The documentation has been updated to reflect new naming conventions for Azure RBAC and Kubernetes RBAC resources. Users will now find references to "entra-id-authorization" and "kubernetes-rbac-entra-id" instead of the previous terms, enhancing clarity and consistency in the context of Azure Active Directory integration with Kubernetes.

The documentation for setting up permissions and role-based access control (RBAC) in AKS Desktop has been updated to clarify how users can manage RBAC permissions based on their roles as cluster operators or developers. Users can now provide environments for developers to deploy and manage applications, and the article emphasizes the need to use the Azure portal or Azure CLI for updating permissions after project creation, as there is currently no UI option for this. Additionally, the documentation now includes clearer instructions on assigning specific roles, such as the Azure Kubernetes Service Namespace Contributor and Azure Kubernetes Service Cluster User roles, to facilitate user access management.

The documentation for outbound network and FQDN rules for Azure Kubernetes Service (AKS) clusters has been updated to clarify the requirements for accessing various services. Users can now see that the Microsoft Container Registry (MCR) in China Cloud requires specific FQDNs, and the authentication requirements for Microsoft Entra have been refined. Additionally, the descriptions for accessing Windows-related binaries and the commerce metering API have been standardized for better clarity.

The documentation now clarifies that when creating a new cluster or adding a node pool, the number of vCPUs determines the OS disk size by default, with a table listing the default sizes for each VM SKU. Additionally, the example YAML manifest has been updated to reflect the use of the _managed-premium-retain_ storage class instead of _managed-premium_. Users can also find improved descriptions of storage classes, including details on reclaim policies and support for zone-redundant storage starting with Kubernetes version 1.29.

The documentation now includes new commands for managing JWT authenticators in Azure Kubernetes Service (AKS), specifically `az-aks-jwtauthenticator-add`, `az-aks-jwtauthenticator-delete`, `az-aks-jwtauthenticator-list`, and `az-aks-jwtauthenticator-show`. Users can now configure and manage JWT authentication more effectively with these added commands, enhancing their ability to secure AKS clusters. Additionally, the documentation has been updated to include commands for registering features and providers, improving the overall clarity and usability of the AKS CLI commands.

The documentation now specifies that Docker Hardened Images (`dhi.io`) and Azure Container Registry (`azurecr.io`) support only authenticated pulls, while NVIDIA NGC Container Registry (`nvcr.io`) supports both authenticated and unauthenticated pulls. This clarification impacts how users can access images from these registries using the Azure CLI and Azure portal.

The documentation now clarifies that the AKS planned maintenance window is specifically for scheduling AKS cluster and node image upgrades, and does not cover platform-level maintenance on the underlying VMSS. Users will be informed in advance about maintenance events requiring a reboot through Maintenance Notifications, which include a self-service phase lasting up to four weeks. Additionally, it emphasizes that AKS will not initiate new upgrade operations after the maintenance window closes, ensuring users understand the timing and conditions for upgrades.

The documentation now includes a note clarifying that managed identities in AKS specifically address the cluster-to-Azure identity scenario, detailing how the AKS cluster interacts with Azure to manage resources. Users are directed to the "Access and identity options for AKS" section for information on other identity scenarios, such as control-plane authentication and pod-to-Azure workload identity.

This guide explains how to deploy the MetalLB extension for Azure Arc-enabled Kubernetes clusters using Azure CLI. It covers prerequisites, installation steps, and configuration details necessary for setting up a load balancer to distribute traffic across multiple nodes.

Learn how to use the AI-powered troubleshooting assistant in AKS desktop to diagnose and resolve Kubernetes issues using natural language.

The documentation for AKS Desktop has been updated to clarify its purpose and benefits, emphasizing that it enables development teams to deploy and manage applications on Azure Kubernetes Service (AKS) without requiring deep Kubernetes expertise. Key features such as guided workflows for application deployment, unified observability, and natural language troubleshooting have been highlighted, allowing users to manage applications more efficiently and effectively. Additionally, the integration with existing tools like Visual Studio Code and GitHub is reinforced, ensuring a seamless experience across development environments.

Learn how authorization for the Kubernetes API works in Azure Kubernetes Service (AKS), and how to choose between Kubernetes RBAC and Microsoft Entra ID authorization with optional Azure ABAC conditions.

