Azure Container Services Docs – Weekly Update (2026-09-06 to 2026-09-13)

AKS – Istio Deploy Addon

Summary

Updates to the Istio deployment documentation include changes to node affinity weights for istiod and ingress/egress gateway pods, providing clearer guidance on scheduling these components on specific nodes.

AKS – Concepts Security

Summary

The security documentation has been updated to recommend using workload identity federation for pipeline identity management, enhancing security practices by avoiding long-lived credentials.

AGC – Troubleshooting Guide

Summary

The documentation has been updated to reflect the new version of the ALB controller, now listed as **1.12.1** instead of **1.9.13**. This change informs users of the latest version available for the ALB controller, which may include new features or improvements relevant to their deployments. Users should refer to this updated version for the most current capabilities and enhancements.

AKS – Auto Upgrade Node Os Image

Summary

Included the retirement notice for Azure Linux with OS Guard, emphasizing the need for migration to avoid disruptions.

AKS – Upgrade Os Version

Summary

Updated guidance for migrating to Ubuntu 26.04, including the need for the `Ubuntu2604Preview` feature flag and clarifications on versioned OS SKUs.

AKS – Use Azure Linux Os Guard

Summary

Added a retirement notice for Azure Linux with OS Guard, indicating that support will end on December 10, 2026, and existing node images will be removed by March 10, 2027. Users are advised to migrate to Azure Container Linux (ACL).

AKS – Node Auto Provisioning Networking

Summary

The documentation now clarifies the networking configurations supported by Node Auto-Provisioning (NAP), detailing specific options for IP address management (IPAM), network plugins, data planes, and network policies. Users can now set the `vnetSubnetID` field in `AKSNodeClass` resources to specify custom subnets for node provisioning, allowing for mixed subnet configurations across node pools. Additionally, the guidance emphasizes that changing `vnetSubnetID` between valid subnets can lead to node provisioning issues, requiring careful management of permissions and available IP addresses.

AGC – API Specification Kubernetes

Summary

The API specification for the Application Gateway for Containers has been updated to reflect changes in target references and health check protocols, enhancing clarity on how these components interact.

AKS – Http Proxy

Summary

The documentation now clarifies that for new clusters, users can specify up to 20 trusted CA certificates, with the CA certificate content limited to 35 KB. Additionally, the `trustedCa` parameter is defined as a string containing base64 encoded alternative CA certificate content, which must be in PEM format.

AKS – Operator Best Practices Network

Summary

The documentation for Azure Kubernetes Service (AKS) has been updated to clarify the use of Azure CNI networking, emphasizing the distinction between Azure CNI Overlay and Flat networking models, which allows users to choose the appropriate setup based on their workload requirements. Additionally, the ingress configuration examples have been revised to reflect the use of the application routing add-on’s managed NGINX ingress class, enhancing clarity on traffic distribution and security measures. Users are now advised to utilize `kubectl debug` for troubleshooting Linux nodes without requiring direct SSH access, improving security practices.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Helm

Summary

The documentation has been updated to reflect the new version 1.12.1 of the Application Gateway for Containers, replacing all instances of version 1.11.4. Users can now utilize the features and improvements introduced in version 1.12.1, enhancing their deployment experience with the Application Gateway. Additionally, version 1.11.4 has been updated to 1.11.4 in relevant sections, ensuring users have access to the latest syntax and commands.

AKS – Upgrade Options

Summary

The documentation has been updated to reflect that the ‘max blocked nodes’ feature is no longer in preview. Additionally, the prerequisites for using this feature have been removed, simplifying the installation process for users.

AKS Arc – Create Manage Cluster

Summary

Renamed the article to better reflect its content and added detailed instructions on creating and managing an AKS cluster with disconnected operations. This includes prerequisites, limitations, and installation steps for Azure CLI extensions, significantly improving user guidance.

AKS – Istio Gateway API

Summary

Minor updates to the load balancer configuration documentation, improving clarity on customizing the load balancer using Kubernetes annotations. This change enhances the usability of the documentation for users configuring load balancers in AKS.

AKS – Custom Certificate Authority

Summary

The documentation now clarifies that for new clusters, the CA certificate content must not exceed 35 KB when adding up to 10 base64-encoded certificates to the node’s trust store. Additionally, it specifies that users should create a text file with up to 10 blank line-separated certificates for installation in the trust stores of the AKS node.

AKS – Network Isolated

Summary

Significant updates were made to the guidance on creating a network isolated Azure Kubernetes Service (AKS) cluster. The article now specifies the required Azure CLI version as 2.73.0 or later, and it includes new sections on setting environment variables and detailed explanations of private cluster modes. Additionally, the outbound type ‘block’ is noted as being in preview.

AKS – Os Guard Preview Retirement

Summary

Newly added document detailing the retirement of Azure Linux with OS Guard, including important dates and migration instructions.

