A Guide to Navigating the AKS Enterprise Documentation & Scripts

NOTE: As with all of my blog posts the views and opinions on this post are my own and are not that of my employer.

The goal of this blog is to serve as Guidance on Microsoft AKS Enterprise Documentation.

Before joining Microsoft, I was in the F500/F100 consulting world. I was focused on Azure, DevOps, and Kubernetes. Many organizations had an interest in utilizing a managed Kubernetes service. This would often lead them to Azure Kubernetes Service (AKS). We spent time guiding organizations on how to get started with AKS including the design of the architecture, deployment, and operation of it.  

Like with Azure and other platforms that have a lot of moving parts, AKS has many design areas that need to be covered as a part of the design and implementation. The core areas are:

  • IAM (Identity and access management)
  • Networking (topology, IP addressing, Ingress, load balancing, service mesh, Web App Firewall, etc.)
  • Governance (Resource organization, taxonomy, etc.)
  • Security (platform security, image security, runtime security, secrets management, etc.)
  • Management and Operations (monitoring, backup, DR, etc.)
  • Automation and DevOps (Orchestration, service discovery, Configuration, Autoscaling, CI/CD/GitOps, etc.)

These are in addition to the core but come into play with the apps that will run on top of Kubernetes:

  • Applications
  • Data

In order to simplify Kubernetes projects, you can funnel them down to three phases; Design, Deploy, and Operate.

This is a lot of ground to cover on top of gaining a solid understanding of Kubernetes itself. Microsoft has created a set of resources that can simplify and accelerate the adoption of Kubernetes. This is a set of resources that help you build out landing zones for AKS and some for Azure. These resources live in the Azure Architecture Center (AAC). The AAC is where you get guidance for architecting solutions on Azure using established patterns and practices.

I highly recommend any team and organization that plans to adopt Kubernetes utilize these artifacts from Microsoft to help you along your journey. This will ensure your AKS clusters are enterprise ready. When starting with AKS it can be confusing when and in what order to use these resources.

Again, the goal of this blog post is to give you a guide on how to use these resources. I will list these resources here in order with a brief description of them, when to use them, and how to use them:

-DESIGN-

Part #1 is to start with architecting. You will need to start with designing your AKS architecture. There are several documents that can assist with this as you work through your AKS architecture design. You will want to start with the Baseline architecture for an Azure Kubernetes Service (AKS) document. This document is core for designing AKS, however, there are some additional AKS documents that you will want to utilize in addition to the Baseline architecture for an Azure Kubernetes Service (AKS). These additional documents will depend on your organization’s specific use case.

Baseline architecture for an Azure Kubernetes Service (AKS) cluster

What it is:

The AKS baseline gives you detailed recommendations for networking, security, identity, management, and monitoring of AKS clusters. This baseline takes you through all the needed facets of AKS to come up with a plan for implementing AKS across your enterprise. The final result will be based on your organization’s business requirements.

How to use it:

This document will take you through 6 core areas divided up into sections with sub-sections.

You will start with your networking and work your way through the sections finishing off with operations.

This document has a Visio file of the AKS architecture you can download to get you started. You can download this right away and build it out with specifics to your needs as you work through this document. In fact, there are multiple Visio templates you can download to help.

A common area that folks really struggle with when getting started with AKS is planning the IP addresses. Teams need help deciding to use Kubenet or Azure CNI for the networking model. You cannot change this on an AKS cluster after it is deployed so you have to make this decision upfront. The only way to go from one networking model to another is to deploy a new cluster. Admins often worry about IP exhaustion when utilizing Azure CNI. There is a Visio and another sub-doc to help with all of this within the IP Address section. It has a link to this: repo (https://github.com/mspnp/aks-baseline/blob/main/networking/topology.md) that has a markdown file that has a table to help with planning your subnets for AKS and this document that helps you determine to go with Kubenet or Azure CNI as well as critical information on each model type and IPs.

This document also covers GitOps, multi-tenancy, and cost management with AKS.

LINK TO THE DOCUMENT: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks

The next four documents I am going to mention fit different scenarios so you may or may not need them. I will call out in the “How to use it” sections below each reference.

AKS Secure Baseline with Private Cluster

What it is:

This document helps you deploy a secure AKS cluster, compliant with Enterprise-Scale for AKS guidance and best practices. This document also contains links to reference scripts for deploying a private AKS cluster.

