Release v2.21.0 · Azure/azure-service-operator

What's Changed

containerservice: ManagedCluster.spec.aadProfile.serverAppSecret is now correctly identified as a secret.
synapse: Workspace.spec.encryption.kekIdentity.useSystemAssignedIdentity is now correctly typed as a Boolean instead of v1.JSON. Valid configurations are unaffected, but invalid configurations may require correction.

Add support for the new entra Application resource (#5232)
Add support for the new containerregistry RegistryCacheRule resource and API version v20251101 (#5615)
Add support for the new databasewatcher Watcher, Target, and SharedPrivateLink resources in API version v20241001preview (#5607)
Add support for the new apimanagement Diagnostic resource (#5561)
Add support for the new kusto ClusterPrincipalAssignment resource (#5598)
Add support for the new sql ServersKey and ServersEncryptionProtector resources (#5412)
Add support for the new network DDoSProtectionPlan resource (#5500)
Add support for the new eventgrid API version v20250215 (#5553)
Add support for the new documentdb API version v20260315 for Managed Cassandra (#5593)
Add support for the new sql API version v20250101 (#5594)
Add support for the new cache API version v20250701, including Redis Enterprise public network access (#5535)
Add support for the new web API version v20250501 for Flex Consumption function apps (#5503)

Add a --tls-min-version flag for the webhook and metrics servers (#5620)
Improve CRD comparison performance (#5628)
Retry Front Door custom-domain route association errors sooner (#5614)
Requeue AKS agent pools while control-plane upgrades are in progress (#5581)
Support additional labels on ASO-managed CRDs (#5588)
Enable smart-deletion prechecks for compute, containerinstance, datafactory, dbforpostgresql, devices, insights, keyvault, machinelearningservices, network, redhatopenshift, resources, servicebus, and storage resources (#5568, #5569, #5570, #5572, #5574, #5575, #5508, #5509, #5510, #5511, #5512, #5513)
Migrate authorization, cache, cdn, cognitiveservices, containerinstance, dataprotection, sql, and subscription resources to hybrid versioning (#5506, #5516, #5507, #5542, #5590, #5533, #5519, #5498)
Allow credential acquisition from an ASO-created managed identity (#5490)
Improve redaction of Entra-specific sensitive values (#5499)
Remove retired Redis Enterprise resources (#5640)
Add and update the Helm chart (#5484)
Update numerous dependencies

Fix bug where special characters in PostgreSQL and Azure SQL user passwords were not escaped correctly (#5551)
Fix bug where generated webhook functions could have colliding receiver names (#5606)
Fix bug where Application Gateway private-link IP configuration was not modeled (#5502)

We welcome and thank our external contributors:

andreidorin-oprea made their first contributions, adding Database Watcher, Kusto ClusterPrincipalAssignment, Managed Cassandra and App Service API support, and several fixes (#5607, #5598, #5593, #5503, #5609, #5606, #5502)
Marek Veber (@marek-veber) made their first contribution, adding configurable minimum TLS versions for the webhook and metrics servers (#5620)

These breaking changes will be included in future releases

In v2.22 we'll default to using TLS 1.3, but will provide a command line flag to enable TLS 1.2 if needed.