Cloud Computing Köln

Announcing general availability of incremental snapshots of Managed Disks

We're announcing the general availability of incremental snapshots of Azure Managed Disks. Incremental snapshots are a cost-effective, point-in-time backup of managed disks. Unlike current snapshots, which are billed for the full size, incremental snapshots are billed for the delta changes to disks since the last snapshot and are always stored on the most cost-effective storage, Standard HDD storage irrespective of the storage type of the parent disks. For additional reliability, Managed Disks are also stored on Zone Redundant Storage (ZRS) by default in regions that support ZRS.

Incremental snapshots provide differential capability, enabling customers and independent solution vendors (ISVs) to build backup and disaster recovery solutions for Managed Disks. It allows you to get the changes between two snapshots of the same disk, thus copying only changed data between two snapshots across regions, reducing time and cost for backup and disaster recovery. Incremental snapshots are accessible instantaneously; you can read the underlying data of incremental snapshots or restore disks from them as soon as they are created. Azure Managed Disk inherit all the compelling capabilities of current snapshots and have a lifetime independent from their parent managed disks and independent of each other.

Examples of incremental snapshots

Let’s look at a few examples to understand how the incremental snapshots help you reduce cost.

If you were using a disk with 100 GiB already occupied and added 20 GiB of data to the disk, you took the first incremental snapshot before 20 GiB of data was added to the disk, making the first copy occupy 100 GiB of data. Then 20 GiB of data was added on the disk before you created the second incremental snapshot. Now with incremental snapshots, the second snapshot occupies only 20 GiB and you’re billed for only 20 GiB compared to the current full snapshots that would have occupied 120 GiB and billed for 120 GiB of data, reducing your cost.

The second incremental snapshot references 100 GiB of data from the first snapshot. When you restore the disk from the second incremental snapshot, the system can restore 120 GiB of data by copying 100 GiB of data from the first snapshot and 20 GiB of data from the second snapshot.

Let's now understand what happens when 5 GiB of data was modified on the disk before you took the third incremental snapshot. The third snapshot then occupies only 5 GiB of data, references 95 GiB of data from the first snapshot, and references 20 GiB of data from the second snapshot.

Now, if you deleted the first incremental snapshot the second and the third snapshots continue to function normally as incremental snapshots are independent of each other. The system merges the data occupied by the first snapshot with the second snapshot under the hood to ensure that the second and the third snapshots are not impacted due to the deletion of the first snapshot. The second snapshot now occupies 120 GiB of data.  Since we launched the preview for incremental snapshot in September 2019, our ISVs have used this capability on a wide range of workloads to reduce the cost and time for backup and disaster recovery.

Below are some quotes from partners in our preview program:

“Zerto has been helping enterprise customers who leverage Microsoft Azure become IT Resilient for years. Extending Azure Managed Disks with the incremental snapshots API has enabled Zerto to improve upon industry-best RTOs and RPOs in Azure. The powerful capabilities of Azure Managed Disks enable Zerto to meet the scale and performance requirements of a modern enterprise. With Zerto and Microsoft’s continued collaboration and integration, we’ll continue to pave the way for IT Resilience in the public cloud.” – Michael Khusid, Director of Product Management, Zerto, Inc.

“Combining Rubrik Azure data protection with the latest Microsoft API delivering incremental snapshots, we reduce the time and cost for backup and recovery, and help our joint customers achieve 18x lower costs, high storage efficiency, reduced network traffic, and hourly RPOs. Together, Rubrik and Microsoft enable our enterprise customers to accelerate their cloud journey while unlocking productivity and better cloud economics.” – Shay Mowlem, Senior Vice President of Product & Strategy, Rubrik

“With incremental snapshots of Azure managed disks, Dell EMC PowerProtect Cloud Snapshot Manager (CSM) customers will be able to reduce their backup times and storage costs significantly. Also, they’ll be able to achieve much shorter recovery time objectives with instant access to their data from snapshots. Designed for any-size cloud infrastructure, CSM provides global visibility and control to gain insights into data protection activities across Azure subscriptions, making CSM a great solution for protecting customer workloads in public cloud environments.” – Laura Dubois, vice president, product management, Dell Technologies Data Protection

 

Availability and pricing

You can now create incremental snapshots in all regions, including sovereign regions.

Incremental snapshots are charged per GiB of the storage occupied by the delta changes since the last snapshot. For example, if you're using a managed disk with a provisioned size of 128 GiB, with 100 GiB used, the first incremental snapshot is billed only for the used size of 100 GiB. 20 GiB of data is added on the disk before you create the second snapshot. Now, the second incremental snapshot is billed for only 20 GiB.

Incremental snapshots are always stored on standard storage irrespective of the storage type of parent managed disks and charged as per the pricing of standard storage. For example, incremental snapshots of a Premium SSD Managed Disk are stored on standard storage. They are stored on ZRS by default in regions that support ZRS. Otherwise, they are stored on locally redundant storage (LRS). The per GB pricing of both the LRS and ZRS options is the same.

Incremental snapshots cannot be stored on premium storage. If you are using current snapshots on premium storage to scale up virtual machine deployments, we recommend you use custom images on standard storage in Shared Image Gallery. This will help you to achieve higher scale with lower cost.

You can visit the Managed Disk Pricing for more details about the snapshot pricing.

Getting started

Create an incremental snapshot using CLI.
Create an incremental snapshot using PowerShell.

Quelle: Azure

Azure Container Registry Private Link support preview for virtual networks

Azure Container Registry announces preview support for Azure Private Link, a means to limit network traffic of resources within the Azure network.

