[MUSIC]
>> You know what I had in mind on my schedule?
The Kubernetes resources and how to integrate
your cluster with Azure AD to
get just-in-time secure clusters.
I would love to welcome to
the studios Michael Withrow who is
a program leader on
the Azure Kubernetes Service that you know as AKS.
Michael, welcome to Build.
Thank you so much for joining us here today.
>> Thank you very much. Excited to be here.
>> For those who do not know
you and everything that you do,
can you please tell us a little bit about
your team, your work, etc, etc.
>> Sure. I'm a Senior Program Manager
on the Azure Kubernetes Service,
which is a heavily used service
within the Azure Community.
My role within there is to cover
all the security features to make sure
that AKS is enterprise-grade capable.
>> What I love about your team's work is
that it is productivity beyond belief.
You're saying, how can we very securely set
you up these environments that you
can use to solve your problem,
and then don't have to worry about
garbage collection, cleanup, etc.
Here at Build, you're introducing
some cool new concepts for cluster security.
Do you want to tell us a little bit about that?
>> Sure. As it
exists natively from a management perspective,
I'm an administrator and I'm trying to
give everybody access to my cluster,
so I've got to go through to find access,
and they're going to be long-lived
from a capabilities point of view.
Now I've got to define a process to make sure
that I've got my role-based access in place.
I've monitored my administrators
and all those things like that.
With just-in-time access, the idea
there is that now I've given
administrators access for resources
that they need at just the time that they need it.
>> What I really like about this is
that you don't need to give your admin access forever.
You're not like, "Oh, I might need you to have
access in three months or in the middle of the night,
so I need to constantly keep this open access."
You just do it,
which is why it's called just-in-time.
That makes sense, good naming.
This is such an interesting game-changer because
you don't have to be overly predicting.
You can just do your work,
be productive without having to
future-proof and predict the future and all of that.
I think that one is really, really cool.
I know this is something your customers have
been asking for forever,
so I love that your team is co-creating with
customers on this. Super cool.
>> Yeah. Absolutely.
>> Tell us about the other thing,
the AKS run command, tell us about that.
>> Yes. Switching gears a little bit,
on the other side, when we look in the security stack,
we have a private cluster capability
that a lot of customers leverage as well.
There can be some challenges with how you get into
that cluster for administration
from a capabilities point of view.
What we've been looking at is trying to simplify
the access mechanisms that you can get
into your private clusters,
but also keep it secure.
That's where AKS run command
comes in for everybody to use.
>> This sounds really interesting.
Do you want to show us a demo so we
can see what you're talking about?
>> Absolutely.
>> Awesome. Here we go. Oh, that's the desktop.
>> Thank you. Sorry about that.
Looking at just-in-time access
from a precursor perspective,
what you want to understand is that this is
all predicated on from a tenant perspective,
that you have implemented your basic P2 skill,
which lights you up for
the just-in-time access capability.
Once you've done that,
as this demo walks through,
now you can start to basically enable
your groups for just-in-time access.
What you're seeing here in the demo perspective
is that [inaudible] ,
that is AAB enabled,
then I've added that just-in-time access
enabled group to that AKS cluster.
Now I'm an administrator,
not necessarily a permanent administrator,
but I need to do something on the cluster.
I run some commands and I realize I don't have access,
so I'm going to request access through just-in-time.
The administrator will go through and now is
provisioning that user to now
have access to that particular cluster.
You can see it's going to define the timeframe,
what that user can do,
and now, essentially,
you are going through from a command-line perspective,
you'll see the time frame there.
To do that assignment, everything's configured,
and then once the administrator has been approved,
that administrator can actually execute commands
against that cluster in that timeframe.
>> This is just incredibly cool, Michael,
and I'm sure you've been getting
some pretty cool feedback on this from your customers.
This is just absolutely phenomenal.
Do you have anything else you'd like to show
us or share with us?
>> I think now is a good time to
probably go over to the Run command.
>> Let's see it.
>> Looking at the Run command,
it's pretty straightforward.
The idea there is that instead of having
to go through traditionally when
someone deploys a private cluster,
they have to do advanced configurations
by adding in private endpoints,
UDRs, stacking in maybe a jump host or
a batching host in order to get
into the private cluster environment.
Really what I'm talking about here is they
have to be on the network somehow
or get access into the network somehow.
A lot of those are complex to set up.
There is cost associated with that,
so what we've created is the Run command,
which is just run directly through kubectl.
With that command, you can shell in to the environment.
Obviously, from a security perspective,
you're going to be worried about that security.
We've created a specialized role
just for this Run command here,
which you're seeing here in this demo environment.
Once you've relegated that role to that user,
think of it like a custom role as an example,
now they can go through just with that specialized access
and remote into the product cluster
from a simplified configuration.
>> This is so cool,
Michael. I love this.
I love that you are
making things so much easier for people,
you're boosting their productivity,
and you're keeping them safe at the same time.
This is not a case of security is annoying.
This security actually makes
your job way the heck easier.
This is fantastic. I absolutely love it.
Our manager actually, Patrick,
he's a huge fan of
Kubernetes and he will probably be freaking out
about this because these are some big changes and I
know these are asks that you've
been getting from your community forever.
So thank you so much.
>> That's right. Absolutely.
>> Where can people go to learn
more? Where should people go?
>> Absolutely. Remember about our AKS documentation?
We have a lot of documentation out there and
the Run command and just-in-time access are documented.
I also have some blog posts out
there that customers can reference.
>> Perfect. Look that up.
AKS runtime and just-in-time access.
Everyone go check it out, and Michael,
thank you so much for joining us here at Build.
It has been such a joy to get this information from you.
>> Thank you very much.
>> Be safe. Bye.