You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/application-gateway/application-gateway-ssl-policy-overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: application gateway
5
5
author: mbender-ms
6
6
ms.service: azure-application-gateway
7
7
ms.topic: concept-article
8
-
ms.date: 03/04/2025
8
+
ms.date: 07/23/2025
9
9
ms.author: mbender
10
10
# Customer intent: As an IT administrator, I want to configure a TLS policy for the Application Gateway, so that I can centralize certificate management and ensure compliance with security standards while optimizing backend performance.
11
11
---
@@ -19,7 +19,7 @@ The TLS policy includes control of the TLS protocol version as well as the ciphe
19
19
## Usage and version details
20
20
21
21
> [!IMPORTANT]
22
-
> Starting **August 31, 2025**, all clients and backend servers interacting with Azure Application Gateway must use Transport Layer Security (TLS) 1.2 or higher, as [support for TLS 1.0 and 1.1 will be discontinued](https://azure.microsoft.com/updates/azure-application-gateway-support-for-tls-10-and-tls-11-will-end-by-31-august-2025).
22
+
> Starting **August 31, 2025**, all clients and backend servers interacting with Azure Application Gateway must use Transport Layer Security (TLS) 1.2 or higher, as [support for TLS 1.0 and 1.1 will be discontinued](https://azure.microsoft.com/updates/azure-application-gateway-support-for-tls-10-and-tls-11-will-end-by-31-august-2025). Visit [TLS 1.0 and 1.1 retirement](application-gateway-tls-version-retirement.md) for more details on deprecating policies and resource configuration changes.
23
23
24
24
- SSL 2.0 and 3.0 are disabled for all application gateways and are not configurable.
25
25
- A custom TLS policy allows you to select any TLS protocol as the minimum protocol version for your gateway: TLSv1_0, TLSv1_1, TLSv1_2, or TLSv1_3.
Copy file name to clipboardExpand all lines: articles/application-gateway/for-containers/migrate-from-agic-to-agc.md
+5-4Lines changed: 5 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: application gateway
5
5
author: mbender-ms
6
6
ms.service: azure-appgw-for-containers
7
7
ms.topic: concept-article
8
-
ms.date: 10/28/2024
8
+
ms.date: 7/22/2025
9
9
ms.author: mbender
10
10
# Customer intent: As a Kubernetes administrator, I want to migrate services from Application Gateway Ingress Controller to Application Gateway for Containers, so that I can leverage improved performance, seamless scaling, and modern API compatibility without experiencing downtime during the transition.
11
11
---
@@ -43,7 +43,6 @@ Prior to migration, it is important to identify any dependencies on Application
43
43
44
44
Such dependencies include:
45
45
46
-
- Web Application Firewall (WAF)
47
46
- Private IP
48
47
- Ports other than 80 and 443
49
48
- Configurable request timeout values
@@ -65,7 +64,7 @@ Here's a summarized list of AGIC annotations and whether Application Gateway for
|[Frontend port other than 80 and 443](migrate-from-agic-to-agc.md#frontend-port-override)| appgw.ingress.kubernetes.io/override-frontend-port | Not supported | Not supported |
67
66
|[Private frontend](migrate-from-agic-to-agc.md#private-frontend)| appgw.ingress.kubernetes.io/use-private-ip | Not supported | Not supported |
68
-
|[WAF](migrate-from-agic-to-agc.md#waf)| appgw.ingress.kubernetes.io/waf-policy-for-path |Not supported| Not supported |
|[Custom health probe](migrate-from-agic-to-agc.md#custom-health-probes)| appgw.ingress.kubernetes.io/health-probe-hostname |[HealthCheckPolicy](migrate-from-agic-to-agc.md#healthcheckpolicy)|[HealthCheckPolicy](migrate-from-agic-to-agc.md#healthcheckpolicy)|
70
69
|[Custom health probe](migrate-from-agic-to-agc.md#custom-health-probes)| appgw.ingress.kubernetes.io/health-probe-port |[HealthCheckPolicy](migrate-from-agic-to-agc.md#healthcheckpolicy)|[HealthCheckPolicy](migrate-from-agic-to-agc.md#healthcheckpolicy)|
71
70
|[Custom health probe](migrate-from-agic-to-agc.md#custom-health-probes)| appgw.ingress.kubernetes.io/health-probe-path |[HealthCheckPolicy](migrate-from-agic-to-agc.md#healthcheckpolicy)|[HealthCheckPolicy](migrate-from-agic-to-agc.md#healthcheckpolicy)|
@@ -298,7 +297,9 @@ AGIC annotation
298
297
299
298
Application Gateway for Containers implementation
300
299
301
-
WAF isn't supported by Application Gateway for Containers.
