(upbeat music)
Coming up, we are going to talk about how you can manage
and operate your Kubernetes Clusters running
on premises and that other Cloud providers using Azure Arc.
I'm here with Jason Hansen program manager
in the Azure Arc team.
Hi, Jason.
Hey, Thomas.
Happy to join you today.
Obviously, Azure Arc is a great tool
and our customers depend a lot on Kubernetes Clusters
but they're not just running them in Azure.
They're running them on premises
or at other Cloud providers.
So, how can Azure Arc help them with that?
Yeah, that's a great question.
And what we're really trying to do
with Azure Arc is to unlock the power
of the Azure Control Plane
And by that, I mean, all of the investments
that we made in management services,
consistency of capabilities, like role-based access control
and really extend those capabilities to other locations.
And those other locations can include
on premises data centers or managed service providers
that you may be using
but also works across other Cloud providers too.
So, this is super interesting.
And I know from speaking with different architects
and Cloud architects and different companies
that, obviously,
they're not just running like an application
or all the services in one place, and we see more
and more these hybrid or Multicloud architectures.
And so, how can we actually leverage the power
of Azure Arc in these cases?
Great question.
So, generally how this looks for an application architect
who does need to run applications and infrastructure in lots
of different places, he'd lay down the infrastructure,
and then by deploying an Arc agent
into that Kubernetes Cluster, that Cluster will attach
to the Azure Control Plane and pulling that cluster up
as a resource that you can see in the Azure portal.
It gets a full MSI or Managed Server Identity.
It has an arm ID,
and as a resource within the context
of Azure, you can do things like tag that resource.
You can use our role-based access control to control who can
and can't have access to it.
And the exciting thing is
that also unlocks management services stuff
like Azure policy, Azure monitor, Azure security center,
really giving you the full breadth
of the Azure platform to wrap your arms around
what it means to run lots of Clusters in lots
in lots of different locations.
I've got a demo that shows what it looks like
to attach a Cluster to Azure.
Let me go ahead and queue that up here,
and we'll talk through what that looks like.
Sounds awesome.
Great! so here, we're in the portal,
and I've navigated to the Azure Arc center.
And I'm gonna add some infrastructure
and choose a Kubernetes Cluster.
Now, I need to provide a few parameters and inputs.
I need to choose a subscription
and a resource group for this Cluster.
I'll give it a name, so that I can identify it
in the portal.
And I'll choose a location
that this Cluster is associated with.
Now I can add some tags and metadata.
And then the portal will generate a script
that allows me to onboard it.
Now, these are basic CLI commands,
and I'm gonna take these commands,
and I'm gonna go ahead and use the Azure CLI
to register the Cluster in my terminal.
So, here I'm deploying the agent,
using the AZ connectedk8s connect command.
And what this is doing is setting up the Arc Agentry
in the Azure Arc namespace on my Cluster.
Now, the Arc agents deploy as any container workload.
And so it should feel very familiar
to Kubernetes native administrators.
Now, once this agent starts, again
it registers with the platform and establishes
that secure relationship between the Control Plane
and my attached Cluster.
Now, navigating to the portal.
I can see that resource.
I can see that Cluster in the resource group.
I can apply tags or update, modify the tags,
and see basic metadata and information about the Cluster.
And again, these Clusters can be anywhere.
They can be on prem.
They can be on another Cloud provider.
What I find great about this.
Well, there's multiple things I find obviously great
about it, but first of all,
the native integration of the agent,
how you connect this up,
And again, this makes, obviously,
we found community's administrators,
that makes me very happy,
that I can do it in the same manner.
I'm already used to do a lot of different things.
And the other thing is really,
this is not just like a connection and it shows up
as you mentioned, beginning, this is really like...
it becomes kind of like a native Azure resource.
And as you said,
this then obviously provides the whole benefits
of having the Azure control plane.
So, this is pretty cool.
The next thing I obviously wanna talk about is
what can developers do with it?
How can developer access now
that Cluster that Kubernetes Clusters
and deploy applications to it.
So, can you show me to learn something there as well?
Sure.
Yeah, as you mentioned as a developer,
you often need to use Kubernetes native tools
to access your Clusters.
So, that could be Kub control or that could be,
even a CI/CD Pipeline, for example.
