Skip to content

2607 Update

Latest
Latest

Choose a tag to compare

View all tags
@vealumalai vealumalai released this 30 Jul 16:58
v1.4.41
4d03935
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AIO2607 (v1.4.41) Public Release Notes

Release date: July 2026

Release type: Milestone

Current GA version: 2607 · Version history

Azure IoT Operations 2607 is a milestone release that delivers ARM64 platform support (GA), new built-in data flow graph transforms (count-based windows, trigger-based windows, and per-topic throttling), data-driven management actions for reactive process control, raw data observation via Azure Event Grid, OPC UA connector high availability and recursive tag onboarding, private container registry support for air-gapped deployments, broker backpressure resilience, and critical security fixes.

Release Highlights

  • ARM64 platform support now generally available: Azure IoT Operations now supports ARM64 architectures, enabling deployment on ARM64-based Kubernetes clusters with full parity across installation, observability, and lifecycle operations. Supported environments matrix

  • Enhanced transforms for data flow graphs: Use the new Throttle transform for better control over your data streams, or the improved Window, Branch, Filter, and Map transforms for more flexible aggregation, routing, validation, and broker state store lookups. Process data with data flow graphs

  • In-place transform upgrades: Use the operations experience to upgrade or downgrade a transform right where it is within a data flow graph — no need to delete and add again.

  • Data-driven management actions: Configure reactive control loops that automatically execute management actions based on data conditions, enabling closed-loop process control directly within Azure IoT Operations. Enable and run management actions

  • OPC UA connector high availability: Configure high availability mode for OPC UA assets to achieve near-zero message loss during failover scenarios, improving data reliability for critical industrial workloads.

  • Recursive OPC UA tag onboarding: Recursively discover and onboard all tags from a starting node in an OPC UA server's address space into one or more assets, significantly reducing manual configuration for large-scale deployments.

  • Broker backpressure resilience: Eliminated the risk of dataflow and application deadlocks when data is re-injected into a backpressured MQTT broker, improving system stability under high-throughput conditions.

  • Security vulnerability remediation: Addressed a security vulnerability in dataflow managed identity token handling and updated dependencies to remediate known vulnerabilities.

Upgrade recommended if you deploy on ARM64, rely on data flow transforms, OPC UA connectors, management actions, or private registry deployments — this release delivers new GA capabilities, critical stability improvements, and security patches.

Upgrade to 2607 from any supported GA version to ensure you receive the latest security patches and feature enhancements. Staying current is recommended for continued support and reliability.

Version support: Azure IoT Operations 2607 introduces the 1.4.x minor version series. Under the N‑2 version support policy, the supported versions are now 1.4.x, 1.3.x, and 1.2.x. The 1.1.x series is no longer supported. Customers still on 1.1.x should upgrade to remain eligible for Azure support.

Known Issues

For the full list of active known issues, see Known Issues.

  • ✅ Fixed in this release: MQTT connector blocks external MQTT brokers with private IPs. Starting in 2605, if an external MQTT broker used a private IP address, the MQTT connector would not connect to it. This is now fully resolved.

Components Overview

This release spans improvements to data flow graphs (new built-in transforms, data-driven management actions, transform version management), Connectors (OPC UA high availability, recursive tag onboarding, Akri-based OPC UA deployment, MQTT private IP fix, diagnostics improvements), Messaging (backpressure resilience, message expiry correctness, topic filter security), Platform (ARM64 GA, private registry support), Azure IoT Operations Experience (management actions configuration, raw data observation, transform version picker), CLI (2607 deployment alignment), and Security (managed identity token hardening, dependency updates).

Data Flows & Data Flow Graphs

New features

  • Count-based window transform: A new built-in transform that aggregates records based on a configurable record count threshold, enabling count-driven data aggregation directly in data flow graphs without custom WebAssembly modules.

  • Trigger-based window transform: A new built-in transform that aggregates records based on trigger conditions, enabling event-driven windowing for scenarios where time-based aggregation is insufficient.

  • Per-topic throttle transform: A diagnostic data flow can subscribe to selected MQTT topics and use the new Throttle transform to apply independent message-rate limits before forwarding sampled messages to cloud endpoints such as Azure Event Grid. This enables raw data observation while controlling cloud egress volume.

  • Date and time expression functions: Map, Branch, Filter, and Accumulate transforms now support built-in date and time functions including now, duration_between, day_of_week, format_timestamp, epoch conversion, and timestamp parsing.

  • Dynamic DSS lookup keys: Dataset enrichment can now derive Distributed State Store (DSS) lookup keys from fields in each incoming message, enabling per-message enrichment without static keys or separate graph deployments.

  • Data-driven management actions: Configure reactive control loops that evaluate incoming data against defined conditions and automatically execute management actions in response. This enables closed-loop process control scenarios such as adjusting setpoints, triggering commands, or executing corrective actions based on live data — directly within Azure IoT Operations.

  • Transform version management: Data flow transforms now support minimum Azure IoT Operations version compatibility checks and a version picker in the transform catalog, enabling operators to select compatible transform versions during pipeline configuration.

