Azure Container Services Docs – Weekly Update (2026-09-13 to 2026-09-20)

ACR – Cluster Container Registry Integration

Summary

The documentation now includes a tested Terraform sample that creates an Azure Container Registry (ACR) and an Azure Kubernetes Service (AKS) cluster, assigns the `AcrPull` role to the kubelet managed identity, and imports an NGINX image into the registry for deployment. Users can now integrate existing ACR and AKS resources by adapting the role assignment in the sample, and the documentation clarifies the process for revoking access while preserving the resources. Additionally, the sample demonstrates how to verify the deployment of the NGINX workload using `kubectl`.

AKS – Os Guard Preview Retirement

Summary

This update includes an important notice about the retirement of Azure Linux with OS Guard for AKS, effective December 10, 2026. It details the implications for existing node images and the need to migrate to Azure Container Linux to avoid disruptions.

AKS – Use Azure Policy

Summary

The documentation now includes a tested sample configuration for creating a `main.tf` file that configures the Azure provider for Terraform, defines input variables for an existing resource group and AKS cluster, and retrieves the built-in pod security baseline initiative. Additionally, it details how to assign this initiative to the resource group with a policy effect set to `Deny`, allowing users to enforce security standards for their Kubernetes workloads. Users can also run `terraform destroy` to remove the policy assignment created by the sample.

AGC – Alb Controller Release Notes

Summary

The documentation now includes updates for ALB Controller versions 1.12.1 and 1.11.5, which introduce security patches and bug fixes, including improvements for helm chart pre-delete tolerations and session affinity cookies. Additionally, version 1.11.1 implements Gateway API v1.5.1, supports Arm64 nodes, and enhances HTTPRoute timeouts and HTTP redirect capabilities. Users can also benefit from the Web Application Firewall (WAF) public preview and various performance improvements across multiple versions.

AKS – Kubelogin Authentication

Summary

The documentation for kubelogin authentication in AKS has been updated to clarify that the service principal authentication method now specifically requires managed Microsoft Entra ID integration, rather than the legacy version. Additionally, new sections have been added detailing the Azure Developer CLI and Azure Pipelines authentication methods, including specific commands for converting kubeconfig files and managing token caches. Users can now utilize these methods to streamline their authentication processes within AKS.

Arc K8s – Gitops Flux2 Parameters

Summary

The documentation for the `az k8s-configuration flux` command has been updated to include the new `provisionedClusters` option for the `–cluster-type` parameter, allowing users to specify additional cluster types. The `–kind` parameter now supports `oci` as a source kind for reconciliation. Additionally, users are advised to transition to more secure SSH key methods due to the deprecation of SSH-RSA by Azure DevOps for connecting to repositories.

AKS – Istio Upgrade

Summary

The documentation now emphasizes that the service mesh add-on does not support automatic upgrades. Users are advised that on clusters with automatic upgrades, an outdated mesh revision may become incompatible and hinder the cluster’s upgrade process. To maintain compatibility with the Kubernetes version, users must manually upgrade the service mesh add-on.

Fleet – Update Create Update Strategy

Summary

The article has been enhanced with a Terraform workflow for managing update strategies in Azure Kubernetes Fleet, including installation instructions for the Azure CLI and the fleet extension.

AKS – Concepts Network Azure Cni Pod Subnet

Summary

The documentation for Azure CNI Pod Subnet networking in Azure Kubernetes Service (AKS) has been updated to clarify that users must now use Azure CLI version 2.75.0 or later to configure Static Block Allocation. Additionally, it specifies that in-place migration or updates of existing node pools are not supported, and users must add a new Static Block Allocation node pool on a different subnet to migrate workloads from Dynamic IP Allocation. The limitations section now also highlights that the maximum supported pod subnet size is /16 and that Dynamic IP Allocation is not compatible with node auto-provisioning.

AKS – Limit Egress Traffic

Summary

The documentation now includes a Terraform workflow for controlling AKS egress traffic, allowing users to deploy an Azure virtual network with dedicated subnets for AKS and Azure Firewall. Users can also configure the virtual network to use the Azure Firewall private IP as its DNS server, ensuring consistent resolution of destination FQDNs. Additionally, the requirements for outbound rules and the necessary commands for setting up AKS with Azure Firewall have been clarified, enhancing user understanding of the integration process.

AKS – Configure Azure Cni Dynamic IP Allocation

Summary

The documentation for configuring Azure CNI Pod Subnet with dynamic IP allocation in AKS has been updated to enhance clarity on features and limitations. Users can now benefit from improved IP utilization, as IPs are dynamically allocated from the pod subnet, allowing for better scalability and performance in large clusters. Additionally, new limitations have been introduced, specifying that dynamic IP allocation supports pod subnets up to `/16` and that node auto-provisioning does not support this configuration.

AKS – Network Isolated

Summary

The documentation for creating a network-isolated Azure Kubernetes Service (AKS) cluster has been updated to require version 2.73.0 or later of the Azure CLI. Users can now set the `–outbound-type` parameter to `block`, which is in preview, allowing them to block all outbound connections for the cluster. Additionally, the Terraform workflow section has been added, providing users with a sample configuration to deploy a network-isolated AKS cluster using Terraform.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Addon

Summary

The documentation now includes a new section on using the Azure CLI to register the Application Gateway for Containers add-on feature, enhancing user guidance for setup. Additionally, the verification process for the ALB Controller installation has been clarified, ensuring users understand the checks required after enabling the add-on, regardless of their deployment path. Users can now better manage the lifecycle of the Application Gateway for Containers resources through the ALB Controller, with clearer instructions on linking the two components.