AKS – Configure AKS Scheduler

Summary

The documentation for configuring advanced scheduler profiles on Azure Kubernetes Service (AKS) has been updated to reflect that users now need Azure CLI version 2.90.0 or later, replacing the previous requirement of version 2.76.0. Additionally, the title has been revised to remove the "preview" designation, indicating that the feature is now generally available. Users should also note that the `aks-preview` Azure CLI extension version has been updated to 18.0.0b27 or later.

AGC – Service Mesh Integration

Summary

The documentation has been updated to reflect the new version 1.12.1 of the service mesh integration for Azure Application Gateway, replacing the previous version 1.11.4. Users can now access features and improvements introduced in this latest version, enhancing their integration capabilities. Additionally, the version 1.11.3 has been updated to 1.11.4, ensuring users have the most current information on available versions.

AKS – Configure Automatic Zone Placement

Summary

The automatic zone placement documentation has been revised to clarify that it only supports regions with availability zone support. Additional details on the per-zone cap and the requirements for the aks-preview CLI extension have been included.

AKS – Plan Pod Networking

Summary

Revised guidance on pod networking options for Azure Kubernetes Service (AKS), emphasizing the importance of choosing a configuration based on IP access needs and scale requirements.

AKS – Istio Deploy Ingress

Summary

Updated the guidance on configuring load balancers to clarify the customization process using Kubernetes annotations. This change improves the clarity and usability of the documentation.

AKS – Cluster Health Monitor

Summary

The Cluster Health Monitor documentation was enhanced to clarify its functionality, including automatic remediation for unhealthy CoreDNS pods. The description now emphasizes the continuous control plane and add-on health checks, and it specifies that these monitors are enabled by default on AKS Automatic clusters running version 1.34 or later.

AGC – Overview

Summary

The documentation now includes details on the new "Request mirroring" feature, which allows users to mirror requests to multiple backend pools. Additionally, support for new regions has been added, including Australia Central 2, Australia Southeast, Canada East, Italy North, and Japan West, expanding the geographical availability of the service.

AKS – Node Auto Provisioning Node Pools

Summary

The documentation now clarifies that AKS Automatic includes Node Auto-Provisioning (NAP) by default, while for AKS Standard clusters, users must enable NAP before configuring node pools. Additionally, the `–node-provisioning-default-pools` flag can now be used not only during cluster creation but also with the `az aks update` command for existing clusters, allowing users to control the creation of default NAP node pools. Furthermore, the guidance on how NAP evaluates and selects node pools has been enhanced to emphasize the importance of mutually exclusive node pools for optimal performance.

AKS – Configure Dual Stack

Summary

The documentation for configuring dual-stack networking in Azure Kubernetes Service (AKS) has been updated to clarify that in Azure Linux node pools, IPv6 services require `externalTrafficPolicy: Local`. Additionally, it now specifies that Azure CNI Overlay does not support Azure or Calico network policies with dual-stack networking, and users should utilize Azure CNI Powered by Cilium for network policies. The article also emphasizes that the Standard NAT Gateway supports only IPv4, and for dual-stack egress, users should use the StandardV2 NAT Gateway, which is currently in preview.

AKS – Configure Load Balancer Standard

Summary

The documentation for configuring the Azure Kubernetes Service (AKS) load balancer has been updated to clarify the use of Kubernetes annotations for customizing load balancer behavior, particularly for inbound traffic. Users can now specify health probe configurations using annotations such as `service.beta.kubernetes.io/azure-load-balancer-health-probe-interval` and `service.beta.kubernetes.io/azure-load-balancer-health-probe-num-of-probe`, with default values provided if not explicitly set. Additionally, the maximum value for TCP idle timeouts has been increased from 30 to 100 minutes, enhancing flexibility in managing connection timeouts.

AKS – Limit Egress Traffic

Summary

The documentation for configuring Azure Kubernetes Service (AKS) egress traffic through Azure Firewall has been updated to clarify that users should plan for at least 20 frontend IPs to prevent SNAT port exhaustion and consider integrating with NAT Gateway for high-traffic clusters. Additionally, the guidance now emphasizes configuring the virtual network to use the Azure Firewall’s private IP as its DNS server to ensure consistent FQDN resolution. Users are also instructed to include the firewall’s public IP when updating authorized IP ranges for the AKS API server.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Addon

Summary

The documentation now includes instructions for using the Azure CLI to register the Application Gateway for Containers add-on feature, which is currently in preview. Users are advised to review the Supplemental Terms of Use for Azure previews and are informed that provisioning of Application Gateway for Containers resources will fail if not deployed in a supported region. Additionally, the verification steps for the ALB Controller installation have been clarified, ensuring users can confirm successful installation and resource provisioning.

AKS – Managed Gateway API

Summary

Documented the Gateway API bundle version 1.6.1 for Kubernetes v1.37+, including updates to the supported versions table. This change provides users with critical compatibility information for managing their Kubernetes environments effectively.

AKS – Use Cvm

Summary

The documentation now includes a retirement notice for Azure Linux with OS Guard, informing users of the upcoming changes and implications for their use of this feature. Users should review this notice to understand how it may affect their deployments and any necessary actions they may need to take.

