Azure Container Services Docs – Weekly Update (2026-04-19 to 2026-04-26)

AKS – Manage Entra Id Authorization

Summary

The documentation has been updated to reflect the transition from Azure RBAC to Microsoft Entra ID authorization for managing access to the Kubernetes API in AKS. Users can now authorize API access using Entra ID identities and apply ABAC conditions to restrict access to specific custom resource types, enhancing their ability to manage permissions at scale. Additionally, the article has consolidated related concepts and improved clarity on the prerequisites and commands for enabling and managing Entra ID authorization.

AKS – AKS Edge Whats New

Summary

The documentation now highlights that with the release of AKS Edge Essentials version 1.12.269.0, users can perform cross-distribution upgrades within the same Kubernetes release version, which was not supported in previous releases. Additionally, the KMS provider is now enabled by default for new deployments, simplifying the setup process as no further configuration is required. Users are also advised to ensure 19GB of free disk space before upgrading or installing the new version.

AKS – Operator Best Practices Cluster Security

Summary

The documentation has been updated to remove references to the legacy Microsoft Entra CLI, ensuring users are directed to the most current integration methods. Additionally, the sections on custom resources and identity management have been refined to enhance clarity and usability for implementing best practices in cluster security.

AKS – AKS Desktop Permissions

Summary

The documentation for setting up permissions and role-based access control (RBAC) in AKS Desktop has been updated to clarify how users can manage RBAC permissions based on their roles as cluster operators or developers. Users can now provide environments for developers to deploy and manage applications, and the article emphasizes the need to maintain or automate permissions over time. Additionally, it notes that there is currently no UI option to modify project permissions after creation, requiring users to utilize the Azure portal or Azure CLI for such updates.

AKS – Helm Charts in Mixed Linux Windows Clusters

Summary

File: AKS-Arc/includes/helm-charts-in-mixed-linux-windows-clusters.md Subjects: – Merge branch ‘main’ into fix/bitlocker-docs-csv-lifecycle – Reverted back David and Paul as per SEth’s suggestions – Update author and ms.author metadata for Liz Ross team content leads Patch excerpt: -author: sethmanheim -ms.author: sethm +author: davidsmatlak +ms.author: davidsmatlak -author: sethmanheim -ms.author: sethm +author: davidsmatlak +ms.author: davidsmatlak -author: davidsmatlak -ms.author: davidsmatlak +author: sethmanheim +ms.author: sethm

AKS – AKS Service Permissions

Summary

Reference for the Azure permissions required by the identity creating an AKS cluster, the cluster identity at runtime, and AKS node access.

AKS – Pci Identity

Summary

The documentation has been updated to clarify the integration of Microsoft Entra ID with Azure Kubernetes Service (AKS) by dropping the ‘AKS-managed’ qualifier and renaming sections for better scenario clarity. Users can now find more relevant information on using Microsoft Entra ID authorization for the Kubernetes API and controlling access to cluster resources with updated links and references throughout the document.

AKS – Disable Windows Nodepool

Summary

The documentation now states that starting with release 2509, the Windows node pool feature is disabled by default, enhancing the download experience by preventing unnecessary Windows VHD downloads. Users with existing clusters that include Windows node pools must either re-enable the feature to continue using them or delete the pools before upgrading Azure Local or AKS Arc, as upgrades will fail if the feature remains disabled while Windows node pools exist.

AKS – AKS Edge Workload Identity

Summary

The document has been modified to enhance the explanation of Workload identity federation in Azure Arc-enabled Kubernetes, including best practices for security and token rotation.

AKS – Intro AKS Automatic

Summary

The documentation has been updated to reflect new naming conventions and restructuring for clarity regarding Azure RBAC and Kubernetes RBAC with Entra ID. Users can now find the updated sections under "entra-id-authorization" and "kubernetes-rbac-entra-id," which provide clearer guidance on managing access and identity within Azure Kubernetes Service. This change enhances the usability and understanding of identity management in AKS scenarios.

AGC – Migrate From Agic to Agc

Summary

The documentation for migrating from Application Gateway Ingress Controller (AGIC) to Application Gateway for Containers (AGC) has been updated to include a new tip about a migration utility that can assist users in automatically translating AGIC Ingress to Gateway API for AGC. Additionally, the language has been refined for clarity, particularly regarding the identification of dependencies on AGIC features that may not be available in AGC, emphasizing that these should be prioritized later in the migration strategy. Users can now find clearer instructions on deprecating AGIC and managing the AGIC add-on and helm deployments.

AKS – Kubernetes Portal

Summary

The documentation has been updated to remove the ‘AKS-managed’ qualifier from the Microsoft Entra integration section, clarifying that any existing AKS cluster can support Microsoft Entra integration. This change simplifies the requirements for users integrating Microsoft Entra with their AKS clusters, making it clear that the integration is not limited to AKS-managed environments.

AKS – Kubernetes Monitor Audit Events

Summary

The documentation now reflects an updated command for creating diagnostic settings in Azure Monitor, specifically changing the parameter from `<LA_Workspace_ID>` to `<LA_Workspace_resource_ID>`. This change clarifies the expected input for users, ensuring they provide the correct resource ID when configuring diagnostic settings for their Kubernetes clusters.

