Hey friends! Creating a new cluster in Azure
Kubernetes Service is a quick way to
get started, but it can leave you
with an overwhelming set of technical
decisions to make before you're really
ready for production workloads.
Derek Martin is here to show me how the AKS
production baseline represents Microsoft's
best practice approach for securely
deploying all new production environments.
I'm learning how, today on Azure Friday.
Hey friends!
I'm Scott Hanselman and it's Azure Friday.
I'm here with Derek Martin.
How are you, Sir?
I'm doing great.
How are you, Scott? Living
the dream living the dream,
learning new things and I'm going
to learn more about AKS. You know,
I've I've done a couple of Kubernetes things,
but I get a little overwhelmed.
I kind of thought it would be like,
I don't know, Apache and I just go like
File > New web server and it would be
awesome and it it didn't turn out that way.
Yeah AKS can be a little bit overwhelming.
People often expect that when you go into
any Kubernetes deployment it's, click
Next, click Start,
click Run and you're up and running.
And while you can do that,
it definitely has a tendency
to fall apart on you.
I think of it as an artist canvas.
The reality is that
customers are simply looking for kind of a
paint-by-number solution with less choices.
When we go to say,
Azure App Service, you hit New,
you deploy it, you're done.
But with Kubernetes we end up with customers,
some of them are brilliant Kubernetes minds,
and they're ready to be doing this.
They've you know been doing
Kubernetes now for a while,
but a lot of customers that we've
been seeing say just tell me exactly
how to build this thing and run it,
but I reserve the right to
make all of these different changes
as we get started and So what the
Microsoft Architecture Center has
put together the Azure Architecture
Center has put together is Microsoft's
recommended baseline production environment.
Nice, I appreciate that.
Yeah, if I want to use an artist canvas,
usually I'm more of a mechanical pencil
person and I think Azure App Service
will give me that mechanical pencil.
But if someone hands me,
you know, 1000 colored pencils,
I'm going to get a little bit overwhelmed.
So having some instruction manual for that,
it's going to be super helpful.
Yeah, that's absolutely right.
Here in the Azure portal,
if you go and create a new environment,
you can go down here real easy.
Hit create,
you click on that and as things
come along slowly click.
As things come along slowly
you will end up with a create.
You have a couple of options up here,
but when you get the output it is not
ready to go and So what we've done
here within the Azure Architecture Center,
if you haven't seen it before,
just go to azure.com/architecture we have
all kinds of great resources around
the Well-Architected Framework.
The Cloud Adoption Framework,
best practices and right here is the AKS
production baseline and this represents,
like I said, Microsoft's best practice
to creating a production environment.
So what it is is two things.
You have a narrative.
What are the design choices
that we are making?
Why did we make them?
We talk about the networking configuration,
the cluster topology.
We set up all the secure identity,
the dataflow continuity and then.
Once you read through that documentation,
you have a good idea of what kind of
solution we're deploying in the environment.
But the best part is Scott is.
You can then just click
over into our GitHub repo.
You can fork this thing and make it your own,
or you can deploy from this environment
and have what Microsoft considers a proper
production ready cluster to begin with.
And once you deploy that,
you end up with something
that looks a little bit.
More complicated than just next.
Next new and new, you actually end up with.
Let me shrink this down a little bit.
You end up with.
Obviously your Kubernetes service.
You end up with private DNS zones,
a container registry,
all of the things that you would expect,
including monitoring and security.
Everything is well secured with
our best practices around managed
identity stored in key vault.
We've got the node pools up and running,
and you're ready then to get started.
But what's even more interesting,
or at least I think it's interesting,
is a lot of customers say,
well, what do I get?
From deploying this Kubernetes
environment and we call this
the uninteresting workload,
this is actually what you would see when
you deploy the AKS production baseline.
Not very much there,
but that's the point we're looking
at this from an infrastructure
and a security perspective,
and so when you get it all up and running,
you're going to be going through App Gateway.
You're going to be going through
the layer 5 and layer 7 backends.
And then you get into Kubernetes
and now it's ready for you to
do additional deployments.
