This document includes the latest release notes for the Application Gateway for Containers add-on, detailing version compatibility with AKS and highlighting security patches and bug fixes. It emphasizes the importance of keeping the add-on updated to ensure functionality and security.

The documentation now includes a new troubleshooting section for the "Mount error(22): Invalid argument" related to Azure Files in Kubernetes. It clarifies that this error often arises when the Kubernetes secret's `data` field values for `azurestorageaccountname` or `azurestorageaccountkey` are not base64 encoded, leading to a corrupted value during the mounting operation. Users are advised to either base64 encode these values or use the `stringData` field, which automatically handles encoding, to prevent this issue.

Removed outdated author and metadata information, which does not impact user experience but cleans up the document. The feature remains in preview status, ensuring users are aware of its current state.

The documentation now includes a note indicating that the 2023-06 and 2023-06-S TLS policies currently enforce the same cipher sets, with plans for future releases to introduce different cipher sets. This change informs users about upcoming updates that may affect their TLS configurations.

The article has been updated to include enhanced guidance on Azure Container Registry monitoring metrics, including new Grafana dashboard capabilities for transaction trends and data transfer analysis.

Learn how to browse, install, manage, and troubleshoot Headlamp plugins in AKS desktop.

The documentation now clarifies that platform-initiated upgrades can occur outside of scheduled maintenance windows. Users are advised to keep their AKS clusters on a supported Kubernetes version to prevent unexpected upgrades after the 60-day platform support grace period ends. This change emphasizes the importance of maintaining version compliance to avoid disruptions.

The document discusses Azure NAT Gateway's capabilities, including support for multiple outbound types and the limitations of each. It highlights the transition from managedNATGatewayV2 to managedNATGateway and the defaulting behavior of AKS to StandardV2 NAT Gateway.

The documentation for the Secret Store Extension (SSE) has been updated to include release notes for version 1.6.0, highlighting new features and changes. Notably, the optional parameter **cloudName** has been clarified, specifying that it indicates the Azure cloud containing the key vault, with examples provided for different cloud environments. Users can now better understand how to configure the SSE based on their Azure cloud context.

Enhancements have been made to the documentation regarding Azure Disk multi-attach errors. The updates clarify the causes of these errors and provide solutions, including the importance of following the pod deletion procedure before rebooting or stopping nodes to prevent delays in pod startup.

The document has been updated to remove the preview tag for AKS control plane metrics monitoring, indicating that it is now generally available. It also clarifies prerequisites and scope for using managed identity authentication with Prometheus.

The documentation now reflects that Kubernetes 1.35.5 is the new default version for deployment on AKS on bare metal Ubuntu, replacing the previous default of Kubernetes 1.33.3. Users should refer to the updated "Supported Kubernetes versions" section for the latest available versions and parameter values during deployment.

The documentation now reflects updated supported Kubernetes versions for AKS on bare metal Ubuntu, including the addition of versions 1.34.8, 1.35.5, and 1.36.1. Users can now specify these versions using the `--kubernetes-version` parameter, allowing for more flexibility in cluster deployments. Additionally, the example command has been simplified to use the version number without the date suffix.

The documentation now clarifies that users cannot roll back a platform-initiated upgrade in AKS when the cluster is upgraded off an unsupported version, as the previous version becomes unavailable. This change emphasizes the limitations users face regarding version management during upgrades.

Modifications include clarifications on NFS mount options for Azure Files CSI volumes and a note that the Secure transfer required setting must be disabled for NFS Azure Files volumes, which is crucial for proper configuration.

Azure Kubernetes Fleet Manager allows orchestration of updates across multiple clusters using update runs. It addresses challenges faced by platform admins in staging node OS image or Kubernetes version upgrades safely and predictably. The document details how Fleet Manager orchestrates upgrades and the implications of platform-initiated upgrades.

Users can now enable trusted launch for Node Auto Provisioning (NAP) clusters by configuring the `spec.security.trustedLaunch` field in the AKSNodeClass CRD, allowing them to set `secureBoot` and `vTPM` to `true` for enhanced security on new or existing nodes. Additionally, changes to the `localDNS` configuration will trigger drift detection, marking existing nodes as drifted and replacing them according to the defined disruption controls, which may impact workloads during the transition. Users are advised to implement pod disruption budgets and monitor node claims to manage potential disruptions effectively.