With Private Link, the registry endpoints are assigned private IP addresses, routing traffic within a customer-defined virtual network. Private network support has been one of the top customer asks, allowing customers to benefit from the Azure management of their registry while benefiting from tightly controlled network ingress and egress.
  

Private Links are available across a wide range of Azure resources with more coming soon, allowing a wide range of container workloads with the security of a private virtual network.

Private Endpoints and Public Endpoints

Private Link provides private endpoints to be available through private IPs. In the above case, the contoso.azurecr.io registry has a private IP of 10.0.0.6 which is only available to resources in contoso-aks-eastus-vnet. This allows the resources in this VNet to securely communicate. The other resources may be restricted to resources only within the VNet.

At the same time, the public endpoint for the contoso.azurecr.io registry may still be public for the development team. In a coming release, Azure Container Registry (ACR) Private Link will support disabling the public endpoint, limiting access to only private endpoints, configured under private link.

Cross tenant manual approval support

Customers looking to establish a private link between two Azure tenants, where an Azure container registry is in one tenant and while container hosts are in other tenants can use the Private Link Manual Approval workflow. This workflow enables many Azure services, including Azure Machine Learning, to securely interact with your registry. Development teams working in different subscriptions and tenants may also utilize private link manual approval to grant access.

Service Endpoints and Private Links

ACR Service Endpoint preview support was released in March 2019. Service Endpoints provide access from Azure VNets through IP tagging. All traffic to the service endpoint is limited to the Azure backbone network through routing. The public endpoint still exists; however, firewall rules limit public access. Private Link capabilities take this a step further by providing a private endpoint (IP address). As Private Links are more secure and a superset of capabilities of Service Endpoints, Private link support will replace Azure Container Registry Service Endpoint support. While both Service Endpoints and Private Link are currently in preview, we plan to release Private Link capabilities as generally available shortly. We encourage Service Endpoint customers to evaluate ACR Private Link capabilities.

Preview support and limitations

During the preview period, private link support is limited to registries that are not geo-replicated. The feature will move to general availability as we assess feedback and geo-replication support is complete.

We’ve heard clearly that customers requiring private networks also require production support. As such, all support requests will be honored through standard support channels.

Regional support and pricing

Azure Container Registry Private Link support is available across 28 regions through the premium tier.

Additional links:

Learn more about Azure Container Registry.
Azure Container Registry pricing.
Configure Azure Private Link for an Azure Container Registry.

Quelle: Azure

Azure Government Secret accredited at DoD IL6, ICD 503 with IaaS and PaaS

Accelerate classified missions with unparalleled connectivity, high availability, and resiliency across three regions with more than 35 services

Azure Government Secret recently achieved Provisional Authorization (PA) at Department of Defense Impact Level 6 (IL6) and Intelligence Community Directive (ICD) 503 with facilities at ICD 705. We’re also announcing a third region to enable even higher availability for national security missions to stay ahead of their unique threats.

Built exclusively for the needs of US government and operated by cleared US citizens, Azure Government Secret delivers dedicated regions to maintain the security and integrity of classified Secret workloads while enabling reliable access to critical data. The first cloud natively connected to classified networks; Azure Government Secret enables customers to leverage options for private, resilient, high-bandwidth connectivity.

Protect national security production workloads with geodiversity across three regions

Azure Government Secret is designed for the unique requirements of critical national security workloads that cannot be served out of a single geographic location. To provide the geodiversity required, Azure Government Secret delivers across three dedicated regions for US Federal Civilian, Department of Defense (DoD), Intelligence Community (IC), and US government partners working within Secret enclaves. These dedicated Azure regions are located over 500 miles apart to enable applications to stay running in the face of a disaster without a break in continuity of operations.

In addition, these regions provide greater choice when working across multiple locations and delivering cloud-to-edge scenarios. With comprehensive cloud services Azure Government Secret enables faster innovation for the mission from cloud to tactical edge meeting the critical availability needs of the warfighter.

Enabling classified missions at scale with more than 35 services

Designed and built for Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) and Marketplace solutions, Azure Government Secret provides a broad range of commercial innovation for classified workloads.­ Some of the services include: identity, analytics, security, and high performance computing to support advanced artificial intelligence (AI) and machine learning.

Operated by cleared US citizens, these new regions are part of Azure Government, delivering a familiar, consistent experience and alignment with existing resellers and programs. Eligible customers can also leverage cleared Microsoft cloud support for their workloads.

Gain speed by connecting directly or extending on-premises networks

With Azure Government Secret, customers can connect natively to classified networks or leverage options for private, resilient, high-bandwidth connectivity using ExpressRoute and ExpressRoute Direct:

Native connection: Agencies with direct connections through US government classified networks can connect natively to Azure Government Secret.
ExpressRoute: Extend on-premises networks into Azure Government Secret regions over a private connection facilitated by a connectivity provider with ExpressRoute.
ExpressRoute Direct: Get the ability to connect directly into Azure Government Secret locations using ExpressRoute Direct.

Continued investments in commercial parity across data classifications

In addition to serving mission customers at DoD IL6 and ICD 503, we continue to invest in rapidly delivering new Azure Government capabilities to support mission needs across all data classifications for any US government customer. In the last six months we’ve continued our drive toward commercial parity, adding hundreds of features and launching 40+ new services and 101 total services in FedRAMP High, with more to come across Azure commercial, Azure Government and Azure Government Secret.

These continued investments enable customers across the full spectrum of government, including departments in every state, all the federal cabinet agencies, and each military branch, modernize their IT to better achieve their missions.

To learn more about Azure Government Secret contact us or visit Azure Government for national security.
Quelle: Azure