AKS Arc – AKS Troubleshoot

Summary

The documentation now includes a new section detailing the impact on clusters when the Azure Arc resource bridge is deleted or recovered, providing users with critical insights into potential disruptions. Additionally, obsolete troubleshooting articles prior to version 2510 have been removed, streamlining the guidance available for users. This ensures that users have access to the most relevant and up-to-date information for managing their Azure environments.

AKS – Considerations Pod Sandboxing

Summary

The documentation for Pod Sandboxing on Azure Kubernetes Service (AKS) has been updated to enhance clarity on resource management, memory management, CPU management, and security considerations. Users are now guided to set appropriate memory and CPU limits for their workloads, with specific emphasis on the implications of `RuntimeClass` overhead and the importance of avoiding `hostPath` volumes to maintain isolation. Additionally, best practices for configuring resource quotas and managing privileged pods have been outlined to ensure secure and efficient deployments.

Arc K8s – Extensions Troubleshooting

Summary

The documentation now includes troubleshooting guidance for the Argo CD extension on Azure Arc-enabled Kubernetes clusters, detailing common installation errors and resolutions, such as verifying namespace creation policies and addressing Helm installation timeouts. Additionally, users are reminded to explicitly load the `iptables_nat` module on each node to resolve specific installation issues, with a note that this action does not make the module persistent. Minor adjustments were made to improve clarity and consistency throughout the document.

AGC – Troubleshooting Guide

Summary

The documentation has been updated to reflect the new version of the ALB controller, now specified as **1.12.1** instead of **1.9.13**. This change informs users of the latest version available for the ALB controller, which may include new features or fixes relevant to their deployments. Users should ensure they are using this updated version for optimal performance and compatibility.

AKS – Confidential Containers Overview

Summary

The documentation for Confidential Containers (preview) with Azure Kubernetes Service (AKS) has been updated to clarify that these containers enhance security by encrypting container memory using AMD SEV-SNP and are currently limited to Azure Linux. Users can now better understand the features that provide data confidentiality, such as hardware attestation and runtime code integrity, and how to implement tasks like deploying an AKS cluster or adding security policies to pod YAML files. Additionally, limitations have been specified, including support only for certain configurations and the inability to change pod environment variables after deployment.

AKS – Node Disruption Policy

Summary

The documentation now clarifies that on Kubernetes 1.37 and later, the Node Disruption Policy covers specific configuration changes that require node reimage, eliminating the need for manual intervention. For users on Kubernetes 1.36 and earlier, it emphasizes the necessity to manually run the `az aks nodepool upgrade` command with the `–node-image-only` parameter after making configuration changes. This update enhances user understanding of the Node Disruption Policy’s coverage based on Kubernetes versions.

AKS – Use Azure Linux Os Guard

Summary

Added a reference to the retirement of the OS Guard preview, providing users with important information regarding the status and future of this feature. This is crucial for users relying on OS Guard for security.

Arc K8s – Conceptual Connectivity Modes

Summary

The documentation for Azure Arc-enabled Kubernetes has been updated to clarify the impact of network connectivity modes on operations. Users are now informed that if the managed identity certificate expires due to lack of network connectivity, they must delete and recreate the Azure Arc-enabled Kubernetes resource and agents to reactivate features. Additionally, the descriptions of connectivity states have been refined for better clarity regarding the status of the Azure Arc-enabled Kubernetes resource.

AKS – Concepts Security

Summary

The article has been updated to include a prescriptive checklist of security best practices for configuring Azure Kubernetes Service (AKS) deployments, enhancing the security guidance provided to users.

AKS Support – Troubleshoot Pod Workload Restart

Summary

The troubleshooting steps for AKS pod restarts have been revised to clarify the distinction between `liveness/startup` probe failures, enhancing user understanding of pod behavior during restarts. Users are now guided to check for pod replacement and investigate termination reasons more effectively, including specific commands for retrieving pod logs and events. Additionally, prerequisites for using `kubectl` commands have been specified, ensuring users are better prepared to diagnose issues.

AKS – Concepts Pod Sandboxing

Summary

The documentation for Pod Sandboxing in Azure Kubernetes Service (AKS) has been updated to clarify the isolation capabilities of lightweight pod virtual machines (VMs). Users can now better understand how to implement pod sandboxing for stronger compute isolation, including specific instructions on setting the `runtimeClassName: kata-vm-isolation` in pod manifests. Additionally, the documentation emphasizes that while pod sandboxing provides compute isolation, it does not cover control plane or storage isolation, guiding users to consider additional controls for multitenant deployments.

AKS – Node Auto Provisioning Networking

Summary

The documentation now clarifies the networking configurations supported by Node Auto-Provisioning (NAP), detailing specific options for IP address management (IPAM), network plugins, data planes, and network policies. Users can set the `vnetSubnetID` field in an `AKSNodeClass` resource to specify custom subnets for NAP nodes, allowing for mixed subnet configurations across node pools. Additionally, it emphasizes that changing `vnetSubnetID` from one valid subnet to another will cause existing nodes to drift, requiring careful management of permissions and available IP addresses.

AKS – Use Pod Sandboxing

Summary

The documentation for Pod Sandboxing with Azure Kubernetes Service (AKS) has been updated to clarify that users can now deploy Pod sandboxing on both new and existing Azure Linux AKS clusters, utilizing Kata Containers for enhanced workload isolation. Key commands and parameters have been specified, including the requirement to register the `Microsoft.Network/AllowBringYourOwnPublicIpAddress` feature and the need for Kubernetes version 1.27.0 or higher. Additionally, users can now verify kernel isolation between Kata and non-Kata pods and manage node pools with specific configurations for Pod sandboxing.

