Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Unified Operations and Management of your cross...

Unified Operations and Management of your cross-premises server fleet with Azure Arc

For organizations that want to simplify the management and governance of complex and distributed environments across on-premises, edge and multi-cloud, Azure Arc enables deployment of Azure services anywhere and extends Azure management to any infrastructure.

In this session we will focus on Arc-enabled servers scenario. We will begin with a deep dive into the architecture of Azure Arc to understand how it works under the hood.

The main part of the session will be a series of demos that will show how to onboard your servers to Arc at scale and leverage Resource Manager policies to automatically enable capabilities like operational and security monitoring, patching, backup, guest configuration, and inventory management.

We will also explore the Jumpstart ArcBox, an easy to deploy sandbox for trying out different Arc scenarios (including Kubernetes and data services) that is suitable for prototyping and proof-of-concepts. It will allow session participants to start quickly and get all the tools and components they need.

David Pazdera

July 08, 2022
Tweet

More Decks by David Pazdera

Other Decks in Technology

Transcript

  1. Unified Operations and Management of your cross- premises server fleet

    with Azure Arc David Pazdera @pazdedav Cloud Solution Architect, Microsoft
  2. • Are you using Azure Governance and Management services in

    production? Do you like the experience? • Are you responsible for managing heterogeneous infrastructure spanning Azure, on-premises, multicloud, and edge? • What pain points are you trying to solve? • What objectives and requirements do you have? • Do you have a clear (PoC) project scope? Start with Why
  3. Unified Operations domains Configure & automate Protect & secure Govern

    & organize Monitor & observe Policy guest configuration Resource tagging Resource Graph Azure Automation: Update Management, Change Tracking & Inventory, Hybrid Runbooks Custom scripts Azure Automanage Sentinel Defender Key Vault Managed Identity Azure RBAC Log Analytics Workbooks VM Insights
  4. • Minimum prerequisites • Provider registration, permissions, supported OS++ •

    Azure Arc landing zone accelerator for hybrid and multicloud • Extension of Azure Landing Zone • Seven ‘Critical Design Areas’ Architecture guidance Identity and access management Network topology and connectivity Resource organization Governance and security disciplines Management disciplines Cost governance Automation disciplines
  5. Landing zone example Workload subscription with RP registered* Resource Group

    * Microsoft.HybridCompute, Microsoft.GuestConfiguration Service Principal RBAC Role assignment Platform subscription Centralized automation account Centralized Log Analytics workspace Policy assignment(s)
  6. Options for onboarding VMware vSphere with PowerCLI SCCM/MECM with PSH

    or Task Sequence Ansible Playbook AD Group Policy Soon coming to the Portal Extend existing infra provisioning tooling (e.g., Terraform) Windows Admin Center
  7. • Limit the scope (blast radius) • Limit permissions (specific

    role) • Limit the secret lifetime SPN credentials is used only once for onboarding, CMA uses Managed Identity and HIMDS • Extra: Limit source IPs for onboarding • Conditional Access Policies for SPNs (Preview) • Allow onboarding from within ‘Trusted locations’ • Source: @SeifBassem, Blob post Onboarding SPN security hardening
  8. • Customize resource name for Arc server (e.g., due to

    reserved resource name error) > azcmagent connect … --resource-name XYZ • Validate network connectivity > azcmagent check --location <regionName> • Regional availability (e.g., Norway East is not available yet) https://azure.microsoft.com/en-us/global-infrastructure/services/?products=azure-arc&regions=all • Check agent status and other metadata > azcmagent show Onboarding tips & tricks
  9. Resource organization CDR • Scaffold for management scopes (ALZ) with

    policy-driven governance • Naming standards • No documented constraints • Unique server name per RG • Reserved names • Tag definition and enforcement • Policy for appending mandatory tags • Resource Manager limits • 5000 Arc-server instances per RG (no sub-level limit) • Same limit for extensions
  10. • Extend the onboarding script with Cloud Provider’s metadata Inventory