The document has been significantly revised to simplify the process of enabling AKS-managed Microsoft Entra integration. It now outlines the steps for configuring Kubernetes role-based access control (RBAC) based on user identity or directory group membership, streamlining the integration process.

The documentation for Azure Kubernetes Service (AKS) has been updated to reflect changes in role-based access control (RBAC) references. Users can now find information on managing Azure RBAC and creating role assignments for cluster access in the new section linked to the Entra ID authorization documentation, streamlining the process of managing access to AKS clusters.

The documentation has been updated to reflect a change in the naming of the RBAC section, now referred to as "kubernetes-rbac-entra-id.md" instead of "azure-ad-rbac.md." This change may impact users by clarifying the integration of Kubernetes RBAC with Entra ID, enhancing their understanding of role-based access control in Azure Kubernetes Service.

The documentation has been updated to clarify the integration with Microsoft Entra for AKS clusters. Users are now directed to use the term "Microsoft Entra integration" instead of "AKS-managed Microsoft Entra integration," ensuring consistency and clarity in the instructions for setting up their AKS clusters.

The document has been updated to clarify the management of local Kubernetes users created during cluster creation, emphasizing the importance of disabling these users for security purposes. It provides a link to the relevant feature for managing local accounts.

The documentation now specifies that the minimum disk space requirement has increased from at least 14 GB to at least 19 GB for certain configurations. Users should ensure they have sufficient disk space available to meet this updated requirement for optimal performance.

Learn how to deploy an AKS enabled by Azure Arc cluster on Azure Local (multi-rack) using an Azure Resource Manager template (ARM template).

The documentation has been updated to reflect changes in the Azure Kubernetes Service (AKS) role-based access control (RBAC) sections. Users can now find information on managing Azure RBAC and creating role assignments for cluster access under the new Entra ID authorization links, streamlining access to relevant resources. This change enhances clarity and directs users to the most current guidance for managing access to AKS clusters.

Learn how to enable Microsoft Entra ID authentication for the Kubernetes API server (control plane) on an Azure Kubernetes Service (AKS) cluster.

The documentation has been updated to reflect changes in the role assignment process for Azure Kubernetes Service (AKS). Users will now find that the section on creating role assignments for cluster access has been moved from the "manage-azure-rbac.md" file to the "entra-id-authorization.md" file, ensuring they have the most current guidance on managing access.

The documentation has been updated to clarify that secret encryption on AKS Edge Essentials clusters is enabled by default starting with version 1.12.269.0, enhancing security for users. Additionally, the section on verifying the KMS provider has been renamed to emphasize checking its health, and users are now instructed to ensure the health status of **kms-providers** is **OK**. The instructions for enabling the KMS provider have also been streamlined for clarity.

The documentation for deploying applications using AKS Desktop has been updated to clarify that users can now deploy containerized applications without writing Kubernetes manifests. Additionally, it specifies the requirement for Azure CLI version 2.64.0 or later and emphasizes the need for appropriate Role-Based Access Control (RBAC) roles for team members. The article also provides clearer instructions on configuring settings during application deployment, enhancing user experience and understanding.

The documentation for Azure Kubernetes Service (AKS) has been updated to reflect changes in the best practices for identity management. Users can now refer to the new section on cluster authentication in "concepts-cluster-authentication.md" instead of the previous "operator-best-practices-identity.md" for guidance on identity-related best practices. This change aims to streamline the information and improve clarity on managing identities within AKS.

The documentation now specifies updated dashboard IDs for importing Azure Insights Container Networking Flow Logs. Users must use ID 23155 for the basic tier and ID 23156 for the analytics tier when importing the respective dashboards. This change ensures users have the correct references for visualizing AKS workload communications.

This article discusses the integration of Microsoft Entra ID with Kubernetes RBAC in AKS, detailing best practices for authentication and authorization. It highlights the importance of managing identities and access controls effectively.

The documentation now clarifies that Microsoft Entra ID is not supported as an external identity provider through structured authentication. Users are directed to use the existing Microsoft Entra integration for authentication, with updated references to the relevant documentation on the integration process. This change ensures users have accurate guidance on how to implement Microsoft Entra ID authentication in AKS.

