Azure Container Services Docs – Weekly Update (2026-10-11 to 2026-10-18)

Arc K8s – Secret Store Extension Reference

Summary

The documentation for the Secret Store Extension (SSE) has been updated to include release notes for version 1.6.0, highlighting new features and changes. Notably, the optional parameter **cloudName** has been clarified, specifying that it indicates the Azure cloud containing the key vault, with examples provided for different cloud environments. Users can now better understand how to configure the SSE based on their Azure cloud context.

Arc K8s – Secret Store Extension

Summary

The documentation now includes a critical update regarding the Azure Key Vault Secrets Provider extension, which will retire on October 9, 2027. Users are advised to migrate from this extension and are cautioned against running both the Azure Key Vault Secrets Provider extension and the offline Secret Store Extension (SSE) in the same cluster. This change emphasizes the importance of planning for the upcoming deprecation to ensure uninterrupted secret management in Arc-enabled Kubernetes clusters.

AKS – Certificate Rotation

Summary

The document has been updated to reflect a new requirement starting November 30, 2026, for Azure RBAC DataAction to authorize kubelet client certificate issuance. It emphasizes the importance of updating custom Azure roles for external-node bootstrap or kubelet client certificate renewal to avoid failures in joining the cluster or renewing certificates.

AKS – Kueue Overview

Summary

The document provides an overview of Kueue, detailing its installation and configuration on AKS. It explains the roles of ClusterQueue and LocalQueue in managing batch workloads and outlines the prerequisites and limitations for using Kueue in AKS environments.

AKS – Node Auto Provisioning Disruption

Summary

The date was updated, and a note was added regarding node-level features configured through the AKSNodeClass, enhancing clarity on configuration impacts.

AKS – AKS Managed Gpu Nodes

Summary

The documentation now emphasizes that during the preview phase, cluster autoscaler functionality is not supported for manually created managed GPU node pools. Users are advised to scale these pools manually or utilize NAP for auto-provisioned GPU capacity. This clarification impacts how users manage scaling for their GPU node pools.

AKS – Update Custom Roles External Node Certificate Bootstrap

Summary

This update introduces a new requirement for Azure Kubernetes Service (AKS) regarding custom Azure roles for external-node certificate bootstrap. Starting November 30, 2026, a dedicated Azure RBAC DataAction is required for kubelet client certificate issuance, which is crucial for new external nodes joining the AKS cluster and for existing nodes renewing their certificates. The document details how to determine if a custom role is affected and how to add the necessary DataAction.

AKS Support – Application Routing Default Domain

Summary

Learn how to troubleshoot the application routing default domain feature in AKS. Fix a certificate that isn’t ready or a domain that doesn’t resolve.

AKS – Roll Back Node Pool Version

Summary

The documentation now clarifies that users cannot roll back a platform-initiated upgrade in AKS, as the previous version becomes unavailable when the cluster is upgraded off an unsupported version. This change emphasizes the limitations users face regarding version management during upgrades.

AKS – Hyperscale Configuration AKS

Summary

Updated the documentation to include regions that currently do not support Hyperscale configuration, enhancing clarity on feature availability. The following regions are specified: australiacentral2, francecentral, germanywestcentral, norwayeast, southafricanorth, swedencentral, switzerlandnorth, taiwannorth, uaenorth, and centralus.

Fleet – Concepts Member Cluster Labels

Summary

This new article provides a conceptual overview of member cluster labels in Azure Kubernetes Fleet Manager, detailing how they can be used to describe and select clusters based on attributes like location and environment. It explains the purpose of member labels and how to manage them effectively.

Fleet – Update Automation

Summary

Updated the section on auto-upgrade triggered update runs to clarify that they honor planned maintenance windows set at the AKS cluster level. Added details about AKS platform-initiated upgrades for clusters on unsupported Kubernetes versions, emphasizing the potential for workload disruption.

AGC – Container Networking

Summary

The documentation now clarifies that Application Gateway for Containers deployed in a virtual network in region A cannot connect to AKS cluster nodes in a separate virtual network within the same region. Additionally, it confirms that Application Gateway for Containers can proxy traffic to clusters using CNI Overlay with Cilium and WireGuard, although WireGuard does not encrypt traffic between the gateway and destination pods. It also states that while VNet encryption can be enabled for the virtual network, it is not utilized for traffic between the gateway and AKS.