So it feels like if I just went and
said new Community deployment next next
next finish and then you know exposed
a node pool with an external IP address,
I'm going to get in my words a fairly
naive implementation of Kubernetes in
that I have made of node pool and I've
put a node on the Internet and it's naive.
Naive in that there is no planning
but what you're describing.
Is a prescription for correctness.
You're going to have,
and I assume that you're thinking
about things like like scalelike
splitting things up.
Where are the credentials being stored?
It is prescriptive for
production that's right.
And so because Kubernetes is so massive.
And again,
we don't want to take away
from the folks that have been
doing Kubernetes for years.
You can go click create like
I just showed you,
and you've got a vanilla
deployment ready to rock and roll.
But this asks environment from.
Our production baseline talks a
lot about the network topology.
It talks about the node pool topology,
cluster monitoring,
governance were using Azure Active
Directory zone awareness and and
then the must have adjacent things
like WAF and the container registry
and the key vault environment.
Wife being the web application firewall,
which is another big important
part about anything.
Anytime you put an external
IP address on the Internet,
usually when I do my aksi demo.
It's like, oh look,
I just put it directly on the Internet.
You want to have that intermediary?
Which are those layer five layer 7?
Intermediaries that you discussed earlier.
That's right and it helps get
your architects and your security
engineers out of analysis paralysis.
It puts a production ready
working model up for everyone
to start iterating on it again.
Just fork the repo after
you deploy something,
fork the repo and start making tweaks
to those arm templates and you know.
Then start adding in your CI CD pipeline.
Start adding into things and we put a
lot of documentation around that so
you can see well why did we choose.
This path, and that's what that
reference architecture is for,
and it's worth noting,
of course,
as you showed us on GitHub
that this is open source,
so if you are a Kubernetes
expert and you're watching Azure
Friday and you have feedback,
that conversation can happen in public
and that that architecture could
theoretically be improved as well.
Absolutely.
So the patterns and practices
team which develops the Azure
Architecture center and this reference
implementation accepts pull requests.
In fact,
we currently have seven issues across.
And three pull requests open.
We make changes to this.
We use this as what we called a zero ready,
which means every time the
Kubernetes the the AKS product team
makes an update to the product.
We are at day zero ready to
go with those updates.
So when a lot of the newer features
come out when we roll to 1.21
which was just a few weeks ago,
we were ready to go with
updated guidance along the way.
And what you end up with is
that AKS baseline with all of
the networking considerations,
the hub and the spoke is all
up and running and ready to go.
I have a really cool architecture diagram
here that you can go down and scroll through.
You can look at,
you know, hey,
this looks a little bit like our network,
but not entirely,
and so you can start tweaking against it.
And we put comments along the way.
Yeah, this is more than just documentation,
right?
This is a whole narrative about the
correctness of doing something.
In production, which is cool,
this is very nice 'cause it
augments the work.
The great work that the AK S team is doing.
But that day zero readiness
shows the the tight relationship
that that AKS team, the product team
who's coming out with this stuff.
And folks like y'all that are
putting this into production for
customers and helping folks out.
You know in the field there's also
this question that comes up a lot
Scott about the wealth of open source
components that are out there.
There are literally 1000 different.
Ingress controllers probably,
and we chose for our Ingress
controller traffic.
Could you have used something else?
Absolutely,
in fact a lot of people will say, oh,
I want to use the the App Gateway
component as our first party solution.
Other people may gravitate
towards something else.
We chose traffic because it has the
ability to load certificates easily
from Key Vault and other solutions.
If you have your own secret store or your
own certificate store you want to use.
The internal Kubernetes
secret store totally fine,
but we want to make sure that that you see
the decisions that we're making and why.
That's really nice.
'cause like I said before,
this is a prescription,
but it's also a cafeteria plan,
and if you want to take a piece
of the prescription and say like
I love everything except the way
we did the key vault and we're
going to do our own thing.
I love everything that the ingress and we
want to do something else that's cool.
Yeah,
we get these questions and we've
been getting these questions a lot.
It's like, OK,
you've done a really great job
creating this baseline,
but it's in a single region.
It's secure and it's production ready.
