The documentation now includes a new tip on using automatic Pod Disruption Budget (PDB) management to prevent quarantine scenarios during upgrades. Users can automatically scale up deployment replicas to meet PDB constraints before draining begins, allowing for smoother evictions without the need for manual intervention. This enhancement streamlines the upgrade process and improves overall deployment efficiency.

The documentation now includes a detailed comparison of the two AKS cluster modes—AKS Automatic and AKS Standard—highlighting their differences in operations, node management, upgrades, security, monitoring, and networking. Users can now better understand which mode to choose based on their needs for production readiness, customization, and operational control when deploying AI and ML workloads on Azure Kubernetes Service. Additionally, the section on designing and deploying AI and ML workloads has been expanded to emphasize the benefits of using AKS for high-performance infrastructure and improved operational reliability.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

The documentation for Deployment Safeguards in Azure Kubernetes Service (AKS) has been updated to clarify the behavior of Deployment Safeguards in different AKS modes. Users can now see that in AKS Automatic mode, Deployment Safeguards are enabled by default in `Enforce` mode, while in AKS Standard mode, they are optional and can be set to either `Warn` or `Enforce`. Additionally, the documentation now specifies that users can exclude certain namespaces from Deployment Safeguards and Pod Security Standards, but cannot change the safeguard level from `Enforce` to `Warn` in AKS Automatic clusters.

This getting started guide has been updated with new author metadata and improvements to the content, enhancing the instructions for using Azure Container Registry with PowerShell.

The documentation now includes support for AKS on bare metal in preview, expanding the list of supported distributions for Kubernetes Fleet integration. Users can now explore this new option alongside existing services like EKS, GKE, K3s, OCP, and Rancher.

This new document outlines the retirement of the preview property `enableCustomCATrust` in AKS, providing important information for users relying on this feature.

This document has been updated with new author metadata, ensuring proper attribution. The content remains technically relevant and accurate.

This document has been updated with author metadata changes, indicating a new author. This may enhance the document’s reliability and reflect current security practices.

This getting started guide has been updated with new author metadata and improvements to the content, enhancing the instructions for using Azure Container Registry with Terraform.

This article has been revised to provide clearer instructions on accessing and interpreting logs for Azure Container Registry tasks, enhancing the troubleshooting process for users.

The documentation now clarifies that when updating application code from managed identity token acquisition to `WorkloadIdentityCredential`, users must utilize Microsoft Entra ID v2 scopes in the format `<resource>/.default`, rather than just the resource URI. Additionally, it specifies the audience for projected service account tokens, indicating that identity bindings and direct workload identity federation use different audiences, which may require separate service accounts or additional token volumes for workloads needing both authentication paths.

The document has been updated with new author metadata and improvements to the content regarding managing repositories in Azure Container Registry, which is crucial for users organizing their container images.

The documentation for Azure Kubernetes Service (AKS) for Extended Zones has been updated to reflect that AKS is now generally available for both public and private clusters. Users can now deploy a private AKS cluster in an Azure Extended Zone by using the `–enable-private-cluster` flag in the Azure CLI command. Additionally, the API version has been updated to "2024-09-01," ensuring users have access to the latest features and improvements.

This document has been revised to improve the guidance on implementing data loss prevention strategies for Azure Container Registry, enhancing security measures.

Updates have been made to clarify the integration of Azure Policy with Azure Container Registry, enhancing compliance and governance capabilities.

This tutorial has been updated with new author metadata and improvements to the content, providing users with better guidance on creating multi-step tasks in Azure Container Registry.

The tutorial has been updated with new author metadata and improvements to the content, providing users with better guidance on updating base images in Azure Container Registry.

The document has been updated with new author metadata and includes important information about webhooks in Azure Container Registry, which are essential for automating workflows and integrating with other services.

The token-based repository permissions documentation was updated with author metadata changes, enhancing the document’s authority.

The document has been updated to improve clarity and consistency in the author metadata, which enhances the overall quality of the documentation.

