Hybide Architektur, Container, K8s, Multi-Cloud

1. Azure Multi-Cloud und
Hybrid
BAMF
Thomas Treml
CTO Government
Microsoft Deutschland GmbH
17.2.2022

3. Vielfältige Infrastruktur
IoT Geräte Edge
Datacenter
Lokationen
Hoster
OEM
Hardware
100 - 1.000 Anwendungen
VMs
Container
Datenbanken
Serverless
Ihre Umgebungen werden immer komplexer
Multi-Cloud

5. Multi-Cloud On-premises Edge

6. Multi-Cloud On-premises Edge

7. Multi-Cloud On-premises Edge

8. Multi-Cloud On-premises Edge

9. Multi-
Cloud On-premises Edge
Souveräne
Cloud

10. Multi-Cloud On-premises Edge

11. 1
1

12. Principal propagation in a multi-cloud solution between
Microsoft Azure and SAP Business Technology Platform (BTP),
Part I: Building the foundation | SAP Blogs

13. Konsistenter Betrieb,
Governance und Sicherheit

14. Innovation anywhere with Azure

15. Hybrid: Azure Stack HCI
Plattform-Architektur

16. Modernisieren von Rechenzentren mit Azure Stack
Azure Stack HCI
Skalierbare Virtualisierung und
Speicher
Remote/Zweigstelle
Hohe Workloads
Integration mit Azure Arc
AKS in Azure Stack HCI
Azure Stack Edge
Computing, KI & IoT
am Edge
Azure Stack Hub
Getrennte
Szenarien

17. Innovation anywhere with Azure

18. Für Infrastruktur und Services...
Azure Arc
Azure Arc-fähige Infrastruktur
Hybride Ressourcen verbinden und
als native Azure-Ressourcen betreiben
Azure Arc-fähige Dienste
Bereitstellen und Ausführen von Azure-
Diensten außerhalb von Azure
Multi-cloud Datacenter Edge

19. Azure Arc-fähige Server SQL Server auf Arc-fähig
Diener
Azure Arc-fähige Kubernetes
AWS Linux 2
AKS on Azure
Stack HCI
OpenShift

20. Azure Portal Azure REST API
Azure CLI PowerShell
User Interface Azure AD (RBAC)
Azure Monitor
Azure ARM Templates
Azure Log Analytics
Azure Tags
Azure Defender
Azure Resource Graph
Azure Sentinel
Azure Audit
Azure Key Vault
Azure Automation
Azure Automanage
Azure Policy
Azure Security Center
Resource Inventory Billing Monitoring & Logs Secrets Management Governance Compliance & Security
VMware vSphere
WS & Linux
VMware vSphere VMs
SQL Servers
VMware vSphere VMs
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Amazon Web Services
WS & Linux
EC2 Instances
SQL Servers
EC2 Instances
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Google Cloud Platform
WS & Linux
Instances
SQL Servers
Instances
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Azure Arc-fähige Server und Azure Arc-fähige SQL-Server
Sicherheitsmanagement mit ASC, Defender und Sentinel
Azure
WS & Linux
Azure VMs
SQL Servers
Azure VMs
Native Azure
Azure Monitor Agent
Azure Stack HCI
WS & Linux
Azure Stack HCI VMs
SQL Servers
Azure Stack HCI VMs
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Azure Security Management & Operations
Azure Security Center
Azure Defender Azure Sentinel
Azure Monitor Agent Azure Monitor Agent Azure Monitor Agent Azure Monitor Agent
Secrets Change Tracking Automanage
Monitoring & Logs Extensibility Patching & Updates
Threat Protection
Azure Arc Integration

21. Konfigurieren
Verbinden
Steuern und
Sichern
Betreiben und
Beobachten
AKS OpenShift
kubeadm GKE
EKS VMware Tanzu

22. Ausführen von Containern
App Service
Environment
Service Fabric
Azure
Container Instance
Azure
Kubernetes Service Azure Batch
IoT Edge
Azure
Functions
Azure Red Hat
OpenShift
Azure
Spring Cloud
Azure
Container Apps
VM (IaaS)
Azure Arc-enabled
Kubernetes
Azure Kubernetes
Service on Stack HCI
Kontrolle Einfachheit

23. Fragen & Antworten
Thomas Treml
CTO Government
Microsoft Deutschland GmbH
Niederlassung Berlin
Unter den Linden 17, 10117 Berlin
Thomas.Treml@microsoft.com

