This post is also available in: Español
Another week, another set of cloud releases.
Welcome to the third edition of Didgii Weekly Cloud, where we focus on the updates that matter to engineers building, operating and securing cloud infrastructure.
This week, we're looking at shared Kubernetes infrastructure, database recovery, monitoring compatibility, new compute options and networking improvements.
Let's get into it.
Cloud in 60 seconds
AWS introduced Elastic Beanstalk Cluster Mode, allowing applications to share EKS-backed infrastructure.
AWS GuardDuty expanded its threat-detection capabilities and updated its runtime security agent.
Azure announced an upcoming PromQL compatibility change that could affect existing dashboards and alerts.
Google Cloud improved Cloud SQL disaster recovery and introduced new compute options.
GKE published new Kubernetes versions and auto-upgrade targets.
OCI enhanced FastConnect and expanded customer-managed encryption capabilities.
AWS
Elastic Beanstalk introduces Cluster Mode
Date: September 17
AWS introduced a new deployment mode for Elastic Beanstalk that allows multiple applications to run on shared infrastructure powered by Amazon EKS.
Instead of provisioning dedicated infrastructure for each application, teams can deploy applications onto pooled infrastructure.
The release includes event-driven autoscaling, OpenTelemetry-based observability, Secrets Manager integration and HTTPS by default.
AWS also introduced a GitHub Action for deploying applications directly from repositories.
Why it matters
This creates an interesting middle ground between traditional PaaS and managing Kubernetes directly.
For teams operating many small applications, sharing infrastructure could reduce per-application compute costs.
However, Cluster Mode isn't free infrastructure. AWS charges for the underlying resources, including EKS and EKS Auto Mode.
Before adopting it, compare the total cost and operational requirements against your existing deployment architecture.
Official source: AWS Elastic Beanstalk Cluster Mode
GuardDuty expands threat detection and updates its security agent
Dates: September 17–18
Amazon GuardDuty published two operationally relevant updates.
On September 17, AWS documented that AI Protection findings can contribute to Extended Threat Detection's attack-sequence correlation.
On September 18, AWS released Runtime Monitoring security agent version 1.17.1 for supported EKS, EC2 and ECS Fargate resources.
Why it matters
Threat detection becomes more useful when individual findings can be correlated into broader attack sequences.
For teams using GuardDuty Runtime Monitoring, the new agent release is also a reason to review deployment versions and compatibility.
Check your existing agent deployment and supported operating systems before planning an update.
Official source: Amazon GuardDuty documentation history
Microsoft Azure
Azure Monitor announces an important PromQL compatibility change
Date: September 17
Microsoft announced that PromQL regex matching in Azure Monitor Workspace will become fully anchored, aligning its behavior with upstream Prometheus.
Consider this query:
kube_pod_container_status_ready{pod=~"frontend"}
If your existing query depends on matching pod names that merely contain frontend, it may stop returning the expected results.
For substring matching, the intended pattern would be:
kube_pod_container_status_ready{pod=~".*frontend.*"}
Why it matters
This is more than a minor query-language adjustment.
Dashboards, recording rules and alerting rules that depend on the previous behavior could return fewer series or stop matching altogether.
For teams using Azure Managed Prometheus, reviewing existing regex selectors should be part of their maintenance work.
Official source: Azure Observability Blog — PromQL regex compatibility announcement
Oracle AI Database@Azure adds Azure Key Vault integration
Date: September 15
Oracle Autonomous AI Database on Dedicated Exadata Infrastructure now supports Azure Key Vault for encryption keys protecting data at rest.
Previously, supported key-management options included Oracle Wallet, OCI Vault and Oracle Key Vault.
The integration allows organizations to manage the relevant encryption keys through Azure Key Vault.
Why it matters
Multicloud architectures often create fragmented key-management processes.
For organizations already standardizing on Azure Key Vault, this integration provides another option for aligning database encryption with existing security policies.
It is particularly relevant to teams running Oracle databases within Azure environments.
Official source: Oracle AI Database@Azure — What's New
Google Cloud
Cloud SQL improves disaster recovery operations
Date: September 17
Google Cloud changed how point-in-time recovery (PITR) is enabled following disaster recovery operations for Cloud SQL for MySQL and PostgreSQL.
After a DR switchover or replica failover completes, PITR is now re-enabled through a separate asynchronous operation.
Previously, PITR enablement could block completion of these operations.
Why it matters
Recovery time is one of the most important considerations in database reliability.
