LISA SHEN: Hi, my name is Lisa Shen,
and I am a product manager in Google Cloud.
In this video, we'll take a look at how
to set up Anthos Config Management
to manage multiple clusters.
We'll set up ACM to manage three Anthos clusters--
a GKE cluster running on GCP, an AWS EKS cluster running
as an Anthos-attached cluster, and an Anthos GKE cluster
running on AWS.
Anthos provides a unified platform
for managing Kubernetes clusters across different clouds
and on-prem.
These clusters can be running inside
of virtual machines and instances,
as well as on bare metal.
Anthos is a 100% software product
that extends Google Cloud Services and the best
engineering practices to your environments
so you can modernize applications
faster and establish operational consistency across them.
Anthos Config Management is a key component of Anthos
to help you achieve governance at scale.
It is a multi-cluster configuration manager
that helps you to have consistent policies
and configurations across the clusters.
And ACM uses a central Git repo to manage
access control policies, resource quotas,
and namespaces.
It is declarative and continuous.
Once you declare a new desired state,
ACM continuously checks for changes
that go against the state.
It uses YAML or JSON, so no rewriting of any existing
Kubernetes configs.
It's just simple to migrate.
In this demo, we'll show you how to install and configure
ACM's Config Sync and Policy Controller across Anthos
clusters.
First, let's navigate to the Anthos page via the Google
Cloud Console.
I have set up three clusters, as you can see here.
One is Anthos GKE cluster running on AWS.
Second is an AWS EKS cluster registered to Anthos
as an Anthos-attached cluster.
And the third cluster is a GKE cluster running on GCP.
Let's switch to the terminal to take a look at the namespace we
have for each cluster.
We'll use a command called kubectx.
And kubectx shows we have three clusters,
as we have seen via the GCP Console earlier.
For example, in the AWS EKS cluster
that is registered as an Anthos-attached cluster,
we have the default namespace along
with a few Kubernetes system namespaces,
as you can see here.
Now, let's go to the GKE cluster and then list namespaces there.
Let's switch the context first and then use
the kubectl get namespace.
And you can see we have similar namespaces there too.
Later on in the video, you'll see
how we can use ACM to create a new namespace automatically
via the Config Sync.
Now let's come back to the Anthos dashboard.
In order to install Anthos Config Management,
you must have the GKE Hub admin IAM role.
Since I'm the owner of my project,
I already have this permission.
Now let's navigate to the Anthos Config Management page.
As you can see here, it states that three clusters
in this project have not set up full Config Management.
So let's click the Setup button.
And there we have our three clusters,
one running on GCP, the other two running on AWS.
You can set up ACM for one or all of them.
So let's select all three clusters.
Policy Controller and Config sync
are two key components of the ACM.
With Policy Controller, you can enforce customizable policies
for your clusters.
With Config Sync, you can consistently
configure your clusters.
When you use these two components together,
you can continuously enforce your policies.
Now, on the Policy Controller page,
let's keep the Enable Policy Controller option checked
and then click Next.
On the Config Sync page, we'll keep
Enable Config Sync checked.
And then under the repo, let's click Custom.
And then we're going to enter the following link to a Google
Cloud sample ACM repo.
And we're going to click on Show Advanced Settings.
In the configuration directory, we're going to enter
the quickstart/config-sync, and this directory contains
the example constraints and the configs that we use
in the following sections.
And we're going to keep the rest of the fields set
to their default values and then click the Complete button.
It takes a few minutes for Config Sync and the Policy
Controller to install on our Anthos clusters.
Now, let's check the status of Anthos Config Management
dashboard.
We can see all three clusters are now
showing synced in the Config Sync status column
and installed in the Policy Controller status column.
Let's take a quick look at the sample ACM Config
codes we're using in this demo.
I have the sample repo open in my Cloud Shell Editor.
A config is a Kubernetes configuration declaration
written in YAML or JSON, and that is stored in the Git repo.
After we have finished installing Anthos Config
Management, Config Sync continuously
applies this config to our clusters.
Remember, we have set a configuration directory path
previously.
It points to a folder called config-sync
under the quickstart directory.
This is the config that Config Sync
is syncing to our clusters.
Let's take a look at the hello.yaml file
in the namespaces directory.
This simple file is to create a namespace called hello
in our clusters.
And this namespace resource should
have been created since our clusters are
synced to the directory.
Now let's verify that namespace called hello is created,
and we can do that via the terminal.
First, let's see the current Kubernetes context we are in.
The kubectx shows we are in the GKE cluster.
Let's list the namespaces that the Config Sync
is managing in our GKE cluster.
No surprise that the hello namespace has showed up.
And then we can switch the context to another cluster,
say, the AWS EKS cluster as the Anthos-attached cluster.
And we can see the same hello namespace is created
in this EKS cluster by the ACM.
And if we switch to the Anthos GKE cluster on AWS,
we're going to see the same hello namespace is created.
This means that Config Sync is watching the Git repo
and continuously syncing the configs to our cluster.
And let's do another experiment to prove this.
What will happen if I accidentally
delete this hello namespace?
The ACM Config Sync continuously monitors all the config drift
and it will correct any mismatched state
based on the single source of truth in the repo.
As you can see, the namespace that was deleted
is now recreated again automatically.
Now let's explore the Policy Controller a bit.
Policy Controller enforces your cluster's compliance
with the policies using objects called constraints.
Constraints look inside incoming Kubernetes configurations
to check specific fields.
We can view the constraint YAML file
by opening it in the Cloud Shell Editor.
The same Config Sync repo has a constraint of type Kubernetes
NoExternalServices.
And this constraint type comes with the Policy Controller's
default constraint template library,
and it blocks public-facing services
in the Anthos clusters.
Let's verify that the policy constraints have been set up
in our three clusters via the terminal.
We're in the AWS EKS cluster as the Anthos-attached cluster,
as we can see by the kubectx command.
And the kubectl get constraint CLI
will show if we have the policy set up correctly,
via the ACM in this cluster.
It's going to take a few seconds for the result to come up.
And here we are.
Let's also check if the constraint is set up correctly
in another cluster.
Let's say we're going to pick the Anthos GKE cluster on AWS.
And then we'll get the constraint with the kubectl
get constraint.
Now that we have the right constraints set up,
we can attempt to violate the policy by manually
applying an external Kubernetes service of type load balancer.
Let's do that.
Since this is against our predefined ACM policy,
we'll get an error when we try to apply
this service.yaml file, as you can see here.
Let's take a look at our service.yaml file
by switching to the editor window.
The file is to create an external load balancer
in our cluster.
By using the Policy Controller and Config Sync together,
the policies are consistently enforced to the clusters.
Config Sync synced the Kubernetes NoExternalServices
policy to the clusters, and the Policy Controller
enforced the policy in the clusters,
blocking users from applying a violating resource.
And that is why we observed the error message.
You can check out a step-by-step guide
of setting up Anthos Config Management in your cluster
at our website here.
To learn more about how to manage
the multi-cluster configuration and policy at scale,
please visit Anthos Config Management website.
Thank you for watching our video.