AKS – Container Network Performance Ebpf Host Routing

Summary

The documentation now clarifies that enabling eBPF Host Routing updates nodes through rolling upgrades for node pools, ensuring existing connections are respected during node drain timeouts. Additionally, it confirms that dual-stack connectivity is supported with eBPF Host Routing, addressing previous limitations regarding dual stack networking. Users should note that the Istio add-on remains incompatible with clusters where eBPF Host Routing is enabled.

AKS – Custom Node Configuration

Summary

The documentation now recommends using Microsoft Entra ID authorization for the Kubernetes API instead of Azure Role-Based Access Control (RBAC) to restrict access to custom node configuration settings. This change emphasizes a more specific approach to managing permissions, which can enhance cluster stability and performance by limiting who can modify configurations. Users should refer to the updated guidance to implement these security measures effectively.

AKS – Concepts Cluster Authorization

Summary

Learn how authorization for the Kubernetes API works in Azure Kubernetes Service (AKS), and how to choose between Kubernetes RBAC and Microsoft Entra ID authorization with optional Azure ABAC conditions.

AKS – Operator Best Practices Identity

Summary

This document discusses best practices for managing authentication and authorization in Azure Kubernetes Service (AKS). It emphasizes the use of Microsoft Entra ID for centralized identity management and outlines strategies for controlling access to resources using Kubernetes RBAC.

AKS – Kubernetes Service Principal

Summary

File: articles/aks/kubernetes-service-principal.md Subjects: – Merge pull request #3082 from MicrosoftDocs/main – Merge pull request #3061 from shashankbarsin/abac-custom-resources-and-identity-refactor – Update authors and references in AKS documentation Patch excerpt: -ms.author: davidsmatlak +ms.author: shasb -ms.author: davidsmatlak +ms.author: shasb -ms.author: davidsmatlak +ms.author: shasb

AKS – AKS Edge Concept Networking

Summary

This document has been revised to enhance the explanation of networking concepts in AKS Edge, providing users with clearer insights into the topic.

AKS – Concepts Kubernetes API Authorization

Summary

New page added.

AKS – Backup Workload Cluster

Summary

The article has been revised to provide clearer instructions on backing up and restoring workload clusters using Velero, which is critical for disaster recovery planning.

AKS – Pci Enhanced Mfa Implementation

Summary

The documentation has been updated to clarify the implementation of Azure RBAC for managing access to AKS resources, specifically highlighting the use of Microsoft Entra ID authorization for the Kubernetes API. Users can now find more relevant information by following the updated links to the Entra ID authorization documentation, which replaces previous references to Azure RBAC for Kubernetes Authorization. This change enhances the guidance on managing access control within AKS environments.

AKS – Pci Malware

Summary

The documentation now clarifies that during cluster creation, multiple local Kubernetes users are created by default, which cannot be audited due to their lack of unique identity and potential high privileges. Users are advised to disable these local accounts using the updated "Disable local accounts" feature of AKS, with improved links directing to the relevant section for better accessibility. Additionally, the identity documentation has been renamed for clearer scenario understanding.

AKS – How to Apply Wireguard

Summary

The documentation for deploying WireGuard encryption with Advanced Container Networking Services has been updated to reflect its general availability status. Users are now informed that WireGuard is disabled by default after enabling Advanced Container Networking Services, and they can enable it by using the `–acns-transit-encryption-type wireguard` flag. Additionally, the instructions clarify that WireGuard can be independently disabled without affecting other features by using the `–acns-transit-encryption-type=none` flag.

ACR – Artifact Cache Acr to Acr CLI

Summary

Learn how to cache container images from one Azure Container Registry in another using managed identity authentication with Azure CLI and Bicep.

AKS – AKS Whats New Local

Summary

The documentation for AKS on Azure Local has been updated to reflect significant changes in Kubernetes version support and encryption methods. Users will now find that Kubernetes versions 1.30 and 1.29 are no longer supported, while KMS v2 is introduced for encrypting the Kubernetes secret store in new clusters created on Azure Local 2510 and later. Additionally, users can now create AKS Arc clusters with a user-specified pod CIDR IP range and enable Azure RBAC during cluster creation using Azure CLI and Resource Manager templates.

AKS – Quick Kubernetes Deploy CLI

Summary

The documentation now includes updated commands for deploying an Azure Kubernetes Service (AKS) cluster, specifically changing variable names to enhance clarity and uniqueness. Users can now add a user mode node pool to their cluster using the `az aks nodepool add` command, which provides better isolation and flexibility for application workloads. Additionally, the article emphasizes that the default node count for production environments should be three or more, while the example specifies one node for evaluation purposes.

AKS – AKS Edge Howto Secret Encryption

Summary

The documentation for AKS Edge Essentials has been updated to clarify that secrets stored in the Kubernetes secret store are encrypted at rest by default using the Key Management Service (KMS) provider. Users can now enable the KMS provider using the aksedge-config for specific product versions, and starting with version 1.12.269.0, it will be enabled by default for all newly created clusters. Additionally, the section on verifying the health of the KMS provider has been revised to reflect these changes.

AKS – Quick Kubernetes Deploy Rm Template

Summary

The documentation has been updated to improve clarity and usability, providing a better guide for users deploying Kubernetes with resource manager templates.