How to use it:

In practice in the real world, you will want to deploy a private AKS cluster 99% of the time. There needs to be a very solid reason not to. By doing this alone you will greatly improve the security posture of your AKS cluster. By default, when you deploy AKS the API server is accessible via a public IP. Deploying a private AKS cluster makes the AKS API Server private and only accessible on the Azure or when connected to your Azure VNet that the private cluster is on i.e. if you are connected via ExpressRoute. I would recommend you plan to deploy your clusters as private and utilize this document right along the baseline document when designing your AKS architecture.

LINK TO THE DOCUMENT: https://github.com/Azure/AKS-Landing-Zone-Accelerator/tree/main/Scenarios/AKS-Secure-Baseline-PrivateCluster

AKS baseline for multi-region clusters

What it is:

This reference architecture details how to run multiple instances of an Azure Kubernetes Service (AKS) cluster across multiple regions in an active/active and highly available configuration.

How to use it:

If you need multi-region AKS clusters with greater high availability then this is a document you will want to look at to guide you with this. If you don’t need multi-region-based clusters skip this document.

LINK TO THE DOCUMENT: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-multi-region/aks-multi-cluster

AKS regulated cluster for PCI

What it is:

Microsoft has built a 9-part series of articles to help when organizations need to run PCI workloads on AKS. Below are the first 3 of those articles as this is where you start. You will want to reference all 9 parts of the series though.

Introduction of an AKS regulated cluster for PCI-DSS 3.2.1 – This reference architecture describes the considerations for an Azure Kubernetes Service (AKS) cluster designed to run a sensitive workload. The guidance is tied to the regulatory requirements of the Payment Card Industry Data Security Standard (PCI-DSS 3.2.1).

Architecture of an AKS regulated cluster for PCI-DSS 3.2.1 – This article describes a reference architecture for an Azure Kubernetes Service (AKS) cluster that runs a workload in compliance with the Payment Card Industry Data Security Standard (PCI-DSS 3.2.1). This architecture is focused on the infrastructure and not the PCI-DSS 3.2.1 workload.

Configure networking of an AKS regulated cluster for PCI-DSS 3.2.1 – This article describes the networking considerations for an Azure Kubernetes Service (AKS) cluster that’s configured in accordance with the Payment Card Industry Data Security Standard (PCI-DSS 3.2.1).

How to use it:

If your organization plans to run any workloads that need PCI compliance on AKS then you will want to check out this document and utilize it when designing for your AKS clusters. It gets into topics such as TLS, DDoS protection, pop-to-pod security, and more.

LINK TO THE DOCUMENT/s:

Introduction of an AKS regulated cluster for PCI-DSS 3.2.1https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-pci/aks-pci-intro

Architecture of an AKS regulated cluster for PCI-DSS 3.2.1 – https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-pci/aks-pci-ra-code-assets

Configure networking of an AKS regulated cluster for PCI-DSS 3.2.1https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-pci/aks-pci-network

Advanced Azure Kubernetes Service (AKS) microservices architecture

What it is:

This reference architecture details several configurations to consider when running microservices on Azure Kubernetes Services. Topics include configuring network policies, pod autoscaling, and distributed tracing across a microservice-based application.

How to use it:

The chances are high that you will be running microservice-based workloads on your AKS cluster. Utilize this document in your design process to ensure your architecture is ready to handle microservices-based workloads. It also includes a Visio file to help you get started.

LINK TO THE DOCUMENT: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-microservices/aks-microservices-advanced

-DEPLOY-

Part #2 is to deploy the architecture you designed. The best option for deploying Azure infrastructure and AKS clusters is to script it as IaC (Infrastructure as Code). Scripting the deployment vs manually deploying allows you to have documentation via code, standardization, and a templatized deployment for repeatability. You can take this code and place it in a pipeline for ease of deployment, in a service catalog for access to teams across your org, or as an inner source for use among DevOps teams.

Microsoft has built something called the AKS Landin Zone Accelerator as a starting point to use for building out your IaC for AKS. The idea is that you can utilize the Azure Kubernetes Service (AKS) Baseline documentation as a reference when designing your AKS and use the AKS Landing Zone Accelerator to deploy. Now your architecture should be based on the AKS baseline with some modifications to fit your specific needs. The AKS Landing Zone Accelerator may need to be modified to fit your specific needs as well. As long as your architecture is based on the AKS Baseline then you should not have to make a ton of modifications to the AKS Landing Zone Accelerator code. In fact, 80% or more of the work should be done for you already when utilizing the AKS Landing Zone Accelerator IaC code.