AKS – Create Volume Azure Files

Summary

Modifications include clarifications on NFS mount options for Azure Files CSI volumes and a note that the Secure transfer required setting must be disabled for NFS Azure Files volumes, which is crucial for proper configuration.

AKS – Long Term Support

Summary

The documentation now clarifies that if users do not manually upgrade their AKS clusters, the system will automatically perform a platform-initiated upgrade after a 60-day grace period following the LTS end-of-life date. It emphasizes that this upgrade does not change the cluster’s billing tier and that users retain control over upgrade timing by choosing to upgrade manually. Additionally, the section on platform-initiated upgrades has been expanded to explain that clusters will not be enrolled in LTS automatically.

AKS Arc – AKS Bare Metal Connect to Cluster

Summary

The documentation now reflects the updated supported Kubernetes version for AKS on bare metal Ubuntu, specifically noting the upgrade from v1.34.2 to v1.34.3. Users can now utilize the latest features and improvements available in Kubernetes v1.34.3 when connecting to their clusters.

AKS – Prepare Flex Node Host Identity

Summary

The documentation now specifies that users can run Azure Kubernetes Service (AKS) on hosts using Red Hat Enterprise Linux (RHEL) versions 9 or 10, in addition to Ubuntu 24.04 LTS and Azure Linux 3.x on AMD64 or ARM64 architectures. This expands the options for users setting up AKS with different operating systems.

AKS – Stop Cluster Upgrade API Breaking Changes

Summary

This document emphasizes that platform-initiated upgrades will occur even if deprecated API usage is detected. Users should check for deprecated APIs and remediate them before the upgrade month.

ACR – Container Registry Troubleshoot Performance

Summary

The article has been updated to improve guidance on monitoring performance issues in Azure Container Registry, including new metrics and troubleshooting steps for identifying throttling and performance differences.

Fleet – Howto Use Overrides Customize Resources Placement

Summary

The document includes significant updates regarding resource placement and configuration parameters for Kubernetes. It emphasizes the importance of specifying a placement to avoid unintended consequences on resource deployment performance.

AKS Arc – AKS Disconnected Operations Preview

Summary

Removed outdated author and metadata information, which does not impact user experience but cleans up the document. The feature remains in preview status, ensuring users are aware of its current state.

ACR – Monitor Container Registry

Summary

The article has been updated to include enhanced guidance on Azure Container Registry monitoring metrics, including new Grafana dashboard capabilities for transaction trends and data transfer analysis.

AGC – Quickstart Deploy Application Gateway for Containers Alb Controller Helm

Summary

The documentation has been updated to reflect the use of version 1.12.2 of the application gateway for containers, replacing the previous version 1.12.1 in the commands. Users should now reference the updated version when deploying the application gateway using the Helm chart.

AKS – Kms Data Encryption

Summary

This article provides troubleshooting steps for the `az aks update` command, specifically addressing the `ReconcileAzureKeyVaultKmsError` error and how to verify secret access in Kubernetes.

AKS Arc – AKS Bare Metal Preview Limitations

Summary

The documentation now reflects that Kubernetes 1.35.5 is the new default version for deployment on AKS on bare metal Ubuntu, replacing the previous default of Kubernetes 1.33.3. Users should refer to the updated "Supported Kubernetes versions" section for the latest available versions and parameter values during deployment.

Arc K8s – Release Notes

Summary

In version 1.38.0 of Azure Arc, managed least-privilege RBAC has been enabled for Azure Arc agents, which replaces shared cluster-admin access with dedicated, minimally scoped service accounts, enhancing security. Both versions 1.37.3 and 1.38.0 also include security vulnerability fixes and general bug fixes for improved reliability.

Fleet – Concepts Lifecycle

Summary

This document now includes important information about access restrictions for Fleet Manager hub clusters starting January 31, 2027. It outlines the types of Kubernetes API requests that will be denied and provides guidance on identifying affected resources and updating automation to comply with these restrictions.

Fleet – Concepts Update Orchestration

Summary

Azure Kubernetes Fleet Manager allows orchestration of upgrades across multiple clusters. If a cluster’s Kubernetes version reaches end of life, it enters a 60-day grace period, after which AKS performs a platform-initiated upgrade if the unsupported version persists.