AKS – Load Balancer Standard

Summary

The documentation now clarifies that the _Standard_ SKU Azure Load Balancer is the default for AKS clusters, with the _Basic_ SKU retired as of September 30, 2025. Users must migrate from the _Basic_ SKU to the _Standard_ SKU using a supported upgrade process, which will incur downtime and cannot be rolled back. Additionally, new service annotations are recommended for specifying existing public IP resources, enhancing efficiency and avoiding throttling.

AKS – Scale Cluster

Summary

The documentation for scaling AKS clusters has been updated to clarify that if the cluster autoscaler is enabled, users cannot manually change the node count without first adjusting the autoscaler settings. Additionally, support for Azure Linux 2.0 has ended, and users are advised to migrate to Azure Linux 3 before scaling affected node pools. The requirements for naming node pools have also been revised, specifying that Linux node pool names must now be between 1-12 characters.

AKS – Concepts Network Azure Cni Pod Subnet

Summary

The documentation for Azure CNI Pod Subnet networking in Azure Kubernetes Service (AKS) has been updated to clarify that users should now utilize Azure CLI version 2.75.0 or later for configuring Static Block Allocation. Additionally, it specifies that in-place migration or updates of existing node pools are not supported, and users must add a Static Block Allocation node pool on a new subnet to migrate from Dynamic IP Allocation. The guidance on Kubernetes network policies has also been refined to indicate the use of Azure CNI Powered by Cilium for Linux node pools and Calico for Windows node pools, with important deadlines for Azure Network Policy Manager support.

AGC – How to Request Mirroring Gateway API

Summary

Learn how to configure request mirroring with Application Gateway for Containers.

AKS Arc – Connectivity Modes

Summary

The documentation now clarifies the distinction between standard, cloud-connected AKS on Azure Local clusters and the disconnected operations mode, emphasizing that the latter operates with its own local control plane and does not require a connection to the Azure public cloud. This change helps users better understand the different connectivity states and deployment modes available for AKS on Azure Local.

AGC – Application Gateway for Containers Components

Summary

The documentation now clarifies that if an association is deleted and recreated, it will be treated as a new association under the current NSG enforcement model. Users are advised to configure the necessary NSG allow rules, including the _AzureLoadBalancer_ tag, before recreating the association to prevent frontend connectivity or health probe issues.

AKS – Node Images

Summary

Updated the node images section to include the retirement notice for Azure Linux with OS Guard and added guidance for Ubuntu 26.04 preview. The date for the last support of Azure Linux with OS Guard is also updated.

AKS – Static IP

Summary

The static IP guidance was refreshed to clarify the requirements for using a Standard SKU IP with a Standard SKU load balancer. The article now emphasizes the deprecation of the ‘loadBalancerIP’ property and recommends using service annotations instead, providing a clearer path for users to follow.

AKS – Workload Identity Overview

Summary

The documentation now emphasizes the importance of using the `AZURE_FEDERATED_TOKEN_FILE` environment variable to locate the projected service account token, advising against hard-coding paths in applications or deployment manifests. It clarifies that Azure Identity client libraries and MSAL automatically handle this variable, allowing users to avoid direct file management, and it highlights the need to read the token file each time it is exchanged for a Microsoft Entra token to ensure it is up-to-date.

AKS – Create Node Pools

Summary

The documentation now includes a retirement notice for Azure Linux with OS Guard, informing users about the upcoming changes and implications for their deployments. This update ensures that users are aware of the timeline and can plan accordingly for the transition away from this feature.

AKS – Kubelogin Authentication

Summary

The documentation for kubelogin authentication in AKS has been updated to clarify that the service principal authentication method now specifically requires managed Microsoft Entra ID integration, rather than legacy Azure Active Directory. Additionally, it now emphasizes that AKS clusters running Kubernetes version 1.24 or later automatically utilize the kubelogin exec plugin format, while earlier versions necessitate manual conversion. New sections have been added detailing Azure Developer CLI and Azure Pipelines authentication methods, providing users with specific commands and guidance for these integrations.

AGC – Alb Controller Release Notes

Summary

The documentation now includes updates for ALB Controller version 1.12.1, which introduces security patches, bug fixes for helm chart pre-delete tolerations, session affinity cookie fixes, and request mirroring. Additionally, version 1.11.1 has been updated to support Gateway API v1.5.1, including features like HTTPRoute timeouts, CORS support, and HTTP redirect 307/308 support. Users can also benefit from improvements in load-aware routing and fixes related to readiness probes for ingress in version 1.10.21.

AKS – Configure Azure Cni Dynamic IP Allocation

Summary

The documentation for configuring Azure CNI Pod Subnet with dynamic IP allocation has been updated to enhance clarity on features such as better IP utilization, scalability, and performance. Users can now configure separate VNet policies for pods, allowing for more flexible network management, including internet connectivity options and traffic filtering. Additionally, the support for Azure Network Policy Manager (NPM) has been clarified, with specific end dates for Windows and Linux nodes, impacting how users manage network policies in their clusters.