The AKS Landing Zone Accelerator contains IaC code for both bicep and terraform. It also has instructions on how to deploy the AKS Baseline using either of the two languages.

Read more

Watch Learn Live Episode 7 – Introduction to Azure Arc enabled Kubernetes

Today Pierre Roman (@wiredcanuck) Senior Cloud Advocate of Microsoft & myself (@buchatech) streamed “Introduction to Azure Arc enabled Kubernetes” on Learn Live. Here is what we covered in this session:

In this session, showed you how Azure Arc enabled Kubernetes clusters can help customers like Contoso to optimize and simplify their operations. Here are the Learning objectives we covered:

  • Describe Kubernetes, Azure Arc, and Azure Arc-enabled Kubernetes.
  • Connect Kubernetes clusters to Azure Arc.
  • Manage Azure Arc enabled Kubernetes clusters by using GitOps.
  • Integrate Azure Arc enabled Kubernetes cluster with Azure services like Azure Monitor and Azure Policy.

If you missed it don’t worry. 🙂 You can watch the playback on the Microsoft Developer YouTube channel here:

You can check out more Learn Live episodes on the:

Or

Read more

Co-hosting 2 sessions in the Azure Hybrid Cloud Study Hall Series

I am very excited to be a part of a new Microsoft Azure Hybrid Cloud Study Hall series. This is a free fourteen-part weekly series that starts in April running through June.

In this study hall, you will learn how you can manage your on-premises, edge, and multi-cloud resources, and how you can deploy Azure services anywhere with Azure Arc and Azure Stack.

In this series, each session covers working with hybrid cloud resources using Azure services and hybrid cloud technologies. In these sessions we will:

  • Answer your questions live
  • Walk-through how to configure hybrid cloud resources
  • Walk-through how to deploy hybrid cloud resources
  • Walk-through how to manage hybrid cloud resources

In these sessions, together with you, we will work through Microsoft Learn modules focused on Azure Arc and Azure Stack HCI.

We have a solid lineup of speakers from Microsoft and the community! And I will be co-delivering two sessions myself.

Some of the speakers and moderators

Check out this video Microsoft marketing made where I talk about the sessions:

My sessions are:

Introduction to Azure Arc enabled Kubernetes

on May 5, 2022 10:00AM – 11:30AM (Pacific) co-hosting with Pierre Roman. 

Add to Calendar:
https://aka.ms/learnlive-azure-hybrid-cloud-study-hall-Ep7

The Learn Module:
https://aka.ms/learnlive-20220505A

Implement Azure App Service on Kubernetes with Arc

on June 9, 2022 10:00AM – 11:30AM (Pacific) co-hosting with Lior Kamrat.

Add to Calendar:
https://aka.ms/learnlive-azure-hybrid-cloud-study-hall-Ep11

The Learn Module:
https://aka.ms/learnlive-20220609A

Check out all of the Learn Live – Azure Hybrid Cloud Study Hall sessions here:

https://docs.microsoft.com/en-us/events/learntv/learnlive-azure-hybrid-cloud-study-hall

Read more

Tech Talk with Kazeem – Azure Arc Enabled Kubernetes for Beginners

I was a guest on Tech Talk with Kazeem again! The topic of discussion was Azure Arc Enabled Kubernetes for Beginners.

This image has an empty alt attribute; its file name is TechTalk-w-Kazeem-2022-ArcK8s-2.pngThis image has an empty alt attribute; its file name is TechTalk-w-Kazeem-2022-ArcK8s-1.png
@KazeemCanTeach & @buchatech@buchatech Azure Arc K8s book with O’Reilly

In the discussion with me and Microsoft MVP Kazeem Adegboyega, we talked about Azure Stack, AKS, Azure Arc: K8s, and GitOps! We talked about each technology and when to use them for what purpose and more.

You can check it out here:

Read more

Azure Arc Book Published

I am excited to kick off the new year announcing that my 8th book has been published! This book is “Azure Arc-Enabled Kubernetes and Servers“.