AKS – Supported Gpu Models

Summary

The documentation now includes additional supported GPU models for Azure Kubernetes Service (AKS) on Azure Local, specifically the NVIDIA L4, L40, L40S, and RTX Pro 6000, along with their respective VM sizes and specifications. Users can now utilize these new GPU models and their associated SKUs, which are currently in preview, enhancing their options for GPU workloads on AKS.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Addon

Summary

The documentation has been updated to clarify that the enablement of the Application Gateway for Containers AKS add-on on an AKS Automatic cluster is not currently supported. Additionally, the guidance on navigating to the `MC_` resource group and checking the GatewayClass condition has been refined for clarity, ensuring users understand that the resources are automatically created by the add-on and managed by the ALB Controller.

AKS – Workload Identity Overview

Summary

The documentation now includes a note clarifying that Workload ID addresses the **pod-to-Azure** identity scenario in AKS, detailing how applications in pods authenticate to Microsoft Entra–protected services. Users are directed to refer to the "Access and identity options for AKS" section for information on other identity scenarios, such as control-plane authentication and cluster-to-Azure managed identities.

AKS – Create Clusters Bicep

Summary

The documentation now provides clearer instructions on creating Kubernetes clusters in Azure Local using Bicep, including a more detailed workflow that emphasizes the creation of an SSH key pair and the use of `kubectl`. Users can now access a dedicated repository for deploying AKS Arc clusters with Bicep templates, which includes deployment instructions, examples, and parameter file templates. Additionally, there are updated references for connecting to the cluster and managing node pools, enhancing the overall usability of the guide.

AKS – Enable Authentication Microsoft Entra Id

Summary

The documentation now clarifies that the AKS-managed Microsoft Entra integration simplifies the setup process by eliminating the need for users to create client and server apps, as these are now managed by the AKS resource provider. Additionally, it specifies that cluster administrators can configure Kubernetes role-based access control (RBAC) based on user identity or directory group membership, enhancing the management of access permissions. Users are also informed about the requirement for specific Azure CLI and Kubernetes versions to ensure compatibility with the new integration features.

AKS – What Is AKS

Summary

The documentation has been updated to clarify the integration of Kubernetes RBAC with Microsoft Entra ID, specifically changing the reference to the relevant RBAC documentation. Users can now find more precise guidance on limiting access to cluster resources and setting up Kubernetes access based on existing identity and group membership through the updated links.

AKS – Managed Namespaces

Summary

The documentation has been updated to reflect a renaming and restructuring of the "manage-azure-rbac" section to "entra-id-authorization," which may affect how users find and utilize information related to Azure RBAC in Kubernetes. Users can now access the updated "entra-id-authorization" how-to guide, which provides clearer instructions on managing identity and access for Azure Kubernetes Service.

AKS – External Identity Provider Authentication Configure

Summary

The documentation for configuring external identity provider authentication in Azure Kubernetes Service (AKS) has been updated to include additional command references, enhancing user access to relevant CLI commands. Users can now find links to commands such as `az-aks-jwtauthenticator-add`, `az-aks-jwtauthenticator-delete`, and `az-feature-register`, which will facilitate easier navigation and usage of these features. This change improves the overall usability of the documentation for managing identity authentication in AKS.

AKS – Azure Cni Overlay Pod Expand

Summary

The document has been modified to remove outdated content and clarify the registration process for the EnableAzureCNIOverlayPodCIDRExpansion feature flag, which is essential for pod CIDR expansion in Azure CNI Overlay AKS clusters.

AKS – Update Credentials

Summary

The documentation has been updated to retire legacy Microsoft Entra CLI references, enhancing clarity for users. Key concepts related to authentication and authorization have been split into two distinct documents, allowing users to better understand and implement best practices for identity management. Additionally, the paths for creating Azure AD applications and integrating with Azure AD have been updated to reflect the new structure, directing users to the latest resources for Entra ID control plane authentication.

AKS – Gpu Enabled Cluster Issue

Summary

This new document outlines troubleshooting steps for issues encountered when creating AKS clusters with GPU-enabled default node pools, specifically when using NVIDIA L-series GPUs.

AKS – Pricing

Summary

The documentation now clarifies that the 60-day evaluation period for Azure Kubernetes Service (AKS) on Windows Server is a one-time benefit per subscription and will not reset upon reinstallation. Additionally, it specifies that running Windows Server containers requires a Windows Server license, which can be obtained separately or added to the cost of a Windows virtual machine on Azure. These changes enhance user understanding of pricing and licensing implications for AKS deployments.

AKS – AKS Edge How to Akri Opc Ua

Summary

The documentation now directs users to a new link for creating OPC UA compliant X.509v3 certificates, which includes necessary components such as an application URI. This update ensures that users have access to the most current resources for certificate management in the context of OPC UA.

AKS – Azure Netapp Files Nfs

Summary

The documentation for installing Trident has been updated to reflect new links for the installation methods, including the Trident operator and `tridentctl`. Users can now access the updated Trident Install Guide, which provides a more streamlined approach to installation, specifically directing them to the quickstart resources. This change enhances clarity and accessibility for users looking to deploy Trident in their Kubernetes environments.

AKS – Support Policies

Summary

The AKS support policy documentation has been updated to clarify that Microsoft does not support node images that are older than 90 days, replacing the previous language that indicated only best-effort support would be provided for such images. This change emphasizes the importance of keeping agent node OS and runtime components up to date to ensure full support from Microsoft. Users should now be more aware of the implications of using outdated node images.

AKS – Trusted Access Feature

Summary

The documentation has been updated to retire legacy Microsoft Entra CLI references and rename identity-related documents for improved clarity. Users can now find updated links to relevant resources, including the new document for Microsoft Entra clusters, which enhances understanding of identity management in AKS. Additionally, the section on accessing AKS clusters with Trusted Access has been clarified to ensure users can effectively utilize role bindings and manage permissions.