And in a hybrid in a multi-cloud context,
often these clusters are spread
over lots of different locations
with different networking configurations.
Now, one of the capabilities that Azure Arc
for Kubernetes brings
to the table is a feature we call Cluster Connect.
And what Cluster Connect allows you to do is request access
to any of these Arc-enabled Kubernetes Clusters.
And using a combination of Azure technologies,
establish a secure connection
from wherever you are to that Kubernetes Cluster.
Now, that means that the Clusters access is controlled
by Azure Role-based access control.
That the end users are authenticated,
using Azure active directory.
And that the network transport to that Cluster is carried
over Azure Hybrid connections.
Now, what this means is, at the end of the day,
you can use Kubernetes native tools to interact
with that Cluster.
So, I've got a demo,
and we'll go ahead and run through what that looks like.
All right, so,
what I'm doing here is I'm starting the proxy,
using AZ connectedk8s proxy.
This again, request that end point
and establishes that secure connection.
And I'm using Kub control
at the top of the terminal here to get Cluster information.
I can, then, navigate that Cluster,
using those standard tools,
so, getting a list of namespaces, for example.
And I can also use other ecosystem tools
that take a Kub config as an input.
Here, I'm using a tool called k9s,
which allows me
to interactively explore my Kubernetes Cluster.
And I'm navigating
through the workloads that are deployed by Azure Arc.
Again, this Cluster is remote.
I'm running this tool on my laptop,
and access is seamless
as if I were on the same network segment.
They're really exciting as a building block,
what the cluster connect capability really unlocks
for developers and cluster administrators alike.
Okay. Wow.
This is awesome.
Especially, it's not just a way
of just connecting to the clusters,
but it also like really benefits now,
from Azure active directory
and to role-based access control.
And that can makes me make sure
that I have a centralized view of all my role and admins.
And people actually can have access
to the Clusters.
So I'm super excited about that one.
Speaking of centralized management,
I also know that, obviously, we have a lot
of IT pros
who actually need to deploy the services.
They need to go out, and they need to manage and operate
these Clusters in different environments.
Again, we also have, as I mentioned,
they can run them on prem.
You can run that over Cloud providers.
And even we have a solution with AKS on Azure Stack HCI
where we can actually help you deploy
or get Azure Kubernetes server within your data center.
And then admins need to actually monitor these Clusters.
So, is there also something there which makes that easier,
especially in these environments?
Yeah, that's a really great point
because Kubernetes isn't just an application.
There are a lot of concerns
around that the customers need to tackle
for the Cluster infrastructure.
And that can include monitoring and alerting, security
policy enforcement, and governance.
And,
one of the nice things with Arc is that we can enable a lot
of those capabilities from Azure to this infrastructure.
I got another demo here,
and what we're gonna see is we're gonna dig in
and look at what it means or how you can deploy something
like Azure monitor container insights
to your connected Clusters.
And the capability that we're using
from Arc-enabled Kubernetes is
something we call a cluster extensions.
And cluster extensions is an API
that allows you as a Cluster operator or a developer
if you have sufficient permissions,
to deploy these management solutions to your infrastructure.
Those solutions, once deployed,
can be automatically upgraded and updated by the platform
as new versions become available.
And with having a set of APIs to request these solutions
to be installed,
it means that you can integrate this
into your automation environment.
So, let's go ahead and kick off that demo.
So again, we're back in the Azure portal,
and I've navigated to the insights blade
on the left-hand side.
Now, I have an enabled monitoring,
so I'm gonna go ahead
and click configure Azure monitor container insights.
I select a log analytics workspace and click configure,
and that's all I needed to do.
The Azure Arc enabled Kubernetes platform,
behind the scenes, uses that secure connection
and installs the Azure monitor container insights extension.
And here, you can see the status being pulled up,
it's current version
and whether or not automatic upgrades are enabled or not.
Now, let's go ahead and look
at the Cluster and see what's happening under the covers.
Now, I've got a custom resource definition
called Extension Configs,
which maps one-to-one to these instances
of the extension and watching it install here.
Just a few moments, click refresh, and you'll see
that the extension is moved from pending to installed
which means that the solution is up and ready to go.
We can now navigate to that insights blade again,
and you can see that we are ready to start receiving metrics
from the Cluster.