Fleet – Faq

Summary

The documentation now includes a new section on the impact of AKS platform-initiated upgrades, clarifying that if a cluster remains on an unsupported Kubernetes version after its grace period, it will be upgraded directly by AKS. This upgrade process is distinct from Fleet Manager updates and can occur outside of the cluster’s maintenance window, emphasizing the importance of keeping member clusters on supported versions.

ACR – Tutorial Rotate Revoke Customer Managed Keys

Summary

The documentation now includes guidance for using Azure Key Vault Managed HSM in addition to Azure Key Vault for key rotation and management. Users can create new key versions in Managed HSM using the `–hsm-name` parameter and must ensure the identity has the appropriate local RBAC role assigned. Additionally, the process for revoking access to keys has been clarified, specifying that Managed HSM does not support Key Vault access policies and requires local RBAC role removal instead.

ACR – Tutorial Enable Customer Managed Keys

Summary

The tutorial was updated to include guidance on using Azure Key Vault Managed HSM for customer-managed keys, enhancing its relevance and usability.

AKS – Configure Multiple Network Interfaces for Pods

Summary

This guide explains how to create an AKS cluster with a multi-NIC node pool using the DRAnet driver. It includes prerequisites, installation steps for the Azure CLI extension, and feature registration.

AKS – Nat Gateway

Summary

The document discusses Azure NAT Gateway’s capabilities, including support for multiple outbound types and the limitations of each. It highlights the transition from managedNATGatewayV2 to managedNATGateway and the defaulting behavior of AKS to StandardV2 NAT Gateway.

Fleet – Update Orchestration

Summary

The article discusses how update runs honor planned maintenance windows but notes that platform-initiated upgrades can occur outside these windows, emphasizing the need for proactive management of cluster versions.

AKS – Egress Outboundtype

Summary

The documentation now clarifies that when selecting `managedNATGateway` for `outboundType`, AKS defaults to using the `StandardV2` NAT Gateway in regions where it’s available, enhancing performance with higher bandwidth and throughput. Additionally, users are informed that migrating from `Standard` to `StandardV2` is possible, but downgrading from `StandardV2` to `Standard` is not supported. The update also removes references to the deprecated `managedNATGatewayV2`, streamlining the options available for managing NAT gateways in AKS.

AGC – Tls Policy

Summary

The documentation now includes a note indicating that the 2023-06 and 2023-06-S TLS policies currently enforce the same cipher sets, with plans for future releases to introduce different cipher sets. This change informs users about upcoming updates that may affect their TLS configurations.

Arc K8s – Tutorial Akv Secrets Provider

Summary

The documentation now advises users to migrate from the Azure Key Vault Secrets Provider extension to the Secret Store extension, as the former will be retired on October 9, 2027, and will no longer receive updates or support. Users are encouraged to make this transition to ensure continued functionality and access to new features. Additionally, it clarifies that the Secret Store extension does not store secrets persistently, requiring connectivity to Azure Key Vault for secret-consuming pods.

AKS – App Routing Gateway API

Summary

Removed an include directive related to the retirement of ingress-nginx, which may affect users relying on that information for their configurations. This change indicates a shift in supported components.

AKS – Ingress Nginx Retirement

Summary

The document has been updated to reflect the retirement of the Ingress NGINX project, with maintenance ending in March 2026. It emphasizes the need for users to migrate to the Gateway API for ingress and L7 traffic management, providing critical timelines and support details.

Arc K8s – Secret Store Extension Troubleshooting

Summary

The documentation for the Azure Secret Store Extension troubleshooting has been updated to clarify error handling and resolution steps. Users can now identify and resolve issues related to the `InvalidClusterSecretLabelError` and `ValidatingAdmissionPolicyCheckFailed` by removing specific keys from the `SecretSync` or existing secrets that SSE does not manage. Additionally, the guidance for handling `ControllerSyncFailed` errors has been enhanced to include specific error codes and their implications regarding permissions and network access issues.

AKS – AKS Communication Manager

Summary

The documentation now specifies that users can set up alerts for upgrade events on an AKS cluster, with queries filtering scheduled events by cluster resource ID. Additionally, it clarifies that auto-upgrades configured on the cluster will follow the planned maintenance window, and it highlights the occurrence of platform-initiated upgrades outside of this window for unsupported Kubernetes versions.