AKS – Upgrade AKS Node Pools Rolling

Summary

Users upgrading an AKS Standard node pool to Kubernetes 1.37 or later should now review the LocalDNS profile, as a node pool without an explicit profile may have LocalDNS enabled during the upgrade. It’s important to verify that the custom virtual network DNS supports both TCP and UDP port 53, and users are advised to test DNS resolution using specific commands before proceeding with the upgrade. Additionally, the documentation clarifies that when `maxUnavailable` is set to `0`, `maxSurge` must be greater than `0` for successful upgrades.

AKS – Static IP

Summary

The documentation now emphasizes that AKS no longer supports Basic Load Balancers, requiring users to upgrade to Standard Load Balancers before configuring static public IP addresses. Additionally, the command for retrieving the static public IP address has been updated to use `az network public-ip show` instead of `az network public-ip list`. Users are also advised to use service annotations instead of the deprecated `loadBalancerIP` property in Kubernetes service manifests.

AKS – Scale Cluster

Summary

The documentation for scaling AKS clusters has been updated to clarify that if the cluster autoscaler is enabled on a node pool, users cannot manually change the node count without first adjusting the autoscaler settings. Additionally, support for Azure Linux 2.0 has ended, and users are advised to migrate to Azure Linux 3 before scaling affected node pools. The requirements for naming node pools have also been refined, specifying character limits and formats for both Linux and Windows node pools.

AKS – Use Node Disruption Policy

Summary

The documentation now clarifies that on Kubernetes 1.37 and later, the Node Disruption Policy covers certain configuration changes, whereas on Kubernetes 1.36 and earlier, these changes require a manual node pool upgrade. Users must manually execute the `az aks nodepool upgrade` command after making configuration changes on Kubernetes 1.36 and earlier, ensuring they understand the upgrade requirements based on their Kubernetes version.

AKS – Intro AKS Automatic

Summary

The documentation now specifies that starting with AKS 1.36, the default ingress option for new clusters is the Kubernetes Gateway API via the application routing add-on, while older clusters will continue to use Managed NGINX. Additionally, users are informed that the Istio-based service mesh add-on ingress gateway requires manual upgrades to maintain compatibility and avoid blocking cluster auto-upgrades.

Arc K8s – Secret Store Extension Release Notes

Summary

The release notes for Secret Store Extension (SSE) version 1.5.5 indicate that user-supplied pod labels and annotations now render correctly as strings in all cases, enhancing the reliability of these configurations. Additionally, the update addresses known vulnerabilities by refreshing dependencies, improving overall security for users.

AKS Support – Error Code Invalidresourcereference

Summary

Removed a duplicate article on troubleshooting the InvalidResourceReference error, streamlining the documentation and redirecting users to the correct resource. This enhances user experience by reducing confusion.

AKS Support – Node Auto Repair Errors

Summary

The documentation for Azure Kubernetes Service (AKS) now clarifies that when a node is detected with a `NotReady` status for over five minutes, it uses node auto-repair to attempt restoration. Additionally, the troubleshooting section has been updated to provide more specific guidance on VM extension provisioning errors and redeployment failures, including links to relevant troubleshooting articles. Users can better understand the limitations of the auto-repair service and find more targeted solutions for common issues.

AKS – Blue Green Node Pool Upgrade

Summary

The documentation now clarifies that during an in-progress upgrade, users can switch from a `BlueGreen` upgrade strategy to a `Rolling` strategy, but not vice versa. Additionally, when resuming a paused upgrade, users can update blue-green settings but cannot change the Kubernetes version. If a blue-green upgrade cannot be resumed due to node pool property changes requiring a node reimage, users can switch to the rolling upgrade strategy using the specified Azure CLI command.

AKS Support – Upgrading or Scaling Does Not Succeed

Summary

Significantly reduced the content by 678 lines, focusing on essential troubleshooting steps for upgrading and scaling errors in AKS. This makes the documentation more concise and user-friendly.

AGC – Service Mesh Integration

Summary

The documentation has been updated to reflect the new version 1.12.1 for the relevant commands, replacing the previous version 1.11.4. Users can now access features and improvements introduced in version 1.12.1, enhancing their experience with the service mesh integration for Azure Application Gateway for containers.

AKS Arc – Cluster Upgrade Status

Summary

This document outlines how to troubleshoot when an AKS Hybrid and Edge cluster is stuck in the ‘Upgrading’ state, including symptoms, causes, and mitigation strategies. It provides commands for checking the cluster status and verifying upgrades.

AKS – Node Auto Provisioning Node Pools

Summary

The documentation now includes detailed instructions for provisioning NVIDIA GPU nodes using Node Auto-Provisioning (NAP) in AKS, specifically highlighting the creation of a `NodePool` that selects GPU-enabled VM sizes. Users can now configure managed GPU settings to allow AKS to automatically install and manage necessary GPU drivers and plugins on NAP-provisioned nodes. Additionally, the section on default node pool configuration has been clarified to specify how to control the creation of default NAP `NodePools` during cluster setup.

AKS – AKS Automatic Managed System Node Pools About

Summary

The documentation now states that new AKS Automatic clusters enable managed system node pools by default. It also includes instructions for migrating existing clusters to managed system node pools in preview, along with necessary commands for feature registration and cluster updates.

