<\/p>\n
Monthly Azure news December 2021<\/p>\n
<\/h1><\/div>
In this issue of Monthly Azure news, we offer a brief retrospective of the most important updates from the cloud-native universe announced or published in December 2021. Make sure to share this post with your community and enjoy reading it. We wish you all the best in the new year and hope you will continue learning and growing with us \ud83c\udf1f\ud83d\ude80<\/p>\n\n\n\n
Contents<\/h3>\n\n\n\n- AKS clusters can now be created without the need of local user accounts<\/a><\/li>
- AKS auto-certificate rotation now in GA<\/a><\/li>
- AKS node image auto-upgrade now in GA<\/a><\/li>
- General availability: Wildcard listener on Application Gateways<\/a><\/li>
- Microsoft Defender for Containers with new capabilities for Kubernetes in Public preview<\/a><\/li>
- Attribute-based Access Control (ABAC) conditions with principal attributes now in public preview<\/a><\/li>
- Azure Boards Ux Modernization in Public Preview<\/a><\/li>
- Automated key rotation in Azure Key Vault is now in public preview<\/a><\/li>
- Using Self-hosted gateways to expand the Azure API management<\/a><\/li>
- We invite you to the upcoming Cloud Native Rosenheim meetup<\/a><\/li><\/ul>\n\n\n\n
AKS clusters can now be created without the need of local user accounts<\/h3>\n\n\n\n
Access to a Kubernetes-Cluster requires a local administrator account. But a local account may provide potential security risks regarding managing the accounts and access. Therefore, it is now possible to use Azure AD integration and deactivate local accounts in general. Azure AD authentication is provided to AKS clusters with OpenID Connect.<\/p>\n\n\n\n
For more information visit this site.<\/a><\/p>\n\n\n\nAKS auto-certificate rotation now in GA<\/h3>\n\n\n\n
The Azure Kubernetes Service<\/a> uses and generates different certificates. The certificates often need to be renewed after a defined period of time. For the non-CA certificates, this can now be handled with auto-certificate rotation, which is generally available and where they will be rotated automatically before expiring. Note that this feature is not available for non-RBAC clusters and is currently available for the following regions:<\/p>\n\n\n\n- East US 2 Early Updates Access Program (EUAP)<\/li>
- Central US EUAP<\/li>
- West Central US<\/li>
- UK South<\/li>
- East US<\/li>
- Australia Central<\/li>
- Australia East<\/li><\/ul>\n\n\n\n
AKS node image auto-upgrade now in GA<\/h3>\n\n\n\n
Images for AKS nodes <\/a>are frequently updated and patched by Microsoft. If a node is running, the upgrade needs to be initiated manually, otherwise, the patch is not applied. With the automatic upgrade, activated the nodes will be updated as soon as new GA versions are available. Keep in mind that there can be weekly updates. This also combines well with the planned maintenance feature and means less work and more flexibility. Check out the documentation on this site and go for the auto-upgrade section.<\/p>\n\n\n\nAKS configuration management with GitOps in Public preview<\/h3>\n\n\n\n
GitOps integration was previously only available for Azure Arc-enabled Kubernetes clusters (details here<\/a>) but is now available for the Azure Kubernetes Service<\/a>. With GitOps the state of a cluster can be declared via versioned files in the Git repository like Helm charts or YAML manifests using the Flux <\/a>toolset. GitOps is enabled via the cluster extension Microsoft.KubernetesConfiguration\/extensions\/microsoft.flux<\/code> and can be installed either automatically or manually. Visit this site<\/a> for more details.<\/p>\n\n\n\n![\"Diagram](\"data:image\/svg+xml,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20width%3D%27-144%27%20height%3D%27-81%27%20viewBox%3D%270%200%20-144%20-81%27%3E%3Crect%20width%3D%27-144%27%20height%3D%27-81%27%20fill-opacity%3D%220%22%2F%3E%3C%2Fsvg%3E\")
Source: Microsoft<\/a><\/figcaption><\/figure><\/div>\n\n\n\nGeneral availability: Wildcard listener on Application Gateways<\/h3>\n\n\n\n
Wildcards like an asterisk (*) and a question mark (?) can now be used for hostnames on a multi-site HTTP(S) listener. Multi-site listener can be used to forward requests based on the hostname or domain name for different backend pools and web applications on the same gateway. <\/a>By using wildcards, it is possible to match multiple hostnames with one listener. Visit the page <\/a>for more details.<\/p>\n\n\n\n![\"Wildcard](\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\")
Source: Microsoft<\/a><\/figcaption><\/figure><\/div>\n\n\n\nMicrosoft Defender for Containers with new capabilities for Kubernetes in Public preview<\/h3>\n\n\n\n