Improvements

  • Branch schema validation: Branch transforms can now validate incoming messages against their schemas and route valid and invalid messages through separate output paths, allowing invalid messages to be sent to a dedicated topic for inspection or further processing.

Fixes

  • Connector startup resilience: Fixed issues where data flow connectors could permanently stop processing after transient startup failures (such as state store timeouts) and where the state manager retry loop lacked backoff, causing Kubernetes API flooding. Connectors now recover gracefully from transient startup errors with proper exponential backoff.

  • Status client performance: Fixed status client inefficiencies that could overload the Kubernetes API under high connector counts, including a thundering herd pattern in concurrent resource updates and an unnecessary GET request that blocked ConfigMap writes. The status client now batches updates efficiently and writes directly without redundant reads.

  • Operator ConfigMap update ordering: Fixed a race condition in operator reconciliation where ConfigMap updates could arrive out of order, causing stale configuration to be applied to data flow components.

  • Custom resource cleanup ordering: Fixed an issue where the CRD deletion job attempted to patch custom resources before removing webhook configurations, which could cause the deletion to hang.

  • WebAssembly runtime resilience: Fixed multiple issues affecting WebAssembly transform reliability: data flow pods could become permanently stuck after a WASM graph controller restart, the controller could serve partial artifacts due to non-atomic file writes, and channel closures could cause unrecoverable backpressure buildup. The WASM runtime now handles controller restarts, ensures atomic artifact delivery, and automatically recovers from channel failures.

  • Upgrade status job transient error handling: Fixed an issue where the upgrade status job failed immediately on transient Kubernetes API errors instead of retrying. The job now retries transient failures before reporting an error.

  • Redundant MQTT keepalive traffic: Fixed an issue where the MQTT client sent redundant PINGREQ packets even when other outgoing packets already satisfied the keepalive interval, generating excessive log noise. The client now correctly suppresses keepalives when regular traffic is flowing.

  • Transform schema rendering: Fixed issues where certain transform schema fields could not be rendered correctly in the configuration UI, affecting the Branch, Throttle, Map, Window, and Filter modules. Schemas now use compatible type representations across all built-in transforms.

  • Window transform boundary handling: Fixed an issue where burst-input messages were incorrectly accumulated across window boundaries, causing data from one window to leak into the next. Window boundaries are now enforced correctly.

  • Health status after upgrade: Fixed an issue where the health status ConfigMap was not created after upgrading from version 1.3 to 1.4, which could prevent health status reporting from initializing on upgraded clusters.

  • Dataflow and dataflow graph metrics accuracy: Fixed an issue where active dataflow and dataflow graph metrics reported flaky or inconsistent values, which could produce misleading monitoring dashboards. Metrics are now reported consistently.

  • Concurrent token request handling: Fixed a thundering herd issue where concurrent system-assigned managed identity token requests during pod startup caused HTTP 429 throttling responses from the token endpoint, leading to pod crashes. Token requests are now serialized with backoff.

Akri

New features

  • Readiness-driven health evaluation: Connectors now use readiness-driven health evaluation when a readiness probe is configured, falling back to existing pod event-based health logic otherwise.
  • Improved connector observability: connector instance counts can now be broken down by protocol (endpoint type), and a new active connectors metric reports how many connectors are healthy, degraded, or unavailable — giving operators clearer visibility into connector health and coverage across protocols.

Connectors

OPC UA

New features

  • High availability mode: OPC UA assets can now be configured for high availability mode, targeting near-zero message loss during failover scenarios. This ensures data continuity for critical industrial workloads where every message matters.

  • Recursive tag onboarding: Operators can now recursively onboard all tags from a starting node in the OPC UA server's address space into one or more assets. This dramatically reduces manual configuration effort when connecting to OPC UA servers with large or deeply nested address spaces.

  • Akri-based connector deployment: The OPC UA connector now uses the Akri connector template deployment model, aligning it with other Akri-managed connectors. This provides a unified deployment and lifecycle management experience across all connector types.

  • Browse-path addressing for OPC UA actions: Dataset and management actions can now identify OPC UA nodes using relative browse paths from a configured starting node. This applies to read, write, and method-call operations.

  • Recursive management actions: Read and write management actions can now target an OPC UA node and its descendants, enabling operations across an entire subtree without configuring every node individually.

  • Triggered dataset reporting: Configure one datapoint to trigger publication of the other sampled datapoints in its dataset. The trigger datapoint can optionally be included in the reported data.

Improvements

  • Runtime diagnostics for release containers: Enabled the ability to collect diagnostic traces from running OPC UA Connector, Commander, and Supervisor containers, improving field diagnostic capabilities for production troubleshooting.

Fixes

  • Data-change batch processing: Fixed an issue where the OPC UA connector periodically encountered a null batch error in outgoing data-change processing, which could cause intermittent data loss. The connector now correctly handles edge cases in data-change batch assembly.

  • Type-based discovery reference handling: Fixed an issue where type-based asset discovery did not correctly handle ordered component references in the OPC UA address space, which could cause incomplete discovery results for servers using ordered component hierarchies.

