Azure Container Services Docs – Weekly Update (2026-04-26 to 2026-05-03)

AGC – Siem Integration with Sentinel

Summary

The integration instructions for enabling Microsoft Sentinel workspace have been updated to use the correct path format, improving clarity and accessibility for users setting up SIEM integration with Azure Kubernetes Service.

AKS – AKS Desktop Permissions

Summary

The documentation for setting up permissions and role-based access control (RBAC) in AKS Desktop has been updated to clarify how users can manage RBAC permissions based on their roles as cluster operators or developers. Users can now provide environments for developers to deploy and manage applications, and the article emphasizes the need to use the Azure portal or Azure CLI for updating permissions after project creation, as there is currently no UI option for this. Additionally, the requirements for Azure CLI and the types of AKS clusters supported have been specified to enhance user understanding.

AKS – AKS Desktop Deploy Ai Assistant

Summary

Learn how to use the AI-powered troubleshooting assistant in AKS desktop to diagnose and resolve Kubernetes issues using natural language.

ACR – Container Registry Private Link

Summary

The documentation now includes a new section on planning subnet IP capacity for Azure Container Registry (ACR) private endpoints, detailing how each private endpoint consumes IP addresses and the implications of geo-replication and regional endpoints on IP usage. Users are advised to ensure sufficient IP capacity in their subnets before adding replicas, with specific recommendations for subnet sizes. Additionally, the error handling for geo-replication failures due to IP exhaustion has been clarified, emphasizing that the error message will not specify which subnet is exhausted, requiring users to verify capacity independently.

AKS – Network System Requirements

Summary

Learn about the network requirements for deploying AKS enabled by Azure Arc clusters on Azure Local (multi-rack), including logical network configuration, IP address requirements, and port requirements.

ACR – Artifact Cache Acr to Acr CLI

Summary

Learn how to cache container images from one Azure Container Registry in another using managed identity authentication with Azure CLI and Bicep.

AKS – AKS Edge Howto Secret Encryption

Summary

The documentation now includes a new section that provides additional information about deploying a new AKS Edge Essentials cluster, directing users to the official deployment documentation. Additionally, the phrasing in the "Validate and troubleshoot secret encryption" section has been standardized for clarity.

AKS – AKS Desktop Quickstart Auto

Summary

The guide provides detailed steps for setting environment variables to simplify command usage, enhancing the user experience for deploying applications on Azure Kubernetes Service.

AKS – Container Network Observability Logs

Summary

The documentation for container network logs in Advanced Container Networking Services for Azure Kubernetes Service (AKS) has been updated to reflect a renaming of components for clarity. Users will need to update their configurations to use the new naming conventions, including changing the Custom Resource Definition (CRD) from `RetinaNetworkFlowLogs` to `ContainerNetworkLog`, and updating CLI flags and Log Analytics table names accordingly. Additionally, the documentation now emphasizes the importance of enabling the Azure Monitor add-on for enhanced log management and analysis capabilities.

AKS – Resource Manager Quickstart

Summary

Learn how to deploy an AKS enabled by Azure Arc cluster on Azure Local (multi-rack) using an Azure Resource Manager template (ARM template).

AKS – AKS List Skus

Summary

This document provides a comprehensive guide on how to list available VM SKUs for Azure Kubernetes Service (AKS) clusters. It includes prerequisites, installation instructions for the aks-preview CLI extension, and detailed commands for listing and filtering SKUs based on various criteria. The updates also clarify that the feature does not consider current quota or real-time available capacity.

AKS – How to Configure Container Network Metrics Filtering

Summary

The documentation for configuring container network metrics filtering for Azure Kubernetes Service (AKS) has been updated to reflect new minimum version requirements. Users must now use Azure CLI version **2.85.0** and the `aks-preview` Azure CLI extension version **20.0.0b4** to complete the steps outlined in the article. Additionally, the required Kubernetes version has been updated to **1.33**.

AKS – Advanced Container Networking Services Overview

Summary

The documentation now includes the removal of the preview tag for the WireGuard Encryption section, indicating that it is no longer in preview and is fully supported. Additionally, a new section on Cilium mTLS Encryption has been added, which allows users to implement transparent mutual TLS encryption for pod-to-pod traffic in Kubernetes without needing to modify their applications or networking stack. Users can refer to the new Cilium mTLS encryption overview for further details.