Microsoft Defender for Cloud (formally known as Azure Security Center and Azure Defender<\/a>) provides a rich toolset for security enhancement and threat protection. Regarding Kubernetes, the capabilities of Azure Defender for Container and Kubernetes are merged and new functionality is added. This includes AKS Profiles, Multi-Cloud support, Runtime visibility of vulnerabilities, Advanced threat protection, Enhanced ACR vulnerability assessment, and continuous image scanning. For detailed information please visit the documentation on this site<\/a>.<\/p>\n\n\n\nSource: Microsoft<\/a><\/figcaption><\/figure><\/div>\n\n\n\nAttribute-based Access Control (ABAC) conditions with principal attributes now in public preview<\/h3>\n\n\n\n
While RBAC determines access according to the respective organizational role of a user, ABAC<\/a> uses user and object attributes associated with security principles, resources, requests, and the environment for this purpose. Combining different conditions with RBAC (Role-based access control) this preview feature allows you to use custom security attributes for principals in role assignment conditions making managing your resources easier. For more details visit this site.<\/p>\n\n\n\nAzure Boards Ux Modernization in Public Preview<\/h3>\n\n\n\n
Azure DevOps provides a variety of functionality for project management, CI\/CD, Testing, or working with repositories. The project management view is now updated and can be activated via the public preview feature “New boards Hubs” in the user settings. The functionality will stay the same but the optic of the backlog view is enhanced. We highlight that it is a preview feature and may contain a few issues as we can say from personal experience. Check out the announcement on this website<\/a>.<\/p>\n\n\n\n![\"\"](\"https:\/\/whiteduck.de\/wp-content\/uploads\/image-53.png\")
<\/figure><\/div>\n\n\n\nAutomated key rotation in Azure Key Vault is now in public preview<\/h3>\n\n\n\n
The Azure Key Vault<\/a> auto key rotation allows setting up an auto-rotation policy that rotates their customer-managed key (CMK) after a specified period of time, so a new version of the key is generated during the process. The feature is free during the preview, so it is easy to test it during this period. Check the link<\/a> out for more details.<\/p>\n\n\n\nUsing Self-hosted gateways to expand the Azure API management<\/h3>\n\n\n\n
Expanding API Management the self-hosted gateway feature allows to securely manage APIs which are hosted on-premises and across clouds. You have the flexibility to deploy a containerized version of the API Management gateway component to the same environments where the APIs are hosted. The API Management consists of three key parts: the Management plane, Gateway, and Developer portal. By default, all those components are running in Azure which leads to the fact that API traffic flows through Azure independently of the backend. Using self-hosted gateways can be deployed as a single point of management at the location of the backend API. This allows traffic to flow directly to the backend improving latency, optimizing transfer costs of data, and enabling additional compliance. Visit the link<\/a> for more details.<\/p>\n\n\n\n<\/figure>\n\n\n\nWe invite you to the upcoming Cloud Native Rosenheim meetup<\/h3>\n\n\n\n
We’d be very glad if you could join us on February 2 at 5:30 PM. Our experts Nico<\/a>, Philip<\/a>, and Dario<\/a> will talk about the Kubernetes 1.23! Visit our meetup page<\/a> for more details.<\/p>\n\n\n\n
AKS clusters can now be created without the need of local user accounts<\/h3>\n\n\n\n
Access to a Kubernetes-Cluster requires a local administrator account. But a local account may provide potential security risks regarding managing the accounts and access. Therefore, it is now possible to use Azure AD integration and deactivate local accounts in general. Azure AD authentication is provided to AKS clusters with OpenID Connect.<\/p>\n\n\n\n
For more information visit this site.<\/a><\/p>\n\n\n\n The Azure Kubernetes Service<\/a> uses and generates different certificates. The certificates often need to be renewed after a defined period of time. For the non-CA certificates, this can now be handled with auto-certificate rotation, which is generally available and where they will be rotated automatically before expiring. Note that this feature is not available for non-RBAC clusters and is currently available for the following regions:<\/p>\n\n\n\n Images for AKS nodes <\/a>are frequently updated and patched by Microsoft. If a node is running, the upgrade needs to be initiated manually, otherwise, the patch is not applied. With the automatic upgrade, activated the nodes will be updated as soon as new GA versions are available. Keep in mind that there can be weekly updates. This also combines well with the planned maintenance feature and means less work and more flexibility. Check out the documentation on this site and go for the auto-upgrade section.