Azure/azure-service-operator v2.21.0

on GitHub

What's Changed

Breaking changes

• containerservice: ManagedCluster.spec.aadProfile.serverAppSecret is now correctly identified as a secret.
• synapse: Workspace.spec.encryption.kekIdentity.useSystemAssignedIdentity is now correctly typed as a Boolean instead of v1.JSON. Valid configurations are unaffected, but invalid configurations may require correction.

New resources

• Add support for the new entra Application resource (#5232)
• Add support for the new containerregistry RegistryCacheRule resource and API version v20251101 (#5615)
• Add support for the new databasewatcher Watcher, Target, and SharedPrivateLink resources in API version v20241001preview (#5607)
• Add support for the new apimanagement Diagnostic resource (#5561)
• Add support for the new kusto ClusterPrincipalAssignment resource (#5598)
• Add support for the new sql ServersKey and ServersEncryptionProtector resources (#5412)
• Add support for the new network DDoSProtectionPlan resource (#5500)
• Add support for the new eventgrid API version v20250215 (#5553)
• Add support for the new documentdb API version v20260315 for Managed Cassandra (#5593)
• Add support for the new sql API version v20250101 (#5594)
• Add support for the new cache API version v20250701, including Redis Enterprise public network access (#5535)
• Add support for the new web API version v20250501 for Flex Consumption function apps (#5503)

Features

• Add a --tls-min-version flag for the webhook and metrics servers (#5620)
• Improve CRD comparison performance (#5628)
• Retry Front Door custom-domain route association errors sooner (#5614)
• Requeue AKS agent pools while control-plane upgrades are in progress (#5581)
• Support additional labels on ASO-managed CRDs (#5588)
• Enable smart-deletion prechecks for compute, containerinstance, datafactory, dbforpostgresql, devices, insights, keyvault, machinelearningservices, network, redhatopenshift, resources, servicebus, and storage resources (#5568, #5569, #5570, #5572, #5574, #5575, #5508, #5509, #5510, #5511, #5512, #5513)
• Migrate authorization, cache, cdn, cognitiveservices, containerinstance, dataprotection, sql, and subscription resources to hybrid versioning (#5506, #5516, #5507, #5542, #5590, #5533, #5519, #5498)
• Allow credential acquisition from an ASO-created managed identity (#5490)
• Improve redaction of Entra-specific sensitive values (#5499)
• Remove retired Redis Enterprise resources (#5640)
• Add and update the Helm chart (#5484)
• Update numerous dependencies

Bug fixes

• Fix bug where special characters in PostgreSQL and Azure SQL user passwords were not escaped correctly (#5551)
• Fix bug where generated webhook functions could have colliding receiver names (#5606)
• Fix bug where Application Gateway private-link IP configuration was not modeled (#5502)

Documentation

• Improve security documentation (#5639)
• Improve the Supported Resources landing page (#5552)
• Fix the CEL hardcoded-string documentation (#5577)
• Add semantic directory indexes (#5411)

Contributors

We welcome and thank our external contributors:

• @andreidorin-oprea made their first contributions, adding Database Watcher, Kusto ClusterPrincipalAssignment, Managed Cassandra and App Service API support, and several fixes (#5607, #5598, #5593, #5503, #5609, #5606, #5502)
• @marek-veber made their first contribution, adding configurable minimum TLS versions for the webhook and metrics servers (#5620)

Upcoming breaking changes

These breaking changes will be included in future releases

TLS 1.3 (v2.22)

In v2.22 we'll default to using TLS 1.3, but will provide a command line flag to enable TLS 1.2 if needed.