ACR – Artifact Cache Overview

Summary

The documentation now specifies that Docker Hardened Images (`dhi.io`) and Azure Container Registry (`azurecr.io`) support only authenticated pulls, while NVIDIA NGC Container Registry (`nvcr.io`) supports both authenticated and unauthenticated pulls. This clarification impacts how users can access images from these registries using the Azure CLI and Azure portal.

AKS – Cluster Upgrade

Summary

This document provides guidance on upgrading an Azure Kubernetes Service (AKS) cluster to a newer Kubernetes version on Azure Local for multi-rack deployments. It includes prerequisites, supported versions, and step-by-step instructions for performing the upgrade.

AKS – Arc Gateway AKS Arc

Summary

The documentation has been updated to simplify the title and clarify the network configuration requirements for the Azure Arc gateway, removing the mention of the preview status. Users can now find more straightforward guidance on the endpoints required for AKS Arc clusters and other Arc-enabled scenarios without the previous emphasis on the preview phase.

AKS – How to Configure Container Network Insights Agent

Summary

The documentation now clarifies that the Container Network Insights agent is supported in all Azure public regions where AKS is available, rather than just a limited list of regions. Additionally, it specifies that the extension is not available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds, providing users with a clearer understanding of where they can deploy this feature.

AKS – How to Configure Container Network Logs

Summary

The documentation for configuring container network logs in Azure Kubernetes Service (AKS) has been updated to clarify the setup process and enhance user understanding. Users can now configure container network logs in both stored and on-demand modes, with specific instructions on applying the `ContainerNetworkLog` custom resource definition (CRD) to define traffic capture parameters. Additionally, the integration with Azure Monitor is now optional, allowing users to directly access host-local logs or forward them to any OpenTelemetry-compatible service, providing greater flexibility in log management.

AKS – AKS Desktop Install Cluster Setup

Summary

Learn how to set up a compatible Azure Kubernetes Service (AKS) cluster for AKS desktop.

AKS – Troubleshoot Container Network Insights Agent

Summary

The documentation now clarifies that the container network insights agent extension is only supported in Azure public regions and is not available in sovereign cloud regions such as Azure Government or Microsoft Azure operated by 21Vianet. Users are instructed to verify that their cluster is in an Azure public region where AKS is supported, rather than just listing specific regions. This change enhances user understanding of regional limitations for the extension.

AKS – Create Volume Azure Disk

Summary

The documentation for creating Azure Disks has been updated to reflect changes in the storage class names, specifically replacing "managed-csi" with "managed-csi-premium." Additionally, users are now instructed to request a disk size of 10 GB instead of 5 GB in the `azure-pvc.yaml` manifest. Other minor adjustments include clarifications in parameter descriptions and formatting corrections for consistency.

AKS – Cluster Architecture

Summary

This article describes the architecture of Azure Kubernetes Service (AKS) enabled by Azure Arc on Azure Local for multi-rack deployments. It details how clusters are deployed, managed, and connected to Azure, including key components like control plane nodes and node pools.

Fleet – Update Orchestration

Summary

The documentation now includes a critical note stating that node image versions are only valid for 90 days from their original publish date, which is essential for users to avoid potential upgrade failures for member clusters. Additionally, the guide has been updated to clarify that the generated update run is not automatically started, allowing users to review it before proceeding. Users can also utilize the `az fleet autoupgradeprofile generate-update-run` command to generate new update runs based on the current AKS-published Kubernetes or node image version.

AKS – How to Apply Wireguard

Summary

The documentation now clarifies that WireGuard encryption is disabled by default even after enabling Advanced Container Networking Services (ACNS), and users must set the encryption type using the flag `–acns-transit-encryption-type wireguard` to enable it. Additionally, it specifies that WireGuard can be independently disabled without impacting other ACNS features by using the flag `–acns-transit-encryption-type=none`.

AKS – Container Network Insights Agent Overview

Summary

The documentation now clarifies that the `microsoft.containernetworkingagent` AKS extension is available in all Azure public regions where AKS is supported, rather than being limited to specific regions like centralus, eastus, and others. Additionally, it specifies that the extension is not available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds, providing users with clearer deployment options and limitations.

