Azure/azure-service-operator v2.22.0

on GitHub

What's Changed

Breaking changes

• Breaking change: Require TLS 1.3 by default for the webhook and secure metrics servers. Clients that need TLS 1.2 can set TLS_MIN_VERSION=VersionTLS12 or Helm value tlsMinVersion: VersionTLS12 (#5748).
• Breaking change: Remove deprecated dbformariadb resources following Azure Database for MariaDB retirement. Migrate away from these resources before upgrading (#5690).

Upcoming breaking changes

• Feedback requested: future global credential defaults. We are considering a configuration option to disable global credentials by default in a future release. Global credentials are already optional, and we recommend using namespace-scoped or per-resource credentials instead. Users would still be able to explicitly enable global credentials. This is a proposal, not a change to global credential behavior in v2.22.0. Please share your use cases and concerns, particularly if disabling global credentials by default would cause problems, in the global credential discussion (tracked for these release notes in #5718).

Versioning migration (#4831)

We strongly recommend you start using the new version format for resources where it is available. This is because:

• It is ordered correctly for kubectl get, unlike the legacy v1api versions (see #4147)
• At some future date, the old-formatted versions beginning with v1api... will be removed. There will be a number of releases of notice before this happens, but best to start now.

All that is required to use the new version format is to update the API version used for your resource YAML and re-apply the YAML w/ kubectl apply or similar.

You can check the tracking issue (#4831), or the resource documentation to determine which resources support which versions.

Example:

• Add date-based API versions for containerregistry, dbforpostgresql, devices, eventhub, and servicebus while retaining existing v1api versions for compatibility (#5685, #5706, #5704, #5747, #5711).

New resources

• Add support for new entra ServicePrincipal resource, including creation, adoption, and exporting tenant-local object IDs to ConfigMaps. Use AdoptOnly for existing principals that ASO must not modify or delete; the default AdoptOrCreate mode manages updates and deletion even for adopted principals (#5725).
• Add support for new servicelinker Linker resource (#5682).
• Add support for new portal Dashboard resource with API version v20250401preview (#5717).
• Add support for new apimanagement Backend resource with API version v20250301preview, including TLS certificate thumbprints (#5700).
• Add support for new sql ManagedInstance, InstanceFailoverGroup, ManagedInstancesDatabase, and ManagedInstancesDatabasesTransparentDataEncryption resources with API version v20250101 (#5763).
• Add support for new keyvault VaultKey resource (#5564).
• Add support for new servicebus QueueAuthorizationRule resource, including exporting keys and connection strings to Secrets (#5550).
• Add support for new eventgrid Namespace and NamespaceTopic resources with API version v20250215 (#5731).
• Add support for new redhatopenshift HcpOpenShiftCluster, HcpOpenShiftClustersExternalAuth, and HcpOpenShiftClustersNodePool resources with API version v20260901preview (#5688).
• Add support for new containerservice IdentityBinding resource with API version v20260501 (#5576).
• Add support for new containerservice API version v20260501 (#5694).
• Add support for new containerregistry API version v20251101 for Registry and RegistryReplication (#5761).
• Add support for new storage API version v20260601, including the Smart access tier (#5757).
• Add support for new web API version v20260715, including Flex Consumption configurations (#5699).

Features

• Add opt-in strict Workload Identity authentication using separate Kubernetes ServiceAccounts for namespace-scoped and per-resource credentials. Set AZURE_WORKLOAD_IDENTITY_AUTH_MODE=strict or Helm value workloadIdentityAuthMode=strict; the default remains relaxed (#5753, #5744).
• Add opt-in Azure CLI authentication for a controller running as a local process after az login, using --enable-azure-cli-authentication. This is not intended for the in-cluster operator (#5772).
• Restrict ARM request destinations, long-running operation polling, final-result requests, and redirects to the configured Resource Manager HTTPS origin (#5786).
• Configure leader election lease timings and Kubernetes probe timings for deployments with different startup and availability requirements; invalid leader election timings are rejected at startup (#5707, #5712, #5766).
• Configure the default reconcile policy through Helm value defaultReconcilePolicy (#5716).
• Configure unhealthyPodEvictionPolicy on the operator's PodDisruptionBudget (#5677).
• Manage Entra SecurityGroup owners and members declaratively (#5462).
• Safely adopt existing Entra Application and SecurityGroup objects with AdoptOnly, without modifying or deleting them (#5725).
• Automatically approve database watcher SharedPrivateLink connections to eligible ASO-managed resources referenced through Kubernetes, and wait for approval before reporting readiness. Connections to bare ARM IDs retain their existing behavior (#5673).
• Updated dependencies.

Bug fixes

• Fix bug where enabling SQL Entra-only authentication could fail while the Entra administrator was still being configured; retry until the administrator is ready (#5754).
• Fix bug where delete retries could take more than an hour (#5778).
• Fix bug where database connection string values could be interpreted as additional connection options (#5762).
• Fix bug where Key Vault data-plane requests did not include ASO's User-Agent (#5741).
• Fix bug where truncated owner labels could be invalid Kubernetes label values (#5742).
• Fix bug where Workload Identity authentication ignored a configured AZURE_FEDERATED_TOKEN_FILE path (#5735).
• Fix bug where nested ARM status conditions were not converted correctly (#5729).
• Fix bug where reconciling an existing PostgreSQL replica sent it as a create rather than an update (#5727).

Documentation

• Add a guide to creating and safely adopting Entra service principals and exporting their IDs (#5725).
• Document strict Workload Identity setup, credential ServiceAccount selection, and multitenancy considerations (#5753).
• Document controller authentication, TLS settings, leader election timings, probe configuration, and ARM endpoint requirements (#5772, #5748, #5707, #5712, #5786).
• Document database watcher private endpoint approval behavior and troubleshooting (#5673).
• Update resource and API reference documentation for the newly supported resources and API versions.