24. Einführung in Hybrid- und Multicloudlösungen - Cloud Adoption
Framework | Microsoft Docs
Dokumentation zu Hybrid- und Multicloudlösungen von Azure |
Microsoft Docs
Worum handelt es sich bei der BareMetal-Infrastruktur in Azure? -
Azure Baremetal Infrastructure | Microsoft Docs
Microsoft launches landing zone accelerator for Azure Arc-enabled
servers | Azure Blog and Updates | Microsoft Azure

25. Deploy the Azure Stack HCI operating system - Azure Stack HCI |
Microsoft Docs
Principal propagation in a multi-cloud solution between Microsoft
Azure and SAP Business Technology Platform (BTP), Part I: Building
the foundation | SAP Blogs
Overview | Azure Arc Jumpstart

26. Cloud-Plattform von SAP und Arvato für die Verwaltung | SAP News Center

27. Microsoft Customer Story-Siemens Healthineers delivers services to
customers’ on-premises machines with Azure Arc

28. "SKF are proud to be at the forefront of the
hybrid cloud revolution. Azure Hybrid Cloud
Solutions enable us to maximize our
efficiency, grow our digital platform for world
class manufacturing and empower the SKF
Factories of the Future to innovate
towards data driven manufacturing."
"Azure Stack HCI, together with Azure
Kubernetes Service, Azure Arc-enabled Data
Services, and Azure SQL Edge for IoT create
SKF a scalable platform across on-premises,
cloud and edge – all with single-pane-of-glass
while driving costs down.”
Sven Vollbehr
Head of Digital Manufacturing, SKF Group

29. Connected Machine Agent
Azure Arc Connected Server (On-Premises, AWS EC2, etc.)
Azure Arc Connected Machine Agent
Hybrid Instance Metadata Service (HIMDS)
Handles managed identity and communication with Azure AD
Guest Configuration
Provides In-Guest Policy and Guest Configuration functionality, such
as assessing whether the machine complies with required policies
Extension Manager
Manages VM extensions, including install, uninstall, and upgrade
Log Analytics
(MMAExtension)
Custom Script
Extension
Parameters passed to the Agent:
• Subscription ID
• Location
• Resource Group
• Proxy (optional)
• Azure Service Principal
Azure AD
Log Analytics Workspace
HTTPS/443
HTTPS/443
Azure Resource Manager (ARM)
Hybrid Compute
Resource Provider
Azure Portal
Az CLI
Azure SDK
REST API
Azure Admin
Authentication &
Authorization
Guest Config
Resource Provider
HTTPS/443

30. Windows OS
On-premises/other clouds
Azure AD
Hybrid Identity Service
Azure Resource
Manager
(ARM)
Log Analytics Workspace
Hybrid Instance
Metadata Service
System
Administrator
Azure Automation Azure Monitoring
Azure Security
Center
Azure Sentinel
Hybrid Compute
Resource Provider
Extension Manager
Log Analytics Agent
Custom Script
DSC
Microsoft Dependency Agent
%SystemDrive%AzureConnectedMachineAgentExtensionServicedownloads
%SystemDrive%PackagesPlugins<extension>>
Guest Configuration
%SystemDrive%Program FilesArcConnectedMachineAgentExtensionServiceGC
%ProgramData%GuestConfig
Azure Arc Connected Machine Agent
%ProgramFiles%AzureConnectedMachineAgent
%ProgramData%AzureConnectedMachineAgent
%ProgramData%AzureConnectedMachineAgentTokens
%ProgramData%AzureConnectedMachineAgentConfig
Guest Configuration
Resource Provider
HTTPS/443

31. Azure AD
Linux OS
On-premises/other clouds
Hybrid Identity Service
Azure Resource
Manager
(ARM)
Log Analytics Workspace
Hybrid Instance
Metadata Service
Azure Automation Azure Monitoring
Azure Security
Center
Azure Sentinel
HTTPS/443
Hybrid Compute
Resource Provider
Extension Manager
Log Analytics Agent
Custom Script
DSC
Microsoft Dependency Agent
/opt/GC_Ext/downloads
/var/lib/waagent/<extension>
Guest Configuration
/var/lib/GuestConfig
Azure Arc Connected Machine Agent
/var/opt/azcmagent/
/var/opt/azcmagent/tokens
Guest Configuration
Resource Provider
System
Administrator

32. Run VMware natively on Azure and gain a
seamless connection to other Azure services
VNet.
On Premises Datacenter Azure Private Cloud Infra
Azure Services (e.g.)
HCX
vSAN
Compute
vCenter
VMware Cloud Foundation
VMware Technology Stack
VM VM VM
Storage Network
VMware vCenter
ESXi Hosts
VNet.
Azure
Backbone
Network.
Azure Portal and Azure Resource Manager
Azure Active
Directory
Azure SQL
Database
Azure Security
Azure Monitor
Azure Lab
Services
Artificial
Intelligence
NSX-T vSphere
Express
Route

