Hey, friends with Microsoft's Ignite Conference having just wrapped up, you would think there
wouldn't be anything new to talk about this week, leaving us with a digital desert of
emptiness.
However, we still have lots of new announcements this week.
I know, I'm just as surprised as you are.
We have a smorgasboard of new AKS announcements and cost saving enhancements for both compute
and DDoS protection.
I'm Matthew Ulasien with A Cloud Guru, and this is Azure This Week.
Let's head off to the news!
Oh, and if you want to always know about all of the amazing Azure news throughout the entire
year, hit that subscribe button.
We'd really appreciate it.
First up, we have a bunch of Kubernetes news for Azure Kubernetes Service.
Last week was Kubecon, which is the yearly annual get together for all things Kubernetes.
Not surprisingly, Azure dropped multiple announcements for Azure Kubernetes Service or AKS for short.
From a performance perspective, the biggest new announcement was a new networking framework
called Azure CNI powered by Cilium.
Let's break down what exactly this new feature is and why it matters into its two main components.
First off, we have Azure CNI, which is short for container network interface.
CNI is an existing AKS network model that essentially provides IP addresses directly
to individual pods in the Kubernetes cluster, which allows for direct pod level communication.
The brand new component called Cilium is an open source platform that powers high performance
network connectivity between different cloud native container workloads.
Now, if you mesh those two features together, you get a brand new service called Azure CNI
powered by Cilium.
Some of the notable benefits include more efficient data pathing to provide faster direct
access to your pods, as well as built in support for Kubernetes network policies without the
need for a separately installed solution.
So what does that mean in plain English?
To put it simply, it makes your high scale Kubernetes workloads a lot faster and more
secure, which is always a good thing.
The new feature's currently available in preview, so of course the usual preview caveats apply.
Also be aware that Cilium only works with Linux kernels, so unfortunately Windows containers
can't get in on the fun.
Azure also announced a couple notable security enhancements for AKS as well.
The first of which is a new feature called Image Cleaner, which is also currently available
in preview.
Now, as you maintain ongoing AKS workloads, those nodes may collect older images over
time, which of course may have security vulnerabilities because again, these are older images.
Image cleaner effectively goes through all your existing nodes and automatically cleans
out those older stale images, removing it as a possible security risk.
Now it acts as a managed addon within AKS from which it will generate a list of your
older stale images.
It will not include images attached to currently running pods, and customers also have the
option to manually exclude certain images.
From there, image cleaner will automatically run a purge job on any remaining images in
that stale list, resulting in a fresher, cleaner, and more secure Kubernetes node.
Awesome.
The second notable security announcement is the availability of Mariner OS images for
AKS clusters.
Now, if you're not familiar with Mariner OS, it is a lightweight Linux distribution developed
by Microsoft designed for secure containers.
It's already in use in several internal Microsoft products like Xbox, Minecraft, and over 100
individual Azure services.
And as of now, it's also available for the public to use in their own containerized workloads.
So if you've always wanted to run a container using the same operating system framework
as Minecraft, well now you can.
Now, if Kubernetes just isn't your thing, don't worry.
We still have two other notable announcements on how to save some money, the first of which
is known as savings plan for compute.
Now, if you have long running compute jobs on Azure, you may already be familiar with
a feature called Azure Reservations, which allows you to pre-purchase a committed amount
of compute for either one or three years at a greatly reduced price.
Now, while Azure Reservations is great for saving money, it does come with some restrictions
like being tied to a specific region for your reservation, limited to specific VM families
or SKUs, or being tied to a specific compute service like VMs or App Service.
Overall, it's a great way to save money, but it's really not that flexible, especially
if you have to make significant changes to your compute environment.
With that mind this new feature called savings plan for compute is similar to Azure Reservations.
However, by comparison, it offers a lot more flexibility on how you use that reserve compute.
With savings plan for compute, you also reserve a set amount of compute capacity, just like
reservations.
However, that reserve capacity can be used on almost any compute type like VMs, AKS containers,
App Service and others, and it can be used in any region that you desire.
It overall gives you much more flexibility on where and how you run your compute workloads
and still save a lot of money.
Now, if you like and use Azure Reservations, don't worry that feature is not going away,
and in fact, it actually provides a slightly better discount compared to savings plan for
compute, and you can even combine Azure Reservations with savings plan compute depending on your
specific flexibility needs.
Last bit of cost saving news today is the introduction of a much more budget friendly
version of Azure's enhanced DDoS Protection Service.
DDoS, of course, being short for distributed denial of service.
DDoS attacks are always a big threat in that it can effectively bring your customer-facing
applications to a grinding halt, which can block your customers from doing business with
you, which is well really bad for business.
Now, Azure has always provided enhanced enterprise grade DDoS protection.
However, with the default SKU running close to $3,000 per month, it's just a little bit
much for small businesses to afford.
The new announcement is that the exact same enhanced DDoS protection will soon become
available for smaller businesses at a much lower cost.
How it works is that the default, more expensive SKU referred to as Network Protection, acts
is charging for a block of 100 IP addresses to protect.
The new lower price skew called IP protection only charges on an individual IP basis versus
a large block of IPs, which is simply overkill for most smaller businesses.
Now, according to Microsoft's calculations, if you need to protect less than 15 public
IP resources, the per-IP pricing of the individual IP pricing SKU will be overall more cost effective,
which coincidentally fits into the needs of most smaller businesses.
Now, I still wouldn't exactly call this service cheap in that it still costs about $200 per
month per protected IP address.
However, compared to the larger block pricing of about $3,000 per month, it is comparatively
a more digestible price point if you only need to protect a few resources.
Well, with that, that brings us to the end of our time today.
I hope you enjoyed this flurry of Azure news on both AKS and cost savings as much as I
did.
Be sure to join us next week for even more Azure announcements here on Azure This week.
Keep being awesome Cloud gurus.
Until next time, I'll see you all later.