The best practices document has been updated to include guidance for both AKS Automatic and AKS Standard modes, emphasizing the differences in implementation responsibilities and providing a structured comparison of features and controls for each mode.

This tutorial has been enhanced with new author metadata and content improvements, providing users with better guidance on troubleshooting issues related to customer-managed keys in Azure Container Registry.

The document now includes standardized terminology for add-ons and emphasizes the application routing add-on as the recommended method for configuring an Ingress controller in AKS, enhancing clarity for users.

The Docker CLI get started guide for container registries was updated with author metadata changes, ensuring the document is up-to-date.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

Learn how to profile GPU workloads with real-time observability and analyze flame graphs to identify memory hotspots to optimize GPU workloads.

This document outlines storage options and configurations for Azure Container Registry, helping users optimize their container storage solutions.

This document introduces AKS end of support notifications, detailing how to receive alerts when a cluster’s Kubernetes version approaches or passes its end of support date. It explains the automatic nature of these notifications and their integration with Azure Resource Graph.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

This new document provides a comprehensive guide on creating an Azure Kubernetes Service (AKS) cluster on bare metal using an ARM template. It includes prerequisites, detailed steps, and configuration parameters necessary for deployment.

This document has been updated to include best practices for MLOps in AKS, providing guidance for both AKS Automatic and AKS Standard modes.

This document serves as a reference for health and error codes related to Azure Container Registry, helping users troubleshoot issues effectively.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

This tutorial has been updated to improve clarity regarding the use of customer-managed keys in Azure Container Registry, providing users with better guidance.

The document clarifies that certain add-ons requiring access to the IMDS endpoint are not supported with IMDS restriction, providing critical information for users configuring their AKS clusters.

The documentation now includes a warning about the audience for Microsoft Entra Workload Identity, emphasizing that changing the audience value may break compatibility with existing configurations and is not recommended unless necessary. Additionally, it clarifies that users should add a slight delay after adding a federated identity credential to avoid potential token request failures due to propagation delays.

The content has been revised to provide clearer instructions on configuring auto-purge settings for Azure Container Registry, improving user experience.

The document has been updated to clarify the roles and permissions for managing Azure Container Registry, enhancing user understanding of RBAC and ABAC.

The documentation for the Azure Monitor metrics add-on has been updated to clarify that the `Minimal ingestion profile` setting is enabled by default for add-on-based collection, specifically focusing on control plane metrics. Additionally, the terminology has been standardized to consistently refer to the "add-on" instead of "addon," which may enhance user understanding of the feature. Users can now expect clearer guidance on the default targets and metrics collected when this profile is enabled.

The documentation has been updated to standardize terminology, changing ‘addon’ to ‘add-on’, which improves clarity and consistency.

The document has been updated with author metadata changes, indicating a new author. This may reflect a change in content responsibility or updates to the document.

The documentation now includes updated information regarding the retirement of the `enableCustomCATrust` (preview) feature. Users are instructed to update their node pools and clusters by using the `–disable-custom-ca-trust` parameter in the `az aks nodepool update` and `az aks update` commands. Additionally, if users wish to enable Custom CA Trust after the retirement, they can do so by using the `–custom-ca-trust-certificates` parameter and providing a path to a certificate file.

The document has been updated with author metadata changes, indicating a new author. This may reflect a change in content responsibility or updates to the document.

This update includes a fix for broken links related to the Virtual Machine Scale Set terminate notifications, which are prerequisites for AKS node auto-drain. The changes enhance the clarity and accuracy of the documentation.

This update documents the limitations of geo-replication when using static-IP private endpoints in Azure Container Registry. It explains the failure scenarios and provides solutions for managing private endpoints effectively, including the use of dynamic IP allocation for future geo-replicas.

This document discusses the use of managed identities for authenticating with Azure Container Registry, providing a secure method for accessing container images.

The article has been updated to include new author metadata and improvements in the content structure. It provides essential information on configuring firewall rules for Azure Container Registry, which is vital for securing access to container images.