The documentation now includes updated links for integrating with Kubernetes RBAC and setting up Microsoft Entra ID for Kubernetes access. Users can now find more relevant resources under the sections for Kubernetes RBAC and Entra ID, which may enhance their understanding and implementation of identity and security management in Azure Kubernetes Service.

Learn how to troubleshoot Kubernetes applications in AKS desktop using the built-in Insights feature powered by Inspektor Gadget.

The document has been significantly updated to remove outdated content and streamline the information regarding Azure RBAC for Kubernetes Authorization. It emphasizes the integration of Microsoft Entra ID and AKS, providing clarity on managing authorization within AKS clusters.

The documentation has been updated to reflect the use of Microsoft Entra ID for Kubernetes API authorization, replacing previous references to Azure RBAC. Users can now find more relevant information on managing access through Microsoft Entra integration, enhancing their understanding of identity management and authorization capabilities within Azure Kubernetes Service (AKS). Additionally, links have been updated to direct users to the correct resources for controlling access to cluster resources using Microsoft Entra identities.

Reference for the Azure permissions required by the identity creating an AKS cluster, the cluster identity at runtime, and AKS node access.

The documentation for creating Azure Disks has been updated to reflect changes in the storage class names, now including `managed-csi-premium` instead of `managed-csi`. Additionally, the example manifest for creating a persistent volume claim has been modified to request a disk size of 10 GB instead of 5 GB. Users should also note the corrected casing for parameters like `skuName` and `userAgent`, which may affect their implementation.

Learn how Azure Kubernetes Service (AKS) authenticates Kubernetes API requests using Microsoft Entra ID, and how to disable local cluster admin accounts in production.

This document provides instructions on upgrading an AKS cluster to a newer Kubernetes version on Azure Local. It details the upgrade process, prerequisites, and supported Kubernetes versions, ensuring users can maintain their cluster’s performance and security.

The documentation now clarifies that the Azure CLI authentication method works with Microsoft Entra instead of being limited to AKS managed Microsoft Entra. Additionally, the explanation regarding the compatibility of the Azure authentication method in kubectl with the device code flow and the removal of the `spn:` prefix from the audience claim has been refined for better understanding. Users can now find updated guidance on integrating AKS with Microsoft Entra in the revised how-to article.

Learn about scale requirements for AKS on Azure Local, Rack Scale deployments, including cluster, node pool, and node limits.

The documentation for Azure Kubernetes Service (AKS) has been updated to clarify the five distinct identity scenarios, including Kubernetes control-plane authentication and authorization, AKS resource authorization, cluster identity, and workload identity. Users can now find detailed guidance on how to implement Microsoft Entra integration and utilize Azure RBAC for Kubernetes authorization, enhancing their ability to manage user permissions and access to resources effectively. Additionally, the article now includes a decision guide to help users choose the appropriate authentication and authorization model for their specific needs.

This document has been renamed and updated to clarify the management of local accounts with Microsoft Entra integration in AKS. It provides essential information on setting up and managing local accounts effectively.

The documentation now clarifies the distinction between existing and potential new nodes for VM SKUs in Kubernetes clusters. Users can now find specific information regarding the available number of existing nodes and the potential number of new nodes for each VM SKU, enhancing their ability to manage resources effectively. This change is reflected in the updated descriptions for the `kubernetes.azure.com/vm-sizes/{vm-sku-name}/count` and `kubernetes.azure.com/vm-sizes/{vm-sku-name}/capacity` endpoints.

The documentation now recommends using Microsoft Entra ID authorization for the Kubernetes API instead of Azure Role-Based Access Control (RBAC) to restrict access to custom node configuration settings. This change emphasizes a more secure method for managing permissions, which can enhance cluster stability and performance by limiting who can modify configurations.

The documentation for the Trusted Access feature has been updated to clarify the access configurations for AKS clusters. Notably, the links to related topics have been revised to point to the correct sections, including updates to the local accounts management and Microsoft Entra integration. Users can now find more accurate references to manage local accounts and authenticate with Microsoft Entra in the context of AKS clusters.

This article has been updated to improve guidance on configuring LocalDNS in AKS. It provides clearer instructions and best practices for managing DNS configurations within Kubernetes clusters.