AKS – Ingress Nginx Retirement

Summary

The documentation now clarifies that users with service mesh or advanced ingress requirements can utilize the Gateway API ingress with the Istio service mesh add-on without needing to inject sidecars into their workloads. Additionally, it highlights the need to review the Gateway API limitations and alternatives if users require specific features like request header and body size limits, Lua scripts, or rate limiting.

AKS – Ai Toolchain Operator Monitoring

Summary

The documentation now clarifies that the vLLM inference runtime is enabled by default in the AKS managed add-on, allowing users to leverage its capabilities for language model inference and serving. Additionally, users are instructed to update their AKS cluster to the latest version if they have the AI toolchain operator add-on enabled, without the need to specify a minimum version. The command for applying the configuration has also been updated to reflect the correct repository URL.

Arc K8s – Flux Gitops Release Notes

Summary

Adds/updates section(s): September 2026 – `microsoft.flux` version 1.25.1 Includes security/operational guidance (Key Vault/managed identity/NSG).

AKS Support – Invalidresourcereference Error

Summary

The troubleshooting guide for the `InvalidResourceReference` error has been revised to clarify the conditions under which this error occurs, particularly regarding the virtual network and virtual machine scale set being in different regions. Additionally, a new section has been added detailing the failure of an AKS managed Bastion operation due to an invalid public IP address reference, including specific commands for checking the public IP’s properties and guidance on using the Azure CLI for resolution. Users are now better informed on how to address these issues and the limitations of modifying underlying resources.

AKS – Istio Gateway API

Summary

The documentation now clarifies that users can set up Istio for ingress without needing to add sidecars to their applications, while still utilizing the managed Istio control plane and gateway proxies. Additionally, it emphasizes the necessity of initiating and completing canary upgrades for minor revision updates, even when using the add-on solely for ingress. Users are also instructed to skip sidecar injection steps in the installation guide if they are using the add-on only for ingress.

AKS – Kaito Custom Inference Model

Summary

The documentation now specifies that the example deployment requires quota for the `Standard_NVads_A10_v5` virtual machine family instead of the previously mentioned `Standard_NCads_A100_v4`. Additionally, users are instructed to set the `"–torch_dtype"` parameter to `"bfloat16"`, which is supported on all GPU SKUs that KAITO manages, and to use `Standard_NV36ads_A10_v5` as the instance type for the example deployment.

AKS – Enable Defender for Containers Terraform

Summary

Use Terraform to deploy an AKS cluster, enable Microsoft Defender for Containers at the subscription level, and verify runtime protection.

AKS – Private Clusters

Summary

The documentation for AKS private clusters has been updated to clarify the requirements for using a custom DNS server. Users must ensure that the DNS server can resolve the cluster’s private DNS zone and that AKS nodes can access it over both UDP and TCP port 53. Additionally, starting with Kubernetes 1.37, LocalDNS can automatically activate for eligible AKS Standard node pools, and users are advised to validate both UDP and TCP protocols before upgrading.

AKS – Managed Gateway API

Summary

The document has been updated with new version information and compatibility details, ensuring users have the latest information on the managed gateway API for AKS.

AKS Arc – Connectivity Modes

Summary

The documentation now clarifies the connectivity states of a standard, cloud-connected AKS on Azure Local cluster, distinguishing it from disconnected operations, which utilize a separate local control plane. Additionally, it includes a new section detailing the impact on clusters when the Arc resource bridge is deleted or recovered, providing users with essential information for managing their AKS deployments effectively.

AKS – Use Cvm

Summary

The documentation for Confidential Virtual Machines (CVMs) has been enhanced to clarify how to add CVM node pools to existing AKS clusters. It includes updates on supported workloads and the requirements for using CVMs.

AKS – Operator Best Practices Network

Summary

The documentation now emphasizes the use of Azure CNI Overlay for most scenarios, allowing users to assign pod IP addresses from a separate pod CIDR while ensuring that traffic leaving the cluster is translated to the node’s IP address. Additionally, it clarifies the requirements for configuring ingress resources, specifying the use of the `webapprouting.kubernetes.azure.com` ingress class for managed NGINX ingress controllers, and highlights the importance of using LocalDNS for improved DNS performance and reliability in AKS clusters. Users are also informed about the upcoming end of support for Azure Network Policy Manager for Windows nodes and the need to migrate to Cilium.

AKS – Ai Toolchain Operator Azure Portal

Summary

Updates include corrections to outdated KAITO facts and clarifications on supported model versions. The documentation now emphasizes the importance of using NVIDIA GPUs with CUDA compute capability 8.0 or later for KAITO.

Fleet – Update Automation

Summary

The documentation now includes a Terraform workflow for automating updates in Azure Kubernetes Fleet, allowing users to create a resource group, an Azure Kubernetes Fleet Manager, and an auto-upgrade profile using Terraform. Users can also install the latest Azure CLI and the `fleet` extension, and utilize commands to manage auto-upgrade profiles, including viewing and deleting them. Additionally, the Terraform sample provided does not join any AKS clusters as Fleet members, but users are guided on how to join existing clusters for real update runs.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Helm

Summary

The documentation has been updated to reflect the upgrade of the Helm chart version from 1.11.4 to 1.12.1. Users can now utilize the latest features and improvements included in version 1.12.1 when deploying the Application Gateway for Containers using the ALB controller.

AKS Arc – Azure Arc Resource Bridge Deleted Recovered

Summary

Learn what happens to AKS clusters on Azure Local when the Azure Arc resource bridge is deleted, becomes unavailable, or is recovered, and how to plan for recovery.

