(funky electronic music)
- Welcome to Microsoft Mechanics Live!
Coming up we look at, hey,
(audience cheering) thanks for coming.
Now coming up we look at the latest tools and updates
to get DevOps right the first time
by instrumenting Ops considerations
directly into your dev practices and tools
using Azure Governance.
We'll show you the latest in Azure policy
to help you audit, enforce and take action
to remediate out-of-policy resources.
How you can ensure, scale and set up new
governed environments in a repeatable way
using the new Azure Blueprint service,
and validate your infrastructure configuration
and your CICD workflows for vulnerabilities
and compliance violations before deployment
with native integration using Azure DevOps,
formerly known as VSTS.
So I'm pleased to be joined by Jeremy Winter.
Good to have you, sir. - Hey, man
- No stranger to Microsoft Mechanics.
- Yeah, no, it's great to be back.
Love it.
- Excellent, so a well known pain point with DevOps
is that while developers get agility with the cloud,
it's often been hard for IT to maintain
control over infrastructure costs, data compliance,
and things like operational requirements.
- Yep, yep, and that's right.
And so when you think about it in the on prem world
with the IT, you actually controlled
how the resources were determined
from, heck, you ordered the hardware
that came into the environment, and you also chose
how you allocated those resources.
But frankly, when you think about it,
the cloud gives our developers that limitless access
and we want that.
That's all goodness.
We want them to have that native
and limitless access.
It's all awesome when you think about the speed.
But you also need to put some guardrails in place here.
It helps keep both IT and the development
and yourself out of trouble from provisioning, say,
too expensive solutions out there, too expensive resources.
or even getting configurations potentially wrong
that then would jeopardize even some of that
sensitive data you have.
- Right, so what are we doing to help solve for that?
- Yeah, yeah.
So first, last year at Ignite, we really just
announced Azure policy.
And when you think about how Azure policy,
it's something we've been investing heavily in
for the course of the last year, and it really just
provides you this control mechanism in Azure,
that really helps you start to think about
the policies and controls
you wanna put in place.
But when I talk about that being native,
you also just want it to be able to be
right through the portal itself.
And so as your developers go use that portal,
it has those native controls as baked in.
So I'm gonna show you.
- Sounds good, let's take a look.
- Cool.
So on the screens here we've got
the Azure portal and I wanna just go
create something simple.
From the dev side I wanna go create a new VM.
So I'll just go choose Create, create a resource here.
And choose Windows Server 2016.
- That's a great start. - Yeah, that's a great start.
Great start. (chuckles)
And so as I come into that
create the virtual machine,
inside this virtual machine, now I can go
fill these core components out as a developer
or someone else inside the organization.
And I'm gonna go change the size.
So here's a (mumbles).
I'm gonna go pick this size.
Let's go pick an expensive one.
- [Matt] So you're saying that ds1
just isn't enough-- - Nah, it's not enough for me.
I'm gonna go see if I can get a d16 out here.
(overlapping dialogue) Yeah, there we go.
Big time. - Right.
- [Jeremy] So let's select this one.
- [Matt] This is a scenario that's
never happened before. - No, no.
- [Matt] I can tell by some of the--
- [Jeremy] Actually I think you pay for it, not me.
- Excellent! - So, let's just go for it.
Let's just goes somewhere else.
Someone else has the budget.
When I'm done with this I come through and just create.
Now I should be off and running.
I'm happy, I was just building a small marketing,
I was just trying something out in my dev environment.
But oh wait.
Now I have a notice.
I've got a validation failed.
So what's going on here?
Behind the scenes we have a policy.
And if I click the details
of what that validation was,
this was intentional.
We want them to come.
We want the folks that are being able to use this to see
that A, that policy that I tried to create
or that VM that I just tried to create
in a different region, I was only allowed to do it,
me, only allowed to do it in the European regions.
I sent the request that said
I wanted to go build that app
into the European site.
The second one is,
I'm only allowed A and B SKUs for my pre,
my development environments.
So our point on that is really just to make sure
whether you're doing it through ARM
as your resource manager and API, or the portal,
those policies are influenced right out of the gate.
You don't need any other layers.
It's just natively in there.
- Yup, and you've saved me
some money by not charging my card.
- Yeah, yeah. - Thank you.
- Absolutely. - And all this is great
for system level controls
but what about process-level controls?
Can we expand there?
- Yeah, yeah.
So, often times it's more than just the hardware, right?
How many of you are using tags?
Okay, you should be using more tags.
These things are really useful when you think about
just classifying how something is in your environment.
Your metadata can be used,
how it associates with an app.
And in this scenario
we can see how we use tags in the Create New.
And this just enforces me the same reason.
I can come in and say look, I have a cost center,
my cost center is one, two, three, four, five,
and that is also a policy that you can
put in place to enforce.
Now this is a free form tag.
But I could also enforce
that it had the right drop-downs inside it
so I could only choose cost centers exist.
This is good so you can ensure
and track those resources inside the environment.
We're seeing tags being used more and more.