The documentation for Azure Kubernetes Service (AKS) has been updated to reflect changes in role-based access control (RBAC) references. Users can now find information on creating role assignments for cluster access in the new section under the Entra ID Authorization documentation, streamlining the process for managing access to AKS clusters. This change enhances clarity and directs users to the most relevant resources for managing RBAC in AKS.

The best practices document for managing authentication and authorization in AKS has been updated to reflect new recommendations and practices. It emphasizes the importance of using Microsoft Entra ID for centralized identity management and outlines strategies for controlling access to resources effectively.

The documentation now directs users to the updated section on "Microsoft Entra ID authorization for the Kubernetes API" instead of the previous "Azure RBAC for Kubernetes Authorization." This change clarifies the use of Azure role-based access control for managing access to AKS resources, ensuring users have the most current information on authorization methods.

Plan the IP addresses needed to deploy AKS enabled by Azure Arc clusters on Azure Local (multi-rack), including node IPs, control plane endpoints, and load balancer addresses.

The documentation has been updated to clarify that users can enable data encryption in transit for NFS Azure file shares by setting `encryptInTransit: "true"` in either the StorageClass parameters or PersistentVolume `volumeAttributes`. Additionally, the example for existing persistent volumes has been enhanced to include a new `PersistentVolume` configuration that specifies `encryptInTransit: "true"`, allowing users to easily implement this feature. Minor formatting adjustments were also made to improve clarity in the YAML syntax examples.

The documentation for deploying WireGuard encryption with Advanced Container Networking Services has been updated to reflect its general availability status. Users are now informed that WireGuard is disabled by default after enabling Advanced Container Networking Services, and they can enable it by using the `–acns-transit-encryption-type wireguard` flag. Additionally, the instructions clarify that WireGuard can be independently disabled without affecting other features by using the `–acns-transit-encryption-type=none` flag.

The documentation for Azure Kubernetes Service (AKS) has been updated to reflect changes in the best practices for identity management. Users can now refer to the new section on cluster authentication, which replaces the previous operator best practices for identity. This change provides clearer guidance on managing identities within AKS clusters.

The documentation now includes an important notice regarding the retirement of the Key Manager for Kubernetes extension (preview), which will no longer be available for deployment after April 15, 2026. Users are advised to seek further assistance through the AKS enabled by Azure Arc GitHub repository if they have questions related to this change.

The documentation has been updated to reflect a change in the reference for Azure Active Directory integration, now directing users to the "entra-id-control-plane-authentication.md" instead of the previous "azure-ad-integration-cli.md." This update ensures that users have access to the most current information regarding authentication methods for Azure Kubernetes Service.

The documentation now emphasizes the importance of installing the Key Manager for Kubernetes on an AKS Edge Essentials cluster to automatically rotate signing keys for Kubernetes service account tokens. Additionally, it provides instructions for users who have not installed the Key Manager, guiding them on how to ensure periodic token rotation.

Learn about Projects in AKS desktop, the application-centric grouping of Kubernetes resources that simplifies deployment and management of applications on Azure Kubernetes Service (AKS).

The documentation now includes a note clarifying that Workload ID pertains specifically to the **pod-to-Azure** identity scenario in AKS, detailing how applications in pods authenticate to Microsoft Entra–protected services. Users are directed to refer to the "Access and identity options for AKS" section for information on other identity scenarios, such as control-plane authentication and authorization, and cluster-to-Azure managed identities.

This document outlines best practices for securing AKS clusters, including the management of identities and access controls. It emphasizes the importance of following security guidelines to protect cluster resources.

This document describes the Key Management Service (KMS) provider for secret encryption in AKS Edge Essentials, detailing how it enables encryption at rest for Kubernetes secrets stored in etcd. It highlights the automatic key rotation feature and provides links for further information.

The documentation now includes significant updates for the release 1.12.269.0, which introduces support for cross-distribution upgrades within the same Kubernetes release version, allowing users to upgrade between different distributions more flexibly. Additionally, the KMS provider is now enabled by default for new deployments, simplifying the setup process as no extra configuration is needed. Users are also provided with detailed upgrade paths and supported versions for better planning of their upgrades.

Learn how to cache container images from one Azure Container Registry in another using managed identity authentication with Azure CLI and Bicep.