AKS – App Routing Gateway API

Summary

The documentation now includes the addition of the `–enable-gateway-api` flag in the `az aks create` and `az aks update` commands, allowing users to enable the Gateway API alongside the application routing Istio feature when creating or updating an AKS cluster. Additionally, the documentation clarifies limitations and migration guidance for the Gateway API, including the inability to configure certain features like request header limits and the use of `EnvoyFilter` in the App Routing Gateway API implementation. Users can now also utilize Terraform to deploy an AKS cluster with the application routing Gateway API enabled, providing a structured approach to managing resources.

AKS – Istio Support Policy

Summary

The documentation now reflects updated expected release dates for the Azure Service Mesh (ASM) versions, specifically for asm-1-29 and asm-1-30, with the expected release for asm-1-29 changed to ~November 2026 and asm-1-30 to ~January 2027. Additionally, the supported versions for asm-1-30 have been expanded to include 1.37, allowing users to utilize a broader range of versions with this release.

AKS – AKS Automatic Limitations

Summary

The documentation now reflects that AKS Automatic is generally available in additional regions, including `australiacentral`, `australiasoutheast`, and `canadaeast`. Users can now migrate from existing AKS Automatic clusters without managed system node pools to those with managed system node pools, which is currently in preview in regions where managed system node pools are available. Additionally, new AKS Automatic clusters will continue to enable managed system node pools and LocalDNS by default, with no option to create clusters without managed system node pools.

AKS – Create Node Pools

Summary

This article has been updated to include the retirement notice for Azure Linux with OS Guard, emphasizing the need for users to migrate to avoid disruptions in service.

AKS – Azure Linux Retirement

Summary

The documentation now specifies that Azure Kubernetes Service (AKS) will no longer support or provide security updates for Azure Linux 2.0 starting November 30, 2025, with the node image frozen at the `202512.06.0` release. Additionally, node images will be removed on October 31, 2026, preventing users from scaling their node pools, necessitating migration to a supported Azure Linux version. Users are advised to upgrade their node pools or migrate to `osSku AzureLinux3` to maintain support.

AKS – Deploy Application Gateway for Containers Alb Controller Terraform

Summary

Use Terraform to deploy an AKS cluster, enable the Application Gateway for Containers ALB Controller add-on, and verify the Gateway API installation.

AKS – Configure Automatic Zone Placement

Summary

Improved the explanation of automatic zone placement in AKS, detailing the per-zone cap and the requirements for regions with availability zone support.

AKS Support – Subnetisdelegated Error

Summary

The documentation for the `SubnetIsDelegated` error in Azure Kubernetes Service (AKS) has been updated to clarify troubleshooting steps for creating a node pool. Users are now instructed to identify the node subnet from the error message and check its delegations using specific Azure CLI commands. Additionally, the guidance emphasizes selecting a dedicated, nondelegated subnet for the node pool and provides updated commands for verifying and modifying subnet delegations.

AKS – Configure Dual Stack

Summary

The documentation for configuring dual-stack networking in Azure Kubernetes Service (AKS) has been updated to clarify that in Azure Linux node pools, IPv6 services require `externalTrafficPolicy: Local`. Additionally, it now specifies that Azure CNI Overlay does not support Azure or Calico network policies with dual-stack networking, and users should utilize Azure CNI Powered by Cilium for network policies. Furthermore, the article emphasizes that the Standard NAT Gateway supports only IPv4, and for dual-stack egress, users should use the StandardV2 NAT Gateway, which is currently in preview.

AKS – Ai Toolchain Operator Fine Tune

Summary

The documentation for the AI toolchain operator (KAITO) has been updated to reflect that users can now utilize KAITO version 0.3.1 and above to fine-tune supported foundation models with new data, enhancing AI model accuracy. Additionally, the command for applying the workspace tuning configuration has been corrected to include the `-f` flag, ensuring proper execution. Users are also advised to update their AKS clusters to the latest version to enable the AI toolchain operator add-on feature flag.

AKS – Plan Pod Networking

Summary

The documentation now clarifies that users should choose a pod networking configuration based on whether pods require direct IP access from connected networks and their IP address scale needs. It introduces a comparison table for IPAM options, highlighting that the Flat Networking Model allows pods to be accessed by private IPs from connected networks, while the Overlay Networking Model is more scalable but restricts direct access. Additionally, the recommendations section emphasizes using Azure CNI Overlay for general use, while suggesting the Azure CNI Pod Subnet options for specific access and scaling requirements.

AKS – Concepts Fine Tune Language Models

Summary

The documentation for fine-tuning language models has been updated to reflect new URLs for the KAITO fine-tuning and repository resources, directing users to the latest content at kaito-project.github.io. Additionally, outdated information regarding KAITO facts in the AI toolchain operator documentation has been corrected, ensuring users have access to accurate and relevant details.

AKS Arc – Overview

Summary

Learn about Azure Kubernetes Service (AKS) enabled by Azure Arc for Azure Local with disconnected operations (preview), including supported scenarios, prerequisites, and limitations.

AKS – Auto Upgrade Node Os Image

Summary

The auto-upgrade documentation has been updated to include the retirement notice for Azure Linux with OS Guard, ensuring users are aware of upcoming changes and necessary actions.

AKS – Secure AKS

Summary

Learn how to secure Azure Kubernetes Service (AKS), with best practices for protecting your clusters, nodes, workloads, and data.

