© Microsoft Corporation · Integrate security with container applications Provide full-stack...

42

Transcript of © Microsoft Corporation · Integrate security with container applications Provide full-stack...

Page 1: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and
Page 2: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

© Microsoft Corporation

Business needs

Widening divide between business and IT

IT challenges

Rapid innovation to transform products

Close the gap from data to decision

Connect with customers

and empower employees

72% of IT budgets are dedicated towards

maintenance (‘keeping the lights on’).

Only half of all decision makers got help

from technologists with their analysis needs

Demand for mobile apps

>5x the capacity of IT

Page 3: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

© Microsoft Corporation

Are your systems readyfor these challenges?

Page 4: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

© Microsoft Corporation

Reasons to modernize

• Aging infrastructure

• Low efficiency and reliability.

• High operational costs and capital expenditure.

• Growing security, audit, and compliance requirements.

• Inflexible and unable to keep up with business growth.

• Stagnant architecture

• Legacy stack and code.

• Long deployment times and release cycles.

• Incompatibilities with modern software systems.

• It’s hard or impossible to add new functionality.

• Innovation is happening outside IT, unmanaged.

Why modernize?

Modernization benefits

• Turn CapEx into OpEx

• Increased operational efficiency

• Get out of the data center business.

• Meet security and compliance requirements.

• Reduce time and budget spent on infrastructure management.

• Rapid innovation

• Ship new capabilities faster.

• Achieve scalability with confidence.

• Better collaboration across business, Ops, IT and dev teams.

Page 5: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

The benefits of using containers

Agility

Ship apps

faster

Portability

Easily move

workloads

Rapid scale

Scale easily

to meet

demand

Density

Achieve

resource

efficiency

Page 6: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

App

Container

App

From traditional systems to portfolio of modern apps

Existing/New

Applications

Containerize

Applications

Each host often runs

8 containers

at a time1

Microservices

Seconds to

deploy, churns

12x faster1

Continuous innovation with DevOps

46x more frequent for code delivery2

Source:

1: Datadog Report: 8 Surprising Facts About Real Docker Adoption; 2: 2017 state of DevOps Report

Page 7: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Finding a solution to support service delivery locally, on-premises, and in the cloud. Fixing shopping cart API flaw to maintain zero-downtime policy.

Helping you achieve more

Page 8: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Containers momentum

75%

The average size of a container deployment has grown 75% in one year. 1

1: Datadog report: 8 Surprising Facts About Real Docker Adoption

2: CNCF survey: cloud-native-technologies-scaling-production-applications

Nearly 50% of organizations1

running 1000 or more hosts

have adopted containers.

Larger companiesare leading theadoption.1

50%

Half of container environments are orchestrated.1

77%77% of companies2 who use

containers orchestrators choose

Kubernetes.

“By 2020, more than 50% of enterprises

will run mission-critical, containerized

cloud-native applications in production,

up from less than 5% today.”

Page 9: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Containers

• Virtualize the hardware

• VMs as units of scaling

• Virtualize the operating system

• Applications as units of scaling

Virtual machines

What is a container?

App

Container

App

Page 10: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

On-premises

Cloud

Anywhere

Monolith

Microservice

Any app

.Net

Java

Python

Node

Any language

Linux

Windows

Any OS

The benefits of using containers

Page 11: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

The container advantage

Hardware

Host OS

Hypervisor 2

VM VM

Application ApplicationCon. Con.

Traditional virtualized environment

Con. Con.

Low utilization of container resources

Containerization of applications and

their dependencies for portability

From dev to production agility across

development and operations teams

Page 12: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

The container advantage

Hardware

Host OS

Docker Engine

VMVM

Con.

Con.

Con.

Con.

Containerized environment

Migrate containers and their

dependencies to underutilized VMs

for improved density and isolation

Decommission unused resources for

efficiency gains and cost savings

Container is lighter weight and

faster to scale dynamically

Page 13: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

What is ?An open source container runtime

Mac, Windows and Linux support

$ cat Dockerfile

$ docker build –t hello-world .

