►
Description
Jurgen Allewijn and Dinant Paardenkooper tell how they have overcome the challenges in setting up Azure Kubernetes Service in such a way that it is secure, multi-tenant and compliant with the local government regulations. The goal is to empower the workload teams with the latest technology and the DevOps way of working. On the Cloud Journey, the teams concluded that it isn’t just enabling “AKS”. It also requires a lot of management and Kubernetes knowledge, which is currently not present by most of the teams. The decision was made to create a Shared-AKS (DTAP) offering for all the teams within the City of Amsterdam, which led to cost savings and central management. To achieve this goal, the choice of multi-tenancy was born. New challenges arose concerning the security and compliance. One of the biggest challenges was segmentation of applications, which is by default not in nature of Kubernetes.
A
B
C
B
If,
yes,
Let's
First
start
with
the
organization
eh
bed
of
background
of
the
City
of
Amsterdam,
so
ja,
eh,
Bit
of
Who
We,
Are,
eh
City
of
Amsterdam
is
a
eh
has
18.000
and
prehease.
We
have
eh
of
crust
eh
de
citycounsel,
eh
de
political
part,
2
of
800
servants
working
for
eh
de
City
of
Amsterdam
We
are
separated
in
Four
clusters
with
42
Direction
eh
management
teams
and
eh
One
Of
The
teams
of
the
clusters.
B
Is
it
and
that's
about
1600
People
would
It's
quite
in
the
organism:
big
organization
en
dat,
surifa
Everybody,
heste
ID.
When
you
talking
about
the
City
Local
coffeement
So,
Quiet,
Big,
ehm
ja,
We,
Started,
With,
The,
New,
It's,
strategy
of
Amsterdam
Because.
You
want
to
move
to
the
next
Face
And
We
aske,
the
userial
suspects
like
card
near
to
talk
to
Talents
what
we
want
to
do,
Turnhout
the
same
as
We
were
already
planning.
But
yes,
even
carters
dit
is
okay,
ehm,
zou,
eh,
wie
de
site
It.
B
We
want
to
go
Clark
native
and
we
decided
to
that.
We
want
to
have
multicloud
strategy
But.
First,
the
art
with
One
So,
we
Focus
Now
on
Archer
eh
as
the
Our
first.
We
also
have
strategy
Here
of
zals
eh
Before
pass
Before
ias,
so
all
the
eh
Escher
components
her
Main
lipas
and
some
to
iase
small
part
ehm.
Yes,
eh
we
Us
Only
general
failable
features
and
the
Sorry
important
for
later
in
the
stor
y
eh
en
eh.
We
do
everything
as
in
frescout
ehm.
Yes,
how
is
it
already
like
eh
architect?
B
Who
stands
there
on
some
Cloud
principals,
ehm
thee.
Also
special
Our
Cloud
strategy,
Ja
die
zalalist,
Here,
I
think
the
most
of
them
eh
arrestnizable
Like,
You,
Bill,
With,
Your,
Own,
It,
start
small
ehm,
Automat,
Everything,
eh,
betales
security
and
service
management,
compliance
by
design,
so
de
eh
Old,
House
things
shoopy
part
of
eh
All
I
was
Solutions
and
of
Cards
wear
of
so
have
to
comply
to
sephal.
B
Complian
standards
like
the
bio
Which
is
the
coverment
eh
compliance,
Standard,
eh
and
pet
al
would
We
Are
using
The
security
control
framework
of
Microsoft
and
the
modern
servers
management,
eh
control
framework,
as
if
already
Microsoft,
and
we
have
the
PH
watch
about
privacy
and
the
coverman
Stenders
flight
Nora
would
be
Lot
of
compliancies
standard
Witcher.
We
have
to
take
in
account
because
we
Deploy
Something.
C
Different
Kind
of
iks
environments,
Without,
Any,
Maintenance
and
Trouble.
Basically
so
I
want
to
take
a
that
into
account
With
You
So.
Looking
to
the
work
clothes,
we
see
a
lot
of
People
that
want
to
Embrace,
basically
The
Elements
in
the
features
of
ATS
eh,
but
also
odotechnologies
in
Azure,
like
the
data
Platform
in
the
Day
bricks
and
That's
A
Long,
but
That's
for
Another
use
case,
but
most
of
them
They
were
experimenting
with
containers.