AKS – Plan Node Networking

Summary

The documentation now includes information on supporting shared subnets for system and agent node pools between multiple clusters, allowing users to optimize their network configurations. Users must ensure that sufficient IP addresses are allocated to prevent potential issues when implementing this feature.

AKS – Outbound Rules Control Egress

Summary

The documentation now specifies that when using custom DNS servers, cluster nodes must be able to reach them over both TCP and UDP on port 53, ensuring the DNS server listens and responds on both protocols. An important note has been added emphasizing that DNS must be allowed over both protocols, as clients may retry over TCP under certain conditions, and users are advised to configure NSGs, firewalls, and access controls accordingly.

AKS – Cluster Health Monitor

Summary

The documentation for the Cluster Health Monitor in Azure Kubernetes Service (AKS) has been updated to clarify that it now includes two monitors: a Control Plane and Add-On Monitor, which performs ongoing health checks, and an On-Demand Monitor that allows users to manually trigger node health checks. Users can enable these features on both new and existing clusters, with specific commands provided for activation and verification. Additionally, the automatic remediation for unhealthy CoreDNS pods is now explicitly noted to occur under certain conditions, enhancing the overall resilience of the cluster.

AKS – AKS Preview CLI Extension

Summary

Install the aks-preview CLI extension by using the [az extension add][az-extension-add] command.

AKS Arc – Storage Provision Issue

Summary

This article describes an issue with storage provisioning in Azure Local clusters, detailing symptoms, causes, and mitigations. It includes specific commands for troubleshooting and resolving the issue, emphasizing the importance of using the correct version of Azure Local.

AKS – Concepts Ai Ml Language Models

Summary

The documentation now reflects updates to the Microsoft Phi model family, specifically replacing references to the Phi-3 models with the new Phi-4 models, which include Phi-4-mini (3.8 billion parameters) and Phi-4 (14 billion parameters). Additionally, the Google Gemma model family has been introduced, featuring Gemma-4-E2B (2 billion parameters), Gemma-4-E4B (4 billion parameters), and Gemma-4-31B (31 billion parameters), providing users with more options for language models.

AKS – Node Images

Summary

The node images documentation has been revised to reflect changes in supported OS SKUs, including Ubuntu 26.04 and Azure Linux with OS Guard. It provides guidance on migrating to new OS versions to avoid Kubernetes upgrade blocks.

Fleet – Howto Managed Namespaces

Summary

The documentation now includes a Terraform workflow for creating and managing Managed Fleet Namespaces, allowing users to set up a Fleet Manager and create namespaces using Terraform scripts. Users can verify the Managed Fleet Namespace created by Terraform by ensuring they have the Azure CLI and the `fleet` extension installed, with specific commands provided for installation and updates. Additionally, the documentation clarifies that the sample does not create or join member clusters, and users must have at least one AKS cluster joined to the Fleet to verify the namespace’s rollout.

AKS Support – Node Not Ready Custom Script Extension Errors

Summary

The documentation has been updated to clarify troubleshooting steps for custom script extension (CSE) errors that prevent Azure Kubernetes Service (AKS) nodes from provisioning. Users can now identify and resolve issues related to newly provisioned virtual machine scale set instances not registering as AKS nodes, including checking DNS configurations and API network time-outs. Additionally, the article emphasizes the importance of retrieving CSE exit codes to diagnose provisioning failures effectively.

Arc K8s – Tutorial Use Gitops Argocd

Summary

The documentation for the Argo CD GitOps tutorial has been refreshed to clarify that users need to create an Azure Kubernetes Service (AKS) cluster with Managed Service Identity (MSI) for the extension to function properly. Additionally, users can now assign the Kubernetes Extension Contributor role to manage Argo CD RBAC policies and grant administrator privileges, allowing for application deployment across any configured namespace. The tutorial also emphasizes that the GitOps agents require outbound TCP access to specific URLs for proper functionality.

AKS Arc – AKS Arc Known Issues

Summary

The documentation now emphasizes that AKS on Azure Local is only supported when the underlying Azure Local instance is within its six-month support window. Users are advised to update to a supported version if their Azure Local version is out of support before troubleshooting. Additionally, new sections have been added regarding support policies for AKS on Azure Local and the impact on clusters when the Arc resource bridge is deleted or recovered.

AKS – Use Network Policies

Summary

The documentation now includes instructions for using Terraform to deploy an AKS cluster with Cilium as the network policy engine, enhancing users’ ability to manage network policies in AKS. Additionally, users can now find specific requirements for Terraform and Azure CLI installations, as well as detailed steps for creating and verifying network policies using Terraform. This update improves clarity on how to implement network policies effectively in AKS environments.

AKS – Dns Concepts

Summary

The documentation now clarifies that starting with Kubernetes 1.37, AKS Standard defaults eligible node pools to `Preferred` LocalDNS mode when no explicit LocalDNS profile is configured. This means LocalDNS will only be enabled if the node pool and cluster pass compatibility checks; otherwise, it remains disabled. Additionally, users can explicitly set the LocalDNS mode to `Disabled` to prevent it from being enabled, with updated instructions provided for doing so.

AGC – How to Request Mirroring Gateway API

Summary

Learn how to configure request mirroring with Application Gateway for Containers.

AKS – Localdns Custom

Summary

The documentation now specifies that starting with Kubernetes 1.37, AKS Standard defaults eligible node pools without an explicit LocalDNS profile to `Preferred` mode, enabling LocalDNS only when compatibility checks are passed. Users are advised to review their LocalDNS profiles before upgrading, as activating LocalDNS alters the DNS forwarding path for workloads. Additionally, updating the LocalDNS profile on an existing node pool will trigger a node reimage, necessitating careful planning for temporary unavailability.

