Azure Container Services Docs – Weekly Update (2026-05-03 to 2026-05-10)

AKS – Azure Cni Powered by Cilium

Summary

The documentation now clarifies that Local Redirect Policy (LRP) is supported from Kubernetes v1.29 and above, along with Cilium v1.14 and above. Users can implement LRP with Advanced Container Networking Services (ACNS) – FQDN Filtering by ensuring that the Cilium Network Policy egress labels match the node-local DNS cache pod labels, with updated YAML examples provided for configuration. Additionally, the documentation specifies that AKS API versions since `2023-02-02preview` utilize the `networkProfile.networkDataplane=cilium` field to enable Azure CNI Powered by Cilium.

AKS – AKS Automatic Managed System Node Pools

Summary

The documentation has been revised to clarify the regions supported by AKS Automatic, ensuring that users are aware of the current availability and limitations of the service across different regions.

AKS – Long Term Support

Summary

The long-term support (LTS) documentation has been updated to clarify that users can opt into LTS while their cluster is still in community support, without incurring additional Premium-tier charges until the LTS support window begins. Additionally, it emphasizes that LTS Premium-tier billing starts only after the Kubernetes minor version exits community support, allowing users to maintain their current billing tier during the community support period. Users are also reminded to enable the patch auto-upgrade channel to ensure they remain on the latest supported patches, as LTS only supports the last two patch versions for each minor version.

AKS – AKS Automatic Managed System Node Pools About

Summary

The documentation now specifies that all pod operations, including `attach`, `exec`, and `port-forward`, are restricted for managed system node pools. This change clarifies the limitations users will encounter when attempting to perform these operations on managed system node pools in Azure Kubernetes Service (AKS).

AKS – Monitor Gpu Metrics

Summary

The documentation for monitoring GPU metrics on Azure Kubernetes Service (AKS) has been updated to clarify that it now provides a how-to guide rather than just a conceptual overview. Users can customize the scraping of NVIDIA GPU metrics by creating a ConfigMap in the Azure Monitor agent, enabling automatic scraping for existing and new NVIDIA GPU node pools. Additionally, users can disable this automatic scraping if needed, ensuring that NVIDIA DCGM metrics will no longer appear in Azure Monitor or Metrics Explorer.

AKS – Keda Workload Identity

Summary

The KEDA workload identity documentation has been improved by adding instructions to annotate the ServiceAccount with the managed identity’s client ID. This ensures that the workload identity webhook correctly binds the identity to the KEDA operator pods, enhancing the clarity of the setup process.

AGC – API Specification Kubernetes

Summary

The documentation now includes a new section on LoadAwareConfig, which defines the configuration for load-aware routing, allowing users to specify parameters such as blackoutPeriod and metricExpirationPeriod to influence load balancing decisions based on endpoint load metrics. Additionally, the health check description has been clarified to indicate that it uses plaintext by default when protocols differ. Users can now better understand how to configure load-aware routing and health checks in their applications.

AKS – Use Nvidia Gpu

Summary

The documentation now highlights the option for users to utilize AKS-managed GPU node pools, which allows Azure Kubernetes Service to automatically install and maintain the NVIDIA driver, device plugin, and DCGM metrics exporter. This change simplifies the setup process for users seeking a fully managed experience with GPU resources in AKS.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Addon

Summary

The documentation now clarifies that when the Application Gateway for Containers add-on is enabled on an AKS cluster using the AKS-managed virtual network option, a subnet named `aks-appgateway` is automatically created with delegation enabled for `Microsoft.ServiceNetworking/TrafficController`. Additionally, users can verify that the GatewayClass has a condition labeled **Valid GatewayClass**, indicating that a default GatewayClass is set up and managed by the ALB Controller.

