Azure Kubernetes service.
Again, pretty standard stuff.
What we're talking
about today is how is that going to look like when
you're going to start projecting Azure Arc resources?
So, I'll switch to the same reasons group
but, with the different filter and what you can see here
that I'm showing Azure Arc resource says, in addition
to the native Azure resources that I already have.
So if you will look here, you can see that they have couple
of Azure Arc enabled Kubernetes clusters.
I have four Azure Arc enabled servers and one Azure Arc
enabled SQL server.
And as you can see, everything looks the same.
There's no different when it comes to the presentation
of these resources in Azure.
So it's very easy to see.
And if you thinking about that from an IT ops perspective
what he's getting is the same view that he used to
with his native Azure resources.
But now he can also start looking at the resources
that he projected as Azure Arc resources.
So there's no need to change your view
and everything is on the same place.
It's Not just like installing an agent and then
there is some meta data going up and that's it, right?
It's really becomes a native Azure resource
and it's integrated into the Azure resource manager.
So is there a way you can show me that a little bit?
I mean, can I just use that in the Azure portal
in the UI or is there also for me, like a way
that I can do that using APIs and common line?
Yeah. Great question.
So if I will go to one
of the Azure Arc enabled servers resources that I have
you can see that this resource have the same look
and feel as an Azure VM.
There's no difference when it comes
to how it's being represented in the Azure portal.
You can also see that in this resource
I applied some tags. That virtual machine that I
deployed was actually on my VMware vSphere environment
and what I did, I projected that
that server as an arc server.
So I also added some tags here.
Now tags are very important
because they represent the Meta data.
They are, they are used to organize your resources
and you can actually query against these tags
as you are managing your environment at scale.
So what I want to show you is how
you can leverage Azure resource graph, for example
as a first-class, you know
service that we have against projected Azure Arc resources.
And for that, I created three queries here
and those are very simple query lists.
Let's open one of those queries and see what we have.
You can see that in this query
I'm actually looking at the text.
So if you remember, I had hosting platform tag
and I also had the environment tag.
So in, in this query, what I'm doing
I'm querying against hosting platform.
So I want to see what type of hosting platform
my Azure Arc enabled servers I'm currently configured
against and in which environment the are deployed?
Is it on my dev environment or my production environment?
So if I'll run here to query, what we will see is
I'm getting three Azure Arc enabled servers.
So that query is basically the same thing that I
would have done on a Azure VM.
So you can see that there's no difference.
So if we were going back
to the IT ops from API representation, there's no chain
that's the same tool chain.
It's the same resource that you are used to
and the same methodologies that you're used to
in order for you to manage your environment.
So that's pretty neat.
Okay, now this is, this is really cool.
And the definitely the tagging part really helps me if I'm
in it operations, or even if I do security and compliance to
actually get an overview about what is going on
what resources do I have?
It helps me to do inventory and discovery and basically
get a full picture of my environment.
Now, another question I get a lot is now, obviously
we saw that Azure Arc, can help me to basically
get that visibility and obviously see what, what is going on
in my environment.
I can quickly get a list of all the resources, again
not just in Azure, but also in our hybrid cloud
and multi-cloud environment.
I also want to do things with this.
I also want to make sure, for example, if I speak
to security and compliance, they, for example
want to make sure that their systems are configured
in a secure way, and that they're actually compliant
with their organizational standards and so on.
So can you show me how we can actually use
Azure Arc to do that?
Right. And
You know, security compliance governance are one
of the biggest topics that we are talking
about in the context of Azure Arc.
Obviously the need to do security compliance
and governance at scale is critical for organizations.
And I'm happy that you raised that question because
as part of us treating Azure Arc enabled resources
as first-class citizens inside the Azure ecosystem
and inside our APIs, as you saw with resource graph.
We're also able to apply
Azure policies on these Azure Arc enabled resources, right?
And in what I want to show you here is in Azure policy
I can go into definition.
And if I look for SERT, for example
you can see here that I have bunch of Azure policies.
And if I go to the second one, you can see
that these policies, with type of guest configuration.
Now the guest configuration policy is a unique policy
to Azure Arc enabled servers.
Because what you can do is you can apply a policy
Azure policy on a resource that is an Azure Arc enabled
in this case, Azure Arc enabled server.
Now, if you're talking about that with the context
of security compliance governance and all that.
You can see here that this specific policy talks
about the expired days of a certificate, but
because that server is projected as an Azure arc
enabled server, I can do that at scale.
So that means that every server that I will onboard
into my Azure environment, rather on the, you know
on the subscription level or, you know
on the resource group level, I can apply policy
on these resources and these policy will start
doing its thing.
We'll start do the remediation.
So, that means that the server in this case will always be
in compliance with the organization standards.
So again, that's another example of how we are
taking advantage of an Azure service, which is Azure policy
against an Azure Arc enabled server that is
deployed obviously outside of Azure.
No, this is awesome.
Again, you showed me so many cool stuff.
You basically show me how we can actually
bridge resources outside of Azure.
Doesn't matter if they're running on premises
and the local data center at actual locations, or even
at all the cloud providers into the Azure control plane
make them a native Azure resource and use Azure
and to Azure management tools to basically get an inventory
get visibility, get control over these resources.
So this is pretty fantastic.
Now I know that obviously people are now very interested
in Azure Arc and how they can leverage Azure Arc
for their servers and Kubernetes clusters
and many other resources, so Lior
or where do people go if they want to learn more?
Yeah
So we have a lot of technical resources when it comes
to Azure Arc.
The first resource that you want to look at is
the Azure Arc jumpstart project, the Azure Arc
jumpstart project will give you off the shelf scenarios.
So you can start getting your hands dirty with Azure Arc
in an automated fashion.
We have a lot of scenarios to offer you.
So please go ahead and check this out.
The second resource that we have is Microsoft Learn.
We created a lot of learning models when it comes
to Azure Arc, step-by-step really from introduction
to an expert level in Azure Arc models.
And the third resource is the tech communities.
The tech communities are a great place to look
when you want to see the latest announcements that we have
around the Azure Arc people from the community coming
and writing technical blogs on Azure Arc.
And really it's just a great place to share knowledge.
So I highly recommend it.
Thank you very much, Lior. This was really great.
And for everyone watching, if you want to know more
about building hybrid and multi-cloud architectures
check out the cloud adoption framework
and the Azure architecture center.