AKS – Configure AKS Scheduler

Summary

The documentation for configuring scheduler profiles on Azure Kubernetes Service (AKS) has been updated to reflect that users now need Azure CLI version `2.90.0` or later, instead of `2.76.0`. Additionally, the section on verifying the feature is disabled has been clarified to specify running the `az aks show` command, enhancing user understanding of the process.

AKS – Use Confidential Gpus

Summary

Learn how to use Confidential GPUs on Azure Kubernetes Service (AKS) to run secure and isolated workloads.

AKS Arc – Kube Apiserver Log Overflow

Summary

The document addresses a critical issue regarding disk space exhaustion on control plane VMs due to the accumulation of kube-apiserver audit logs. It includes mitigation strategies and workarounds, making it essential for users facing this problem.

AKS – Kubernetes RBAC Entra Id

Summary

The documentation now specifies that users must install Terraform version 1.6.0 or later to configure Kubernetes RBAC, replacing the previous requirement of version 2.99.0. Additionally, it clarifies that users need permission to create Azure role assignments at the AKS cluster scope and manage Kubernetes resources, along with two existing Microsoft Entra groups for access validation. The article also introduces a Terraform workflow that automates the creation of an AKS cluster with Microsoft Entra integration and Kubernetes RBAC enabled, simplifying the setup process for users.

AKS – AKS Managed Gpu Nodes

Summary

Enhanced the documentation on using the aks-preview CLI extension, specifying version requirements and clarifying the installation and update processes.

AKS – Quick Create Gpu Linux Cluster CLI

Summary

Learn how to create a Linux-based Azure Kubernetes Service cluster with a fully managed GPU node pool using Azure CLI.

AKS Arc – Create Manage Cluster

Summary

Updated the title and description to better reflect the content, focusing on creating and managing AKS clusters with disconnected operations.

AGC – Application Gateway for Containers Components

Summary

The documentation now includes a note emphasizing that if an association is deleted and recreated, it will be treated as a new association under the current NSG enforcement model. Users are advised to configure the necessary NSG allow rules, including the _AzureLoadBalancer_ tag, before recreating the association to prevent frontend connectivity or health probe issues.

AKS – AKS Automatic Sku Migration

Summary

The documentation for migrating AKS Automatic clusters has been updated to clarify the supported migration paths between managed system node pools and AKS Standard configurations. Users can now migrate from an AKS Automatic cluster without managed system node pools to one with managed system node pools in preview, provided they meet specific prerequisites, including having the latest Azure CLI version and the `aks-preview` extension. Additionally, the article now details the commands required for migration, including the use of the `–enable-hosted-system` and `–system-node-subnet-id` parameters.

AKS – Upgrade Options

Summary

The documentation now includes a new section on validating LocalDNS and custom DNS configurations before upgrading to Kubernetes 1.37. Users are instructed to check the LocalDNS profile, test their custom DNS server over both UDP and TCP, and ensure that network security groups and firewalls allow traffic on both ports. Additionally, it emphasizes the importance of upgrading non-production node pools first and monitoring for errors related to CoreDNS and LocalDNS.

AKS – Csi Secrets Store Driver

Summary

The documentation for the Azure Key Vault provider for Secrets Store CSI Driver in AKS has been updated to clarify the roles used in Azure CLI workflows and Terraform samples. Users can now see that the Azure CLI workflows utilize the Key Vault Secrets Officer role for secret creation, while the Terraform sample grants the add-on identity the Key Vault Secrets User role. Additionally, the Terraform sample has been enhanced to include a tested configuration that creates a resource group, AKS cluster, Azure Key Vault, example secret, and necessary role assignments, streamlining the setup process for users.

Arc K8s – Identity Access Overview

Summary

The documentation for Azure Arc-enabled Kubernetes has been updated to clarify the use of the cluster connect feature, emphasizing that it allows access to clusters both within Azure and from the internet, which can facilitate interactive debugging and troubleshooting. Additionally, it now specifies that if users opt for Microsoft Entra authentication without cluster connect, Azure RBAC is the only authorization option available, while users can choose between Azure RBAC and Kubernetes RBAC when using cluster connect with Microsoft Entra authentication.

App Net – Get Started

Summary

The documentation for deleting an Azure Kubernetes Application Network resource has been updated to clarify that deleting the resource automatically removes all of its members, eliminating the need for users to remove members individually beforehand. Additionally, it specifies that removing a member does not delete the corresponding AKS cluster, providing clearer guidance on resource management.

AKS Support – Cluster Node Virtual Machine Failed State

Summary

The documentation has been updated to enhance troubleshooting guidance for Azure Kubernetes Service (AKS) clusters and nodes in a failed state. Users can now follow a more structured approach to identify and resolve issues related to failed upgrades, scaling operations, and provisioning states. Key sections have been restructured to clarify prerequisites, common causes, and troubleshooting steps, allowing users to more effectively diagnose and rectify problems impacting their AKS environments.

AKS – Istio Deploy Addon

Summary

The documentation now clarifies the node affinity preferences for the `istiod` and ingress/egress gateway pods, specifying that they have a weighted preference of `100` for nodes labeled `azureservicemesh/istio.replica.preferred: true` and `50` for AKS system nodes. Additionally, it notes that for revisions earlier than `asm-1-30`, these weights are reversed. This change helps users understand how pod scheduling will behave based on node labels and versions.