The documentation now specifies that using BYO ACR with `authentication-as-arm` disabled is not supported, clarifying a limitation for users. Additionally, it emphasizes that during cluster creation and bootstrapping, no outbound traffic is needed from the network isolated cluster, as images for AKS components and add-ons are sourced from the private ACR connected to the cluster instead of the public Microsoft Artifact Registry.

This update includes author metadata changes and ensures that the documentation is up-to-date with the latest contributions, maintaining the integrity and accuracy of the content.

The documentation has been updated to standardize terminology regarding the Azure Monitor managed service for Prometheus, which is crucial for users configuring monitoring solutions in AKS.

The documentation for the Azure Kubernetes Service (AKS) has been updated to recommend starting with AKS Automatic as the default for most production workloads, highlighting its preconfigured best-practice defaults for scaling, security, networking, monitoring, and upgrades. Users can now choose between two cluster modes: AKS Automatic for ease of use and faster deployment, or AKS Standard for more advanced customization options. Additionally, the introduction section has been revised to emphasize AKS fundamentals and common platform areas, enhancing clarity for new users.

The document has been updated to include new guidelines for pushing multi-architecture images to Azure Container Registry, improving support for diverse deployment scenarios.

The documentation now clarifies that the built-in storage classes for AKS include the new `managed-csi-premium-v2` storage class, effective with Kubernetes version 1.35, which provisions Premium SSD v2 disks designed for I/O-intensive workloads. Additionally, it specifies that starting with Kubernetes version 1.29, AKS uses zone-redundant storage (ZRS) for managed disks across availability zones, enhancing data resilience, though at a higher cost compared to locally redundant storage (LRS). Users are now informed that they can create a new storage class with the LRS SKU for cost optimization if needed.

This quickstart guide has been updated with new author metadata and provides step-by-step instructions for integrating Azure Container Registry with Event Grid, enhancing the automation capabilities of container image management.

This document has been updated with new author metadata, ensuring proper attribution. The content remains technically relevant and accurate.

This document has been revised to clarify the soft delete policy for Azure Container Registry, enhancing data protection strategies.

The document has been updated with new author metadata and improvements to the content regarding allowing access to trusted services in Azure Container Registry, enhancing security practices.

The documentation for the Azure Kubernetes Service (AKS) has been updated to standardize terminology related to add-ons. Users can now find clearer instructions on using the `az aks show` command to retrieve the `clientId` of the user-assigned managed identity for the Azure Key Vault Provider, which is essential for managing secrets in Kubernetes Ingress. Additionally, the role assignment for the Key Vault Administrator has been clarified to ensure proper access for the user-assigned managed identity.

The documentation now clarifies that when using the `az acr login` command on an ABAC-enabled registry, the command will succeed with the specified role, but the identity will not have data plane operations (pull, push, delete) unless it also holds an ABAC-compatible data plane role. Additionally, the customer intent section has been updated to specify "containers" instead of "container images," reflecting a broader scope of management for Azure Container Registry resources.

This document has been revised to clarify the ingress networking in AKS, including the recommended production-ready defaults for most workloads and the differences between AKS Automatic and AKS Standard modes.

This document outlines monitoring strategies for Azure Kubernetes Service (AKS), including author updates and best practices for effective monitoring.

The documentation for best practices in cluster security for Azure Kubernetes Service (AKS) has been updated to clarify the differences in security responsibilities between AKS Automatic and AKS Standard modes. Users can now find detailed guidance on securing API server access, managing upgrades, and maintaining node security, emphasizing the preconfigured defaults in AKS Automatic versus the explicit configurations required in AKS Standard. Additionally, the section on upgrade processes has been enhanced to highlight the importance of monitoring impacts when upgrading Kubernetes versions.

The documentation now correctly specifies the `–drain-timeout` parameter for setting the node drain timeout in minutes when using the `az aks nodepool add` and `az aks nodepool update` commands. Previously, the parameter was incorrectly referred to as `–drain-time-out`, which could lead to confusion for users attempting to configure node pools. This change ensures that users can accurately set the timeout values of 100 or 45 minutes without encountering errors.

