Skip to content

Commit 92a8f57

Browse files
roygararoygara
committed
Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into liFlag
2 parents e683bc3 + 4ce6fdc commit 92a8f57

File tree

10 files changed

+236
-17
lines changed

10 files changed

+236
-17
lines changed

‎articles/aks/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,8 @@
260260
- name: Scan images in your CI/CD Workflow
261261
href: ../defender-for-cloud/defender-for-container-registries-cicd.md
262262
maintainContext: True
263+
- name: Remove vulnerable images with ImageCleaner (preview)
264+
href: image-cleaner.md
263265
- name: Registry security
264266
items:
265267
- name: Scanning images in ACR registries

‎articles/aks/image-cleaner.md

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
---
2+
title: Use ImageCleaner on Azure Kubernetes Service (AKS)
3+
description: Learn how to use ImageCleaner to clean up stale images on Azure Kubernetes Service (AKS)
4+
ms.author: nickoman
5+
author: nickomang
6+
services: container-service
7+
ms.topic: article
8+
ms.date: 08/26/2022
9+
---
10+
11+
# Use ImageCleaner to clean up stale images on your Azure Kubernetes Service cluster (preview)
12+
13+
It's common to use pipelines to build and deploy images on Azure Kubernetes Service (AKS) clusters. While great for image creation, this process often doesn't account for the stale images left behind and can lead to image bloat on cluster nodes. These images can present security issues as they may contain vulnerabilities. By cleaning these unreferenced images, you can remove an area of risk in your clusters. When done manually, this process can be time intensive, which ImageCleaner can mitigate via automatic image identification and removal.
14+
15+
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
16+
17+
## Prerequisites
18+
19+
* An Azure subscription. If you don't have an Azure subscription, you can create a [free account](https://azure.microsoft.com/free).
20+
* [Azure CLI][azure-cli-install] or [Azure PowerShell][azure-powershell-install] and the `aks-preview` CLI extension installed.
21+
* The `EnableImageCleanerPreview` feature flag registered on your subscription:
22+
23+
### [Azure CLI](#tab/azure-cli)
24+
25+
Register the `EnableImageCleanerPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
26+
27+
```azurecli-interactive
28+
az feature register --namespace "Microsoft.ContainerService" --name "EnableImageCleanerPreview"
29+
```
30+
31+
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature list][az-feature-list] command:
32+
33+
```azurecli-interactive
34+
az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/EnableImageCleanerPreview')].{Name:name,State:properties.state}"
35+
```
36+
37+
When ready, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
38+
39+
```azurecli-interactive
40+
az provider register --namespace Microsoft.ContainerService
41+
```
42+
43+
### [Azure PowerShell](#tab/azure-powershell)
44+
45+
Register the `EnableImageCleanerPreview` feature flag by using the [Register-AzProviderPreviewFeature][register-azproviderpreviewfeature] cmdlet, as shown in the following example:
46+
47+
```azurepowershell-interactive
48+
Register-AzProviderPreviewFeature -ProviderNamespace Microsoft.ContainerService -Name EnableImageCleanerPreview
49+
```
50+
51+
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [Get-AzProviderPreviewFeature][get-azproviderpreviewfeature] cmdlet:
52+
53+
```azurepowershell-interactive
54+
Get-AzProviderPreviewFeature -ProviderNamespace Microsoft.ContainerService -Name EnableImageCleanerPreview |
55+
Format-Table -Property Name, @{name='State'; expression={$_.Properties.State}}
56+
```
57+
58+
When ready, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [Register-AzResourceProvider][register-azresourceprovider] command:
59+
60+
```azurepowershell-interactive
61+
Register-AzResourceProvider -ProviderNamespace Microsoft.ContainerService
62+
```
63+
64+
---
65+
66+
## Limitations
67+
68+
ImageCleaner does not support the following:
69+
70+
* ARM64 node pools. For more information, see [Azure Virtual Machines with ARM-based processors][arm-vms].
71+
* Windows node pools.
72+
73+
## How ImageCleaner works
74+
75+
When enabled, an `eraser-controller-manager` pod is deployed on each agent node, which will use an `ImageList` CRD to determine unreferenced and vulnerable images. Vulnerability is determined based on a [trivy][trivy] scan, after which images with a `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` classification are flagged. An updated `ImageList` will be automatically generated by ImageCleaner based on a set time interval, and can also be supplied manually.