An important note has been added regarding the retirement of the 'pod' dimension for specific AKS platform metrics, effective September 30, 2027. This change is crucial for users relying on these metrics.

The document has been updated to clarify the configurations for assigning both IPv4 and IPv6 public IP addresses to nodes in a dual-stack cluster. It emphasizes the importance of using public IP prefixes and provides detailed instructions for creating clusters with IPv6-only configurations.

This article discusses platform-initiated upgrades in Azure Kubernetes Service (AKS), detailing how AKS automatically upgrades clusters that remain on unsupported Kubernetes versions after a grace period. It emphasizes the importance of keeping clusters updated to avoid disruptions and outlines the implications of such upgrades, including potential workload interruptions and the need for preemptive actions to ensure compatibility.

This document now includes important information about access restrictions for Fleet Manager hub clusters starting January 31, 2027. It outlines the types of Kubernetes API requests that will be denied and provides guidance on identifying affected resources and updating automation to comply with these restrictions.

Updated the documentation to include regions that currently do not support Hyperscale configuration, enhancing clarity on feature availability. The following regions are specified: australiacentral2, francecentral, germanywestcentral, norwayeast, southafricanorth, swedencentral, switzerlandnorth, taiwannorth, uaenorth, and centralus.

A new troubleshooting article has been added for low disk space issues on AKS nodes caused by BlobFuse file handles. It includes symptoms, causes, and mitigation strategies, providing valuable guidance for users experiencing these issues.

The documentation now clarifies that the `ClusterResourcePlacementStatus` resource provides a namespace-specific view of the status for a corresponding cluster-scoped `ClusterResourcePlacement` object, allowing namespace users to read placement status without exposing cross-namespace information. Starting January 31, 2027, this view will only include resources and references within the selected namespace, with nonempty member-cluster and hub values replaced by `(redacted)`. Users are advised to update applications that read `ClusterResourcePlacementStatus` to handle these changes appropriately.

The document includes significant updates regarding resource placement and configuration parameters for Kubernetes. It emphasizes the importance of specifying a placement to avoid unintended consequences on resource deployment performance.

Removed an include directive related to the retirement of ingress-nginx, which may affect users relying on that information for their configurations. This change indicates a shift in supported components.

The documentation now specifies that users can run Azure Kubernetes Service (AKS) on hosts using Red Hat Enterprise Linux (RHEL) versions 9 or 10, in addition to Ubuntu 24.04 LTS and Azure Linux 3.x on AMD64 or ARM64 architectures. This expands the options for users setting up AKS with different operating systems.

The document now includes information about pod startup waits for dynamic IP allocation, which is critical for users managing workloads with high pod churn.

Updated the title and description for creating and managing an AKS cluster with disconnected operations. The article now reflects the current date and removes the preview label, indicating a stable feature. This change enhances clarity for users looking to implement this functionality.

The document now includes an important note about the retirement of the Azure Key Vault Secrets Provider extension, urging users to migrate to the Secret Store extension before the deadline.

Updated a command in the traffic management use cases to correct a variable name, ensuring accurate instructions for users.

Learn how to troubleshoot the application routing default domain feature in AKS. Fix a certificate that isn't ready or a domain that doesn't resolve.

The documentation now reflects the updated supported Kubernetes version for AKS on bare metal Ubuntu, specifically noting the upgrade from v1.34.2 to v1.34.3. Users can now utilize the latest features and improvements available in Kubernetes v1.34.3 when connecting to their clusters.

The documentation now includes guidance on using Azure Key Vault Managed HSM for customer-managed keys, allowing users to bring their own keys from either Azure Key Vault or Managed HSM for encrypting their Premium container registry. Additionally, it emphasizes that a Managed HSM must be provisioned and activated before configuration, and it introduces local role-based access control (RBAC) for Managed HSM, which differs from Key Vault access policies. Users can also verify the availability of Managed HSM in their desired Azure region.

Updates include requirements for using FIPS with Azure Container Linux (ACL) and clarifications on supported Kubernetes versions. FIPS-enabled node pools now require AKS version 1.34 or later, and Trusted Launch with FIPS supports both Ubuntu 22.04 and ACL on Generation 2 VM sizes.

This article provides troubleshooting steps for the `az aks update` command, specifically addressing the `ReconcileAzureKeyVaultKmsError` error and how to verify secret access in Kubernetes.