And as we bring policy into the picture,
we're really seeing that start to be pervasive.
- And you could apply tags previously afterwards,
but this is now ahead of time.
- Yeah, this is ahead of time before it even
hits inside the environment.
- Great, so what does the Ops team need to do
to get started setting some of these guardrails
for their developers that they can use
in their environment? - Yeah, absolutely.
So, when you think about
from the Ops perspective, what do I have out
in that environment?
We've talked about the Create New but
how do I start to get a picture of those
existing behaviors out inside the rest of the environment?
And so this is where Azure Policy fits in.
You can come in and start to see within Azure Policy,
I'm able to create initiatives and policies
that I can then go look across the environment on.
And that key piece is really just so I can
define the policies but hold off before
I start to execute them.
So I look at here, example here is that
tags policy we just saw on my Create New
that I can enforce on the tags.
But also if later I wAnna say later come in
from a security perspective, and look at the express;
I wanna start to setup my express route subscriptions
as an example, I can look and start to look
across my entire environment and see which ones
aren't compliant or not.
And the key thing I'll pinpoint about this one
is if you look down at the effective type,
it's an audit.
It's not going to do anything.
It's just gonna audit the environment to help me
get a better pulse of what's going out there.
- [Matt] Right, so what about resources I've already got
in my environment?
Can we retroactively enforce policy?
- Yeah, that's a great, Matt, I like that.
So this is a new feature we just rolled out this week,
and let me go back into the policies
and show, let's say we wanna go,
I say I have all this environment out there,
and we like to call it the brownfield,
or the existing environment that's out there.
Here's an example I've been using that does log collections.
And so I can go out and create
an initiative that I wanna go collect logs.
I wanna make sure I've got my diagnostic logs,
whether it's against my SQL
or network security groups or my VMs.
But the key piece to this is,
we added this new element,
for those that have been watching,
with our overall policy, with that audit,
which is allowing me to see what's going on
in the environment.
We had deny, which is what you saw me
put in place for the portal,
and now we have deploy, if not exist.
Now basically what that is, it allows me to remediate.
So let's say I go choose these VM logs,
and I already have thousands of VMs inside the environment,
I can just create a remediation task.
This remediation task allows you to roll out policies
at your own discretion and at your own pace.
We did not give you the trigger
to just go blast it across everything.
You can go do that, but we wanted to let you choose.
And based off of the feedback as we we're
working with some of the customers
that we designed this with, I could choose my scope,
which is to the subscription or resource group.
I can also come down and choose the location.
And for some of those that were in my session earlier,
I talked about just, let's go hit the sent,
let's go, I've already deployed, remember this morning,
or this afternoon, I deployed against Canada,
and that is already fixed, because we fixed it there
and already rolled it out.
So it still holds true.
It's keeping that up.
So now I feel good about the Canada environment,
and now I'm gonna roll through Central US.
- Nice. - And so that allows us
to roll these things out over a period of time.
- Cool.
So the policy provides IT with the controls
around the resources that are created,
but how do we help IT to start to proactively define
and create compliant environment from the start?
Especially considering things like scale and consistency?
- Yeah, so this is one of those big asks that came out,
is setting up well-governed or enterprise environments
is just something we know takes time.
It's a challenge today because you're rolling out
subscriptions, but what about all my policies
that I may wanna apply, that I ensure upstream
to those development environments, or even if I'm migrating,
how do I bring those in?
And so this is a new announcement
that we've really brought out and you're seeing us push,
is Blueprints, Azure Blueprints.
And what Azure Blueprints is, is it's basically
a repeatable way, an easy way to go define
what's in an environment where I'm able to take
my Azure Resource templates,
I'm able to then put access controls and policy
and bring those all together in what's called a blueprint.
Again, this blueprint is a really easy way
for you to layer over the top of everything,
whether you're doing it for your new environments,
your existing, or even as you start to migrate into Azure.
And so this blueprint, we think,
is a really nice way that allows you to deploy
a repeatable set of configurations into the environment.
- And it sits on top of your ARM templates?
- Absolutely. - Your existing investments
you've made creating artifacts.
- It sits right on top of Azure Resource Manager
and is native, so anything that goes on
through that environment, or anything that goes
into the subscriptions, it's there.
No third-party solutions over the top,
it's native right inside Azure.
And what's really cool is it's free.
All these things I just showed you,
policy and blueprinting, available at no additional cost.
This is just what we wanna do to make sure
that you're secured and have those controls in place
for the guardrails, especially as you move
to this dev and IT and bringing those two worlds together.
- So you've built it up, now we have to see it.
Can you show us?
- Oh yeah, yeah, yeah I could do that.
So let's switch over to Blueprint.
So inside policy, or just do a search inside the portal
for Azure Blueprints.
We have a simple Overview page,
the format we've been doing with all
our services these days, and I can basically come in
and create these.
Just for speed's sakes, I'm gonna go apply.
I'm gonna go look at how this sits.
And so here are definitions that I've already created.
Example is the Contoso-Global-Blueprint.