76+
77+
Once an `ImageList` is generated, ImageCleaner will remove all the images in the list from node VMs.
78+
79+
80+
:::image type="content" source="./media/image-cleaner/image-cleaner.jpg" alt-text="A diagram showing ImageCleaner's workflow. The ImageCleaner pods running on the cluster can generate an ImageList, or manual input can be provided.":::
81+
82+
## Configuration options
83+
84+
In addition to choosing between manual and automatic mode, there are several options for ImageCleaner:
85+
86+
|Name|Description|Required|
87+
|----|-----------|--------|
88+
|--enable-image-cleaner|Enable the ImageCleaner feature for an AKS cluster|Yes, unless disable is specified|
89+
|--disable-image-cleaner|Disable the ImageCleaner feature for an AKS cluster|Yes, unless enable is specified|
90+
|--image-cleaner-interval-hours|This parameter determines the interval time (in hours) ImageCleaner will use to run. The default value is one week, the minimum value is 24 hours and the maximum is three months.|No|
91+
92+
## Enable ImageCleaner on your AKS cluster
93+
94+
To create a new AKS cluster using the default interval, use [az aks create][az-aks-create]:
95+
96+
```azurecli-interactive
97+
az aks create -g MyResourceGroup -n MyManagedCluster \
98+
--enable-image-cleaner
99+
```
100+
101+
To enable on an existing AKS cluster, use [az aks update][az-aks-update]:
102+
103+
```azurecli-interactive
104+
az aks update -g MyResourceGroup -n MyManagedCluster \
105+
--enable-image-cleaner
106+
```
107+
108+
The `--image-cleaner-interval-hours` parameter can be specified at creation time or for an existing cluster. For example, the following command updates the interval for a cluster with ImageCleaner already enabled:
109+
110+
```azurecli-interactive
111+
az aks update -g MyResourceGroup -n MyManagedCluster \
112+
--image-cleaner-interval-hours 48
113+
```
114+
115+
Based on your configuration, ImageCleaner will generate an `ImageList` containing non-running and vulnerable images at the desired interval. ImageCleaner will automatically remove these images from cluster nodes.
116+
117+
## Manually remove images
118+
119+
To manually remove images from your cluster using ImageCleaner, first create an `ImageList`. For example, save the following as `image-list.yml`:
120+
121+
```yml
122+
apiVersion: eraser.sh/v1alpha1
123+
kind: ImageList
124+
metadata:
125+
name: imagelist
126+
spec:
127+
images:
128+
- docker.io/library/alpine:3.7.3 # You can also use "*" to specify all non-running images
129+
```
130+
131+
And apply it to the cluster:
132+
133+
```bash
134+
kubectl apply -f image-list.yml
135+
```
136+
137+
A job will trigger which causes ImageCleaner to remove the desired images from all nodes.
138+
139+
## Disable ImageCleaner
140+
141+
To stop using ImageCleaner, you can disable it via the `--disable-image-cleaner` flag:
142+
143+
```azurecli-interactive
144+
az aks update -g MyResourceGroup -n MyManagedCluster
145+
--disable-image-cleaner
146+
```
147+
148+
## Logging
149+
150+
The deletion logs are stored in the `image-cleaner-kind-worker` pods. You can check these via `kubectl logs` or via the Container Insights pod log table if the [Azure Monitor add-on](./monitor-aks.md) is enabled.
151+
152+
<!-- LINKS -->
153+
154+
[azure-cli-install]: /cli/azure/install-azure-cli
155+
[azure-powershell-install]: /powershell/azure/install-az-ps
156+
157+
[az-aks-create]: /cli/azure/aks#az_aks_create
158+
[az-aks-update]: /cli/azure/aks#az_aks_update
159+
[az-feature-register]: /cli/azure/feature#az_feature_register
160+
[register-azproviderpreviewfeature]: /powershell/module/az.resources/register-azproviderpreviewfeature
161+
[az-feature-list]: /cli/azure/feature#az_feature_list
162+
[get-azproviderpreviewfeature]: /powershell/module/az.resources/get-azproviderpreviewfeature
163+
[az-provider-register]: /cli/azure/provider#az_provider_register
164+
[register-azresourceprovider]: /powershell/module/az.resources/register-azresourceprovider
165+
166+
[arm-vms]: https://azure.microsoft.com/blog/azure-virtual-machines-with-ampere-altra-arm-based-processors-generally-available/
167+
[trivy]: https://github.com/aquasecurity/trivy

‎articles/aks/media/image-cleaner/image-cleaner.jpg

90.5 KB
Loading

‎articles/cosmos-db/mongodb/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,8 @@
413413
href: diagnostic-queries-mongodb.md
414414
- name: Prevent rate-limiting errors
415415
href: prevent-rate-limiting-errors.md
416+
- name: Optimize query and storage costs when upgrading
417+
href: compression-cost-savings.md
416418
- name: Analytics and BI with Azure Synapse Link
417419
items:
418420
- name: Configure Azure Synapse Link