The title and description have been updated to remove the preview label for AKS on Azure Local with disconnected operations. This change signifies that the feature is now stable and provides users with essential information about supported scenarios, prerequisites, and limitations.

The article has been updated to improve guidance on monitoring performance issues in Azure Container Registry, including new metrics and troubleshooting steps for identifying throttling and performance differences.

Updates clarify the AKS MCP server's functionality, emphasizing its open-source nature and the importance of RBAC permissions. It also details the server's operational modes and prerequisites for installation.

Significant additions were made to document pod startup waits for dynamic IP allocation, which is crucial for users managing workloads with high pod churn.

This guide explains how to create an AKS cluster with a multi-NIC node pool using the DRAnet driver. It includes prerequisites, installation steps for the Azure CLI extension, and feature registration.

The document has been updated to reflect the retirement of the Ingress NGINX project, with maintenance ending in March 2026. It emphasizes the need for users to migrate to the Gateway API for ingress and L7 traffic management, providing critical timelines and support details.

The documentation now includes a critical update regarding the Azure Key Vault Secrets Provider extension, which will retire on October 9, 2027. Users are advised to migrate from this extension and are cautioned against running both the Azure Key Vault Secrets Provider extension and the offline Secret Store Extension (SSE) in the same cluster. This change emphasizes the importance of planning for the upcoming deprecation to ensure uninterrupted secret management in Arc-enabled Kubernetes clusters.

The document discusses platform-initiated upgrades, detailing how AKS upgrades clusters that remain on unsupported Kubernetes versions after a grace period. It emphasizes the importance of keeping clusters on supported versions to maintain control over upgrade timing and behavior.

The documentation now clarifies that when selecting `managedNATGateway` for `outboundType`, AKS defaults to using the `StandardV2` NAT Gateway in regions where it's available, enhancing performance with higher bandwidth and throughput. Additionally, users are informed that migrating from `Standard` to `StandardV2` is possible, but downgrading from `StandardV2` to `Standard` is not supported. The update also removes references to the deprecated `managedNATGatewayV2`, streamlining the options available for managing NAT gateways in AKS.

The documentation has been updated to reflect the use of version 1.12.2 of the application gateway for containers, replacing the previous version 1.12.1 in the commands. Users should now reference the updated version when deploying the application gateway using the Helm chart.

The date was updated, and a note was added regarding node-level features configured through the AKSNodeClass, enhancing clarity on configuration impacts.

The documentation now specifies that for clusters using Node public IPs, each node pool must use public IP prefixes. It also clarifies that an IPv6-only node public IP prefix cannot be used due to Azure's automatic assignment of IPv4 addresses.

This update introduces a new requirement for Azure Kubernetes Service (AKS) regarding custom Azure roles for external-node certificate bootstrap. Starting November 30, 2026, a dedicated Azure RBAC DataAction is required for kubelet client certificate issuance, which is crucial for new external nodes joining the AKS cluster and for existing nodes renewing their certificates. The document details how to determine if a custom role is affected and how to add the necessary DataAction.

The documentation now includes a note about platform-initiated upgrades, clarifying that AKS will attempt a normal drain first, but if it fails or times out, it will override the Pod Disruption Budget (PDB) to ensure the cluster reaches a supported Kubernetes version. Additionally, the section on configuring upgrade settings has been updated to direct users to the rolling upgrade settings for node pools, enhancing clarity on the upgrade process.

The article outlines the support policies for AKS, emphasizing the importance of keeping Kubernetes versions updated according to the support version policy. It discusses the implications of platform-initiated upgrades and the tools available for maintaining cluster compliance.

Updates clarify that auto-upgrade triggered update runs honor planned maintenance windows set at the AKS cluster level. It also explains how AKS platform-initiated upgrades can occur outside of these windows, emphasizing the importance of maintaining supported Kubernetes versions.

The documentation now emphasizes that during the preview phase, cluster autoscaler functionality is not supported for manually created managed GPU node pools. Users are advised to scale these pools manually or utilize NAP for auto-provisioned GPU capacity. This clarification impacts how users manage scaling for their GPU node pools.