<\/p>\n\n\n\n GitOps integration was previously only available for Azure Arc-enabled Kubernetes clusters (details here<\/a>) but is now available for the Azure Kubernetes Service<\/a>. With GitOps the state of a cluster can be declared via versioned files in the Git repository like Helm charts or YAML manifests using the Flux <\/a>toolset. GitOps is enabled via the cluster extension Wildcards like an asterisk (*) and a question mark (?) can now be used for hostnames on a multi-site HTTP(S) listener. Multi-site listener can be used to forward requests based on the hostname or domain name for different backend pools and web applications on the same gateway. <\/a>By using wildcards, it is possible to match multiple hostnames with one listener. Visit the page <\/a>for more details.<\/p>\n\n\n\n Microsoft Defender for Cloud (formally known as Azure Security Center and Azure Defender<\/a>) provides a rich toolset for security enhancement and threat protection. Regarding Kubernetes, the capabilities of Azure Defender for Container and Kubernetes are merged and new functionality is added. This includes AKS Profiles, Multi-Cloud support, Runtime visibility of vulnerabilities, Advanced threat protection, Enhanced ACR vulnerability assessment, and continuous image scanning. For detailed information please visit the documentation on this site<\/a>.<\/p>\n\n\n\n While RBAC determines access according to the respective organizational role of a user, ABAC<\/a> uses user and object attributes associated with security principles, resources, requests, and the environment for this purpose. Combining different conditions with RBAC (Role-based access control) this preview feature allows you to use custom security attributes for principals in role assignment conditions making managing your resources easier. For more details visit this site.<\/p>\n\n\n\n Azure DevOps provides a variety of functionality for project management, CI\/CD, Testing, or working with repositories. The project management view is now updated and can be activated via the public preview feature “New boards Hubs” in the user settings. The functionality will stay the same but the optic of the backlog view is enhanced. We highlight that it is a preview feature and may contain a few issues as we can say from personal experience. Check out the announcement on this website<\/a>.<\/p>\n\n\n\n The Azure Key Vault<\/a> auto key rotation allows setting up an auto-rotation policy that rotates their customer-managed key (CMK) after a specified period of time, so a new version of the key is generated during the process. The feature is free during the preview, so it is easy to test it during this period. Check the link<\/a> out for more details.<\/p>\n\n\n\n Expanding API Management the self-hosted gateway feature allows to securely manage APIs which are hosted on-premises and across clouds. You have the flexibility to deploy a containerized version of the API Management gateway component to the same environments where the APIs are hosted. The API Management consists of three key parts: the Management plane, Gateway, and Developer portal. By default, all those components are running in Azure which leads to the fact that API traffic flows through Azure independently of the backend. Using self-hosted gateways can be deployed as a single point of management at the location of the backend API. This allows traffic to flow directly to the backend improving latency, optimizing transfer costs of data, and enabling additional compliance. Visit the link<\/a> for more details.<\/p>\n\n\n\n We’d be very glad if you could join us on February 2 at 5:30 PM. Our experts Nico<\/a>, Philip<\/a>, and Dario<\/a> will talk about the Kubernetes 1.23! Visit our meetup page<\/a> for more details.<\/p>\n\n\n\nAKS auto-certificate rotation now in GA<\/h3>\n\n\n\n
AKS node image auto-upgrade now in GA<\/h3>\n\n\n\n
AKS configuration management with GitOps in Public preview<\/h3>\n\n\n\n
Microsoft.KubernetesConfiguration\/extensions\/microsoft.flux<\/code> and can be installed either automatically or manually. Visit this site<\/a> for more details.<\/p>\n\n\n\nGeneral availability: Wildcard listener on Application Gateways<\/h3>\n\n\n\n
Microsoft Defender for Containers with new capabilities for Kubernetes in Public preview<\/h3>\n\n\n\n
Attribute-based Access Control (ABAC) conditions with principal attributes now in public preview<\/h3>\n\n\n\n
Azure Boards Ux Modernization in Public Preview<\/h3>\n\n\n\n
<\/figure><\/div>\n\n\n\nAutomated key rotation in Azure Key Vault is now in public preview<\/h3>\n\n\n\n
Using Self-hosted gateways to expand the Azure API management<\/h3>\n\n\n\n
![\"\"\/](\"https:\/\/docs.microsoft.com\/en-au\/azure\/api-management\/media\/self-hosted-gateway-overview\/with-gateways.png\")
We invite you to the upcoming Cloud Native Rosenheim meetup<\/h3>\n\n\n\n
![\"Diagram](\"https:\/\/docs.microsoft.com\/en-au\/azure\/azure-arc\/kubernetes\/media\/gitops\/flux2-extension-install-aks.png\")
![\"Wildcard](\"https:\/\/docs.microsoft.com\/en-us\/azure\/application-gateway\/media\/multiple-site-overview\/wildcard-listener-diag.png\")
![\"Understanding](\"https:\/\/docs.microsoft.com\/en-us\/azure\/defender-for-cloud\/media\/defender-for-cloud-introduction\/defender-for-cloud-synopsis.png\")
![\"Cloud](\"https:\/\/whiteduck.de\/wp-content\/uploads\/WD-CN-Meetup-Youtube-Screen-Type-1024x576.png\")
<\/a>