Removing a blocking step can help reduce the time required to complete a switchover or failover.
However, teams should account for the asynchronous PITR re-enablement when validating recovery procedures and backup protection.
The improvement does not eliminate the need to test failover behavior or establish realistic RTO and RPO objectives.
Official source: Cloud SQL release notes
Compute Engine introduces Z4D instances
Date: September 17
Google Cloud announced general availability of its storage-optimized Z4D machine series.
Powered by AMD EPYC Turin processors and Titanium offload processors, these instances target workloads requiring substantial local storage capacity.
Google documents configurations supporting up to 3 TB of memory, 42,000 GiB of local Titanium SSD capacity and 400 Gbps of network bandwidth.
Why it matters
Z4D is relevant for workloads such as SQL and NoSQL databases, search engines, analytics and parallel file systems.
For database teams, high local-storage density can open new performance and cost-optimization possibilities.
But local SSD capacity shouldn't be confused with durable storage. Applications must still account for persistence, replication and recovery requirements.
Official source: Compute Engine release notes
GKE publishes new Kubernetes versions and upgrade targets
Date: September 17
Google Kubernetes Engine published version updates across its release channels.
In the Regular channel, Kubernetes 1.35.8-gke.1036000 became the default version for new cluster creation.
Additional builds became available for Kubernetes 1.34, 1.35 and 1.36.
Google also updated auto-upgrade targets and deprecated an older 1.36.3 build.
Why it matters
Managed Kubernetes still requires lifecycle management.
Teams should review available versions, maintenance windows, deprecated APIs and auto-upgrade targets.
Google notes that version rollouts can take several days across regions and zones, so availability may differ between clusters.
Official source: GKE Regular channel release notes
Oracle Cloud Infrastructure
FastConnect introduces traffic draining
Date: September 16
OCI FastConnect now supports traffic draining for private virtual circuits across partner connections, direct connections and Oracle Interconnects.
Oracle also introduced enhancements involving minimum links, interface hold timers and Letters of Authorization for direct cross-connects.
Why it matters
Hybrid cloud connectivity is often a critical dependency.
Traffic draining gives network teams an additional capability for managing traffic during connectivity changes.
Organizations using FastConnect should review how the feature fits into their existing maintenance and failover procedures.
Official source: OCI FastConnect enhancements
OCI Database with PostgreSQL adds customer-managed encryption keys
Date: September 15
OCI Database with PostgreSQL now supports using your own encryption key.
This gives organizations greater control over encryption-key management for their managed PostgreSQL databases.
Why it matters
Customer-managed keys can help organizations align database encryption with internal security and compliance requirements.
However, taking control of encryption keys also introduces operational responsibilities around access, key lifecycle and availability.
Official source: OCI Release Notes
OCI Management Agent receives security and compatibility updates
Date: September 16
Oracle released several Management Agent updates.
The agent now includes its own Jlinked JDK 21, adds Windows Server 2025 support and includes Log Analytics collector enhancements.
The release also contains bug fixes and security fixes.
Why it matters
Management agents are part of the operational foundation of cloud environments.
Keeping them compatible and updated helps maintain monitoring, logging and management capabilities.
Teams using OCI Management Agent should review their deployment versions and supported platforms.
Official source: OCI Management Agent updates
⚠️ Action Required
Review Azure Monitor PromQL queries
The upcoming regex behavior change is the clearest compatibility issue in this week's selected announcements.
Check PromQL expressions in dashboards, recording rules and alerts that depend on substring matching.
Patterns such as:
pod=~"frontend"
should be reviewed to determine whether exact matching or substring matching was intended.
If substring matching is required, use an explicit pattern such as:
pod=~".*frontend.*"
Don't wait until dashboards or alerts unexpectedly return fewer series.
Source: Azure Observability Blog
Didgii Take
Three developments stand out this week.
Kubernetes is becoming more accessible through managed abstractions. Elastic Beanstalk Cluster Mode demonstrates how AWS is bringing Kubernetes-backed infrastructure into a more traditional application-deployment experience.
Database reliability continues improving through smaller operational changes. Cloud SQL's asynchronous PITR re-enablement is a good example. Not every meaningful release introduces a new product; sometimes removing a blocking operation is what matters.
Observability compatibility deserves the same attention as application compatibility. Azure's PromQL change is a reminder that monitoring queries and alerting rules are production dependencies.
For platform teams, that means monitoring configurations should be version-controlled, reviewed and tested just like application code.
Comments