>> Hey, everyone. Welcome to KubeCon 2021.
I'm Poornima and I'm joined by Aurnov, and
we both are PMs in Microsoft Azure working on Azure Arc.
Now as you bring your Kubernetes clusters
under Azure management using Azure Arc,
you start considering using Azure services for management,
and value added functionality
on these clusters that you brought under management.
To do that, you can leverage a capability that we provide
called cluster extensions,
which enables installation and lifecycle management
of services such as Azure Monitor
and Azure Defender for Kubernetes
using client interfaces like the Azure Portal,
Azure CLI, and SDKs.
Today, we'll be focusing on
two Azure Arc-enabled Kubernetes Services
or Azure services that can run on Kubernetes clusters
enabled by Azure Arc,
using Azure Defender and Azure Monitor.
>> In our demo, we're specifically going to be
zooming in from Azure Security Center,
and then we're going to be going into
Azure defender for Azure Arc-enabled Kubernetes
before visualizing cluster performance with Azure Monitor,
and actually going ahead and creating a custom alert rule
for an Arc-enabled cluster.
Let's get after it with our hypothetical customer,
Northwind Traders, a financial services firm
that has recently acquired Tailwind Traders,
and has a pretty intensive cluster infrastructure.
>> So right here in Azure Security Center,
you can see that we get a high-level overview
of the entire resource group's security score.
Now, Northwind Traders has Servers,
SQL Servers and Kubernetes infrastructure deck,
and you can see all of that
appearing in Azure Security Center.
All these resources can be analyzed together
in a single pane of glass from a security perspective,
within the Azure Defender bin.
Now, we can also tailor the security score
to look at just our Kubernetes infrastructure,
if your admins are interested with looking at
just the Kubernetes infrastructure to determine
the health and security score of that infrastructure.
Now, Azure defender for Kubernetes
provides cluster level threat detection
when running advanced analytics on logs from the cluster
to detect and surface security threats.
Some examples of security events that
Azure Defender for Kubernetes monitors and surfaces
include cluster role binding for cluster admin role,
Kubernetes services that may have been exposed,
containers running in privileged mode,
and sensitive volume mounts.
Azure Defender for Kubernetes defends clusters
not only in managed Kubernetes offering of Azure, AKS,
but also on your on-prem and on-premises and
multi-Cloud Azure Arc-enabled Kubernetes environments.
>> Great. Now we see Pivot to another cluster extensions,
we're going to be looking into
the Azure Monitor capabilities that are also available.
Let's look at this one cluster,
one of the four Arc-enabled clusters
belonging to Northwind Traders,
specifically Northwind risk, an on-prem cluster.
We can see that Azure Monitor really allows us
to view monitoring insights at a cluster level
like node CPU utilization percentages,
node memory utilization percentages,
active node cons, etc.
What we can do is, we can actually dive even further
into specific analytics on nodes, for example,
or controllers as well.
We can even go into
the container level for additional insights.
With this in mind, and this capability,
we can also incorporate this
into our custom Azure dashboards,
as well as entire Log Analytics Workspace.
Not only can we dive in at a resource level,
but we can see this across
our entire cluster infrastructure.
Now based off of this, one key capability
is actually the ability to create a custom rule.
Let's go ahead and go through the process of
actually creating an alert rule.
While you guys are probably in here and join KubeCon,
a question might be
what's going on with your infrastructure?
Let's see what happens if
you are from Northwind Traders and
the specific cluster actually has a CPU utilization spike
that ends up impacting business critical workloads.
We can go right from Azure Portal
and define a custom resource alert.
It's going to be conditionally notifying the right people,
and this is all through the power of Azure Monitor.
Here we define the percentage wherever
the CPU usage percentage is greater than 80 percent,
next we define action group that's going to be notified,
and then we can give them an alert name as well,
saying CPU utilization threshold passed.
On this basis, we can create a new alert rule.
That concludes our live demo.
Summary we covered,
cluster extensions defender and monitor.
From an Azure Defender for Kubernetes perspective,
we went from a high-level overview
of Security Posture service by Security Center,
to seeing the breadth of defender coverage
and granular threat alerts.
From the Azure Monitor perspective,
we saw both the deep Performance Insights and
the capability to create a custom resource, Hoefler.
While you guys are enjoying KubeCon,
you'll be able to see what happens
if you wanted to get an alert right here.
>> Now, beyond Azure Monitor and Azure Defender,
there are other capabilities or Azure services
that you can install and run on your Kubernetes clusters
that are Arc-enabled for extended functionality.
These other cluster extensions or services include;
Azure Arc-enabled Open Service Mesh,
Azure Arc-enabled data services
that allows you to run and install
Managed SQL instances on your Kubernetes clusters
or Azure app services that allows you
to run Web applications on your Kubernetes clusters.
Even grid on Kubernetes,
Azure Functions, Azure API Management,
Azure machine learning are other services that
can run on Azure Arc-enabled Kubernetes clusters as well.
To learn more about cluster extension
or Arc-enabled Kubernetes,
please check out our additional resources.
>> You can extend the functionality
of your Kubernetes infrastructure
by connecting to Azure Arc
and deploying the cluster extensions we showed today.
Consolidate it enhance security and
observability across your clusters anywhere.
That's clusters extensions and actions.
Thank you so much for tuning in.
>> Thank you.