So.
You
want
to
Embrace
Them
that
they
are
doing
SO.
C
C
In
Place,
but
most
of
them
with
trying
to
Achieve
and
setting
Osso
finops
That's
One
Of,
The,
Elements,
That
We
are
doing
Old
so
and
we
are
trying
to
centralize,
basically
all
those
aks
clusters
to
have
not
Cost
Running
everywhere.
But
you
little
bit
sensorized
and
if
you
have
some
centralized
Platform
UEFA
possibility,
also
to
take
in
to
account
The
compliance
en
eh
de
ultimation,
bij
het
self.
C
Ehm
denne
technical
site,
we
Had
A
Little
demonstration
of
one
of
our
speakers:
Yesterday
eh,
Christina,
Thanks
Thank.
You
forget
ehm,
we're
going
to
Dive
Little
Bit
Deeper,
but
most
of
them
It's
OBS,
of
course,
cubernetys
of
itself
the
Were
a
lot
of
functionalities
in
technical
preview,
1.5
euro.
So
we
face
to
Lot
of
issues
like
we
can
not
solve
It.
So
for
that
we
had
stod,
do
some
tricks
and
Elements,
so
That
We,
Will,
Take,
eh,
firday,
Hour,
Presentation.
B
B
D
B
E
B
B
We,
you
also
BBN
to
compliance
That's,
something
about
the
security
of
data
Witches
eh
used
in
the
cluster
eh
like
personal
eh,
eh
tracible
data
ehm,
so
eh
weird
to
take
that
in
eh
how
to
sign
account
Our
current
hubspout
model,
where
the
solution
shoot
land
and
eh.
We
want
Every
to
be
private,
so
Hour
clusters
are
not
pebay.
The
accessible
eh
default,
eh
If
You
dip
tree
accessible,
but
we
use
private
end
Points
for
that
to
make
it
easy,
More
secure.
So
basically.
C
C
Was
starting
some
functionalities
World
available
odiad
Time
For
instants
It
was
the
acright
that
was
not
Furry,
Help
But.
Also.
We
had
some
other
discussions
beside
of
this
list.
I
want
to
highlight
Son
of
them.
The
I
have
try
to
make
Them
Bolt,
but
one
of
the
key
functionalities
was.
We
have
to
separate
all
Our
Workout,
specially
Meaning
that
Every
work
Load
has
to
be
identified
and
must
not
Sea
each
other
Within
The
cluster
zo
When
We,
Started
When
We
First
met.
He
says
tour
de
guys,
like
Hey
Do.
C
You
know
that
There's
won
Beautiful
functionality
coming
availa
en
dat
is
eh
The
agent
pool
concept.
Dat
is
een
functionality,
eh
beast
on
defect
that
you
can
set
in
cubanity,
stains
or
Sword
of
labels,
And
that
you
can
also
setem
in
ehm
he
was
dat
Cold
Again
over
eh
vdability,
Stones
So.
You
can
basically
eh
Select
Tree
of
them
set
'm
in
an
agent
pool
concept
and
lay
down
a
sword
of
Azure
Tag
and
all
the
costs
are
also
identify.
Also,
the
traffic
was
separated
completely
so
that
Was
A
Cool
feature
and
I
think
Else.
C
Subscriptions
The
possibility
to
use
the
agick,
that
is,
the
application,
Gateway
Ingress
controller,
the
Combination
of
the
application
Gateway
and
the
incass
control
combine,
and
those
are
that
we
you
find
westicated,
but
also
eh.
Later
this
Year
in
in
the
January
we
stilzy
in
this
CIA
But
It's
Got,
A
Lot
of
issues.
It's
not
reacting,
As
it
supposed
to
be,
and
since
we
are
facing
40
Year
eh
teams,
We
did
want
to
look
to
that
issue
facing
The
issues
that
There
explaining
on
gets
of.
Basically,
so
we
chose
engine
x
en
in
That
Way.
C
We
can
delivery
very
fast,
eh
One.
Other
Elements
autosquilling
is
of
course
enables
on
hourside
and
Which
Wine
to
use
Edge
Defender
for
Cloud
as
Well
looking
to
the
ultimation
We
Are,
using
of
course
The
Products.
That
microft
is
offering
so
Every
Devils
This,
one
of
the
tools
That
We
Are
using
We,
are
also
have
take
on
the
look
to
cured.