300
+
#### Web Application Firewall Policy
301
+
302
+
The equivalent is a new WebApplicationFirewallPolicy resource with a reference to a defined resource or resource section. More details can be found in the [Web Application Firewall](web-application-firewall.md) document.
@@ -44,7 +44,7 @@ Jobs for Hybrid Runbook Workers run under the local **System** account.
44
44
>- PowerShell 5.1, PowerShell 7.1(preview), Python 2.7, and Python 3.8 runbooks are supported on both extension-based and agent-based Windows Hybrid Runbook Workers. For agent based workers, ensure the Windows Hybrid worker version is 7.3.12960 or above.
45
45
>- PowerShell 7.2 and Python 3.10 (preview) runbooks are supported on extension-based Windows Hybrid Workers only. Ensure the Windows Hybrid worker extension version is 1.1.11 or above.
> To create environment variable in Windows systems, follow these steps:
@@ -54,89 +54,72 @@ Jobs for Hybrid Runbook Workers run under the local **System** account.
54
54
> 1. Provide **Variable name** and **Variable value**, and then select **OK**.
55
55
> 1. Restart the VM or logout from the current user and login to implement the environment variable changes.
56
56
57
+
**PowerShell 7.4**
58
+
59
+
To run PowerShell 7.4 runbooks on a Windows Hybrid Worker, install *PowerShell* on the Hybrid Worker. See [Install PowerShell on Windows](/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.5).
60
+
61
+
After PowerShell 7.4 installation is complete, create an environment variable with Variable name as powershell_7_4_path and Variable value as location of the executable *PowerShell*. Restart the Hybrid Runbook Worker after environment variable is created successfully.
62
+
57
63
**PowerShell 7.2**
58
64
59
-
To run PowerShell 7.2 runbooks on a Windows Hybrid Worker, install *PowerShell* on the Hybrid Worker. See [Installing PowerShell on Windows](/powershell/scripting/install/installing-powershell-on-windows).
65
+
To run PowerShell 7.2 runbooks on a Windows Hybrid Worker, install *PowerShell* on the Hybrid Worker. See [Install PowerShell on Windows](/powershell/scripting/install/installing-powershell-on-windows).
60
66
61
67
After PowerShell 7.2 installation is complete, create an environment variable with Variable name as powershell_7_2_path and Variable value as location of the executable *PowerShell*. Restart the Hybrid Runbook Worker after environment variable is created successfully.
62
68
63
69
**PowerShell 7.1**
64
70
65
-
To run PowerShell 7.1 runbooks on a Windows Hybrid Worker, install *PowerShell* on the Hybrid Worker. See [Installing PowerShell on Windows](/powershell/scripting/install/installing-powershell-on-windows).
71
+
To run PowerShell 7.1 runbooks on a Windows Hybrid Worker, install *PowerShell* on the Hybrid Worker. See [Install PowerShell on Windows](/powershell/scripting/install/installing-powershell-on-windows).
66
72
Ensure to add the *PowerShell* file to the PATH environment variable and restart the Hybrid Runbook Worker after the installation.
67
73
68
74
**Python 3.10**
69
75
70
-
To run Python 3.10 runbooks on a Windows Hybrid Worker, install *Python* on the Hybrid Worker. See [Installing Python on Windows](https://docs.python.org/3/using/windows.html).
76
+
To run Python 3.10 runbooks on a Windows Hybrid Worker, install *Python* on the Hybrid Worker. See [Install Python on Windows](https://docs.python.org/3/using/windows.html).
71
77
72
78
After Python 3.10 installation is complete, create an environment variable with Variable name as python_3_10_path and Variable value as location of the executable *Python*. Restart the Hybrid Runbook Worker after environment variable is created successfully.
73
79
74
80
**Python 3.8**
75
81
76
-
To run Python 3.8 runbooks on a Windows Hybrid Worker, install Python on the Hybrid Worker. See [Installing Python on Windows](https://docs.python.org/3/using/windows.html). Create **environment variable***PYTHON_3_PATH* for Python 3.8 runbooks and ensure to add the location of executable Python as **Variable value**. Restart the Hybrid Runbook Worker after the environment variable is created successfully.