  • Commander responsiveness under load: Fixed an issue where the OPC UA Commander could become unresponsive under high load in certain scenarios. The Commander now handles concurrent requests more efficiently.

  • Connector metadata path resolution: Fixed an issue where connector metadata for relative paths was outdated, which could cause incorrect resource resolution during connector configuration.

  • Diagnostic logging improvements: Fixed misleading log messages when the shared endpoint feature was in use and reduced excessive logging in the Supervisor maintenance loop. Operators now see clearer, less verbose diagnostic output from the OPC UA connector.

  • Message schema consistency for multiple datasets: Fixed an issue where status updates could overwrite the message schema when an asset contained multiple datasets, causing downstream consumers to receive incorrect schema metadata. Each dataset's schema is now maintained independently.

  • Array length enforcement: Fixed an issue where the OPC UA protocol stack did not honor the MaxArrayLength configuration for operations, which could cause failures when interacting with OPC UA servers that enforce strict array size limits.

  • Stale connector cleanup after upgrade: Fixed an issue where the Supervisor did not remove stale OPC UA Connector deployments after an upgrade when no new assets existed, leaving orphaned pods consuming cluster resources. Stale deployments are now cleaned up automatically.

  • Connector template finalizer handling: Fixed an issue where a finalizer was incorrectly added to the OPC UA ConnectorTemplate during device reconciliation, which could block resource deletion. Finalizers are now managed correctly.

MQTT

Fixes

  • Private IP address connectivity: Fixed an issue where the MQTT connector blocked connections to external MQTT brokers with private IP addresses, preventing valid customer scenarios such as connecting to on-premises brokers on private networks. The connector now correctly allows connections to private IP addresses. (Previously tracked as a known issue in 2605 and 2606.)

REST / SSE Connectors

  • Readiness probe support: Added readiness probe support (connector observability/readiness integration) on both REST/HTTP and SSE connectors.

Messaging and MQTT

Improvements

  • Backpressure resilience and deadlock prevention: The MQTT broker and dataflow pipeline now handle backpressure scenarios without risk of deadlock when applications re-inject data into a backpressured broker. Previously, this could cause the entire data pipeline to stall. The system now isolates backpressure propagation to prevent cascading blocks.

Fixes

  • Message expiry interval correctness: Fixed an issue where the MQTT broker treated message_expiry_interval=0 as no-expiry instead of expire-immediately, which did not conform to the MQTT specification. Messages with an expiry interval of zero are now correctly expired immediately.

Platform

New features

  • ARM64 platform support (GA): Azure IoT Operations now supports ARM64 architectures, enabling deployment on ARM64-based Kubernetes clusters. This includes full installation, upgrade, deletion, and observability lifecycle support with architecture-native container images. Supported environments matrix

Azure IoT Operations Experience

New features

  • Cloud-to-edge management actions: Send commands to your assets for remote operational management. Learn more
  • Enhanced transforms for data flow graphs: Leverage the new Throttle transform for better control over your data streams, or the improved Window, Branch, Filter, and Map transforms for more flexible aggregation, routing, validation, and broker state store lookups. Learn more
  • In-place transform upgrades: Upgrade or downgrade a transform right where it is within a data flow graph–no need to delete and add again. Version compatibility with your instance is automatically verified.

Azure IoT Operations CLI

Install Compatibility

  • 64-bit Azure CLI installation is required.

Deployment alignment

  • The CLI has been updated for Azure IoT Operations 2607 and deploys the following Arc extension versions:
    • Azure IoT Operations: 1.4.41
    • Cert Manager: 0.14.0
    • Secret Store: 1.5.1

Features

  • Multi-cloud support for Azure Government and China. ARM, Key Vault, Event Grid, and ACR endpoints now resolve per cloud instead of assuming public Azure.
  • Generalized az iot ops ns asset commands for events and event groups, streams, and management actions and groups.

Fixes

  • az iot ops check now reports a precise per resource "Access denied" when the cluster returns 401 or 403, instead of the misleading "Unable to fetch ... in any namespace" false negative. Principals with partial access still see valid results for the resources they can read, and the command no longer aborts.
  • Namespaced asset commands now reject capabilities the connector does not support with a clear error instead of accepting invalid input. Applies to datasets, data points, events, event groups, streams, and management groups and actions, on both add and update, whether config is inline or from a file.

Dependencies

  • The kubernetes client was updated to 36.0.2, which fixes NO_PROXY being ignored so proxied users bypass the proxy for cluster traffic as expected.

Full changelog: Azure/azure-iot-ops-cli-extension@v2.7.0...v2.8.0

Security

Fixes

  • Dataflow endpoint managed identity hardening: Fixed a security vulnerability where custom MQTT and Kafka dataflow endpoints configured with managed identity could be exploited for token theft in a confused deputy scenario. Managed identity token scoping and validation have been strengthened to prevent unauthorized token acquisition.

  • Vulnerability remediation: Addressed security vulnerabilities in Azure IoT Operations components by updating affected dependencies to patched versions.

Assets 2
Loading