‎articles/cosmos-db/mongodb/compression-cost-savings.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
title: Improve performance and optimize costs when upgrading to Azure Cosmos DB API for MongoDB 4.0+
3+
description: Learn how upgrading your API for MongoDB account to versions 4.0+ saves you money on queries and storage.
4+
author: gahl-levy
5+
ms.service: cosmos-db
6+
ms.topic: how-to
7+
ms.date: 09/06/2022
8+
ms.author: gahllevy
9+
---
10+
11+
# Improve performance and optimize costs when upgrading to Azure Cosmos DB API for MongoDB 4.0+
12+
[!INCLUDE[appliesto-mongodb-api](../includes/appliesto-mongodb-api.md)]
13+
14+
Azure Cosmos DB API for MongoDB introduced a new data compression algorithm in versions 4.0+ that saves up to 90% on RU and storage costs. Upgrading your database account to versions 4.0+ and following this guide will help you realize the maximum performance and cost improvements.
15+
16+
## How it works
17+
The API for MongoDB charges users based on how many [request units](../request-units.md) (RUs) are consumed for each operation. With the new compression format, a reduction in storage size and query size directly results in a reduction in RU usage, saving you money. Performance and costs are coupled in Cosmos DB.
18+
19+
When [upgrading](upgrade-mongodb-version.md) from an API for MongoDB database account versions 3.6 or 3.2 to version 4.0 or greater, all new documents (data) written to that account will be stored in the improved compression format. Older documents, written before the account was upgraded, remain fully backwards compatible, but will remain stored in the older compression format.
20+
21+
## Upgrading older documents
22+
When upgrading your database account to versions 4.0+, it's good idea to consider upgrading your older documents as well. Doing so will provide you with efficiency improvements on your older data as well as new data that gets written to the account after the upgrade. The following steps upgrade your older documents to the new compression format:
23+
24+
1. [Upgrade](upgrade-mongodb-version.md) your database account to 4.0 or higher. Any new data that's written to any collection in the account will be written in the new format. All formats are backwards compatible.
25+
2. Update at least one field in each old document (from before the upgrade) to a new value or change the document in a different way- such as adding a new field. Don't rewrite the exact same document since the Cosmos DB optimizer will ignore it.
26+
3. Repeat step two for each document. When a document is updated, it will be written in the new format.
27+
28+
29+
## Next steps
30+
Learn more about upgrading and the API for MongoDB versions:
31+
* [Introduction to the API for MongoDB](mongodb-introduction.md)
32+
* [Upgrade guide](upgrade-mongodb-version.md)
33+
* [Version 4.2](feature-support-42.md)

‎articles/cost-management-billing/automate/get-small-usage-datasets-on-demand.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Cost Management
44
description: The article explains how you can use the Cost Details API to get raw, unaggregated cost data that corresponds to your Azure bill.
55
author: bandersmsft
66
ms.author: banders
7-
ms.date: 07/15/2022
7+
ms.date: 09/08/2022
88
ms.topic: conceptual
99
ms.service: cost-management-billing
1010
ms.subservice: cost-management
@@ -21,6 +21,14 @@ To learn more about the data in cost details (formerly referred to as *usage det
2121

2222
The [Cost Details](/rest/api/cost-management/generate-cost-details-report) report is only available for customers with an Enterprise Agreement or Microsoft Customer Agreement. If you're an MSDN, Pay-As-You-Go or Visual Studio customer, see [Get cost details for a pay-as-you-go subscription](get-usage-details-legacy-customer.md).
2323

24+
## Permissions
25+
26+
To use the Cost Details API, you need read only permissions for supported features and scopes. For more information, see:
27+
28+
- [Azure RBAC scopes - role permissions for feature behavior](../costs/understand-work-scopes.md#feature-behavior-for-each-role)
29+
- [Enterprise Agreement scopes - role permissions for feature behavior](../costs/understand-work-scopes.md#feature-behavior-for-each-role-1)
30+
- [Microsoft Customer Agreement scopes - role permissions for feature behavior](../costs/understand-work-scopes.md#feature-behavior-for-each-role-2)
31+
2432
## Cost Details API best practices
2533