I,
don't
know
if
it
from
Million
for
everybody.
C
Schedule
So,
if
there
update's
required
for
reboot
It,
will
do
it
by
itself,
not
Meaning
that
all
the
notes
are
coming
Together
but
shepherdly,
of
course,
and
other
topic
That
We
are
highlighters
in
to
do.
Is
the
ultimation
of
eh
DNS
and
satificate,
most
Of
You
Maybe
eh
Are
Family,
with
external
DNS
or
set
manager.
Those
tools
are
mostly
used
in
the
ultimation
ehm,
but
we
have
some
Manual
process
That's
not
allowing
has
to
talk
to
the
API
Systems.
Yet
So
This
is
coming
but
Maybe
in
the
future.
C
Butter
for
Now
It's,
a
Manual
process
Looking
on
the
application
site.
So
we
have
used
How
many
Osso
take
a
look
to
some
applications.
One
of
them
was
the
application
Performance
monitoring,
That
We
Are
Filling
in
with
application,
Insights
Is
It
the
end
of
forevering.
At
the
moment
we
hope
so
but
uhm,
what's
called
don't
have
Any
requirements
yet
to
differentiate
on
this.
So
there
a
lot
of
two
South
There
That's,
helping
and
performing
in
the
application
Stack,
but
That's
A
Moment.
C
We
don't
have
complains
yet
in
That
Way,
besides
of
That
We,
all
so
use
pm
skills
sets
for
creating
Hour
ehm
container
images
required
for
applications
to
Run,
of
course,
And.
That
is
also
a
lot
of
Conversation
About
It
Because
It's,
an
Eyes
solution,
but
current
States,
The,
Only,
One,
That,
We
Can
live
here
also
have
take
a
look
to
ACA.
C
Nowadays,
It
is
image:
Into,
the
Ash,
your
policies,
giving
Us
The
possibility
to
hard
in
basically
our
clusters
under
security
site
under
clusterside
and
also
on
the
on
the
cubernetjes
versions
as
well
de
Cabinet
is
best.
Practice
is
also
Yesterday
explained
by
you,
ehm
and
other
Elements
That
We
Are,
using
a
calic
open,
so
cubernet
is
offers
as
the
possibility
to
go.
Eh
clouinative
at
the
self
at
cubernet
policies.
C
Those
are
have
the
limitation
that
you
can
addam
on
namespace
level
en
scalicio,
one
of
the
first
c&a
eh,
that
is
eh
ja
with
Microsoft
ehm
Gifts
of
the
possibility
to
not
Only
Unlimited
on
names
Space,
but
overallercluster
So,
you
can
set
Your.
Basically,
your
networking,
Rules
onhan
highest
level
is
possible
Meaning
that
you
can
make
it
closed
and
Less
And
then
open
with
the
specific
viral
requiems
of
your
Needs.
C
Looking
to
other
Elements
2
small
I
do
not
this.
So
we
have
edit
a
lot
of
links.
A
Little,
Bit
of
the
base,
Line
weir,
Just
Fallout
from
Microsoft,
so
Microsoft
is
creating
a
lot
of
Base
Lines
Now
specific
on
the
topics
of
a
CR
dat.
We
also
required
and
a
k
s
And,
that
we
have
made
in
a
lot
of
lists
to
Just
Feel,
then
Down.
C
Looking
to
the
end
solution,
What
are
we
offering
to
Our
Workout
teams,
possibility,
of
course,
to
get
there
Own
agent
pool
to
the
Asian
pool
we
Give
Them
The,
possibility
to
differentiate
beast
on
the
VM
size.
Just
now
did
not
More
CPU
or
memory.
They
can
choose
other
Wise
in
this
picture.
It's
A
tv
for
s,
V3
Music],
a
limits
on
the
pot
raid,
zo
de
je
nat
over
profession,
There's,
Workum
notes.
Dat
is
beast
on
the
VM
size.
C
C
What
Does
that
Mean
for
Workout
Team,
so
Workout
Team,
Still
professions,
There
Own,
Resources,
That,
We,
Do,
a
purpose
because
They
are
responsible
for
the
days
base
or
a
keyful
for
the
certificate,
for
example,
but
also
for
that
Resistance
storage
ehm.