AKS – Access Control Managed Azure Ad

Summary

The documentation has been updated to remove the ‘AKS-managed’ qualifier from references to Microsoft Entra integration, simplifying the language used throughout the section. Users can now configure node-side access modes that inherit Conditional Access, including Microsoft Entra ID-based SSH, with clearer instructions linked to the "Manage SSH access on AKS cluster nodes" guide. This change enhances clarity and usability for managing access control in AKS environments.

AKS – AKS Edge Overview

Summary

The documentation has been updated to reflect that the Key Management Service (KMS) provider for secret encryption is now enabled by default on AKS Edge Essentials version 1.12.269.0 and later. Users can now validate and troubleshoot encryption for their AKS Edge Essentials clusters, enhancing their ability to manage secret encryption effectively. Additionally, the terminology has been changed from "KMS plugin" to "KMS provider" for clarity.

AKS – Manage Azure RBAC

Summary

The document has been significantly updated to remove outdated content and streamline the information regarding Azure RBAC for Kubernetes Authorization. It emphasizes the integration of Microsoft Entra ID and AKS, providing clarity on managing authorization within AKS clusters.

AKS – Entra Id Authorization

Summary

The article has been significantly updated to include new examples and detailed instructions for creating custom role definitions and assigning them using Azure CLI commands. It emphasizes the importance of enabling Entra ID authorization at cluster creation and provides a comprehensive overview of available Kubernetes API authorization options in AKS.

AKS – External Identity Provider Authentication Overview

Summary

The documentation has been updated to clarify that Microsoft Entra ID is not supported as an external identity provider through structured authentication, and users should utilize the existing Microsoft Entra integration for authentication instead of the previously referenced AKS-managed integration. Additionally, the documentation has been renamed for better clarity regarding the identity scenarios, specifically changing references to the Microsoft Entra integration to reflect this update.

AGC – Overview

Summary

The documentation for Application Gateway for Containers has been updated to include flexible load balancing strategies, such as Least Request, Load Aware Routing, Ring Hash, Round Robin, and Weighted Round Robin. This enhancement allows users to implement more efficient traffic management and distribution across their AKS clusters. Additionally, the overview now specifies that the new set of Azure Resource Manager APIs is distinct from the existing Application Gateway, clarifying the service’s architecture and management within the AKS environment.

AKS – AKS Edge System Requirements

Summary

The documentation now specifies that the minimum disk space requirement for the host machine running AKS Edge Essentials has increased from at least 14 GB to at least 19 GB free. Additionally, a new section on secret encryption has been added, detailing the KMS provider for AKS Edge Essentials, enhancing user understanding of security requirements.

AKS – Create Volume Azure Files

Summary

The documentation now clarifies that users can enable data encryption in transit for NFS Azure file shares by setting `encryptInTransit: "true"` in either StorageClass parameters or PersistentVolume `volumeAttributes`. Additionally, a new example for existing persistent volumes has been added, demonstrating how to configure `encryptInTransit` for PVs created without this setting. The StorageClass name has also been updated to `azurefile-csi-premiumv2-eit` to reflect this change.

AKS – Get Started

Summary

The documentation now specifies that users should refer to the updated link for AKS-managed Microsoft Entra integration, which is now located at /azure/aks/entra-id-control-plane-authentication. This change clarifies the necessary steps for enabling Azure Kubernetes Application Network connectivity and security when using an existing AKS cluster.

AKS – AKS Desktop Deploy Troubleshooting

Summary

Learn how to troubleshoot Kubernetes applications in AKS desktop using the built-in Insights feature powered by Inspektor Gadget.

AKS – Best Practices

Summary

The documentation has been reorganized to provide clearer guidance on authentication and authorization in Azure Kubernetes Service (AKS). Users can now find dedicated sections for "Cluster authentication concepts" and "Cluster authorization concepts," which replace the previous combined best practices section, allowing for more focused information on each topic. This change enhances the clarity and usability of the documentation for managing identity and access in AKS.

AKS – Data Collection

Summary

The data collection document has been updated to clarify the types of data collected and the processes involved. This enhances transparency and understanding for users regarding data handling in AKS Arc.

AKS – Local Accounts

Summary

The documentation for managing local accounts with Microsoft Entra integration has been updated to remove the ‘AKS-managed’ qualifier, clarifying that the integration is now referred to simply as Microsoft Entra integration. Additionally, references to the Azure RBAC integration have been updated to point to the new "entra-id-authorization" documentation, enhancing user understanding of identity management within AKS.

AKS – Kubernetes RBAC Entra Id

Summary

The documentation has been reorganized to enhance clarity on authentication and authorization in AKS. Users can now find best practices consolidated under "Authentication and authorization concepts in AKS," which replaces the previous references to "Best practices for authentication and authorization in AKS." Additionally, the sections on identity best practices and authorization concepts have been merged into a single concepts page, streamlining the information available for users.

AKS – Cluster Unhealthy After Kubernetes Upgrade

Summary

Learn how to troubleshoot and mitigate an issue that causes AKS cluster to become unhealthy after Kubernetes upgrade

AKS – Container Network Security Wireguard Encryption Concepts

Summary

The documentation for WireGuard encryption with Advanced Container Networking Services (ACNS) has been updated to reflect its general availability, removing references to public preview. Users can now find detailed information on how WireGuard in-transit encryption secures specific traffic flows within Kubernetes clusters, including which traffic types are encrypted and which are not supported.