2634
Microsoft recommends the following best practices as you use the Cost Details API.

‎articles/cost-management-billing/costs/understand-work-scopes.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Cost Management
44
description: This article helps you understand billing and resource management scopes available in Azure and how to use the scopes in Cost Management and APIs.
55
author: bandersmsft
66
ms.author: banders
7-
ms.date: 12/07/2021
7+
ms.date: 09/08/2022
88
ms.topic: conceptual
99
ms.service: cost-management-billing
1010
ms.subservice: cost-management
@@ -82,7 +82,7 @@ The following table shows how Cost Management features are used by each role. Th
8282

8383
| **Feature/Role** | **Owner** | **Contributor** | **Reader** | **Cost Management Reader** | **Cost Management Contributor** |
8484
| --- | --- | --- | --- | --- | --- |
85-
| **Cost Analysis / Forecast / Query API** | Read only | Read only | Read only | Read only | Read only |
85+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only | Read only | Read only | Read only |
8686
| **Shared views** | Create, Read, Update, Delete | Create, Read, Update, Delete | Read only | Read only | Create, Read, Update, Delete|
8787
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete | Read only | Read only | Create, Read, Update, Delete |
8888
| **Alerts** | Read, Update | Read, Update | Read only | Read only | Read, Update |
@@ -128,7 +128,7 @@ The following tables show how Cost Management features can be utilized by each r
128128

129129
| **Feature/Role** | **Enterprise Admin** | **Enterprise Read-Only** |
130130
| --- | --- | --- |
131-
| **Cost Analysis / Forecast / Query API** | Read only | Read only |
131+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only |
132132
| **Shared Views** | Create, Read, Update, Delete | Create, Read, Update, Delete |
133133
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete |
134134
| **Alerts** | Read, Update | Read, Update |
@@ -139,7 +139,7 @@ The following tables show how Cost Management features can be utilized by each r
139139

140140
| **Feature/Role** | **Enterprise Admin** | **Enterprise Read Only** | **Department Admin (only if "DA view charges" setting is on)** | **Department Read Only (only if "DA view charges" setting is on)** |
141141
| --- | --- | --- | --- | --- |
142-
| **Cost Analysis / Forecast / Query API** | Read only | Read only | Read only | Read only |
142+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only | Read only | Read only |
143143
| **Shared Views** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
144144
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
145145
| **Alerts** | Read, Update | Read, Update | Read, Update | Read, Update |
@@ -150,7 +150,7 @@ The following tables show how Cost Management features can be utilized by each r
150150

151151
| **Feature/Role** | **Enterprise Admin** | **Enterprise Read Only** | **Department Admin (only if "DA view charges" is on)** | **Department Read Only (only if "DA view charges" setting is on)** | **Account Owner (only if "AO view charges" setting is on)** |
152152
| --- | --- | --- | --- | --- | --- |
153-
| **Cost Analysis / Forecast / Query API** | Read only | Read only | Read only | Read only | Read only |
153+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only | Read only | Read only | Read only |
154154
| **Shared Views** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
155155
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
156156
| **Alerts** | Read, Update | Read, Update | Read, Update | Read, Update | Read, Update |
@@ -215,7 +215,7 @@ The following tables show how Cost Management features can be utilized by each r
215215

216216
| **Feature/Role** | **Owner** | **Contributor** | **Reader** |
217217
| --- | --- | --- | --- |
218-
| **Cost Analysis / Forecast / Query API** | Read only | Read only | Read only |
218+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only | Read only |
219219
| **Shared Views** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
220220
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
221221
| **Alerts** | Read, Update | Read, Update | Read, Update |
@@ -226,7 +226,7 @@ The following tables show how Cost Management features can be utilized by each r
226226

227227
| **Feature/Role** | **Owner** | **Contributor** | **Reader** | **Invoice Manager** |
228228
| --- | --- | --- | --- | --- |
229-
| **Cost Analysis / Forecast / Query API** | Read only | Read only | Read only | Read only |
229+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only | Read only | Read only |
230230
| **Shared Views** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
231231
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
232232
| **Alerts** | Read, Update | Read, Update | Read, Update | Create, Read, Update, Delete |
@@ -237,7 +237,7 @@ The following tables show how Cost Management features can be utilized by each r
237237

238238
| **Feature/Role** | **Owner** | **Contributor** | **Reader** | **Azure Subscription Creator** |
239239
| --- | --- | --- | --- | --- |
240-
| **Cost Analysis / Forecast / Query API** | Read only | Read only | Read only | Read only |
240+
| **Cost Analysis / Forecast / Query / Cost Details API** | Read only | Read only | Read only | Read only |
241241
| **Shared Views** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
242242
| **Budgets** | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete | Create, Read, Update, Delete |
243243
| **Alerts** | Read, Update | Read, Update | Read, Update | Read, Update |

0 commit comments

Comments
 (0)