AKS – Configure Queues with Automatic Resource Flavors

Summary

Simplify workload queueing and prioritization on AKS with managed Kueue automatically generated resource flavors and default workload priority classes

Fleet – Concepts Fleet Kubernetes Version Support

Summary

Made a minor modification to include AI-assisted usage in the documentation, indicating a focus on enhancing user experience and support.

Arc K8s – Extensions Release

Summary

The document now includes an important note about the retirement of the Azure Key Vault Secrets Provider extension, urging users to migrate to the Secret Store extension before the deadline.

AKS – AKS Desktop Headlamp Plugins

Summary

Learn how to browse, install, manage, and troubleshoot Headlamp plugins in AKS desktop.

AKS – Upgrade Options

Summary

The document outlines that platform-initiated upgrades do not follow maintenance windows and do not run deprecated API checks. Keeping clusters on supported versions is crucial for control over upgrade timing.

AKS – Node Auto Provisioning Aksnodeclass

Summary

Users can now enable trusted launch for Node Auto Provisioning (NAP) clusters by configuring the `spec.security.trustedLaunch` field in the AKSNodeClass CRD, allowing them to set `secureBoot` and `vTPM` to `true` for enhanced security on new or existing nodes. Additionally, changes to the `localDNS` configuration will trigger drift detection, marking existing nodes as drifted and replacing them according to the defined disruption controls, which may impact workloads during the transition. Users are advised to implement pod disruption budgets and monitor node claims to manage potential disruptions effectively.

AKS – API Server Authorized IP Ranges

Summary

The documentation now specifies that for clusters using Node public IPs, each node pool must use public IP prefixes. It also clarifies that an IPv6-only node public IP prefix cannot be used due to Azure’s automatic assignment of IPv4 addresses.

AGC – Alb Controller Release Notes

Summary

This document includes the latest release notes for the Application Gateway for Containers add-on, detailing version compatibility with AKS and highlighting security patches and bug fixes. It emphasizes the importance of keeping the add-on updated to ensure functionality and security.

AKS – Create Volume Azure Disk

Summary

The article now includes important information regarding the downtime requirements when expanding Azure disks beyond 4 TiB, which is critical for users managing large volumes.

AKS – Auto Upgrade Cluster

Summary

This article explains that if a cluster stays on an unsupported version after the grace period, AKS will upgrade it through a platform-initiated upgrade, regardless of the auto-upgrade channel settings.

App Net – Traffic Management Use Cases

Summary

Updated a command in the traffic management use cases to correct a variable name, ensuring accurate instructions for users.

AKS – Platform Initiated Upgrade Notice

Summary

Introduced a new notice regarding AKS platform-initiated upgrades, effective June 1, 2027. It details the implications of automatic upgrades for unsupported Kubernetes versions, including potential disruptions and the importance of maintaining supported versions.

ACR – Tutorial Troubleshoot Customer Managed Keys

Summary

The documentation now clarifies that enabling a Key Vault or Managed HSM firewall, virtual network, or private endpoint after creating an encrypted registry may result in HTTP 403 errors during image import or automated key rotation. Users are advised to ensure the key store’s network configuration allows Azure Container Registry access and to verify that their client is within the configured network boundary. Additionally, it highlights that automatic Azure Policy remediation for registries encrypted with customer-managed keys is not supported, requiring users to manually set properties to maintain compliance.

AKS – Monitor AKS

Summary

The document has been updated to remove the preview tag for AKS control plane metrics monitoring, indicating that it is now generally available. It also clarifies prerequisites and scope for using managed identity authentication with Prometheus.

AKS Arc – Overview

Summary

The title and description have been updated to remove the preview label for AKS on Azure Local with disconnected operations. This change signifies that the feature is now stable and provides users with essential information about supported scenarios, prerequisites, and limitations.

AKS – Platform Initiated Upgrades

Summary

The document details how AKS automatically upgrades clusters that remain on unsupported Kubernetes versions after the grace period. It highlights the risks of workload disruption and the importance of maintaining supported versions.

AKS Support – Fail to Mount Azure Disk Volume

Summary

Enhancements have been made to the documentation regarding Azure Disk multi-attach errors. The updates clarify the causes of these errors and provide solutions, including the importance of following the pod deletion procedure before rebooting or stopping nodes to prevent delays in pod startup.