This update standardizes add-on terminology in the documentation, specifically changing ‘add on’ to ‘add-on’ for consistency. It also includes an example YAML configuration for Azure Managed Prometheus as a DaemonSet.

The tutorial has been updated with new examples and clearer instructions for performing quick tasks in Azure Container Registry, improving the user experience.

The documentation now includes important notes regarding the configuration of Prometheus/Grafana instances, highlighting that certain dashboard panels may need specific adjustments to display all data correctly. Additionally, it clarifies that Cilium does not support DNS metrics or dashboards, which is crucial for users relying on these features for network observability.

This document has been updated with new author metadata and improvements to the content regarding managing network bypass policies for tasks in Azure Container Registry, which is important for security.

The documentation for upgrading the OS version in Azure Kubernetes Service (AKS) has been updated to remove the `–node-count` parameter from several command examples. Users can now focus on specifying the node pool name without needing to include the node count, simplifying the command syntax for node pool updates. Additionally, the Kubernetes version references have been streamlined, enhancing clarity in the upgrade process.

The documentation now clearly states that starting on September 30, 2027, Azure Kubernetes Service (AKS) will no longer support the Open Service Mesh (OSM) add-on, as the upstream OSM project has been retired. Users with clusters utilizing the OSM add-on are advised to migrate to the Istio add-on before the end-of-support date, with specific migration guidance provided in the documentation.

The documentation now specifies that when dedicated data endpoints are enabled during image pulls, the temporary download link provided by ACR is valid for at least 20 minutes and can extend up to 30 minutes. This change enhances the security and flexibility for users downloading image layers, as they can now have a longer window to complete their downloads before needing to request a new link.

The document has been updated to standardize terminology regarding add-ons in AKS, improving clarity and consistency across the documentation.

The documentation has been updated to provide clearer guidance on migrating from the Open Service Mesh (OSM) add-on to the Istio add-on for Azure Kubernetes Service (AKS). Users can now find detailed instructions on how to translate OSM configurations to Istio equivalents, including specific commands for enabling and disabling add-ons, labeling namespaces, and applying translated Istio resources. Additionally, the article emphasizes the importance of planning for service disruption during the migration process and includes a structured approach for verifying the state of the OSM and Istio add-ons throughout the transition.

The documentation has been updated to clarify the use of the application routing add-on for AKS, improving the guidance provided to users.

This update introduces API request rate limits for Azure Container Registry, detailing how these limits are enforced based on the SKU. It includes a new section on API request rate limits, which is crucial for users to understand the performance constraints of their registry operations.

The documentation now includes updated information on configuring private endpoints for Azure Container Registry, improving security and access control guidance for users.

This document has been updated to clarify the deprecation of content trust in Azure Container Registry, providing users with essential information regarding changes in functionality.

This document has been updated with author metadata changes. The author has been changed to KumudD, which may reflect a change in responsibility or ownership of the content.

The documentation has been updated to standardize the terminology from ‘addon’ to ‘add-on’ for virtual nodes, improving consistency across the documentation.

The documentation now indicates that the Istio Gateway API has reached General Availability (GA), allowing service mesh users to plan their migration from Istio Ingress to the Istio Gateway API. This change provides clarity for users adopting a service mesh, emphasizing the readiness of the Istio Gateway API for production use.

Minor updates were made to the continuous patching documentation, including author metadata changes.

The documentation now clarifies that when using `WorkloadIdentityCredential`, users must pass scopes in the Microsoft Entra ID v2 format `<resource>/.default`, such as `https://management.azure.com/.default`, to avoid failures associated with raw resource URIs. Additionally, it details how to use identity bindings and direct federation within the same workload by projecting a second service account token with the audience `api://AzureADTokenExchange`, allowing for more flexible identity management configurations.