Now remember I told you it's basically
a stack of these components that you can add,
and so here's an assigned subscription,
and this is exactly the scenario we just did.
This is the blueprint that's applied to my environment.
Allowed locations.
Which locations can I do it?
I want tags and how I can set up the policies for tags.
It allows me to lay down the resources
and the access groups that I want tied into this,
which is tied to your management groups.
Hits your Contoso Infrastructure,
my Central Log Analytics Workspace,
so all that information's coming into logs.
Everything from my network, clear down to that app team
that's gonna go deploy out into Europe.
I know that they always need Cosmos DB and Web App.
If I've spent time with as an architect
working with (stutters) the development team.
So we can even have it tailored
for each development team to lay down
these subscriptions over the top.
- So it's bringing together people,
it's bringing together groups and applications and services
and all of those cases. - Yeah, so it's simple.
Just assign it.
Remember, originally I'm like, gosh,
I really just want another subscription.
So I'm done with my development environment,
but I need a pre-prod development environment
over in Europe.
And so I can come in here and choose this blueprint
and which environment to apply it to.
So I've already applied it to the devtest.
So I'm gonna go ahead and hit it into my pre-prod.
So I, whether I'm a developer using this natively myself,
the business team where you can put self-delegation to this,
just use our blueprints as you create it up,
it's easy to be able to apply.
And then there's this notion I'll call a lock.
And when I choose Lock, it allows me to lock this thing down
so only the people that created it
and have access to it can make the edits
and changes to the subscription.
Or you could choose to just be a best practice approach
and allow it to not lock.
- [Matt] And you've also got the definition version there
so as you evolve and you create new instances
and new versions of this,
you can still roll back, go forward.
- So it's a simple assign.
Bam, it's already applied to the environment.
- Cool, excellent.
So we've covered a decent amount
of detail there about Blueprint.
How are we enforcing the guardrails without impacting
things like developer productivity
and the speed at which we want devs to operate?
- Yeah, yeah, so this is key.
So for the DevOps side, with DevOps in mind,
what we really wanted to do was go include
policy and blueprinting and just shift that upstream
into the development pipelines.
And so that's part of the reason we natively baked this
into Azure and through.
And so within Azure, DevOps itself,
which was formerly VSTS,
we went and did the work to go plum policy
right inside Azure DevOps.
And so now, as I'm a developer,
and you're working with your development teams,
I can rest assured that I'm running in the guardrails
that IT set up, or I can go author and create
my own blueprints inside so that my team
sits within those policies.
And so here inside VSTS, I have that up in Azure DevOps.
I have releases.
And inside of those releases, I have a pipeline of releases
that are coming down the path.
And what you wanna do on that is be able to set up
so your developers can automatically go deploy
into Azure directly, and we have those connections in.
And so here's Release 4.
But Release 4 shows that it has a fail,
a failure on that deployment.
And if I drill in, natively in, it'll show you okay,
first, I made some changes as a developer.
I'm right in here.
The automatic trigger kicked it out to go get that out
into Azure, but then I had a failure
that happened because of the policy
and so I can see which policy, link over to policy,
and we even give you down to the level of code
so you can take as a developer right into the code
and go look at the changes that you made.
And so here, for example, as I was moving
from that dev environment to a pre-production environment,
remote debugging I had set to true.
And the policy I had set was false
because I wanna make sure when you come out
into my pre-production or production environments,
that setting is not there for a safety reason.
So the point I'm trying to show you at this level
is you're able to get right down to the specific settings
that you're gonna bring.
And in the course of the next few months,
we're gonna get you able to do it into the guest as well
so you can start to have your own custom configurations
right down into the guest,
not only just the Azure resource.
- Awesome. - So that's how it fits
when you think about it between the developers and IT.
- Yup, awesome!
Fantastic updates.
Thanks for joining us today.
- Eh, I love it! - Yeah!
(audience cheering) There we go, thank you.
Good stuff.
Now where do people go to learn more?
- Look, I think the fastest thing I'd say to go learn more
is just go try it.
It's already in the portal.
It's out there, just go in.
Policies and Blueprints are free, they're included.
Just go into the portal, sign up
and start using the pieces.
- Yeah, nice, short URL to remember there as well.
And of course, stay tuned to Microsoft Mechanics
for the latest in tech updates.
Subscribe on Twitter, and thanks for watching.
Bye for now. - Hey, thanks, everybody.
(audience cheering)
(funky music)
For more infomation >> Does ZMA Work? Or Is It Bogus? My 60 Day Experiment Results - Duration: 9:27. 
For more infomation >> You're Doing It Wrong: This Is How To Fold T-Shirts (so you can "file" them in your drawers) - Duration: 1:37. 
For more infomation >> Quantitative Easing - The End of the Big Easy - Did it Work? - Duration: 14:28. 
For more infomation >> Taiwan's got a new cruise missile, and it's got mainland China's coastal strongholds in its sights - Duration: 3:36. 
Không có nhận xét nào:
Đăng nhận xét