AKS – AKS Arc Local Requirements

Summary

Learn about system storage requirements for Azure Kubernetes Service (AKS) for Azure Local.

AKS – Cis Kubernetes

Summary

The documentation has been updated to improve clarity regarding identity management in Azure Kubernetes Service (AKS). Users can now find more precise information under the renamed sections for Entra ID authentication and local account management, specifically in the new files "entra-id-control-plane-authentication.md" and "local-accounts.md." This change enhances the understanding of how to manage authentication and local accounts effectively.

AKS – How to Enable Ebpf Host Routing

Summary

The document has been updated to include new requirements and parameters for enabling eBPF Host Routing in Azure CNI powered by Cilium AKS clusters. It specifies the necessary Azure CLI and Kubernetes versions, as well as the supported operating systems.

AKS – Azure Netapp Files Smb

Summary

The documentation for installing Trident has been updated to reflect new links for the installation methods, including the Trident operator and `tridentctl`. Users can now access the updated Install Guide and specific installation instructions more efficiently, enhancing their ability to deploy Trident in Kubernetes environments. Additionally, the guidance for ensuring Windows worker nodes are enabled during installation remains unchanged.

Fleet – Concepts Resource Placement

Summary

The documentation now clarifies the distinction between existing and potential new nodes for VM SKUs in Kubernetes clusters. Users can now find specific information regarding the available number of existing nodes and the potential number of new nodes for each VM SKU, enhancing their ability to manage resources effectively. This change is reflected in the updated descriptions for the `kubernetes.azure.com/vm-sizes/{vm-sku-name}/count` and `kubernetes.azure.com/vm-sizes/{vm-sku-name}/capacity` endpoints.

AKS – AKS Desktop Overview

Summary

The overview of AKS Desktop has been updated to clarify its purpose and benefits for development teams, highlighting how it simplifies application deployment and management on Azure Kubernetes Service without requiring deep Kubernetes expertise.

AKS – Disconnected Operations AKS

Summary

This document has been updated to provide an overview of Azure Kubernetes Service (AKS) Arc for disconnected operations, including deployment and management in disconnected environments. It highlights key differences and limitations, ensuring users understand the operational context.

AKS – Concepts Cluster Authentication

Summary

Learn how Azure Kubernetes Service (AKS) authenticates Kubernetes API requests using Microsoft Entra ID, and how to disable local cluster admin accounts in production.

AKS – Supported Kubernetes Versions

Summary

The documentation now includes updated information on supported Kubernetes versions for Azure Kubernetes Service (AKS) enabled by Azure Arc, specifically highlighting that Kubernetes versions 1.30 and 1.29 are no longer supported. Additionally, users are advised to ensure their Kubernetes clusters are on a supported version before upgrading Azure Local, as the upgrade does not automatically update Kubernetes versions, and there may be no supported upgrade path if the current version is incompatible with the new Azure Local release.

AKS – Privileged Identity Management

Summary

The documentation has been updated to remove the ‘AKS-managed’ qualifier from references to Microsoft Entra integration, clarifying the integration’s scope. Users can now utilize just-in-time elevation for node sign-in with Microsoft Entra ID based SSH, enhancing security and access management for AKS cluster nodes. Additionally, the links for creating AKS clusters and managing RBAC have been renamed for better clarity regarding their scenarios.

AKS – Advanced Container Networking Services Overview

Summary

The documentation now includes a new section on Cilium mTLS encryption, which provides users with transparent, mutual TLS encryption and authentication for pod-to-pod traffic in Kubernetes without the need for application changes or additional networking configurations. This enhancement allows users to secure their Kubernetes communications more effectively.

AKS – Concepts Identity

Summary

The documentation for Azure Kubernetes Service (AKS) has been updated to clarify the five identity scenarios, including Kubernetes control-plane authentication and authorization, AKS resource (ARM) authorization, cluster identity, and workload identity. Users can now find detailed guidance on how to manage permissions using Microsoft Entra ID and Azure RBAC, including the ability to restrict access to specific custom resource types using ABAC conditions. Additionally, the AKS service permissions reference has been moved to a standalone page, providing clearer access to the necessary permissions for creating and operating clusters.

AKS – Operator Best Practices Scheduler

Summary

The documentation has been updated to merge the identity best practices and authorization concepts into a single concepts page, streamlining the information available to users. Additionally, the authentication and authorization concepts have been split into two distinct documents, allowing for clearer guidance on each topic. Users can now find more organized and focused content on cluster authentication and authorization practices.

AKS – Control Kubeconfig Access

Summary

The documentation has been updated to replace references to the legacy Microsoft Entra (CLI) with the new Entra ID Control Plane Authentication guide. Users will now find updated instructions for Azure Active Directory integration, ensuring they have access to the most current information for managing authentication in Azure Kubernetes Service.

AGC – Load Balancing Strategies

Summary

Learn about different load balancing strategies to help build resilient and performant workloads.

AKS – AKS Disconnected Operations Preview

Summary

[!IMPORTANT]

AKS – AKS Edge Quickstart

Summary

The quickstart guide for setting up an Azure Kubernetes Service (AKS) Edge Essentials single-machine K3S Linux-only cluster has been updated for clarity and consistency. Users are now explicitly instructed to use "interactive authentication" instead of "interactive login" for Azure CLI, and the script’s functionality is emphasized, including the requirement for higher-level credentials for Azure subscription setup. Additionally, minor adjustments have been made to the phrasing of instructions regarding the script execution and Azure subscription parameters.

