Baixar para ler offline
Carregado porJorge Arteiro
Gerenciando Clusters Kubernetes usando Cluster API, Azure Arc e GitOps
Este documento discute como a Azure Arc pode ajudar um varejista com centenas de lojas a migrar suas aplicações para contêineres em Kubernetes de forma unificada e segura em todas as suas localizações. A Azure Arc permite governança centralizada, monitoramento e deployments consistentes de aplicações usando GitOps para todos os clusters Kubernetes conectados, independentemente de onde estejam hospedados.
Gerenciando Clusters Kubernetes usando Cluster API, Azure Arc e GitOps
- 3. Ciência da Computaçãoem Nuvem – Desde a abstração até a invenção, mudando a forma como nos comunicamos, aprendemos, resovemos problemas e fazemos negócios. youtube.com/AzureTar AzureTar.com @AzureTar
- 5. Sumário Um Varejista comcentenas de lojas gostaria de alterar suas aplicações de loja para usar containers rodando em Kubernetes clusters O principal desafio encontrado é como fazer o deploy, configuração e gerenciamento das aplicações, de forma unificada, em todas as localizações espalhas pelo globo. Requerimentos do Cliente • Permitir a criação de uma nova loja com todas as configurações e aplicações necessárias • Permitir Monitoramento e Governança centralizadade de todas as lojas pelo time de TI da empresa. • Monitorar o estado desejado da aplicações e configurações em todas as lojas • Integrar DevOps e práticas de deployment seguro em todas applicações rodando nas lojas
- 7. Azure Arc Azure Arc– Infra-estrutura Conecta e gerencia recursos híbridos como sendo um recurso nativo da Azure Azure Arc - serviços Deploy e executa serviços nativos da Azure em ambientes externos, mas mantém Gerenciamento na Azure Multi-cloud Datacenter Edge
- 8. Operação, Governança e SegurançaConsistente
- 9. Configura Conecta Governança e Segurança Opera e Monitora AKSOpenShift kubeadm GKE EKS VMware Tanzu
- 10. PUBLIC PREVIEW Integra facilmentcom serviços da Azure usando extensões do Cluster Monitor Secure
- 11. PUBLIC PREVIEW Permite queos serviços Azure e usuários acessem os Kubernetes clusters conectados AAD RBAC Cluster Connect Custom Locations
- 12. Principais Benefícios doAzure Arc • Visualiza todos os recursos e serviços de forma unificada usando o portal da Azure • Modelo de deploy, usado por todos os cluster, baseado no GitOps e configurações como Código • Atualização das aplicações de forma escalonável • Utilização do Git para controlar os deployments de aplicações e configurações de forma segura • Desenvolvedor continua usando as mesmas ferramentas de sua preferência, sem restrições Azure Management (Azure Resource Manager, Azure Policy, Azure Portal, API, CLI…)
- 13. Git como fonteda verdade para as aplicações Operação centralizada usando Git (create, change, and delete) Todas as mudanças são capturadas https://www.weave.works/technologies/gitops/ Descrição declarative dos sistemas para manter o estado desejado Versões das aplicações usando o controle de versão do Git Mudanças são aplicadas automaticamente Agentes mantém o estado desejado
- 14. Kubernetes Cluster conectado noAzure Arc Configurações GitOps git Repositório Flux Operator + Helm Operator Mudanças na aplicação git merge Flux identifica alterações Aplicação V1 (Estado desejado) Google Kubernetes Engine (GKE) Elastic Kubernetes Service (EKS) Rancher K3s Azure Kubernetes Service on HCI 1 2 3 4 Deploy da Aplicação 5 6 7 Aplicação V2 (Novo estado desejado) Aplicação é atualizada de forma progressiva 8 Any Kubernetes, any Infrastructure
- 18. Legend: CAPIZ – AzureCAPI Provider CAPI – Cluster API Flux - fluxcd.io Flux AKS CAPI Control plane (capi-controlplane) AKS Gerenciado GitOps config GitOps config GitOps config Gerenciado pelo Cliente Gerenciado pelo Cliente CAPIZ git Repositório Flux Mudanças na Aplicação git merge Flux