The documentation has been updated to reflect the correct link for the AKS-managed Microsoft Entra integration, now directing users to the appropriate page for control plane authentication. This change ensures that users can access the correct resources needed for Azure Kubernetes Application Network connectivity and security when using an existing AKS cluster.

The documentation has been updated to reflect a change in the naming of the Azure RBAC for Kubernetes section, now referred to as "Entra ID Authorization." This change may impact users by providing a clearer understanding of the integration with Entra ID, enhancing their ability to manage authorization in Azure Kubernetes Service.

This document introduces access and identity management options for Kubernetes clusters in AKS on Azure Local, emphasizing the use of Kubernetes RBAC for securing cluster access. It outlines the limitations of Azure RBAC in multi-rack deployments and provides detailed information on roles, role bindings, and the overall RBAC framework.

This document outlines the network requirements for deploying AKS enabled by Azure Arc clusters on Azure Local, including logical network configuration, IP address requirements, and port requirements necessary for successful deployment.

The documentation for Azure Kubernetes Service (AKS) has been updated to reflect changes in the authentication and local account management sections. Users can now find more accurate references to the "Entra ID Control Plane Authentication" and "Local Accounts" topics, which may enhance their understanding and implementation of these features. This update improves clarity and accessibility for managing authentication and local accounts in AKS.

Learn about the architecture of AKS enabled by Azure Arc on Azure Local (multi-rack), including how clusters are deployed, managed, and connected to Azure.

The documentation for customizing cluster egress with outbound types in Azure Kubernetes Service (AKS) has been updated to clarify the selection of `managedNATGatewayV2` or `managedNATGateway` when using managed virtual networks, emphasizing the benefits of the StandardV2 NAT gateway. Additionally, the section on supported migration paths has been refined for clarity, and the command syntax for updating the outbound configuration has been corrected to ensure users can accurately execute the `az aks update` command.

The documentation for the AKS Arc gateway has been updated to clarify that it simplifies network configuration requirements, removing the mention of it being in preview. Users can now find more straightforward information regarding the endpoints required for AKS Arc clusters and other Arc-enabled scenarios, emphasizing that additional endpoints may still need to be allowed in their proxy based on specific scenarios.

The documentation now directs users to the updated section on Microsoft Entra ID authentication, specifically referencing the concepts-cluster-authentication.md file instead of the previous concepts-identity.md. This change clarifies the authentication process for users deploying a private Kubernetes API endpoint, ensuring they have the most accurate and relevant information for securing their cluster.

The documentation for the Azure Kubernetes Service (AKS) has been updated to reflect changes in the best practices for identity management, specifically by linking to the new section on cluster authentication. Users can now find more relevant information on identity management practices in the updated "concepts-cluster-authentication.md" section, enhancing their understanding of how to manage identities within AKS.

The documentation has been updated to reflect the removal of "AKS-managed" from the title and sections regarding Microsoft Entra integration, simplifying the terminology. Users can now configure node-side access modes that inherit Conditional Access, including Microsoft Entra ID-based SSH, with the newly referenced section on managing SSH access on AKS cluster nodes.

Learn how to set up a compatible Azure Kubernetes Service (AKS) cluster for AKS desktop.

The documentation for configuring AKS availability zones has been updated to clarify that not all VM SKUs are accepted when creating node pools in a specified location. Users are now informed that node pool creation will fail if the selected VM SKU does not support the requested availability zones in that region, and they can check SKU availability using the `az aks list-vm-skus` command with specific parameters.

The documentation has been updated to include the latest versions of the K8s and K3s installers, now reflecting K8s installer version 1.33.5 and K3s installer version 1.33.5. Users can now access these updated installers through the provided links, ensuring they are using the most current software for their AKS Edge setup.

The documentation for WireGuard encryption has been updated to remove the preview tag, indicating that it is now generally available. Additionally, a new section on Cilium mTLS encryption has been added, which allows users to implement transparent, mutual TLS encryption and authentication for pod-to-pod traffic in Kubernetes without needing to modify applications or add extra networking components.

The documentation for WireGuard encryption with Advanced Container Networking Services (ACNS) has been updated to reflect its general availability, removing references to public preview. Users can now find detailed information on how WireGuard in-transit encryption secures specific traffic flows within Kubernetes clusters, including which traffic types are encrypted and which are not supported.