This update refines the documentation for Linux OS settings in AKS, detailing custom OS configuration settings that affect node behavior. It emphasizes the importance of careful configuration and testing in non-production environments.

This document has been revised to provide updated instructions for managing Helm repositories in Azure Container Registry, enhancing usability for developers.

The content has been updated to provide clearer instructions on implementing content trust for Azure Container Registry, improving security practices.

This document has been enhanced with new information on cross-registry authentication methods, providing users with better guidance on managing authentication across multiple registries.

This update standardizes the terminology for the Istio-based service mesh add-on, ensuring consistency and clarity in the documentation regarding compatibility and functionality.

This document has been updated to enhance the instructions for importing images into Azure Container Registry, improving user experience.

This document has been updated with author metadata changes, indicating a new author responsible for the content, which may enhance the document’s credibility.

The documentation now includes a new section on "Automatic PDB management (preview)," which allows users to automate the management of Pod Disruption Budgets (PDBs) during AKS upgrade drains. This feature enables automatic scaling of deployment replicas to satisfy disruption budgets when a PDB blocks eviction on a cordoned node, and it can also create PDBs for deployments lacking them, enhancing workload protection during upgrades. For further details on installation and configuration, users are directed to the "Manage Pod Disruption Budgets automatically during AKS upgrades" section.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

This document has been updated to include author metadata changes, ensuring proper attribution and authorship for the content related to container registry tasks.

The documentation for cost optimized add-on scaling in AKS has been updated to clarify the installation of the Vertical Pod Autoscaler (VPA) add-on, which allows supported add-ons to autoscale based on usage. Users are now advised to ensure sufficient compute resources in the system node pool and to consider enabling the cluster autoscaler or node autoprovisioning for optimal resource management. Additionally, users should monitor for pending add-on pods, as VPA may suggest resource requests that exceed available node capacity, and they can customize min/max values for requests and limits of supported add-ons to manage this behavior.

The troubleshooting guide has been updated to provide clearer steps and solutions for issues related to artifact caching in Azure Container Registry.

The documentation now states that the control plane can be up to three minor versions ahead of node pools, an increase from the previous limit of two minor versions. For instance, if your control plane is at version 1.35.x, your node pools can now be at versions 1.32.x, 1.33.x, 1.34.x, or 1.35.x, providing users with greater flexibility in managing version compatibility.

This document has been updated to enhance the instructions for pulling images in Dockerfiles, improving clarity and usability.

The document has been updated with author metadata changes, reflecting a new author. This may indicate a change in content responsibility or updates to the document.

This document introduces the Automatic Pod Disruption Budget management feature in AKS, which automates the creation of Pod Disruption Budgets (PDBs) to protect application availability during node drain operations. It details how the extension works, when to use it, and provides installation instructions, including configuration options for enabling automatic PDB creation.

The documentation now includes a detailed comparison of AKS cluster modes, specifically highlighting the differences in reliability features between AKS Automatic and AKS Standard. Users can better understand how to configure their clusters, as AKS Automatic provides preconfigured reliability defaults, while AKS Standard requires explicit management of features like node autoprovisioning and workload autoscaling. Additionally, the article emphasizes the importance of application-specific settings and best practices for ensuring high availability and resilience in both cluster modes.

This document has been updated to improve clarity and accuracy regarding configuring conditional access for Azure Container Registry, enhancing security practices.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

The documentation now clarifies that injecting non-Microsoft-managed sidecars, such as custom telemetry, logging, or security agents, into the ingress-nginx proxy pods managed by the add-on is not officially supported. Users should be aware that if they choose to proceed with this injection, Microsoft will only provide best-effort support for any resulting issues.

This update standardizes terminology for add-ons in the context of L7 Policies using AKS and Istio. It also enhances the content related to Container Network Observability features, providing clearer guidance for users.

The document has been updated to improve clarity and consistency in the author metadata, which enhances the overall quality of the documentation.

This document has been updated with author metadata changes, indicating a new author. This may enhance the document’s reliability and reflect current practices.

