OpenSec Atlas

Name: azure-service-operator
Author: Azure

azure-service-operator: An Open Source Tool for Cloud Security | OpenSec Atlas

Back to Browse

Cloud Security

Tool

azure-service-operator

Azure Service Operator enables Kubernetes users to provision and manage Azure resources directly using kubectl commands.

Visit Website View on GitHub

About This Tool

Azure Service Operator allows you to create Azure resources using kubectl

Primary Use Case

This tool is designed for Kubernetes users and cloud engineers who want to manage Azure cloud resources using Kubernetes-native tooling and workflows. It allows seamless integration of Azure resource management into Kubernetes clusters by defining Azure resources as Kubernetes Custom Resources, enabling infrastructure as code and automation within Kubernetes environments.

Key Features

Provision Azure resources using Kubernetes Custom Resource Definitions (CRDs)
Kubernetes controller synchronizes desired state with actual Azure resource state
Supports two independent versions: stable v2 and deprecated v1
ASO v2 uses code-generated CRDs from Azure OpenAPI specifications for rapid resource addition
Enhanced resource status visibility with detailed Azure state and Ready condition
Dedicated storage versions for better support of Azure API version changes
Uniform resource definitions due to code generation
Can be deployed side-by-side with different versions in the same cluster

Insights & Recommendations

Users should prefer ASO v2 as ASO v1 is deprecated and no longer maintained, lacking bug fixes and security updates. ASO v2 offers improved stability, better resource state visibility, and faster support for new Azure APIs. It is recommended to review the ASOv1 to ASOv2 migration guide if upgrading from the older version. Proper Kubernetes cluster permissions and Azure credentials are required for the operator to manage resources.

Installation

For ASO v2, install via Helm chart available in /v2/charts
Alternatively, download and install from GitHub release 2.x
Refer to the official installation guide at https://azure.github.io/azure-service-operator/#installation
For ASO v1 (deprecated), install via Helm chart at /charts or OperatorHub
Or download from GitHub release 1.x

Usage

kubectl apply -f <azure-resource-crd.yaml>

Create or update an Azure resource defined as a Kubernetes Custom Resource

kubectl get <azure-resource>

Retrieve the current state of the Azure resource managed by the operator

kubectl delete <azure-resource>

Delete the Azure resource managed by the operator

Smart Usage Notes

Integrate Azure Service Operator with Kubernetes-native CI/CD pipelines to enforce secure infrastructure as code deployments.Leverage ASO's detailed resource status visibility to automate drift detection and remediation of cloud resource configurations.Use ASO to simulate attacker persistence by programmatically provisioning and modifying cloud resources during purple team exercises.Combine ASO with cloud security posture management tools to enhance continuous compliance monitoring.Deploy multiple ASO versions side-by-side to test and validate security policies and automation workflows without impacting production.