AKS – AKS Managed Gpu Nodes

Summary

The documentation now details the introduction of fully managed GPU nodes in Azure Kubernetes Service (AKS), which simplifies the process of running NVIDIA GPU workloads by automatically installing and maintaining the NVIDIA GPU driver, device plugin, and DCGM metrics exporter. Users can create a managed GPU node pool in a single step using the `–enable-managed-gpu=true` flag, and they can configure the management mode and MIG strategy through the `gpuProfile.nvidia` fields. Additionally, the Azure CLI version requirement has been updated to 2.85.0 or later for these features.

AGC – Alb Controller Release Notes

Summary

The documentation now includes a new entry for version 1.10.27, which addresses a hotfix for a pod crash related to GitHub issue 5758. Additionally, the text has been updated for clarity, specifying that updates using the AKS add-on are automatically applied to the cluster. Users can refer to the updated instructions for deploying or upgrading the ALB Controller with Helm.

AKS – Gpu Health Monitoring

Summary

The documentation now clarifies that the health monitoring feature for GPU node pools specifically applies to AKS-managed GPU node pools, enhancing user understanding of where this functionality is applicable. Additionally, minor spelling corrections were made to ensure consistency in terminology throughout the GPU health monitoring section. Users can expect clearer guidance on monitoring the NVIDIA device plugin service within their AKS-managed environments.

AKS – Gpu Multi Instance

Summary

The documentation now includes a new tip highlighting the option for a fully managed Multi-Instance GPU (MIG) experience in AKS, where the NVIDIA driver, device plugin, and DCGM metrics exporter are automatically installed and maintained. Additionally, the mixed strategy section has been clarified to ensure users understand that GPU resources are displayed as `nvidia.com/mig1g.5gb: 1`, improving the accuracy of resource representation.

AKS – Identity Bindings Concepts

Summary

The identity bindings documentation has been updated to document Azure.Core v1.55.0+ as an alternative for .NET identity bindings, enhancing clarity on version compatibility and usage.

Fleet – Concepts Update Orchestration

Summary

The documentation now includes enhanced details on the use of `memberSelector` for grouping clusters in update strategies, allowing users to utilize Kubernetes-style label selectors for more flexible and multi-dimensional member selection. Users can now assign multiple labels to fleet members and configure their update sequences at both the stage and group levels, improving management of large fleets with dynamic membership. Additionally, the recommendation to use member labels over update groups for grouping clusters has been emphasized, providing users with better control over their update strategies.

AKS – Blue Green Node Pool Upgrade

Summary

The documentation for blue-green upgrades in AKS has been updated to clarify that new green nodes are added to the existing node pool rather than creating a new pool. This change enhances understanding of the upgrade process and its implications for capacity and rollback procedures.

AGC – Migrate From Agic to Agc

Summary

The documentation now emphasizes that Application Gateway for Containers has a migration utility to assist users in automatically translating AGIC Ingress to Gateway API, providing a more streamlined migration process. Additionally, users are informed that they can deprecate the Application Gateway Ingress Controller after migrating all services, and they can delete or uninstall the AGIC add-on using specified commands. The section on certificate requirements has been clarified to state that certificates must be local to the AKS cluster and cannot be mounted from external volumes, which impacts how users manage their certificate storage.

Fleet – Faq

Summary

The documentation now includes detailed explanations on how to control the order of cluster updates using member labels and update groups, emphasizing that member labels (via `memberSelector`) are the preferred method for selecting fleet members due to their flexibility. Additionally, it clarifies that when a `memberSelector` is set at the stage level, all matching clusters form a single implicit group, and that the group name is only for display purposes when a `memberSelector` is defined at the group level.

AKS – Upgrade AKS Node Pools Rolling

Summary

The documentation now includes a new section on "Capacity Based Surge" (preview), which allows users to set both MaxUnavailable and MaxSurge values based on available capacity. If the MaxSurge value cannot be met due to quota or capacity limitations, AKS will automatically attempt a surge of 1 node as a backup. Additionally, it is now recommended to use the max unavailable configuration for in-place upgrades when additional quota or capacity for the upgrade surge is not possible.