AKS – Concepts Network Azure Cni Pod Subnet

Summary

Significant additions were made to document pod startup waits for dynamic IP allocation, which is crucial for users managing workloads with high pod churn.

AKS – Monitor AKS Reference

Summary

An important note has been added regarding the retirement of the ‘pod’ dimension for specific AKS platform metrics, effective September 30, 2027. This change is crucial for users relying on these metrics.

AKS Arc – AKS Bare Metal Upgrade Cluster Ubuntu

Summary

The documentation now includes updated information on the supported Kubernetes versions for AKS on bare metal Ubuntu, clarifying that the versions for new deployments do not necessarily represent valid upgrade paths for existing clusters. Users can refer to the "Supported Kubernetes versions" section for the latest deployment versions. This change enhances understanding of version compatibility during cluster upgrades.

AKS – Multiple Network Interfaces for Pods Overview

Summary

This article introduces multi-NIC pod support in Azure Kubernetes Service (AKS), allowing the attachment of secondary network interfaces to pods. It details the use of Dynamic Resource Allocation (DRA) and the DRAnet network driver for automatic NIC management.

AKS – Supported Kubernetes Versions

Summary

The documentation now includes a new section on **Platform-initiated upgrades**, detailing how AKS will automatically upgrade clusters that remain on unsupported Kubernetes versions after a 60-day grace period. Users can expect notifications via Azure Resource Health and email before these upgrades occur, ensuring they are aware of any changes to their cluster’s status. Additionally, the upgrade timeline for various Kubernetes versions has been clarified, providing users with better planning estimates for when upgrades will take place.

ACR – Monitor Container Registry Reference

Summary

This document has been expanded to include detailed descriptions of metrics and dimensions for Azure Container Registry, enhancing the understanding of monitoring capabilities and API operations.

AKS – Enable Fips Nodes

Summary

Updates include requirements for using FIPS with Azure Container Linux (ACL) and clarifications on supported Kubernetes versions. FIPS-enabled node pools now require AKS version 1.34 or later, and Trusted Launch with FIPS supports both Ubuntu 22.04 and ACL on Generation 2 VM sizes.

Fleet – Concepts Resource Placement

Summary

The documentation now clarifies that the `ClusterResourcePlacementStatus` resource provides a namespace-specific view of the status for a corresponding cluster-scoped `ClusterResourcePlacement` object, allowing namespace users to read placement status without exposing cross-namespace information. Starting January 31, 2027, this view will only include resources and references within the selected namespace, with nonempty member-cluster and hub values replaced by `(redacted)`. Users are advised to update applications that read `ClusterResourcePlacementStatus` to handle these changes appropriately.

AKS – Use Pod Sandboxing

Summary

The documentation now emphasizes the requirement to register the `Microsoft.Network/AllowBringYourOwnPublicIpAddress` feature for Pod sandboxing workloads using the Kata runtime. Users are guided through the registration process with updated commands for registering the feature, verifying its status, and refreshing the resource provider registration, ensuring they can successfully deploy Pod sandboxing.

Arc K8s – Secret Store Extension Release Notes

Summary

Release notes for version 1.6.0 were added, detailing new features and improvements, which are essential for users to stay informed about updates.

AKS – Use Trusted Launch

Summary

The document now specifies that to use Trusted Launch with Azure Container Linux (ACL), Azure CLI version 2.86.0 or later is required. It also clarifies compatibility with AKS version 1.34 or later and provides updated instructions for deploying node pools with Trusted Launch and FIPS enabled.

AKS – Localdns Custom

Summary

The documentation now clarifies that when using Node Auto-Provisioning (NAP), changes to the `spec.localDNS` in the `AKSNodeClass` will result in node replacement through drift rather than reimaging for NAP-managed nodes. Additionally, it emphasizes the importance of defining pod disruption budgets before making changes to LocalDNS settings, and provides guidance on disabling LocalDNS with NAP, noting that this action will also lead to node replacement.

AKS – Support Policies

Summary

The documentation now emphasizes the use of "cluster auto-upgrade" and "Fleet Manager auto-upgrade profiles" to help users maintain their AKS clusters on supported minor versions. Additionally, it clarifies that if a cluster remains on an unsupported version after the grace period, AKS will automatically upgrade it, providing users with more guidance on managing their Kubernetes versions effectively.