AKS – Egress Outboundtype

Summary

The documentation for customizing cluster egress with outbound types in Azure Kubernetes Service (AKS) has been updated to clarify the selection of `managedNATGatewayV2` or `managedNATGateway` when using managed virtual networks, emphasizing the benefits of the StandardV2 NAT gateway. Additionally, the section on supported migration paths has been revised for clarity, ensuring users understand the migration possibilities between outbound types for both managed and BYO virtual networks. Users can now more easily navigate the commands and parameters related to updating their cluster’s outbound configuration.

ACR – Set Container Registry Service Health Alerts

Summary

This document has been updated to clarify the process for viewing and managing service health notifications in the Azure portal, enhancing user understanding of service health management.

AKS – Localdns Custom

Summary

The documentation for LocalDNS configuration in AKS has been updated to clarify that if a custom configuration file is not specified, AKS will automatically apply a default LocalDNS configuration. This change enhances user understanding of the default behavior of LocalDNS in AKS, ensuring they are aware of the automatic settings applied when no custom configurations are provided.

AKS – Use Labels

Summary

The documentation for AKS reserved labels has been updated to clarify the usage of certain labels, including the introduction of a new label, `kubernetes.azure.com/priority`, which replaces the deprecated `kubernetes.azure.com/scalesetpriority`. Users can now refer to the updated table for recommended substitutes for deprecated labels, enhancing clarity on which labels to use for their configurations. Additionally, the formatting of example outputs has been improved for better readability.

AKS – AKS Edge System Requirements

Summary

The documentation for the AKS Edge system requirements has been updated to reflect an increase in the minimum disk space requirement from 14 GB to 19 GB. Users should ensure that their systems meet this new requirement for optimal performance.

AKS – AKS Desktop Projects

Summary

Learn about Projects in AKS desktop, the application-centric grouping of Kubernetes resources that simplifies deployment and management of applications on Azure Kubernetes Service (AKS).

AKS – Concepts Security Access Identity

Summary

Learn about access and identity management options for Kubernetes clusters in AKS on Azure Local.

AGC – Service Mesh Integration

Summary

The documentation for the Application Gateway for Containers Service Mesh Integration has been updated to reflect the new version of the ALB Controller Istio Extension, which is now version 1.10.26. Users are now instructed to define a namespace for Istio sidecar injection and must ensure that the correct label is configured based on the Istio installation method, either using `istio-injection: enabled` for open-source Istio or `istio.io/rev: asm-<version>` for the Istio AKS add-on. Additionally, commands for managing resources have been updated to reference the new namespace `test-infra` instead of `istio-example-namespace`.

AKS – Container Network Security Wireguard Encryption Concepts

Summary

The documentation now includes details about WireGuard encryption for AKS, which is part of the Advanced Container Networking Services feature set. This update clarifies the implementation and the types of traffic flows that are secured within Kubernetes clusters.

AKS – AKS Edge Whats New

Summary

The documentation now includes significant updates for AKS Edge Essentials version 1.12.269.0, highlighting that cross-distribution upgrades are supported, allowing users to upgrade Kubernetes versions within the same release version. Additionally, the KMS provider is enabled by default for new deployments, simplifying the setup process as no extra configuration is needed. Users can also refer to the newly added upgrade paths table for supported combinations when upgrading from previous versions.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Addon

Summary

The documentation now clarifies that when the Application Gateway for Containers add-on is enabled on an AKS cluster using the AKS-managed virtual network option, a subnet named `aks-appgateway` is automatically created with delegation enabled for `Microsoft.ServiceNetworking/TrafficController`. Additionally, users can verify that the GatewayClass has a condition labeled **Valid GatewayClass**, indicating that a default GatewayClass is set up and managed by the ALB Controller.

Fleet – Concepts Update Orchestration

Summary

The document has been updated to include a note about the 90-day validity of node image versions, which is important for ensuring successful upgrades. It also emphasizes the orchestration of updates across multiple clusters using Azure Kubernetes Fleet Manager.

AGC – Alb Controller Release Notes

Summary

The ALB Controller release notes have been updated to reflect the new version 1.10.26, which includes an Istio service mesh integration fix along with security patches. Additionally, the documentation now specifies that updates for the AKS add-on are automatically applied to the cluster, enhancing user experience by ensuring they receive the latest updates without manual intervention. Users can also find improved instructions for deploying and upgrading the ALB Controller with Helm.

