Every day in Azure, we spend time working with customers who are bringing mission critical enterprise workloads to Kubernetes with AKS. Their requirements drive our roadmap, ensuring that we are balancing the innovative capabilities of the cloud native ecosystem with the requirements of some of the world’s largest companies.
AKS for regulated industries
Many AKS customers are subject to the compliance requirements of a specific industry, such as finance, healthcare, or government services. Meeting those requirements can be onerous at the best of times, but it can be even more difficult to do in the context of Kubernetes, where patterns are nascent and flexibility is limited. To help address this challenge, we are announcing AKS for regulated industries, a collection of guidance, benchmarks, and best practices that makes it simpler for customers subject to those constraints to be successful on AKS. This includes a baseline cluster architecture for regulated industries, specific guidance for customers seeking Payment Card Industry (PCI) compliance, and an AKS-specific security benchmark published by the Center of Internet Security (CIS).
Enterprise security
In support of that initiative, we are also pleased to announce a series of new product capabilities that will help customers deliver mission critical workloads with Kubernetes on Azure. First, we are excited to become the first cloud provider to offer integrated Kubernetes agent nodes meeting the Federal Information Processing Standards (FIPS) compliance bar, now available in public preview. With a single CLI flag and at no extra charge, AKS customers can now obtain a version of Ubuntu 18.04 that includes the necessary components for their agent nodes to be FIPS compliant. Windows Server-based agent nodes will follow in just a couple of weeks. Speaking of agent nodes, we are also announcing today the general availability of host-based encryption for AKS agent nodes. This capability provides an additional layer of security as OS, temp, and data disks can now be automatically encrypted with either platform or customer-managed keys. Finally, we are pleased to announce the general availability of Azure role-based access control (RBAC) for Kubernetes. This capability allows customers to manage granular access to AKS and Arc-connected Kubernetes clusters at scale leveraging the same framework that they use for all other Azure resources.
Planned maintenance support for auto-upgrade
Of course, when it comes to meeting the needs of the enterprise, security is just one piece of the picture. Today, we are excited to announce several other capabilities designed meet the needs of our largest customers. We recently announced previews for cluster auto-upgrade, the ability to have AKS automatically trigger upgrade of your clusters, and planned maintenance, the ability to signal to the service when you would prefer to have potential impactful maintenance operations occur. Now, you can combine those two features with the integration of auto-upgrade with planned maintenance, ensuring that any potential disruptions from a cluster upgrade occur at a time that minimizes business impact.
Standardization & innovation
Containerd has become the industry-standard container runtime and it has been deployed by default on Linux nodes in AKS starting with Kubernetes version 1.19. Today, we are pleased to announce that containerd will be available in preview for Windows nodes starting with Kubernetes version 1.20. By adopting containerd, Windows nodes in AKS will offer better performance and stability, and will lay the groundwork for numerous platform capabilities down the line.
Finally, we know how important it is for customers to stay up-to-date with the latest innovation happening in the Kubernetes community. That’s why we’re proud to once again lead the way among cloud providers in offering the latest upstream releases in AKS, with the preview of Kubernetes 1.21. This release includes a number of significant improvements, including the graduation of CronJobs and immutable secrets/configmaps to stable. Please give it a try and let us know if you have any trouble by logging an issue on GitHub.
This year’s //build conference marks an exciting milestone in the Kubernetes on Azure journey. No longer are customers simply looking for the core capabilities required to make their initial applications run in a cloud native environment. Now they are looking for the guidance and advanced features required to meet the high bar set by their most crucial workloads. Azure is committed to meeting those needs by building a platform that is enterprise-grade, by design. And with the announcement of application services for Kubernetes clusters, we are making it easier than ever for developers to build on top of the platform.