AKS – Quick Kubernetes Deploy Bicep

Summary

This tutorial has been improved with additional examples and clarifications on deploying Kubernetes using Bicep, enhancing the learning experience for users.

AKS – Arc Gateway AKS Arc

Summary

The documentation for the AKS Arc gateway has been updated to clarify that it simplifies network configuration requirements for AKS on Azure Local. Users can now create and manage AKS Arc clusters with the Arc gateway enabled, which automatically utilizes the gateway for improved network connectivity. Additionally, the prerequisites for using the Arc gateway with AKS on Azure Local have been emphasized, ensuring users are aware of the necessary steps before implementation.

AKS – AKS Edge Howto Key Manager

Summary

The document now includes an important notice regarding the retirement of the Key Manager for Kubernetes extension, effective April 15, 2026. It provides details on the implications of this change and directs users to the AKS enabled by Azure Arc GitHub repository for further inquiries.

AKS – AKS Desktop Projects

Summary

Learn about Projects in AKS desktop, the application-centric grouping of Kubernetes resources that simplifies deployment and management of applications on Azure Kubernetes Service (AKS).

AKS – AKS Networks

Summary

The documentation now clarifies that users must ensure an external VM switch is accessible by all machines in their Azure Local cluster, emphasizing the importance of this setup. Additionally, the instructions for creating a logical network have been streamlined, with changes to the phrasing of required parameters for the `az stack-hci-vm network lnet create` command, making it clearer that only one address prefix is supported and that the IP allocation method is limited to "Static."

AGC – Alb Controller Release Notes

Summary

The ALB Controller release notes have been updated to reflect the new version 1.10.21, which introduces Load Aware Routing and fixes for the Application Gateway for Containers (AGC) and AKS Istio add-on, as well as a fix for the readiness probe for ingress. Additionally, the documentation now specifies that if using the AKS add-on, updates are automatically applied to the cluster, enhancing user clarity on deployment management.

AKS – AKS Edge Howto Setup Machine

Summary

The documentation has been updated to reflect the latest versions of the K8s and K3s installers, now listing version 1.33.5 for both, which users can access via the provided links. Additionally, the link for Windows node files has been updated to direct users to a new URL for better resource access.

AKS – Nat Gateway

Summary

The documentation for the NAT gateway section has been updated for clarity, specifically regarding the limitations of managed NAT gateway resources in relation to availability zones. Users are now directed to use the `managedNATgatewayV2` for achieving zone-redundant outbound connectivity, enhancing their understanding of how to configure their AKS clusters effectively.

AKS – Tutorial Kubernetes Deploy Cluster

Summary

The documentation has been updated to rename the identity-related sections for improved clarity, specifically changing references from "azure-ad-rbac" to "kubernetes-rbac-entra-id." This change helps users better understand the context and application of role-based access control in Kubernetes environments using Entra ID.

AKS – Cluster Create Fails After Azure Local Upgrade

Summary

This new article provides guidance on troubleshooting and resolving issues with AKS Arc cluster creation failures after upgrading Azure Local, detailing symptoms and causes.

AKS – Managed Identity Overview

Summary

The documentation now includes a note clarifying that managed identities in AKS specifically address the **cluster-to-Azure** identity scenario, detailing how the AKS cluster interacts with Azure to manage resources. Users are directed to the "Access and identity options for AKS" section for information on other identity scenarios, such as control-plane authentication and pod-to-Azure workload identity.

AKS – Use System Pools

Summary

The documentation for Azure Kubernetes Service (AKS) has been updated to clarify that an API version of `2020-03-01` or greater is required to set a node pool mode, and that clusters created on older API versions will only contain user node pools. Additionally, the commands for creating and managing node pools have been revised to use variables for resource group, cluster name, and location, enhancing usability and consistency in examples. Users are now explicitly guided on how to verify node pool modes and manage system and user node pools effectively.

AGC – Application Gateway for Containers Components

Summary

The documentation now includes detailed connectivity requirements for the Application Gateway for Containers, specifying both outbound and inbound connectivity needs. Users can reference specific endpoints and ports necessary for operations, such as Azure ARM API and Entra AD authentication, as well as backend health and metrics endpoints for troubleshooting. Additionally, it clarifies that frontends must adhere to a specific naming format and can only listen on ports 443 and 80.

AKS – AKS Windows Server Retirement

Summary

The documentation now clarifies that the architecture of AKS enabled by Azure Arc on Windows Server will be retired in stages between March 2026 and March 2028, with specific deprecation dates for Windows Server 2019 and 2022 node pools. Users are advised to plan their migration to AKS Arc on Azure Local to ensure continued support, as Windows Server 2025 will not be supported. Additionally, AKS Arc deployments on Azure Local must now be managed entirely through Azure Resource Manager (ARM), requiring users to adapt their operational procedures to utilize cloud-based tools instead of local commands.