82
+
To run Python 3.8 runbooks on a Windows Hybrid Worker, install Python on the Hybrid Worker. See [Install Python on Windows](https://docs.python.org/3/using/windows.html). Create **environment variable***PYTHON_3_PATH* for Python 3.8 runbooks and ensure to add the location of executable Python as **Variable value**. Restart the Hybrid Runbook Worker after the environment variable is created successfully.
77
83
78
84
If the *Python* executable file is at the default location *C:\WPy64-3800\python-3.8.0.amd64\python.exe*, then you do not have to create the environment variable.
79
85
80
86
81
87
**Python 2.7**
82
88
83
-
To run Python 2.7 runbooks on a Windows Hybrid Worker, install Python on the Hybrid Worker. See [Installing Python on Windows](https://docs.python.org/3/using/windows.html). Create **environment variable***PYTHON_2_PATH* for Python 2.7 runbooks and ensure to add the location of executable Python file as **Variable value**. Restart the Hybrid Runbook Worker after the environment variable is created successfully.
89
+
To run Python 2.7 runbooks on a Windows Hybrid Worker, install Python on the Hybrid Worker. See [Install Python on Windows](https://docs.python.org/3/using/windows.html). Create **environment variable***PYTHON_2_PATH* for Python 2.7 runbooks and ensure to add the location of executable Python file as **Variable value**. Restart the Hybrid Runbook Worker after the environment variable is created successfully.
84
90
85
91
If the *Python* executable file is at the default location *C:\Python27\python.exe*, then you do not have to create the environment variable.
> To create environment variable in Windows systems, follow these steps:
91
-
> 1. Go to **Control Panel** > **System** > **Advanced System Settings**.
92
-
> 1. In **System Properties** select **Environment variables**.
93
-
> 1. In **System variables**, select **New**.
94
-
> 1. Provide **Variable name** and **Variable value**, and then select **OK**.
95
-
> 1. Restart the VM or logout from the current user and login to implement the environment variable changes.
96
-
97
-
**PowerShell 7.1**
98
-
99
-
To run PowerShell 7.1 runbooks on a Windows Hybrid Worker, install *PowerShell* on the Hybrid Worker. See [Installing PowerShell on Windows](/powershell/scripting/install/installing-powershell-on-windows).
100
-
Ensure to add the *PowerShell* file to the PATH environment variable and restart the Hybrid Runbook Worker after the installation.
101
-
102
-
**Python 3.8**
103
-
104
-
To run Python 3.8 runbooks on a Windows Hybrid Worker, install Python on the Hybrid Worker. See [Installing Python on Windows](https://docs.python.org/3/using/windows.html). Create **environment variable***PYTHON_3_PATH* for Python 3.8 runbooks and ensure to add the location of executable Python as **Variable value**. Restart the Hybrid Runbook Worker after the environment variable is created successfully.
105
-
106
-
If the *Python* executable file is at the default location *C:\WPy64-3800\python-3.8.0.amd64\python.exe*, then you do not have to create the environment variable.
107
-
108
-
109
-
**Python 2.7**
110
-
111
-
To run Python 2.7 runbooks on a Windows Hybrid Worker, install Python on the Hybrid Worker. See [Installing Python on Windows](https://docs.python.org/3/using/windows.html). Create **environment variable***PYTHON_2_PATH* for Python 2.7 runbooks and ensure to add the location of executable Python file as **Variable value**. Restart the Hybrid Runbook Worker after the environment variable is created successfully.
112
-
113
-
If the *Python* executable file is at the default location *C:\Python27\python.exe*, then you do not have to create the environment variable.
114
-
115
-
---
116
93
117
94
### Linux Hybrid Worker
118
95
119
96
> [!NOTE]
120
97
>- PowerShell 5.1, PowerShell 7.1(preview), Python 2.7, Python 3.8 runbooks are supported on both extension-based and agent-based Linux Hybrid Runbook Workers. For agent-based workers, ensure the Linux Hybrid Runbook worker version is 1.7.5.0 or above.
121
98
>- PowerShell 7.2 and Python 3.10 (preview) runbooks are supported on extension-based Linux Hybrid Workers only. Ensure the Linux Hybrid worker extension version is 1.1.11 or above.
> To create environment variable in Linux systems, follow these steps:
127
104
> 1. Open /etc/environment.
128
105
> 1. Create a new Environment variable by adding VARIABLE_NAME="variable_value" in a new line in /etc/environment (VARIABLE_NAME is the name of the new Environment variable and variable_value represents the value it is to be assigned).
129
106
> 1. Restart the VM or logout from current user and login after saving the changes to /etc/environment to implement environment variable changes.