- 21. azuretar/clusterapi-gitops: This repostores configuration to Kubernetes clusters management (github.com) Concepts - The Cluster API Book (k8s.io) Cluster API Azure Provider | Azure Arc Jumpstart Quick Start - The Cluster API Book (k8s.io) Guide To GitOps (weave.works) kubernetes-sigs/cluster-api (crds.dev) kubernetes-sigs/cluster-api-provider-azure@v0.4.13 (crds.dev) kubernetes-sigs/image-builder: Cross provider Kubernetes image building utility. (github.com) Azure/azure-capi-cli-extension: Kubernetes Cluster API support in the Azure CLI (github.com) Tutorial: Deploy configurations using GitOps on an Azure Arc enabled Kubernetes cluster - Azure Arc | Microsoft Docs Azure RBAC for Azure Arc-enabled Kubernetes clusters - Azure Arc | Microsoft Docs Use Cluster Connect to connect to Azure Arc-enabled Kubernetes clusters - Azure Arc | Microsoft Docs Monitor Azure Arc enabled Kubernetes clusters - Azure Monitor | Microsoft Docs Built-in policy definitions for Azure Kubernetes Service - Azure Kubernetes Service | Microsoft Docs Built-in policy definitions for Azure Arc-enabled Kubernetes - Azure Arc | Microsoft Docs Azure/arc-k8s-demo: Artifacts for Arc For Kubernetes Demo (github.com) Azure Arc-enabled Kubernetes - YouTube
- 22.
- 23. • Provide a“zero to hero” scenarios for multiple environments and deployment type using as much automation as possible. • Create a ”supermarket” experience by being able to take “off the shelf” scenarios and implement it. • Meeting Azure Arc customers and partners where they are. • Agile, “startup-like” team. • No detail is too small. • Ready to go technical demos • Jumpstart ArcBox is a sandbox environment that allows users to explore all the major capabilities of Azure Arc in a click of a button. • Jumpstart Lighting is a show where people come to share their Azure Arc/Jumpstart/Hybrid experience.
- 24. aka.ms/arc-introvideo Introducing Azure Arc aka.ms/arc-compete AzureArc compete deck aka.ms/azurearcpricing Azure Arc pricing page aka.ms/arc-techcommunity Deep dives on Azure Arc, best practices and more aka.ms/arc-customerstories Learn how customers are implementing Azure Arc https://aka.ms/arc-feedback Public Q&A forum aka.ms/AzureArcJumpstart Azure Arc Jumpstart aka.ms/AzureArcJumpstartDemos Azure Arc Jumpstart demos aka.ms/arc-blog Azure Arc: Extending Azure management to any infrastructure aka.ms/arc-k8svideo Kubernetes—Managing K8 clusters outside of Azure with Azure Arc aka.ms/arc-serversvideo Server management—Organize all your servers outside of Azure with Azure Arc aka.ms/arc-serversdocs Documentation for Azure Arc enabled servers aka.ms/arc-k8sdocs Documentation for Azure Arc enabled Kubernetes aka.ms/arc-datablog Run Azure data services on-premises, at the edge, and multi-cloud with Azure Arc aka.ms/arc-data-mechanicsvideo Azure Arc-enabled data services demos including SQL and PostgreSQL Hyperscale aka.ms/arc-ignite-video Ignite 2021: Innovate across hybrid and multicloud with Azure Arc aka.ms/arc-datadocs Documentation for Azure Arc-enabled data services Azure Arc complete overview Azure Arc-enabled Kubernetes & servers Azure Arc-enabled data services
Notas do Editor
- #10 So, just want to summarize Azure Arc-enabled Kubernetes for you. Again, similar to Arc-enabled servers, we offer a lot of flexibility to you based on your specific needs. We support a wide range of Kubernetes distributions with flavors from different vendors – as you can see on the slide. You can connect all these clusters to Azure and start deploying applications to these clusters using a GitOps-based model. Additionally, you can enable cluster health monitoring with Azure Monitor for Containers. Another powerful capability is the integration with Azure Policy that can ensure compliance with the organization’s security baselines.