    and tagging Example code for getting Zone and Instance ID for a Windows VM on GCP: # Get GCP VM Instance data $GCPZone = Invoke-RestMethod -Headers @{'Metadata-Flavor' = 'Google'} -Uri "http://metadata.google.internal/computeMetadata/v1/instance/zone" $GCPInstanceId = Invoke-RestMethod -Headers @{'Metadata-Flavor' = 'Google'} -Uri "http://metadata.google.internal/computeMetadata/v1/instance/id" # Create Tags $tags = "Datacenter=GCP,CountryOrRegion=Germany,GCPZone=$GCPZone,GCPInstanceId=$GCPInstanceId“ ... # Run connect command & "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" connect --service-principal-id $env:appId --service-principal-secret $env:password --resource-group $env:resourceGroup --tenant-id $env:tenantId --location $env:location --subscription-id $env:subscriptionId --tags "$tags“ --correlation-id "d009f5dd-dba8-4ac7-bac9-b54ef3a6671a" Source: @thomasmaurer, blog post
  11. • wrapper for software installation & configuration / small apps

    providing post-deployment config and automation tasks • purpose: enable services on Arc machines • auto-update in Preview • only one extension per extension type can be installed/enabled per VM/Arc server • Check requirements for each service! Extension-based Management - MicrosoftMonitoringAgent - DependencyAgentWindows - CustomScriptExtension - IaaSAntimalware - WindowsAgent.AzureSecurityCenter - KeyVaultForWindows - WindowsAgent.SqlServer - AzureMonitorWindowsAgent - HybridWorkerForWindows - OmsAgentForLinux - DependencyAgentLinux - CustomScript - LinuxAgent.AzureSecurityCenter - KeyVaultForLinux - AzureMonitorLinuxAgent - HybridWorkerForLinux
  12. • MMA (Log Analytics, OMS) vs. AMA vs. Dependency Agent

    • MMA is used by Azure Monitor, Defender, Sentinel, Automation • Which one to pick? • Workspace: RBAC for log data • Agent deployment “at scale” • Workbooks and dashboards Monitoring agents
  13. • Azure Automation services • Update Management • Change Tracking

    and Inventory • Hybrid Runbooks • (State Configuration) • Custom script extension • Azure Automanage • Not all features are available for Connected Machines Configure and Automate Inventory Management Change Tracking Update Managemen
  14. • Managed Identity and HIMDS • Secret auto-rotation • Microsoft

    Defender for Cloud • Advisor recommendations • Azure Policy Guest configuration • Enforce security baseline for OS level • Microsoft Sentinel • Key Vault integration and cert management • Azure Backup Configure and Automate Guest Policies Sentinel Key Vault
  15. • Uninstall / disable all extensions first • Deregister using

    azcmagent • Uninstall CMA agent from the server • Cleanup in Azure: • resource group • SPN and role assignments • Note: collected telemetry doesn't get deleted Offboarding
  16. Azure Arc Jumpstart For meeting Azure Arc customers and partners

    where they are, we created the Azure Arc Jumpstart project that introduce a ”supermarket” experience by being able to take “off the shelf” automated scenarios and implement it. • Provide a “zero to hero” scenarios for multiple environments and deployment type using as much automation as possible. • Ready to go technical demos • Jumpstart ArcBox is a sandbox environment that allows users to explore all the major capabilities of Azure Arc in a click of a button. • Jumpstart Lighting is a show where people come to share their Azure Arc/Jumpstart/Hybrid experience. aka.ms/AzureArcJumpstart
  17. • Microsoft Learn – Manage Hybrid Infrastructure with Azure Arc

    • https://docs.microsoft.com/en-us/learn/paths/manage-hybrid-infrastructure- with-azure-arc/ • Azure Arc Jumpstart YouTube channel • https://www.youtube.com/channel/UCoIJw-P_9Jp6Jo_0Ca9avcA • Azure Arc Jumpstart project site • https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_servers/ • Microsoft Docs – Azure Arc-enabled servers • https://docs.microsoft.com/en-us/azure/azure-arc/servers/overview • Cloud Adoption Framework – Landing zone accelerator for Azure Arc • https://docs.microsoft.com/en-us/azure/cloud-adoption- framework/scenarios/hybrid/enterprise-scale-landing-zone Resources
  18. Slides and demos from the conference will be available at

    https://github.com/nordicinfrastructureconference/2022