AKS – Best Practices Gpu Observability

Summary

This article provides insights into monitoring correlated GPU metrics to help improve long term GPU node utilization and performance on AKS.

AKS – How to Configure Container Network Logs

Summary

The documentation has been updated to clarify the steps for enabling container network logs in Azure Kubernetes Service (AKS). It now includes a detailed end-to-end setup guide, emphasizing the importance of applying a ContainerNetworkLog CRD for log collection and the integration with Azure Monitor.

AKS – Istio Cni

Summary

The Istio CNI documentation has been updated to reflect the latest Azure CLI version requirements and to clarify the process for enabling Istio CNI on both new and existing mesh installations. This ensures users have the most current information for setup.

AKS – Overview

Summary

The documentation now includes an update on a critical local privilege escalation vulnerability (CVE-2026-31431) in the Linux kernel’s `algif_aead` module, which could allow an attacker with code execution in any pod to escalate to root on the node. AKS has deployed a mitigation to block the module from autoloading, but existing nodes created before May 1, 2026, remain exploitable unless a self-service mitigation is applied. Additionally, the document clarifies that AKS does not use path-based gRPC authorization interceptors that are susceptible to a recently disclosed vulnerability (CVE-2026-33186), ensuring that AKS clusters are not vulnerable to this issue.

AKS – AKS Automatic Limitations

Summary

The list of regions where AKS Automatic is available has been updated, removing regions that do not support availability zones. This change ensures users have accurate information regarding the deployment of AKS Automatic in various geographical locations.

AGC – Siem Integration with Sentinel

Summary

The integration instructions for Microsoft Sentinel have been updated to provide clearer guidance on enabling the workspace, improving the usability of the documentation for users looking to implement security monitoring.

AKS – Use Kms Etcd Encryption

Summary

The documentation now specifies that when creating a key using the `az keyvault key create` command, users must ensure that the `encrypt` and `decrypt` key operations are enabled. This clarification helps users understand the necessary steps to properly configure key operations in Azure Key Vault.

Fleet – Update Create Update Strategy

Summary

The document has been updated to clarify the selection of clusters for update strategies, emphasizing the use of member labels over update groups for better flexibility. It includes new instructions for applying labels to fleet members and creating update strategies using member selectors.

AKS – Csi Secrets Store Nginx Tls

Summary

The documentation now clarifies the process for binding certificates to both applications and ingress controllers using the `helm install` command, emphasizing that the application’s deployment references the Secrets Store CSI Driver’s Azure Key Vault provider. Additionally, the link to create or use an existing Azure Key Vault has been updated to specify creating a new key vault, enhancing user understanding of the setup process.

AKS – Ai Toolchain Operator Monitoring

Summary

The documentation has been updated to reflect a change in the URL for accessing the Grafana dashboard configuration named `grafana.json` for inference workload monitoring. Users should now navigate to the examples page under the "observability" section to find and copy the contents of the `grafana.json` file, ensuring they are using the correct resources for monitoring.

AKS – Container Network Security Fqdn Filtering Concepts

Summary

The documentation now clarifies that if Advanced Container Networking Services (ACNS) security is disabled, FQDN and L7 policies (HTTP(s), Kafka, and gRPC) are blocked, which may impact users relying on these features. Additionally, it emphasizes that Alpine-based container images may face DNS resolution issues with Cilium Network Policies due to musl libc’s limitations, advising users to explicitly define all search domains in the Network Policy’s DNS rules.

AGC – Load Balancing Strategies

Summary

Learn about different load balancing strategies to help build resilient and performant workloads.

AKS – Nvidia Gpu Operator

Summary

The documentation now highlights the option for users to utilize AKS-managed GPU node pools, which automatically install and maintain the NVIDIA driver, Kubernetes device plugin, and DCGM metrics exporter, providing a simplified alternative to using the full NVIDIA GPU Operator. This change emphasizes the benefits of choosing managed GPU node pools for users who do not require full control over the GPU setup.