AKS – Csi Secrets Store Identity Access

Summary

The documentation now includes updated instructions for configuring managed identity access in Azure Kubernetes Service (AKS) using Terraform. Users can follow a new section that details the prerequisites, including the required versions of Terraform and Azure CLI, and provides a tested sample configuration for creating a `SecretProviderClass`. Additionally, the documentation clarifies that the Terraform sample automatically assigns the `Key Vault Secrets User` role to the add-on identity, streamlining the setup process for users.

AKS – Deploy Confidential Containers Default Policy

Summary

The documentation for deploying an Azure Kubernetes Service (AKS) cluster with Confidential Containers has been updated to clarify the steps and requirements for configuration. Users can now find detailed instructions on creating a cluster with the `az aks create` command, including parameters for enabling workload identity and specifying the workload runtime. Additionally, the process for adding a node pool with Confidential Containers has been refined, ensuring users understand the necessary parameters and commands for successful deployment.

AKS – Ai Toolchain Operator

Summary

The documentation for the AI toolchain operator has been updated to clarify that it now supports a curated list of models from the KAITO GitHub document, rather than all hosted model preset images. Additionally, users should note that the operator typically lags one release behind the latest KAITO version, and virtual machines using NVIDIA GPUs older than the Ampere architecture are no longer supported, requiring GPUs with CUDA compute capability 8.0 or later.

AKS – AKS List Skus

Summary

The documentation now includes an `aks-preview` CLI extension section, allowing users to install and update the extension using the `az extension add` and `az extension update` commands. Additionally, the command examples have been reformatted for clarity, ensuring users can easily understand how to specify parameters like `–location`, `–size`, and `–zone` when querying available SKUs. This enhances the usability of the commands for managing Azure Kubernetes Service (AKS) resources.

AKS – Load Balancer Standard

Summary

The documentation now clarifies that the _Basic_ SKU for Azure Load Balancer has been retired as of September 30, 2025, and AKS no longer supports it. Users must migrate existing AKS clusters using the _Basic_ SKU to the _Standard_ SKU through a supported upgrade process, which will cause downtime and cannot be rolled back. Additionally, new service annotations have been introduced, allowing users to specify an existing public IP resource by name for improved efficiency.

AKS – Cluster Extensions

Summary

The documentation for AKS cluster extensions has been enhanced to include Azure Monitoring for Containers as a core extension alongside Azure Backup, improving the integrated experience for users. Additionally, an extension capability matrix has been introduced, detailing support for security, identity, networking, and deployment readiness across various extensions, allowing users to better assess which extensions meet their operational and governance requirements.

AKS Arc – AKS on Azure Local Support Policy

Summary

The documentation now includes a new section on the Azure Local version support window, clarifying that AKS on Azure Local is only supported on versions within a six-month support window. If an Azure Local instance is running a version outside this timeframe, AKS clusters on that instance will be considered unsupported until the version is updated. Users should refer to the updated policy for details on supported versions and the end-of-support timeline.

AKS – Nat Gateway

Summary

The documentation now specifies that users can create an AKS cluster using the `managedNATGatewayV2` by utilizing the `–outbound-type managedNATGatewayV2` parameter in the `az aks create` command. This change highlights the use of the StandardV2 NAT Gateway SKU, providing users with details on its enhancements compared to the Standard NAT Gateway SKU. Users should refer to the updated section for guidance on implementing this new configuration.

AKS – Upgrade Os Version

Summary

This article has been updated to include information about Ubuntu 26.04, which is now available in preview for Kubernetes version 1.36 and later. It emphasizes the need for specific Azure CLI versions and feature flags for migration.

AGC – API Specification Kubernetes

Summary

The documentation now includes a new section on `BackendLoadBalancingPolicyTargetRef`, which defines the target reference and ports for the backend load balancing policy, allowing users to specify the API object to apply the policy to and the list of ports on the target. Additionally, the health check protocol behavior has been clarified, stating that it will use the same protocol by default, and if different, it will be plaintext. Users will also find updated references to the `SecretObjectReference` and `NamespacedPolicyTargetReference` in the context of the API specifications.

AKS – Virtual Machines Node Pools

Summary

The documentation now includes information about the support for availability zones in Virtual Machines node pools, clarifying that they are not supported and recommending the use of Virtual Machine Scale Sets for workloads requiring zone resiliency. This change helps users understand the limitations of Virtual Machines node pools regarding availability zones and guides them towards appropriate alternatives.

AKS – Prepared Image Specification

Summary

The documentation now includes instructions for installing and updating the `aks-preview` CLI extension using the `az extension add` and `az extension update` commands, ensuring users can easily manage their extensions. Additionally, it clarifies the distinction between updating PIS metadata and creating new PIS versions, emphasizing that users must create a new version to change container images or scripts and update the node pool accordingly.

AKS – Best Practices Ml Ops

Summary

The documentation has been updated to reflect a change in the API version from `kaito.sh/v1alpha1` to `kaito.sh/v1beta1`, which may affect users implementing the AI toolchain operator. Additionally, the section on allocating multitenant GPU quotas with Kueue has been revised for clarity, ensuring users have the most accurate guidance for managing GPU resources.

AKS – Supported Kubernetes Versions

Summary

The documentation now includes details about Kubernetes 1.37, highlighting significant updates to AKS managed add-ons and OS components. Notably, users must configure namespace-scoped access to Kubernetes secrets for `PodMonitor` and `ServiceMonitor` configurations when using `basicAuth` in the Azure Monitor managed service for Prometheus, effective from Kubernetes 1.37 onwards.