130
107
108
+
**PowerShell 7.4**
109
+
110
+
To run PowerShell 7.4 runbooks on a Linux Hybrid Worker, install *PowerShell* file on the Hybrid Worker. See [Install PowerShell on Linux](/powershell/scripting/install/installing-powershell-on-linux?view=powershell-7.5).
111
+
112
+
After PowerShell 7.4 installation is complete, create an environment variable with **Variable name** as powershell_7_4_path and **Variable value** as location of the executable *PowerShell* file. Restart the Hybrid Runbook Worker after an environment variable is created successfully.
113
+
131
114
**PowerShell 7.2**
132
115
133
-
To run PowerShell 7.2 runbooks on a Linux Hybrid Worker, install *PowerShell* file on the Hybrid Worker. For more information, see [Installing PowerShell on Linux](/powershell/scripting/install/installing-powershell-on-linux).
116
+
To run PowerShell 7.2 runbooks on a Linux Hybrid Worker, install *PowerShell* file on the Hybrid Worker. For more information, see [Install PowerShell on Linux](/powershell/scripting/install/installing-powershell-on-linux).
134
117
135
118
After PowerShell 7.2 installation is complete, create an environment variable with **Variable name** as *powershell_7_2_path* and **Variable value** as location of the executable *PowerShell* file. Restart the Hybrid Runbook Worker after an environment variable is created successfully.
136
119
137
120
**Python 3.10**
138
121
139
-
To run Python 3.10 runbooks on a Linux Hybrid Worker, install *Python* on the Hybrid Worker. For more information, see [Installing Python 3.10 on Linux](https://docs.python.org/3/using/unix.html).
122
+
To run Python 3.10 runbooks on a Linux Hybrid Worker, install *Python* on the Hybrid Worker. For more information, see [Install Python 3.10 on Linux](https://docs.python.org/3/using/unix.html).
140
123
141
124
After Python 3.10 installation is complete, create an environment variable with **Variable name** as *python_3_10_path* and **Variable value** as location of the executable *Python* file. Restart the Hybrid Runbook Worker after environment variable is created successfully.
142
125
@@ -150,21 +133,6 @@ Ensure to add the executable *Python* file to the PATH environment variable and
150
133
To run Python 2.7 runbooks on a Linux Hybrid Worker, install *Python* on the Hybrid Worker.
151
134
Ensure to add the executable *Python* file to the PATH environment variable and restart the Hybrid Runbook Worker after the installation.
Create Service accounts **nxautomation** and **omsagent** for agent-based Hybrid Workers. The creation and permission assignment script can be viewed at [linux data](https://github.com/microsoft/OMS-Agent-for-Linux/blob/master/installer/datafiles/linux.data). The accounts, with the corresponding sudo permissions, must be present during [installation of a Linux Hybrid Runbook worker](automation-linux-hrw-install.md).
156
-
157
-
If you try to install the worker, and the account is not present or doesn't have the appropriate permissions, the installation fails. Do not change the permissions of the `sudoers.d` folder or its ownership. Sudo permission is required for the accounts and the permissions shouldn't be removed. Restricting this to certain folders or commands may result in a breaking change. The **nxautomation** user enabled as part of Update Management executes only signed runbooks.
158
-
159
-
To ensure the service accounts have access to the stored runbook modules:
160
-
161
-
- When you use `pip install`, `apt install` or other method for installing packages on Linux, ensure the package is installed for all users. For example `sudo -H pip install <package_name>`.
162
-
- If using [PowerShell on Linux](/powershell/scripting/whats-new/what-s-new-in-powershell-70), when you use the [Install-Module](/powershell/module/powershellget/install-module) cmdlet, be sure to specify `AllUsers` for the `Scope` parameter.
163
-
164
-
The Automation worker log is located at `/var/opt/microsoft/omsagent/run/automationworker/worker.log`.
165
-
166
-
---
167
-
168
136
## Configure runbook permissions
169
137
170
138
Define permissions for your runbook to run on the Hybrid Runbook Worker in the following ways:
@@ -434,7 +402,7 @@ You will perform the following steps to complete this configuration:
434
402
> [!NOTE]
435
403
> The Create a GPG keyring and keypair are applicable only for the agent-based hybrid workers.
436
404
437
-
To create the GPG keyring and keypair, use the Hybrid Runbook Worker.
405
+
To create the GPG keyring and keypair, use the Hybrid Runbook Worker:
438
406
439
407
1. Use the sudo application to sign in as the **nxautomation** account.
0 commit comments