AKS – Cluster Upgrade

Summary

The documentation for upgrading AKS clusters has been updated to clarify the upgrade process, emphasizing that all upgrades run in a continuous, rolling manner to maintain workload availability. Additionally, the instructions now specify that users must perform upgrades sequentially by major version number and provide clearer guidance on the automatic upgrade to the latest GA patch version when no patch is specified. The section on updating the operating system version has also been refined to ensure users understand the conditions under which they can update worker nodes without changing the Kubernetes version.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Helm

Summary

The documentation for deploying the Application Gateway for Containers using the ALB Controller has been updated to reflect the new version 1.10.21 of the helm chart, replacing the previous version 1.9.13. Additionally, the uninstallation steps have been renumbered for clarity, now starting with "2" instead of "3." Users can now follow the refined guidance for installation and uninstallation processes more effectively.

AKS – AKS Overview

Summary

The documentation now clarifies that when creating an AKS enabled by Azure Arc cluster, users automatically connect it to Azure Arc for centralized management, enhancing the user experience. Additionally, the text has been updated for clarity regarding managing Kubernetes clusters centrally through the Azure portal, emphasizing that this management applies regardless of where the clusters are hosted.

AKS – Concepts Authentication Authorization

Summary

New page added.

AKS – Enable Fips Nodes

Summary

The documentation for enabling Federal Information Processing Standard (FIPS) for Azure Kubernetes Service (AKS) node pools has been updated to clarify the prerequisites, including the requirement for Azure CLI version 2.32.0 or later and the need for an active Azure subscription. Additionally, the instructions now specify that FIPS-enabled node pools require Kubernetes version 1.19 or greater and detail the limitations and compatibility for various operating systems, including Ubuntu and Windows Server versions. Users can now also find updated Terraform examples for creating and managing FIPS-enabled node pools.

AKS – Quick Kubernetes Deploy Powershell

Summary

This document has been updated to improve content and commands related to deploying Kubernetes applications using PowerShell. It includes new examples and clarifications to enhance user understanding.

AKS – Operator Best Practices Advanced Scheduler

Summary

The documentation has been reorganized to improve clarity on authentication and authorization concepts. Users can now find best practices for identity management consolidated into a single concepts page, enhancing their understanding of cluster authentication. Additionally, the table of contents has been tidied up to better reflect these changes.

AKS – AKS Arc Known Issues

Summary

The documentation now includes new known issues for AKS clusters, specifically addressing problems such as clusters becoming unhealthy after upgrades when Azure Policy or Gatekeeper is in use, and failures in cluster creation following an Azure Local update from version 2510. Additionally, there is a noted issue regarding the inability to create AKS clusters with GPU-enabled default node pools, providing users with critical information to troubleshoot these scenarios.

AKS – AKS Create Clusters CLI

Summary

The documentation now includes a warning advising users not to install Azure CLI extensions directly on an Azure Local node, recommending instead that they install these extensions on a client machine used to connect to the Azure Local instance. Additionally, the phrasing has been updated to clarify that multiple commands are required to install the necessary Azure CLI extensions.

AKS – Operator Best Practices Cluster Isolation

Summary

The documentation has been updated to merge the identity best practices and authorization concepts into a single concepts page, streamlining the information available to users. Additionally, the authentication and authorization concepts have been split into two distinct documents, allowing for clearer guidance on each topic. Users can now find more organized and focused content on cluster authentication and authorization practices.

AGC – API Specification Kubernetes

Summary

The documentation for the Application Gateway API has been updated to include detailed information about the LoadAwareConfig, which defines the configuration for load-aware routing. Users can now find specific parameters such as blackoutPeriod, metricExpirationPeriod, errorUtilizationPenalty, and namedMetrics, along with their descriptions and default values, enhancing their ability to configure load balancing strategies effectively. Additionally, the health check protocol behavior has been clarified, stating that it uses the same protocol by default, and if different, it will be plaintext.

AKS – Node Auto Provisioning Aksnodeclass

Summary

The documentation has been updated to reflect significant changes in the configuration parameters for node auto-provisioning in AKS. Users can now set a longer cache duration of 3600 seconds, increase the maximum concurrent connections to 1000, and modify the forward policy to Sequential. Additionally, the protocol can now be set to PreferUDP, and query logging has been updated to log errors, enhancing the overall performance and reliability of DNS queries in the cluster.

AKS – AKS Desktop Install Cluster Setup

Summary

Learn how to set up a compatible Azure Kubernetes Service (AKS) cluster for AKS desktop.

AKS – Encrypt Etcd Secrets

Summary

The documentation has been updated to clarify the encryption of etcd secrets in AKS on Azure Local, specifically highlighting that starting with the 2510 release, KMS v2 is enabled by default for new cluster deployments, while existing clusters will continue using KMS v1. Users can now understand the benefits of migrating to KMS v2, including improved performance and scalability, and are provided with guidance on how to update their secrets after the Key Encryption Key (KEK) rotation every 30 days. Additionally, the article now includes a new section on verifying the KMS provider’s status and optional steps for confirming that data is encrypted.

AKS – Manage Local Accounts Managed Azure Ad

Summary

This document has been updated to reflect changes in authorship and references, ensuring that the information is current and accurate regarding managing local accounts with Azure AD.

AKS – Csi Migrate in Tree Volumes

Summary

The documentation has been updated to reflect changes in the management of Azure RBAC for AKS, specifically regarding the cluster admin role. Users can now find instructions for creating role assignments for cluster access in the newly structured "entra-id-authorization" section, which replaces the previous references to "manage-azure-rbac." This restructuring aims to streamline the process and improve clarity for users managing access in AKS.