The documentation has been updated to replace references to "Best practices for authentication and authorization" with more specific sections on "Cluster authentication concepts" and "Cluster authorization concepts." This change allows users to access detailed information on authentication and authorization tailored specifically for clusters, enhancing their understanding and implementation of these critical security aspects.

The documentation for Azure Kubernetes Service (AKS) has been updated to reflect changes in the best practices for identity management and Azure Active Directory (AAD) integration. Users can now refer to the new sections on cluster authentication and Entra ID control plane authentication, which provide updated guidance on creating AAD applications and implementing identity best practices. This change enhances clarity and ensures users have access to the most current information for managing identities in AKS.

The documentation has been updated to reflect the integration of Microsoft Entra with AKS, removing the "managed" terminology for clarity. Users can now utilize just-in-time elevation for node sign-in using Microsoft Entra ID based SSH, enhancing security and access management. Additionally, references to related resources have been updated to direct users to the correct documentation for managing SSH access and role-based access control.

The release notes for the ALB Controller include updates on security patches, bug fixes, and new features such as Load Aware Routing and Istio service mesh integration. It provides detailed information on version updates and improvements.

This document has been updated to clarify the process for viewing and managing service health notifications in the Azure portal, enhancing user understanding of service health management.

Learn about different load balancing strategies to help build resilient and performant workloads.

The documentation now includes a new section on Network Security Groups (NSGs) for the Application Gateway for Containers, detailing that NSGs are fully supported on association subnets for associations created on or after April 23, 2026. Users can configure both inbound and outbound rules, but for associations created before this date, inbound traffic on ports 80 and 443 will always be allowed, regardless of configured rules. Additionally, "Deny all" rules can be applied, but users must be cautious as they may inadvertently block essential traffic unless explicit allow exceptions are defined.

The documentation for Application Gateway for Containers has been updated to include a new set of Azure Resource Manager APIs, which differ from the existing Application Gateway APIs. Additionally, users can now utilize flexible load balancing strategies, including Least Request, Load Aware Routing, Ring Hash, Round Robin, and Weighted Round Robin, enhancing their traffic management capabilities.

The documentation has been updated to clarify that the health check now uses the same protocol by default, rather than stating it will use the same protocol. Additionally, a new section on LoadAwareConfig has been introduced, detailing its configuration for load-aware routing, including parameters such as blackoutPeriod, metricExpirationPeriod, errorUtilizationPenalty, and namedMetrics, which provide users with more control over load balancing decisions. Users can now better understand how to implement and configure load-aware routing strategies in their applications.

The documentation for migrating from Application Gateway Ingress Controller (AGIC) to Application Gateway for Containers (AGC) has been updated to clarify that users can now utilize a migration utility to automatically translate AGIC Ingress to Gateway API for AGC. Additionally, the language has been refined to indicate that users can deprecate AGIC after migration and delete the AGIC add-on or uninstall the controller if deployed via Helm. These changes enhance the clarity and usability of the migration process for users transitioning to AGC.

The documentation has been updated to reflect the upgrade of the ALB Controller Helm chart version to 1.10.26, replacing the previous version 1.10.23 in multiple command examples. Additionally, the uninstallation steps for the ALB Controller have been renumbered for clarity, changing from step 3 to step 2. Users can now follow the revised instructions to ensure they are using the latest version of the Helm chart and understand the updated sequence for uninstallation.

The documentation for the Application Gateway for Containers Service Mesh Extension has been updated to reflect the new version 1.10.21, replacing the previous version 1.9.13. Users are now informed that the ALB Controller Service Mesh Extension will implicitly define mutual authentication for services in a namespace labeled with either `istio-injection` or `istio.io/rev`, enhancing clarity on configuration requirements for mutual TLS. Additionally, the instructions for defining a namespace for Istio sidecar injection have been refined to improve user understanding.

The documentation now clarifies that when the Application Gateway for Containers add-on is enabled on an AKS cluster using the AKS-managed virtual network option, a subnet named `aks-appgateway` is automatically created with delegation enabled for `Microsoft.ServiceNetworking/TrafficController`. Additionally, users can expect to see a condition labeled **Valid GatewayClass** in the GatewayClass status, indicating that a default GatewayClass is set up and managed by the ALB Controller.