AKS – AKS Edge Howto Setup Machine

Summary

The documentation has been updated to include the latest versions of the K8s and K3s installers, now reflecting K8s installer version 1.33.5 and K3s installer version 1.33.5. Users can now access these updated installers through the provided links, ensuring they are using the most current software for their AKS Edge setup.

AKS – Update Azure Cni

Summary

The documentation now clarifies the process of enabling Cilium on a cluster that uses another network policy engine, such as Azure Network Policy Manager or Calico. It emphasizes that the existing engine will be uninstalled and replaced by Cilium, which may impact network policy behavior, and provides a link for further information on migration.

AGC – Application Gateway for Containers Components

Summary

The documentation now includes support for Network Security Groups (NSGs) on the Application Gateway for Containers association subnet for associations created on or after April 23, 2026. Users can configure both inbound and outbound NSG rules, but for associations created before this date, inbound traffic on ports 80 and 443 will always be allowed, regardless of the configured rules. Additionally, "Deny all" rules are supported, but users must define explicit allow rules to prevent blocking essential traffic.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Helm

Summary

The documentation has been updated to reflect the upgrade of the ALB Controller Helm chart version from 1.10.23 to 1.10.26. Users can now utilize the latest features and fixes included in this version by specifying the updated version in their Helm installation commands. Additionally, the instructions for overriding namespaces during deployment have been clarified to enhance user understanding.

AKS – Use System Pools

Summary

The documentation now includes detailed Terraform configurations for creating an AKS cluster with both system and user node pools, enhancing user guidance on isolating critical workloads. Users can now easily set up a dedicated system node pool with specific taints to prevent application workloads from being scheduled on it, as well as add user node pools for application separation. Additionally, instructions for changing the mode of existing node pools have been clarified, allowing users to switch between system and user modes directly in their Terraform configurations.

AKS – Scale Requirements

Summary

Learn about scale requirements for AKS on Azure Local, Rack Scale deployments, including cluster, node pool, and node limits.

AKS – Node Auto Provisioning Node Pools

Summary

The documentation for the `NodePool` API has been updated to include new SKU selectors and well-known labels that users can utilize to define VM characteristics. Notably, the `karpenter.azure.com/sku-series` selector has been added, allowing users to specify the VM SKU series, enhancing their ability to customize node configurations. Additionally, the documentation now includes examples for new labels such as `kubernetes.azure.com/cluster` and `kubernetes.azure.com/mode`, providing users with more options for defining node characteristics.

AGC – Migrate From Agic to Agc

Summary

This document outlines the migration process from Application Gateway Ingress Controller (AGIC) to Application Gateway for Containers (AGC). It highlights important considerations, dependencies, and provides tips for a successful migration.

AKS – Deploy Load Balancer CLI

Summary

This guide explains how to deploy the MetalLB extension for Azure Arc-enabled Kubernetes clusters using Azure CLI. It covers prerequisites, installation steps, and configuration details necessary for setting up a load balancer in a multi-rack deployment.

Fleet – Node Image Versions

Summary

[!IMPORTANT]

AKS – Container Network Observability Metrics

Summary

The documentation for container network metrics in Advanced Container Networking Services for Azure Kubernetes Service (AKS) has been updated to clarify the collection and filtering capabilities of network metrics. Users can now utilize source-level filtering on Cilium clusters to define which namespaces, workloads, and metric types to collect before data leaves the node, enhancing visibility and reducing unnecessary data ingestion. Additionally, the overview now emphasizes the importance of pod-level metrics for troubleshooting and planning, allowing users to isolate issues more efficiently.

AGC – API Specification Kubernetes

Summary

The documentation now includes a new section on `LoadAwareConfig`, which defines the configuration for load-aware routing, detailing parameters such as `blackoutPeriod`, `metricExpirationPeriod`, `errorUtilizationPenalty`, and `namedMetrics`. Users can now understand how to set these parameters to influence load balancing decisions effectively. Additionally, the text has been updated for clarity, including changes to the health check protocol description and the ability to add values to certain enums.