AKS – AKS Create Clusters Portal

Summary

The documentation for creating Kubernetes clusters using the Azure portal has been updated to clarify the process and requirements. Users are now explicitly instructed to provide a Microsoft Entra group for cluster administrator access and to ensure they have the necessary Azure subscription ID, custom location ID, and AKS logical network ID from their infrastructure administrator. Additionally, the authentication options have been detailed, emphasizing the importance of adding oneself to the Microsoft Entra group to access the AKS cluster using `kubectl`.

AGC – Service Mesh Integration

Summary

The documentation for the Application Gateway for Containers Service Mesh Extension has been updated to reflect that the ALB Controller version has been changed to 1.10.21. Additionally, users are now informed that mutual authentication will be implicitly defined for services in a namespace with the `istio-injection` or `istio.io/rev` label, enhancing clarity on how to configure sidecar injection based on the Istio version installed.

AKS – Concepts Support

Summary

The documentation for Azure Kubernetes Service (AKS) on Windows Server has been updated to clarify the validation of configurations, resource limits, and scaling considerations. Users are now informed that exceeding specified maximums may lead to unexpected behaviors, and they are provided with clearer guidance on planning for scaling, including the importance of understanding workloads and available hardware resources. Additionally, the language has been refined for better readability, ensuring users can easily grasp critical information regarding VM sizes and deployment strategies.

AKS – Entra Id Control Plane Authentication

Summary

Learn how to enable Microsoft Entra ID authentication for the Kubernetes API server (control plane) on an Azure Kubernetes Service (AKS) cluster.

AKS – Cluster Architecture

Summary

The documentation now clarifies that AKS clusters on Azure Local utilize the Arc Resource Bridge for orchestration and management, emphasizing that users deploy containerized applications into these clusters. Additionally, it highlights that when using multiple Cluster Shared Volumes (CSVs), virtual machine data will automatically spread across all available CSVs, enhancing application reliability during outages.

AKS – AKS Desktop App

Summary

This article has been revised to provide clearer instructions on deploying applications using AKS Desktop, including updated prerequisites and a more structured approach to the deployment process.

AKS – AKS Desktop Deploy Ai Assistant

Summary

Learn how to use the AI-powered troubleshooting assistant in AKS desktop to diagnose and resolve Kubernetes issues using natural language.

AKS – Prepare Windows Nodes Gmsa

Summary

The documentation now clarifies that users can utilize group Managed Service Accounts (gMSA) for Windows containers without the need to manually join Windows worker nodes to a domain, simplifying the setup process significantly. Additionally, it emphasizes that in rolling update scenarios, rejoining nodes to a domain is no longer necessary, further streamlining operations for users. Other minor adjustments enhance clarity and readability throughout the document.

AKS – Azure Netapp Files

Summary

The documentation for Azure NetApp Files has been updated to reflect new links for the Trident installation guide, Helm chart, and Trident CLI commands. Users can now access the latest quickstart and installation resources, which may provide improved guidance and updated procedures for deploying Trident in Kubernetes environments.

AKS – Istio Gateway API

Summary

The documentation now includes a new section on enabling access logging for Gateway pods using the Telemetry API. Users can create a Telemetry resource in the aks-istio-system namespace to enable access logs for all Gateway pods in the mesh or target specific namespaces. An example manifest is provided to illustrate how to configure this feature effectively.

AKS – AKS Platforms Compare

Summary

The documentation now specifies that the Linux OS offerings include Azure Linux, providing users with updated links to the relevant resources. This change enhances clarity regarding the available operating systems for Azure Kubernetes Service (AKS) and ensures users can access the most current information about Azure Linux.

AKS – AKS Edge Howto Single Node Deployment

Summary

The documentation now emphasizes the command structure for creating a single machine cluster, clarifying that users should run the `New-AksEdgeDeployment` cmdlet. Additionally, it specifies that to connect to Arc and deploy apps with GitOps, users must allocate at least four CPUs and 4 GB of RAM for the Linux node, while also ensuring the `ServiceIPRangeSize` is greater than 0. The instructions for creating configuration files for both Linux and Windows nodes have been streamlined for clarity.

AKS – Deploy Gpu Node Pool

Summary

The documentation now clarifies that users must install the necessary GPU drivers before deploying an AKS cluster with Azure Arc, emphasizing the importance of confirming driver uninstallation and installation steps. Additionally, it specifies that users can only utilize GPU-enabled node pools for Linux node pools and provides clearer instructions on confirming GPU scheduling in Kubernetes. The upgrade process for GPU-enabled node pools has also been detailed to ensure users understand the requirement for extra GPU resources during upgrades.

AKS – Deploy Cluster Terraform Verified Module

Summary

The documentation now correctly references the Microsoft Entra authentication section, updating the link to point to the appropriate concepts-cluster-authentication.md page. This change ensures users have accurate guidance on securing the Kubernetes API with Microsoft Entra ID and managing local accounts.

AKS – Kubelogin Authentication

Summary

The documentation now clarifies that the Azure CLI authentication method works with Microsoft Entra, removing the previous qualifier of "AKS-managed." Additionally, users are directed to a revised integration guide for Microsoft Entra, reflecting this change. This update enhances understanding of authentication compatibility and integration processes for AKS users.

AKS – Create Clusters Terraform

Summary

This document has been updated to clarify the steps for creating a Kubernetes cluster using Terraform, including necessary parameters and links to relevant resources for enabling Microsoft Entra authentication and Azure RBAC.