The documentation now advises users to migrate from the Azure Key Vault Secrets Provider extension to the Secret Store extension, as the former will be retired on October 9, 2027, and will no longer receive updates or support. Users are encouraged to make this transition to ensure continued functionality and access to new features. Additionally, it clarifies that the Secret Store extension does not store secrets persistently, requiring connectivity to Azure Key Vault for secret-consuming pods.

Release notes for version 1.6.0 were added, detailing new features and improvements, which are essential for users to stay informed about updates.

This article introduces multi-NIC pod support in Azure Kubernetes Service (AKS), allowing the attachment of secondary network interfaces to pods. It details the use of Dynamic Resource Allocation (DRA) and the DRAnet network driver for automatic NIC management.

The documentation now emphasizes the requirement to register the `Microsoft.Network/AllowBringYourOwnPublicIpAddress` feature for Pod sandboxing workloads using the Kata runtime. Users are guided through the registration process with updated commands for registering the feature, verifying its status, and refreshing the resource provider registration, ensuring they can successfully deploy Pod sandboxing.

The documentation now includes expanded guidance on monitoring Azure Container Registry metrics, specifically addressing how to audit throttling and bandwidth issues. Users can utilize Azure Monitor metrics to filter and split transactions by response type, API name, and region to identify affected operations. Additionally, the section on mitigating throttling now emphasizes the importance of updating the registry's SKU or contacting Azure support for limit increases if persistent issues occur.

The document now specifies that to use Trusted Launch with Azure Container Linux (ACL), Azure CLI version 2.86.0 or later is required. It also clarifies compatibility with AKS version 1.34 or later and provides updated instructions for deploying node pools with Trusted Launch and FIPS enabled.

The documentation now includes updated information on the supported Kubernetes versions for AKS on bare metal Ubuntu, clarifying that the versions for new deployments do not necessarily represent valid upgrade paths for existing clusters. Users can refer to the "Supported Kubernetes versions" section for the latest deployment versions. This change enhances understanding of version compatibility during cluster upgrades.

The documentation now includes guidance for using Azure Key Vault Managed HSM in addition to Azure Key Vault for key rotation and management. Users can create new key versions in Managed HSM using the `--hsm-name` parameter and must ensure the identity has the appropriate local RBAC role assigned. Additionally, the process for revoking access to keys has been clarified, specifying that Managed HSM does not support Key Vault access policies and requires local RBAC role removal instead.

The documentation now clarifies that if users do not manually upgrade their AKS cluster, it will automatically undergo a platform-initiated upgrade after a 60-day grace period following the LTS end-of-life date, ensuring it remains on the LTS track. Additionally, it emphasizes that AKS will not enroll clusters in LTS automatically or change billing tiers, and provides guidance on what happens when a cluster's LTS version reaches end of life. Users are encouraged to review the AKS LTS release calendar for version timelines.

The documentation for the Azure Secret Store Extension troubleshooting has been updated to clarify error handling and resolution steps. Users can now identify and resolve issues related to the `InvalidClusterSecretLabelError` and `ValidatingAdmissionPolicyCheckFailed` by removing specific keys from the `SecretSync` or existing secrets that SSE does not manage. Additionally, the guidance for handling `ControllerSyncFailed` errors has been enhanced to include specific error codes and their implications regarding permissions and network access issues.

The article now includes important information regarding the downtime requirements when expanding Azure disks beyond 4 TiB, which is critical for users managing large volumes.

The tutorial was updated to include guidance on using Azure Key Vault Managed HSM for customer-managed keys, enhancing its relevance and usability.

The documentation now includes an important notice regarding platform-initiated upgrades in AKS. Users are advised that if their cluster remains on an unsupported Kubernetes version after the grace period, AKS will proceed with upgrades despite any deprecated API usage. It is crucial for users to check for and address deprecated API usage before the scheduled upgrade month to avoid potential issues.

The document outlines how auto-upgrade triggered update runs in AKS honor planned maintenance windows set at the cluster level. It also explains the implications of platform-initiated upgrades, which can occur outside these windows if a cluster remains on an unsupported version after the grace period.

This document has been expanded to include detailed descriptions of metrics and dimensions for Azure Container Registry, enhancing the understanding of monitoring capabilities and API operations.

In version 1.38.0 of Azure Arc, managed least-privilege RBAC has been enabled for Azure Arc agents, which replaces shared cluster-admin access with dedicated, minimally scoped service accounts, enhancing security. Both versions 1.37.3 and 1.38.0 also include security vulnerability fixes and general bug fixes for improved reliability.