AKS – Container Network Observability Guide

Summary

The documentation for the Advanced Container Networking Services (ACNS) has been updated to enhance user guidance on diagnosing and resolving network issues in Azure Kubernetes Service (AKS). Key changes include a restructured title and description that emphasize a user-first troubleshooting approach, along with detailed playbooks for addressing specific symptoms such as DNS failures, packet drops, traffic imbalances, and L7 errors. Additionally, the guide now organizes content around tasks rather than features, making it easier for users to navigate directly to the relevant solutions for their network issues.

AGC – Load Balancing Strategies

Summary

Learn about different load balancing strategies to help build resilient and performant workloads.

AKS – AKS Desktop App

Summary

The documentation for deploying applications using AKS Desktop has been updated to clarify that users can now deploy containerized applications without writing Kubernetes manifests. Additionally, the prerequisites have been refined to specify the need for an existing AKS Automatic cluster with Microsoft Entra authentication and Azure CLI version 2.64.0 or later. Users are also guided to create a new Project when deploying applications, with detailed steps for configuring various settings during the deployment process.

AKS – AKS Desktop Overview

Summary

The documentation for AKS Desktop has been updated to clarify its purpose and benefits, emphasizing that it simplifies application deployment and management on Azure Kubernetes Service (AKS) without requiring deep Kubernetes expertise. Users can now leverage features such as guided workflows for deploying applications, natural language troubleshooting, and unified observability, which collectively enhance the management experience for development teams. Additionally, the documentation now highlights the integration with existing tools like Visual Studio Code and GitHub, allowing for a more seamless workflow.

AKS – Create Volume Azure Files

Summary

This article details how to enable data encryption in transit for NFS Azure file shares by setting specific parameters in the StorageClass. It also provides examples for dynamic provisioning and existing persistent volumes.

AKS – Concepts Storage

Summary

The documentation now clarifies that when creating a new cluster or adding a node pool, the number of vCPUs determines the OS disk size by default, with specific details on the default sizes for various VM SKUs. Additionally, the example YAML manifest has been updated to reflect the use of the _managed-premium-retain_ storage class instead of _managed-premium_, which may impact users configuring persistent volume claims. Users can also find updated links to the Azure Disk and Azure Files documentation for better resource access.

AKS – Overview

Summary

The documentation now includes an advisory for the CVE-2026-31431 vulnerability, detailing a local privilege escalation risk associated with the Linux kernel’s `algif_aead` module. Users are informed that all current AKS Linux nodes are exploitable, allowing attackers with code execution in any pod, including non-root pods, to escalate to root on the node. A mitigation is being deployed to block the module from auto-loading, but existing nodes created before the hotfix remain vulnerable, and users are advised to apply self-service mitigations as necessary.

AKS – Cis Ubuntu

Summary

The article has been updated to reflect the security OS configuration applied to both Ubuntu 24.04 and Ubuntu 22.04 images used by AKS. It includes new recommendation statuses and guidance based on the latest CIS benchmarks, ensuring compliance with security standards such as SOC, ISO, PCI DSS, and HIPAA.

AKS – Planned Maintenance

Summary

A new section has been added to clarify that the AKS planned maintenance window is specifically for scheduling AKS cluster and node image upgrades, and does not apply to Azure platform-level maintenance. This distinction is important for users managing their AKS environments.

AKS – Reliability Availability Zones Configure

Summary

The documentation for configuring AKS availability zones has been updated to clarify that not all VM SKUs are accepted when creating node pools in a specified location. Users are now informed that node pool creation will fail if the selected VM SKU does not support the requested availability zones in that region, and they can check availability using the `az aks list-vm-skus` command.

AKS – AKS Desktop Deploy Troubleshooting

Summary

Learn how to troubleshoot Kubernetes applications in AKS desktop using the built-in Insights feature powered by Inspektor Gadget.

AKS – Outbound Rules Control Egress

Summary

The documentation for outbound network and FQDN rules for Azure Kubernetes Service (AKS) clusters has been updated to clarify the requirements for accessing various services. Users can now see improved descriptions for accessing the Microsoft Container Registry in China Cloud, as well as updated details for Windows-related binaries installation and Microsoft Entra authentication. These changes enhance the clarity and accuracy of the information provided to users.

AKS – Plan AKS IP Address

Summary

Plan the IP addresses needed to deploy AKS enabled by Azure Arc clusters on Azure Local (multi-rack), including node IPs, control plane endpoints, and load balancer addresses.