$ docker run hello-world

Page 14: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

The elements of orchestration

Scheduling Affinity/anti-

affinity

Health

monitoring

Failover

Scaling Networking Service

discovery

Coordinated

app upgrades

Page 15: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Deploy your

applications quickly

and predictably

Scale your

applications on

the fly

Roll out

new features

seamlessly

Limit hardware

usage to required

resources only

Portable

Public, private, hybrid,

multi-cloud

Extensible

Modular, pluggable,

hookable, composable

Self-healing

Auto-placement, auto-restart,

auto-replication, auto-scaling

Kubernetes: empowering you to do more

Page 16: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Containers on Azure

Accelerate

containerized

application

development

Deploy containerized

applications in your

preferred

environment

Manage, monitor,

and help secure your

containers

Flexibility Productivity Trust

Page 17: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

If you have a preferred container platform

Pivotal Cloud Foundry Kubernetes Docker Enterprise Edition

Red Hat OpenShift Mesosphere DC/OS

You could bring that platform to Azure

Flexibility Productivity Trust

Page 18: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

If you are without a preferred container platform…

Let’s profile your needs and help you select the right

option

Flexibility Productivity Trust

Page 19: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

© Microsoft Corporation

Choose the platform that meet your container needs

Deploy web apps or APIs using Linux containers (Windows in Preview) in a PaaS

environmentAzure App Service

Scale and orchestrate Linux containers using Kubernetes

Azure Kubernetes Service (AKS)

Lift, shift and modernize .NET applications to microservices using Windows Server

containers

Azure Service Fabric

Flexibility Productivity Trust

Page 20: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Flexibility Productivity Trust

Page 21: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Database IoT Security

AnalyticsStorage Intelligence

Integration Cache OSS services

Flexibility Productivity Trust

Container platform of your choice

Azure

Page 22: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Integrate security with

container applications

Provide full-stack security for your

containers including vulnerability

scanning, run-time protection,

and compliance. Add single sign-

on with Azure Active Directory.

Gain visibility into

your containers

Get a full view of your container

deployment. View centralized CPU,

memory, storage, and network and

performance information with

tools like Application Insights

and Log Analytics.

Efficiently manage

container images

Manage a Docker private registry

as a first-class Azure resource

with Container Registry. Manage

container images with familiar,

open-source Docker command-

line interface (CLI) tools.

Flexibility Productivity Trust

Page 23: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Azure Container Registry (ACR)

Azure Kubernetes Service (AKS)Simplify the deployment, management, and operations of Kubernetes

Service Fabric

App Service

Azure Batch

Deploy and

manage Kubernetes

with ease

Scale and run

applications with

confidence

Secure your

Kubernetes

environment

Accelerate

containerized application

development

Work how you want

with open-source

tools & APIs

Set up

CI/CD in a

few clicks

Page 24: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Master Node(s) – self managed

API Server

Scheduler

etcd store

Controller Mgr

Cloud Controller

How Managed Kubernetes on Azure works

Azure managed control plane

Page 25: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

innovation

Responsibilities DIY with Kubernetes Managed Kubernetes on Azure

Containerization

Application iteration,

debugging

CI/CD

Cluster hosting

Cluster upgrade

Patching

Scaling

Monitoring and logging

Customer

Microsoft

Managed Kubernetes

empowers you to do more

Focus on your containers

and code, not the plumbing

of them.

Page 26: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Siemens Health leverages technology to connect medical devices to the cloud through AKS

Challenge: Siemens needed to speed up their development process to make the

transition from value-added services provider to platform provider.

Solution: Siemens adopted Azure Kubernetes Service (AKS) to speed up application

development and run their microservices-based apps.

Outcome: With AKS, Siemens has driven newfound product development agility. AKS

enables them to use an applicant gateway and API management to manage

exposure, control, and to meter the access continuously.

The managed Azure Kubernetes Service puts us really into a position to not

only deploy our business logic in Docker containers, including the

orchestration, but it’s also really easy through application gateway and API

management to manage that exposure and control and meter the access

continuously.

Thomas Gossler, Lead Architect - Digital Ecosystem Platform, Siemens

Page 27: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Fully managed platform

Automatic scalingand load balancing

High availabilityw/ auto-patching

Backup &recovery

Accelerated outer loop

Intelligent diagnostics & troubleshooting, remote debugging

Built-in CI/CD w/Deployment Slots

Tight integration w/ Docker Hub, Azure Container Registry

Flexibility & choices

Single Docker image, multi container w/ Docker Compose

IntelliJ, , Jenkin, Maven Visual Studio family

From CLI, portal, orARM template

App ServiceEasily deploy and run container-based web apps at scale

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Azure Container Registry (ACR)

Service Fabric

App Service

Azure Batch

Page 28: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Japanese financial technology company speeds app development, expands market using cloud platform

We created the system on Azure with technical support from Microsoft. Because

we could transfer Ruby on Rails in its existing state, using Docker containers, we

encountered no technical problems.