So
we
can
Deliver
the
fool
self
service
functionality
and
We
Are,
creating
connectivity
from
hourssubscription.
Basically,.
C
About
can
be
Ultra
Eyed
on
Those
components.
Wat
eh
de
workouts
are
basically
creating
on
That
Way.
We
can
provision
a
lot
of
functionality
out
of
the
box,
They
Get
There,
Own
Ash
your
Devils,
and
that
we
can
create
All,
so
The
ultimation
eh
to
the
name,
Spaces
and
element
That
We
are
here
to
lot
based
on
names
Spaces,
so
we
privation
and
namespace,
and
the
agent
pool
and
They
can
delivered
all
the
applications.
They
Need.
B
So
eh
Road
map,
of
course,
we
don't
have
Everything,
radiate
restart
It.
Last
Year
Still
working
progress,
some
components,
Are
Not,
afable,
So
ja,
work,
Loud,
Identity
We
are
really
Waiting
For
Microsoft
to
have
that
ga
jou
happy
to
implement
at
When
Their
The
multilizer
of
support
be
already
incremented
at
the
moment.
That
was
one
of
The
request
of
our
teams:
ehm
paultbase
routing
we
also
in
clementin
that
was
over
also
Request
of
the
teams
ehm
service
Mesh.
B
We
have
not
implement
at
service
Messi
at
because
There's
No
requirement
you
at
the
moment
for
service
match
so
Why
influence,
Something,
Which,
ex
complexity,
If
It's,
Not,
Need
it,
but
so
nesset
ehm
Esta
requirements
are
there.
We
will
included
eh
a
kit,
Ops
eh,
also
On
Our
list
toe
aimplim
Ent
ze
somwardess,
Year
man,
We
Can,.
C
B
B
Tattoo
for
that
And
implementing
that
Together
with
a
Fender
ja,
als
er
no
requirement
yet
for
it.
Ehm
Confidential
FM
is
Something
Which
We
Are
Looking
into
because
Next
To
BBN
to
ehm
eh
compliancies
Standard.
We
ik
als,
er,
nou,
Something,
That's
BBN,
two
plus
That's
eh
morse,
tricked
so
We
Are.
Investing
If,
I,
isolated
notes
could
be
there
a
solution
for
that
ja
en
eh
sommodiger
of
the
eikjs
eh
ik
eh
Ash
Edge
is
already
so
on
of
the
things
Which
is.
There
is
There's
a
requirement.
We
wel
inplent
That's
When.
B
Slurance
Ja
I
think
a
one
of
our
bakerst
Lessons
learns
was
That
We
It's
nice
to
the
eh
Deploy
aks,
but
it's
not
Only
deploying
A
caress.
It's
not
Ready
that
product
you!
You
have
to
do
lot
yourself
and
what
We
Found
Out
is
that
the
Our
Choice
for
running
at
private
eh,
Limit
eh
in
de
sum,
ofte
options.
That
are
available
sum.
Ofte.
Options
for
private
are
not
available
eh
in
gi,
but
for
Public
Da
faila,
some
difficult
diskus
eh
discussion.
Sometimes
about
that.
How
are
we
fixing
That?
B
B
C
B
B
C
C
So
we
have
proficient
it
in
a
Public,
cubanettes
environment,
strict
Place,
with
a
lot
of
Network
policy
on
that,
so
we
can
Deliver
Basically
Only
That
requirement:
To
Go
from
Public
to
private,
to
Dear
subs
And
For
with
Microsoft
we
had
last
week
really
Fresh
We
are
taking
To
Look
to
the
HC,
a
solution
to
see
if
they
can
off
her
It.
Likewise.
But
then
it's
for
the
climative,
not
Deliver
de
Isolation
met
required.
A
D
B
There
Ja,
so
We
used
The
biow
compliancy
policy
Initiative
from
Microsoft
eh.
We
Use
the
scf
en
we
have
Our
Own
security,
Risk
Team
that
Extender
The
scf
en
met
sure
that
We
Are
The
Translation
to
the
air
force
and
yeah
It
Was
A
Lot
of
work,
It
Still
Lot
of
work
to
keep
it
up
to
date
of
quart
because
I
Was
A
Chains
and
policies
en
eh,
zou
eh
ja.
We
constantly
Looking
How
to
improve
that
in
Made,
For
Pressure.