The documentation now includes a **Platform-initiated upgrade** column that specifies the planned rollout month for Kubernetes versions remaining after the 60-day platform support grace period. Users are informed that if their cluster remains on an unsupported version post-grace period, AKS will automatically upgrade it to the lowest supported version, ensuring no cluster stays on a version without security patches. Additionally, the grace period for upgrading after a version's removal has been extended from 30 days to 60 days, providing users more time to manage their upgrades.

The documentation now clarifies that when using Node Auto-Provisioning (NAP), changes to the `spec.localDNS` in the `AKSNodeClass` will result in node replacement through drift rather than reimaging for NAP-managed nodes. Additionally, it emphasizes the importance of defining pod disruption budgets before making changes to LocalDNS settings, and provides guidance on disabling LocalDNS with NAP, noting that this action will also lead to node replacement.

This new article provides a conceptual overview of member cluster labels in Azure Kubernetes Fleet Manager, detailing how they can be used to describe and select clusters based on attributes like location and environment. It explains the purpose of member labels and how to manage them effectively.

Simplify workload queueing and prioritization on AKS with managed Kueue automatically generated resource flavors and default workload priority classes

The documentation now clarifies that if an AKS cluster remains on an unsupported version after the 60-day grace period, it will undergo a platform-initiated upgrade, regardless of the auto-upgrade channel settings. Users are informed that setting the `stable` channel along with a maintenance window can help avoid such upgrades, while the `patch` channel will only apply patches within the current minor version without upgrading to a newer minor version. Additionally, it emphasizes that auto-upgrade is contingent on the cluster's Kubernetes version being within the AKS support window.

The document provides an overview of Kueue, detailing its installation and configuration on AKS. It explains the roles of ClusterQueue and LocalQueue in managing batch workloads and outlines the prerequisites and limitations for using Kueue in AKS environments.

The documentation now specifies that users can set up alerts for upgrade events on an AKS cluster, with queries filtering scheduled events by cluster resource ID. Additionally, it clarifies that auto-upgrades configured on the cluster will adhere to planned maintenance windows, while platform-initiated upgrades may occur outside these windows for unsupported Kubernetes versions.

The document has been updated to reflect a new requirement starting November 30, 2026, for Azure RBAC DataAction to authorize kubelet client certificate issuance. It emphasizes the importance of updating custom Azure roles for external-node bootstrap or kubelet client certificate renewal to avoid failures in joining the cluster or renewing certificates.

The documentation now clarifies that Application Gateway for Containers deployed in a virtual network in region A cannot connect to AKS cluster nodes in a separate virtual network within the same region. Additionally, it confirms that Application Gateway for Containers can proxy traffic to clusters using CNI Overlay with Cilium and WireGuard, although WireGuard does not encrypt traffic between the gateway and destination pods. It also states that while VNet encryption can be enabled for the virtual network, it is not utilized for traffic between the gateway and AKS.

The Azure Key Vault Secrets Provider extension (AKV SPE) is set to retire on October 9, 2027. The documentation has been updated to guide users on migrating to the Secret Store extension (SSE) safely and effectively. Key changes include clarifications on managing workloads and the importance of stopping workloads that mount CSI volumes before the migration.

The documentation now clarifies that enabling a Key Vault or Managed HSM firewall, virtual network, or private endpoint after creating an encrypted registry may result in HTTP 403 errors during image import or automated key rotation. Users are advised to ensure the key store's network configuration allows Azure Container Registry access and to verify that their client is within the configured network boundary. Additionally, it highlights that automatic Azure Policy remediation for registries encrypted with customer-managed keys is not supported, requiring users to manually set properties to maintain compliance.

[!IMPORTANT]

Added a link for managed Kueue installation on AKS, enhancing the documentation for users looking to manage Kueue extensions. This update includes multiple additions to improve clarity and accessibility of the installation process.

Introduced a section on the impact of AKS platform-initiated upgrades, clarifying how unsupported Kubernetes versions are handled. This update provides critical information on upgrade processes and maintenance windows, which is essential for cluster management.

Made minor updates related to AI usage, which may enhance the documentation's relevance to AI-assisted features. While the changes are small, they contribute to the overall clarity of the content.