Haley Koike, Development Manager, Crowd Cast

Challenge: Crowd Cast experienced growing demands for Staple, their cloud-based

expense management service, and wanted to increase its development speed

and agility to meet demand from enterprise customers.

Solution: The company switched its platform as a service (PaaS) environment from

Heroku and Amazon Web Services to Microsoft Azure, transferring its Ruby

on Rails development environment using Docker containers and App Service.

Outcome: With App Service on Linux, Crowd Cast developers can take advantage of the

agility and scalability of the microservices approach, building their app as a

small set of services, while reducing the complexity of managing

microservices deployments.

Page 29: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Increase agility

with containers on

demand

Secure applications

with hypervisor

isolation

Run containers

without managing

servers

Azure Container Instances (ACI)Easily run containers on Azure without managing servers

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Azure Container Registry (ACR)

Service Fabric

App Service

Azure Batch

Page 30: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Rapidly growing software company attracts customers with seamless cloud demo experience

We are far more responsive to customer needs since adding Azure Container Instances. Our Marketplace demos are powerful marketing tools for Jedox, and we’ve used Azure to improve the customer experience significantly.

Vladislav Malicevic , Vice President Development and Support, Jedox

Challenge: Jedox needed a more lightweight compute unit than virtual machines to

power its website demos and provide a good customer experience.

Solution: The company used Microsoft Azure Container Instances to support the Jedox

Marketplace and power its demos.

Outcome: With ACI, Jedox is able to spin up customer demos on demand, improve

provisioning speed, build confidence in the cloud, and lower IT costs.

Page 31: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Build Deploy Operate

always-on, highly scalable microservice apps

</>

.NET

</>

Flexible

infrastructure

Lifecycle

management

24/7 availability

& performance

Elastic

scalability

Microservice

and container

orchestration

Security &

compliance

Health &

monitoring

Azure Service FabricA microservices platform for business critical applications

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Azure Container Registry (ACR)

Service Fabric

App Service

Azure Batch

Page 32: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Next Games powers its global augmented reality game in Microsoft Azure

In addition to all the new services, Microsoft is constantly improving existing

Azure services … This continual improvement enhances our games and makes

our lives easier.

Kalle Hiitola, Chief Technology Officer and Cofounder, Next Games

Challenge: Next Games required a lot of back-end processing power—processing power

that was sited close to players, wherever they wanted to play in the world.

The company also needed database and compute services that could handle

massive amounts of geo-distributed data.

Solution: Next Games adopted a microservices-based development and hosting

environment that relies on Azure Service Fabric, Azure Functions, and Azure

Cosmos DB to provide very fast, very low-overhead support of geo-

distributed data services.

Outcome: Azure Service Fabric handles the passage of messages between players, and

Azure Cosmos DB provides a geo-distributed database that locates player

data geographically close to the player and coordinates player matchups.

Page 33: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Enable applications and algorithms to

easily and efficiently run in parallel at scale.

Run Batch tasks without having to manage an

environment and dependencies.

Package, execute, and scale your High

Performance Computing applications and

batch workloads in a consistent, reproducible

manner.

Azure BatchRun repetitive compute jobs using containers

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Azure Container Registry (ACR)

Service Fabric

App Service

Azure Batch

Page 34: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Use familiar, open-

source Docker CLI tools

Azure Container Registry

geo-replication

Manage images for all

types of containers

Azure Container Registry (ACR)Manage a Docker private registry as a first-class Azure resource

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Azure Container Registry (ACR)

Service Fabric

App Service

Azure Batch

Page 35: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and
Page 36: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and
Page 37: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and
Page 38: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

apiVersion: apps/v1beta1

kind: Deployment

metadata:

name: my-api

spec:

replicas: 1

template:

metadata:

labels:

app: my-api

spec:

containers:

- name: my-api

image: hock2k5/wkhtmltopdf-netcore:latest

ports:

- containerPort: 80

---

apiVersion: v1

kind: Service

metadata:

name: my-api

spec:

type: LoadBalancer

ports:

- port: 80

selector:

app: my-api

Page 39: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

aks browse --resource-group aks --name ahock-cluster

kubectl get service my-api

kubectl get nodes

kubectl get pods

kubectl scale deployment/my-api --replicas=4

Page 40: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and

Get started today!

Sign up

for Azure / Login

to the PoralCheck out

resources

Spin up an

AKS cluster

Page 42: © Microsoft Corporation · Integrate security with container applications Provide full-stack security for your containers including vulnerability scanning, run-time protection, and