I had the honor to co-author this book with a long-time friend and fellow Microsoft MVP John Joyner. This is John’s latest book since his last 8 years ago!

The forward was written by Thomas Maurer a former MVP and now Microsoft Azure Evangelist. This book was reviewed by fellow Microsoft MVP Adnan Hendricks and a chapter contributed by a buddy of mine Fred Limmer.

This book covers an exciting technology from Microsoft exploring Azure Arc-Enabled Kubernetes and Servers. This book is for DevOps professionals, system administrators, security professionals, cloud admins, and IT professionals that are responsible for servers or Kubernetes clusters both on-premises and in the cloud.

Author copies!

This book covers:

  • Introduces the basics of hybrid, multi-cloud, and edge computing and how Azure Arc fits into that IT strategy
  • Teaches the fundamentals of Azure Resource Manager, setting the reader up with the knowledge needed on the technology that underpins Azure Arc
  • Offers insights into Azure native management tooling for managing on-premises servers and extending to other clouds
  • Details an end-to-end hybrid server monitoring scenario leveraging Azure Monitor and/or Azure Sentinel that is seamlessly delivered by Azure Arc
  • Defines a blueprint to achieve regulatory compliance with industry standards using Azure Arc, delivering Azure Policy from Azure Defender for Servers
  • Explores how Git and GitHub integrate with Azure Arc; delves into how GitOps is used with Azure Arc
  • Empowers your DevOps teams to perform tasks that typically fall under IT operations
  • Dives into how to best use Azure CLI with Azure Arc

You can order the book and watch for its official release here:

https://www.amazon.com/gp/product/1484277678

Read more

Pre-Order: Azure Arc-Enabled Kubernetes and Servers Book

I am excited to announce my 8th book is complete and is available for pre-order. I am even more excited that long-time friend and fellow Microsoft MVP John Joyner joined me on the journey of writing this book. John is one of the few people I have looked up to when coming into the MVP program. He also was like an OG showing me the ropes of being an MVP. This is John’s latest book since his last 8 years ago! Thanks again John for saying yes to being a part of this!

Microsoft Ignite 2016 with Fellow MVP’s Sam Erskine, and John Joyner.

In this book, we also had the honor of having the forward written by Thomas Maurer a former MVP and now Microsoft Azure Evangelist. This book was reviewed by fellow Microsoft MVP Adnan Hendricks and a chapter contributed by a buddy of mine Fred Limmer.

This book covers an exciting technology from Microsoft exploring Azure Arc-Enabled Kubernetes and Servers. This book is for DevOps professionals, system administrators, security professionals, cloud admins, and IT professionals that are responsible for servers or Kubernetes clusters both on-premises and in the cloud. This book covers:

  • Introduces the basics of hybrid, multi-cloud, and edge computing and how Azure Arc fits into that IT strategy
  • Teaches the fundamentals of Azure Resource Manager, setting the reader up with the knowledge needed on the technology that underpins Azure Arc
  • Offers insights into Azure native management tooling for managing on-premises servers and extending to other clouds
  • Details an end-to-end hybrid server monitoring scenario leveraging Azure Monitor and/or Azure Sentinel that is seamlessly delivered by Azure Arc
  • Defines a blueprint to achieve regulatory compliance with industry standards using Azure Arc, delivering Azure Policy from Azure Defender for Servers
  • Explores how Git and GitHub integrate with Azure Arc; delves into how GitOps is used with Azure Arc
  • Empowers your DevOps teams to perform tasks that typically fall under IT operations
  • Dives into how to best use Azure CLI with Azure Arc

You can pre-order the book and watch for its official release here:

https://www.amazon.com/gp/product/1484277678

Read more

Featured on AzureCrazy.com

Thanks to AzureCrazy.com for featuring me in an interview.

In the article we discussed being a Microsoft MVP, getting certified in Azure, the positive impact PowerShell can have on ones IT Career, getting started with Azure Kubernetes Service, Azure Stack Hub & more. Check it out here:

https://azurecrazy.com/steve-buchanan-interview/

Read more

Second Pluralsight Course Published – Monitor and Maintain a Software-Defined Datacenter with SCOM

Pluralsight has recently published my second course. This course is Monitor and Maintain a Software-Defined Datacenter with SCOM. This one took me back to my System Center roots focusing on Operations Manager.

This course prepares you for the 70-745 exam, while simultaneously showing you how to use SCOM for your datacenter.