33. App, data &
ML services
Security &
Governance
Dev tools &
practices
Azure
Azure Arc

34. Use industry-leading threat intelligence to gain deep insights into your cloud workloads
Protect data services, cloud native
services, servers, and IoT from threats
Extend protection to on-premises and
multi-cloud for virtual machines and SQL
databases using Azure Arc
With prioritized alerts, focus on what
matters the most
Azure Defender
Containers
Server
VMs
SQL
Industrial
IoT
Azure app
services
Network
traffic

35. Visualize and investigate the attack chain with cloud-native SIEM
SIEM | Azure Sentinel Collect security data at cloud scale and
integrate with your existing tools
Leverage AI to detect emergent threats
and reduce alert fatigue by 90 percent
Respond rapidly with built-in
orchestration and automation
Investigate
Detect
Respond
Collect
Multi-cloud Third-party User environment Hybrid

36. Accelerate deployment
with Reference
Architectures
Optimize workloads
with Azure
Well-Architected
Apply best
practices to
rapidly onboard
Review technical
documentation on
featured products
Build skills across
your team with
Microsoft Learn
Start with the cloud adoption framework to guide your cloud journey
and build on it using the hybrid adoption scenario guidance
https://aka.ms/adopt/hybrid
Cloud Adoption Framework
Guide your cloud journey across
people, process and technology
Complete guidance for hybrid and multicloud approach
Govern Manage
Ready
Adopt
Define
Strategy

37. Azure Arc-enabled servers
GENERALLY AVAILABLE
SQL Server on Arc-enabled
servers
GENERALLY AVAILABLE
GENERALLY AVAILABLE
Azure Arc-enabled Kubernetes
OpenShift
AKS on Azure
Stack HCI
GENERALLY AVAILABLE
AWS Linux 2

38. Fast, most flexible hybrid connectivity and app delivery
MPLS
Azure ExpressRoute
Global reach
Azure virtual WAN
Azure Front Door
Branch
office
Branch
office
Datacenter Datacenter
Branch
office
Branch
office
VNET VNET

39. Co2 Fussabruck als Entscheidungskriterium die Plazierung der
Nodes/Container

40. Azure Portal Azure REST API
Azure CLI PowerShell
User Interface Azure AD (RBAC)
Azure Monitor
Azure ARM Templates
Azure Log Analytics
Azure Tags
Azure Defender
Azure Resource Graph
Azure Sentinel
Azure Audit
Azure Key Vault
Azure Automation
Azure Automanage
Azure Policy
Azure Security Center
Resource Inventory Billing Monitoring & Logs Secrets Management Governance Compliance & Security
VMware vSphere
WS & Linux
VMware vSphere VMs
SQL Servers
VMware vSphere VMs
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Amazon Web Services
WS & Linux
EC2 Instances
SQL Servers
EC2 Instances
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Google Cloud Platform
WS & Linux
Instances
SQL Servers
Instances
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Azure Arc-enabled servers & Azure Arc-enabled SQL server
On-premises and multi-cloud compliance with Azure Policy
Azure Stack HCI
WS & Linux
Azure Stack HCI VMs
SQL Servers
Azure Stack HCI VMs
Azure Arc Connected Machine Agent
Azure Arc-enabled
servers
Azure Arc-enabled
SQL servers
Azure
WS & Linux
Azure VMs
SQL Servers
Azure VMs
FedRAMP High Regulatory
Compliance built-in initiative
Federal Risk and Authorization Management
Program (FedRAMP) Azure Policy
UK OFFICIAL and UK NHS
Regulatory Compliance
built-in initiative
UK OFFICIAL and UK NHS
Azure Policy
Canada Federal PBMM
Regulatory Compliance
built-in initiative
Canada Federal PBMM
Azure Policy
HIPAA HITRUST 9.2 Regulatory
Compliance built-in initiative
Healthcare
Azure Policy
Native Azure
Secrets Change Tracking Automanage
Monitoring & Logs Extensibility Patching & Updates
Threat Protection
Azure Arc Integration

41. Azure Arc-enabled Kubernetes
Cluster Connect
Kubernetes Cluster
Microsoft.Kubernetes
Resource Provider (RP)
listClusterUserCredentials
Client-side proxy
Dataplane Service
Hybrid Connections
Azure Resource Manager (ARM)
Azure AD Entity
(User Account/Service Principal)
az connectedk8s proxy Cluster
connect-
agent
API
Server
Customer
Firewall
heartbeat
Customer Location
(On-Premises/Cloud Provider)
kube-aad-
proxy