But what if I want to grow this
out to be regionally resilient
and so the architecture center
has put together an entire node?
Here?
I'll show you here on the screen and
entire node around the baseline,
so this is where we were right there.
Now we've got.
And a K S baseline for multi region clusters.
And So what we've done is we've
taken the exact same repository,
the exact same implementation,
and we have created additional ARM
templates that build on top of that
baseline to now deploy a working
copy in another region and connect
them together so you have it now,
a regionally resilient aksi deployment,
and again we go down through.
Each of the components.
Why did we choose what we chose?
What are the design patterns?
One of the things Scott that that
that I'm sure you know is not all
regions are built the same and so we
try to take a lot of the guesswork out.
If you're going to deploy and
east do deploy and West or do
you deploy and east two?
What are some of those reasons?
Do you use the paired region?
Do you use regions that are in a
different geography so we try to
take a lot of that guesswork out
for you so that you have a really
robust multi region deployment.
That's an interesting point,
because it's not just a prescriptive
production workload for Kubernetes,
it is a prescription custom workload
for Azure, Kubernetes service,
and it understands how Azure
works and it makes things the
best it can be for this cloud.
That's right, the people customers that
have been doing Kubernetes maybe on one
of our competitor clouds or on premise.
They will feel it at home with
IIS next next new you're done or
deploy very simple ARM template
and you drop down to Cube TL and.
Off you go absolutely.
You could do that.
What we're doing here,
particularly in the multi region
deployment is showing you how you
should start your process in Azure.
Taking the things about Azure that
are relevant into consideration.
But there's more. It's one of those.
But wait,
there's more scenarios is we get a lot of
questions from our really big customers,
particularly banks and other
financial institutions.
And they say great,
but I need a Kubernetes environment that
is PCI ready and so the architecture
center just in the last couple of
weeks has deployed a another instance,
another build on top of this,
and it's an AK S regulated cluster for
PCI DSS and PCI certification represents.
The best practices for running a
cloud in a secure way for things
like any sensitive workload, right?
It can be for any sensitive workload.
This particular environment has been
takes a narrative around the payment
card industry here in the United
States and so it deploys against the
standard specification DSS three point 2.1.
If you don't know what that means,
you can go do a little bit of research,
but essentially what you get.
From deploying this baseline is an additional
set of guidance around host infrastructure,
access controls,
network security,
data protection and malware protection,
and that is a really really powerful
narrative that can be applied not
just to PC or or financial services,
but for government contract work.
For additional sensitive things,
and we take a look into each
of those major components.
Again,
in the PCI world around network segmentation,
and we've built up on that
baseline to create.
A even more secure environment that
fits the needs of PPC ISO instance.
We go through the actual PCI requirements,
install and maintain a firewall.
OK, what is akso do out of the box for that?
And then what does Microsoft
recommend on top of that?
To say in addition to out of the box
we say here are your requirements
and hear what here are the things
that we do in our baseline.
To support you, that's nice.
It's the annotated PCI DSS.
That's right specific to AS which is
the meat spin on that it's not this
amorphis esoteric thing that you're like.
OK,
I have to deploy firewall.
Well is that literally just go
stick Azure firewall in front of it?
No you have to configure asks in a
certain way to make sure that it is.
Not vulnerable to the attacks that that
you're going to be seeing, so should
we all go to the Azure architecture?
Pages are primary entry to go
and learn about this stuff.
That's right, if you go to
azure.com/architecture you will see both
the narrative as well as the links into
the GitHub repository's that you can fork.
You can write pull requests on,
you can do additional changes
to them to fit your environment,
but again, the key is akso is amazing.
It's incredibly complex and
we want our customers,
those that are comfortable with
carbonates to just rock and roll.
But those that just really want
Microsoft to say how would you do it?
That's what the Azure
Architecture Center does for you.
Very cool. Well,
I appreciate you bringing all of this to us.
This is super useful information.
Yeah, my pleasure.
Alright, I've been learning all about the AKS
production baseline, today on Azure Friday.
Hey, thanks for watching this
episode of Azure Friday.
Now I need you to.
Like it comment on it,
tell your friends,
retweet it.
Watch more Azure Friday.