AKS – Istio Support Policy

Summary

The documentation now reflects an updated support policy for Istio versions in Azure Kubernetes Service (AKS), specifically adding version 1.36 to the list of supported versions for asm-1-29. Users can expect continued support for this version through approximately September 2026, enhancing their options for managing Istio within AKS.

AGC – Application Gateway for Containers Components

Summary

The documentation now includes a new section on Network Security Groups (NSGs) for the Application Gateway for Containers association subnet, effective April 23, 2026. Users can fully utilize NSGs for both inbound and outbound rules for associations created on or after this date, while those created before will have specific limitations on inbound traffic for ports 80 and 443. Additionally, the implications of "Deny all" rules on both inbound and outbound traffic are clarified, highlighting the need for explicit allow exceptions to maintain access.

AKS – Update Kms Key Vault

Summary

The documentation for updating the key vault has been revised to include clearer instructions and updated date information, enhancing the clarity and usability of the command for users managing their key vaults.

AGC – Service Mesh Integration

Summary

The documentation now clarifies that the ALB Controller Service Mesh Extension requires the use of specific labels for mutual authentication, detailing that both `istio-injection: enabled` and `istio.io/rev: asm-<version>` labels can be used. Additionally, users are provided with updated commands and examples for configuring namespaces and retrieving the Istio version, enhancing their ability to manage service mesh integrations effectively. The version for the ALB Controller has also been updated to 1.10.26, reflecting the latest changes.

AKS – Keda Deploy Add on CLI

Summary

The documentation now includes a new section on vertically scaling the keda-operator using the Vertical Pod Autoscaler (VPA) to address OOMKill errors. Users can enable VPA on their AKS cluster with the `az aks update` command and apply a provided VPA configuration file to automatically adjust CPU and memory limits for the keda-operator pods based on usage. This enhancement allows users to better manage resource allocation and improve the stability of their applications.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Helm

Summary

The documentation has been updated to reflect the new Helm chart version 1.10.27, replacing previous references to version 1.10.26. Users can now utilize the latest features and improvements associated with this version when deploying the Application Gateway for Containers using the Helm controller. Additionally, the instructions for overriding namespaces during installation have been clarified, ensuring users can customize their deployments more effectively.

AKS – Kms Data Encryption

Summary

The documentation has been updated to clarify the steps for creating a key in the key vault, specifically emphasizing that users must ensure the `encrypt` and `decrypt` key operations are enabled. Additionally, instructions for creating a key vault with Azure RBAC enabled have been revised to include the same requirement for key operations, enhancing user understanding of necessary configurations for data encryption.

AKS – Control Plane Metrics Monitor

Summary

The documentation for control plane metrics has been updated to reflect a schema v2 change, which separates the configuration for targets into `cluster-metrics` and `controlplane-metrics`. Users migrating from v1 should adjust their configurations accordingly, including changing the key name from `default-scrape-settings-enabled` to `default-targets-scrape-enabled` and removing the `controlplane-` prefix from target names. Additionally, the instructions for setting the `minimal-ingestion-profile` have been clarified to ensure users can effectively manage the ingestion volume of metrics.

AKS – Csi Secrets Store Driver

Summary

The documentation now includes detailed instructions for creating and updating an AKS cluster using both Azure CLI and Terraform, specifically with support for the Azure Key Vault provider for Secrets Store CSI Driver. Users can follow new Terraform configurations to create a key vault with Azure role-based access control (RBAC) enabled, assign roles, and add secrets, enhancing their ability to manage secrets securely within their AKS environments. Additionally, the documentation emphasizes the need to set the Azure subscription in the CLI and provides commands for verifying the managed identity and key vault provider installation.

AKS – Csi Secrets Store Identity Access

Summary

Updated the documentation regarding the Azure Key Vault provider for Secrets Store CSI Driver on AKS. The changes clarify the process of granting access to cluster resources and the creation of user identities when enabling the provider.