- #11 With the new Cluster Extensions feature, you get a modern management experience on your Arc-enabled Kubernetes clusters. Users can now deploy and configure services like Azure Monitor and Azure Defender via the Azure Portal, CLI and APIs. Previously, these add-ons could be only be deployed manually via Helm Charts. Azure Monitor Container Insights The first experience we are enabling is Azure Monitor Container Insights. Monitoring your containers is critical, especially when you're running a production cluster, at scale, with multiple applications. Azure Monitor for Containers has been available for AKS, ARO as well as self managed clusters hosted using AKS-Engine but we can now extend this easily to any Kubernetes cluster, even one running on AWS or GKE! Container insights delivers a comprehensive monitoring experience across the full stack with workload monitoring encompassing collection of metrics and logs that are sent to Log Analytics resource in the customer’s tenant and subscription. You can get rich live telemetry on cluster health, node/pod status and container performance and correlate these metrics/logs across the App & Infra layers for full stack diagnostics. Container Insights also offers rich integration with the Open Source Ecosystem with support for metrics from Prometheus, Grafana and OpenTelemetry. Azure Defender Azure Defender can now be easily extended to clusters that live outside of Azure through the Azure Defender extension for Arc-enabled Kubernetes clusters. This can be easily enabled through the Azure Portal or CLI and supports multiple Kubernetes distributions across on-premises and multi-cloud. You can get a single pane of glass view in Azure to easily monitor the security posture of all your Kubernetes clusters, no matter where they are deployed and detect threats across these clusters using advanced analytics. Once deployed, the extension collected Kubernetes data and sends it to the Azure Defender backend in the cloud for further analysis. Azure Defender continuously analyzes the Kubernetes cluster for potential threats based on collected data and reports threats and malicious activity detected as Alerts in Azure Security Center. More new extensions for Azure Policy (Gatekeeper) and Open Service Mesh are coming soon. Azure Arc-enabled data services will also be deployable as an extension.
- #12 AAD RBAC: The Kubernetes native way of defining authorization checks involves creation of ClusterRoleBindings and RoleBinding objects in the cluster. The AAD RBAC feature instead allows for usage of Azure role assignments as the single source of truth for all authorization checks happening on the cluster. Any requests sent to the API server of the cluster are checked with the Azure authorization service to see if the entity making the request (user or service principal) is allowed (or not allowed) to access the resource of concern. This feature allows for a single place of audit on all the role assignments made on any resource within any of the Arc-enabled Kubernetes clusters. Note: This feature is only applicable for those self-managed Kubernetes clusters where the apiserver of the cluster is accessible by the customer. As a result, this feature is not applicable for cloud provider managed K8s clusters like GKE and EKS. On AKS, this feature is available natively and Arc onboarding of the cluster is not required for the same. Cluster Connect: Cluster Connect feature of Azure Arc-enabled Kubernetes provides connectivity to the apiserver of the cluster without requiring any additional inbound communication to be enabled. This is achieved by mapping a Hybrid Connections resource on the Azure service side to every Arc-enabled Kubernetes cluster where a reverse proxy agent is able to securely initiate a session with hybrid connection in an outbound manner. This feature allows your developers to access the clusters from anywhere for interactive development and debugging. If you already have a lot of investments in terms of paid pipeline concurrency for Azure Pipelines or GitHub Actions or any other hosted CI/CD provider, you can now reuse the same to deploy against even on-prem clusters without requiring self hosted agents (VMs) on-prem. Custom Locations: In Azure, every resource is created in a specific location such as eastus or westeurope. This location maps to an Azure region. Custom location allows for extension of this concept beyond the boundaries of Azure to allow customers to define their own Kubernetes clusters (on-prem or hybrid) as targets for running Azure PaaS services. This allows for consistent developer experience across Azure and off-Azure environments.