In the course you will learn:

  • How to plan, deploy, and configure Operations Manager.
  • Then, you will discover how to tune Operations Manager.
  • Finally, you will learn about monitoring infrastructure and virtual machine workloads.

By the end of this course, you will have a better understanding of how monitoring works using SCOM.

Please check out the course here: https://app.pluralsight.com/library/courses/monitor-maintain-software-defined-datacenter-scom/table-of-contents

Also, be sure to follow my profile on Pluralsight so you will be notified as I release new courses! I will be releasing an Azure course soon!

Here is the link to my Pluralsight profile: https://app.pluralsight.com/profile/author/steve-buchanan

 

Read more

Speaking at Experts Live Europe 2019

Next week I will travel across the pond again to speak at Experts Live Europe 2019. I am excited to reunite with many friends and fellow Microsoft MVPs in the Microsoft community. I am honored to be a part of this conference again. I will be speaking about Azure, participating in Ask the Experts as a cloud expert, and will sit on an Azure Stack Hub panel.

Here are the details for the sessions I will be a part of:

Master Azure with VS Code

22nd of November, 3:30pm – 4:20pm

Description

There are many ways to work with Azure and its services including the: Azure portal, CloudShell, Azure CLI, and Azure REST APIs. And there are even more tools to choose when it comes to working with other services on Azure such as Docker, Kubernetes and more. It can be overwhelming to decipher what Azure tool to use for your day-to-day Azure administration and deployment.

VS Code to the rescue!!!! You can deploy and administer Azure and supporting services direct from VS Code through the plethora of extensions built for Azure. These extensions can be used to work with ARM Templates, Storage, App Service, Docker, Azure Kubernetes Service, Functions, Logic Apps, Event Hub, Cosmos DB, and more. Also, VS Code brings CloudShell directly in so you can work from a single tool!

Azure Stack Experts Panel

21st of November, 5:00pm – 5:50pm

Description

Join this global list of Azure Stack Experts for an open question and answer session as we discuss real-world scenarios.

Fellow panelists include: Kristopher Turner Global Azure Stack Hub CSA, Dino Bordonaro Microsoft Azure MVP, and Thomas Maurer Cloud Advocate at Microsoft. 

Check out the sessions here: https://www.expertslive.eu/agenda

Shout out to Marcel and Isidora the folks behind the conference!

Read more

Azure DevOps & Teams Integration = perfect match

 Recently Microsoft announced they have 13 million daily users in Teams outpacing Slack. You can read about this announcement here:  https://www.theverge.com/2019/7/11/20689143/microsoft-teams-active-daily-users-stats-slack-competition. There are many reasons Microsoft Teams has seen tremendous growth since its launch. I use Teams daily across all of my projects. In this post, I am going to write about one that has been exciting and useful for me. In this post, I am going to explore the integration with Microsoft Teams and Azure DevOps.

Are you working on Azure? If so, you are probably working with ARM Templates for Infrastructure as Code (IaC). Azure DevOps can help you centralize DevOps teams IaC ARM Templates. In addition, you will want to use VS Code and Microsoft Teams. There are many extensions in VS Code for ARM Templates. With Teams, you can integrate with Azure DevOps to track commits, pull requests, and even 2-way integration with Kanban boards.

Within Microsoft Teams you can add what is called “Apps”. These Apps are how you extend Teams and or integrate with other systems. This is how you integrate with Azure DevOps. Before we dive into this there are two important prereqs to note.

#1 You can only integrate a Teams channel with Azure DevOps when they both exist in the same Azure Active Directory tenant organization.

#2 Your Teams needs to be a part of an Office 365 account. The free version of Teams does have an Azure Pipelines app but does not have the Azure DevOps app that gives you full 2-way integration. The Azure Pipelines app is for notifications while the Azure DevOps app is for full collaboration.

Here are the high-level steps to integrate a Teams channel with the Azure DevOps App.

In your Teams channel go to Manage Team and then click on Apps.

Click on More Apps.

Search for Azure DevOps and click on it.

Input your Teams channel in the field next to Add to a team and then click on Install. This will load the Azure DevOps app into your teams’ channel. Note this needs to be done for each teams’ channel if you want this integration across multiple channels.

Next click the Set up button next to the feature you want to configure and use. The following screenshot shows the 3 features available. 

Read more