So, really quick and easy to enable solutions.
Wow. Okay. This is really, really cool stuff.
I mean, again, me as an administrator
or a former administrator, this makes me so happy.
It looks really like, now, I'm administrating a resource
which actually runs an Azure,
but it can basically run everywhere.
So, that is awesome.
And then, you also talked about policies obviously
which helps me to actually make sure
that things are compliant in that environment.
Now, I know there's probably more for security engineers
and people who are responsible for compliance.
So, what else do we offer there?
Yeah. Great question.
There are some other management services
that we've talked about and I'll dig in and, and show those.
So, in this next demo,
we'll take a look at policy Azure defender for Kubernetes
and a little bit of monitoring again as well.
This is an AKS-HCI Cluster
which means we've installed AKS on top of Azure stack HCI.
And we've been able to number of these management solutions.
We'll kind of go through them one by one.
Again, bringing the goal
with Arc is to bring all of this information
across all of my Clusters into one place.
That one place is Azure
and powered by the Azure control plane.
So, let's go ahead and pull up this demo.
So, here we've got an AKS-HCI Cluster, as I mentioned.
We could see it in the portal, and again,
all of the metadata that is flowing up.
Now, let me go ahead and navigate
to the extensions in view here.
And here, you can see all of the solutions
that we've installed, monitoring defender policy.
Again, we can navigate to monitoring here.
And this Cluster has been streaming metrics and logs
for quite some times.
So, here we can see visualized in terms of a chart.
We can navigate to,
say the nodes and view,
and explore the nodes that are part
of this AKS-HCI Cluster.
And we can go ahead and configure some baseline alerts.
Here, we've got nodes going not ready
and controllers that are restarting too frequently.
Those can be send notifications to a notification group.
Now, if we go to the security tab,
this is bringing in the Azure defender for Kubernetes view.
And what Azure defender
for Kubernetes can do is make a set of recommendations
for best practices configuration for your Cluster.
It can also actively monitor and view the security incidents
or things that the defender has noticed,
for example, a new cluster admin role being created.
Last but not least, we can go to policy.
And here, we have a policy,
we can assign policies to our Cluster,
which means that the Azure policy engine is making sure
that our Clusters are configured appropriately
and kept up to date.
And so, in this case,
what I'm doing is I'm adding a policy to ensure
that no privileged containers
or high privileged containers can be started.
Now, if I apply this policy, it'll be pushed down to all
of my Clusters,
And we'll monitor and ensure
that no privileged containers are started.
Now, additionally, we can also use policy
to attach configurations to our Clusters.
So, I can assign a policy here that says,
this get Ops configuration should be associated
with this Cluster, which makes sure
that all of my Clusters are kept up to date
with the appropriate configuration.
And again, monitoring the posture and disposition
across metrics and logs,
security,
and configuration
from one place in the Azure portal is really, again,
the goal here.
Okay. Wow.
Again, very impressive.
Not just that we actually get all these management tools
which we need to actually manage Kubernetes Clusters,
but we also have a lot of tools and a lot of benefits,
actually, by connecting these. I mean,
I still love the Azure security center recommendations
which actually make sure that if I,
for example, I forgot something, right?
I mean, most of the IT administrators,
they know how to secure a Kubernetes Clusters.
They are aware of it, but you can always forget
or someone does a change,
and you're not aware of it anymore.
And security center can do a great job there.
They'll absolutely love it.
People are now hopefully as excited as I am about that.
And so where can they find more?
Yeah, great question.
And we've spent a lot of time
across a number of resources to help people get started.
And I'd say the first place
to head is definitely the Microsoft docs sites.
So we have Azure Arc Kubernetes doc site
with Quickstarts and examples.
We've also spent a bunch of time
in the Azure Arc jumpstart repository that has a number
of getting started examples, Terraform scripts,
for you to provision a demo environment
and really get your hands dirty
to kick the tires and see how this stuff works.
And last but not least, Microsoft Learn, which has a series
of modules that walk you through, from sort of zero
to hero, so that you can scale up
across these various areas.
That's great.
Thank you very much, Jason.
And for everyone watching here, if you want to learn more
about Multicloud or Hybrid architectures,
check out our Cloud Adoption Framework
and the Azure architecture center.
(upbeat music)