AKS – Planned Maintenance

Summary

Platform-initiated upgrades can occur outside of maintenance windows. Users are advised to keep clusters on supported versions to avoid unexpected upgrades.

AKS – Upgrade Conceptual

Summary

The documentation now includes a note on platform-initiated upgrades, explaining that AKS will attempt a normal drain first but will override the Pod Disruption Budget (PDB) if the drain fails, ensuring the cluster reaches a supported Kubernetes version. Additionally, the link for configuring upgrade settings has been updated to direct users to the section on rolling upgrade settings for node pools.

AKS – Configure Azure Cni Dynamic IP Allocation

Summary

The document now includes information about pod startup waits for dynamic IP allocation, which is critical for users managing workloads with high pod churn.

AKS – Use Node Public IPs

Summary

The document has been updated to clarify the configurations for assigning both IPv4 and IPv6 public IP addresses to nodes in a dual-stack cluster. It emphasizes the importance of using public IP prefixes and provides detailed instructions for creating clusters with IPv6-only configurations.

AKS – AKS Model Context Protocol Server

Summary

Updates clarify the AKS MCP server’s functionality, emphasizing its open-source nature and the importance of RBAC permissions. It also details the server’s operational modes and prerequisites for installation.

AKS – Ray Overview

Summary

Added a link for managed Kueue installation on AKS, enhancing the documentation for users looking to manage Kueue extensions. This update includes multiple additions to improve clarity and accessibility of the installation process.

Arc K8s – Secret Store Extension Migration

Summary

The Azure Key Vault Secrets Provider extension (AKV SPE) is set to retire on October 9, 2027. The documentation has been updated to guide users on migrating to the Secret Store extension (SSE) safely and effectively. Key changes include clarifications on managing workloads and the importance of stopping workloads that mount CSI volumes before the migration.

AKS Arc – AKS Bare Metal Create Cluster Ubuntu CLI

Summary

The documentation now reflects updated supported Kubernetes versions for AKS on bare metal Ubuntu, including the addition of versions 1.34.8, 1.35.5, and 1.36.1. Users can now specify these versions using the `–kubernetes-version` parameter, allowing for more flexibility in cluster deployments. Additionally, the example command has been simplified to use the version number without the date suffix.

ACR – Tutorial Customer Managed Keys

Summary

The documentation now includes guidance on using Azure Key Vault Managed HSM for customer-managed keys, allowing users to bring their own keys from either Azure Key Vault or Managed HSM for encrypting their Premium container registry. Additionally, it emphasizes that a Managed HSM must be provisioned and activated before configuration, and it introduces local role-based access control (RBAC) for Managed HSM, which differs from Key Vault access policies. Users can also verify the availability of Managed HSM in their desired Azure region.

ACR – Container Registry Skus

Summary

The documentation now includes expanded guidance on monitoring Azure Container Registry metrics, specifically addressing how to audit throttling and bandwidth issues. Users can utilize Azure Monitor metrics to filter and split transactions by response type, API name, and region to identify affected operations. Additionally, the section on mitigating throttling now emphasizes the importance of updating the registry’s SKU or contacting Azure support for limit increases if persistent issues occur.

AKS Support – Fail to Mount Azure File Share

Summary

The documentation now includes a new troubleshooting section for the "Mount error(22): Invalid argument" related to Azure Files in Kubernetes. It clarifies that this error often arises when the Kubernetes secret’s `data` field values for `azurestorageaccountname` or `azurestorageaccountkey` are not base64 encoded, leading to a corrupted value during the mounting operation. Users are advised to either base64 encode these values or use the `stringData` field, which automatically handles encoding, to prevent this issue.

AKS Arc – Create Manage Cluster

Summary

Updated the title and description for creating and managing an AKS cluster with disconnected operations. The article now reflects the current date and removes the preview label, indicating a stable feature. This change enhances clarity for users looking to implement this functionality.

AKS Support – Blobfuse Low Disk Space Excessive File Handles

Summary

A new troubleshooting article has been added for low disk space issues on AKS nodes caused by BlobFuse file handles. It includes symptoms, causes, and mitigation strategies, providing valuable guidance for users experiencing these issues.