The document now includes standardized terminology for the Istio-based service mesh add-on, enhancing clarity regarding compatibility with AKS clusters.

The description for Istio service mesh latency comparisons has been updated to standardize terminology, changing ‘addon’ to ‘add-on’. This improves clarity and consistency in the documentation.

The document was updated to clarify the authentication-as-arm feature for container registries, including author metadata changes.

The documentation now clarifies that while Microsoft Support can offer general guidance on the application and evaluation of custom Azure Policy definitions within AKS, they will not provide detailed troubleshooting for customer-authored policy logic, including Rego-based policies. This change informs users that they may need to independently analyze or explain the behavior of their specific policies regarding workload permissions.

The documentation has been updated to standardize the terminology for the Prometheus add-on, ensuring consistency in the naming convention. Users can now refer to the feature as the "Prometheus add-on" throughout the documentation, which clarifies the process for enabling Prometheus metrics collection from their Kubernetes cluster.

The document has been updated with new author metadata and includes improvements to the content related to managing access to Azure Container Registry from selected networks, enhancing security practices.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

This document has been updated with new author metadata, ensuring proper attribution. The content remains technically relevant and accurate.

This article has been updated to include new authentication methods for Azure Container Registry tasks using Azure Key Vault, enhancing security and usability for users.

The documentation for creating a cluster in the Azure Kubernetes Service (AKS) portal has been updated to specify that the cluster name must be 1-27 characters long, start and end with a letter or number, and can only contain letters, numbers, hyphens, or underscores. This change clarifies the naming requirements for users, ensuring they adhere to the specified format when creating a cluster.

The documentation now includes details about the `managed-csi-premium-v2` storage class, which utilizes Azure Premium SSD v2 with locally redundant storage (LRS) for creating managed disks. Users can now understand that this storage class ensures the underlying Azure Disk is deleted when the associated persistent volume is deleted, and it is available starting with Kubernetes version 1.35.

The tutorial was updated with author metadata changes, enhancing the documentation’s credibility.

This update standardizes the terminology for the Azure Keyvault Secrets Provider add-on, improving consistency across documentation and enhancing user understanding of integration options.

This document provides troubleshooting steps for issues related to connected registries in Azure Container Registry, enhancing user experience and operational efficiency.

This article has been updated with new author metadata and improvements to the content regarding anonymous pull access in Azure Container Registry, which is crucial for managing access control.

This quickstart guide has been updated with new author metadata and improvements to the content, enhancing the instructions for connecting Azure Container Registry with Azure Arc.

The documentation now specifies that to install the AKS add-on, users must verify certain items, enhancing the clarity of installation requirements.

The document has been updated with new author metadata and improvements to the content regarding artifact streaming in Azure Container Registry, which is important for users managing container images.

This document has been revised to enhance the explanation of using managed identities for authentication with Azure Container Registry, improving security practices.

The get started guide for container registries was updated with author metadata changes, ensuring the document is current.

The document has been updated with new author metadata and improvements to the content regarding service tags for Azure Container Registry, which is important for network configuration.

The documentation for the Azure Kubernetes Service (AKS) has been updated to standardize terminology related to add-ons, ensuring consistency throughout the content. Additionally, the operational impacts of certain security configurations, such as password expiration and inactive password locking for the root user, have been clarified to emphasize their potential to disrupt AKS add-on functionality and prevent nodes from joining the cluster. Users should review these changes to understand the implications of these configurations on their AKS deployments.

The documentation now includes detailed descriptions of the two cluster modes available in Azure Kubernetes Service (AKS): AKS Automatic and AKS Standard. Users can choose AKS Automatic for a fully managed experience with reduced operational overhead and preconfigured defaults, or AKS Standard for greater flexibility and control over cluster configuration and operations. Additionally, the documentation highlights the differences in service-level agreements (SLAs) between the two modes, providing users with clearer guidance on which mode to select based on their operational needs.

The documentation for Azure Kubernetes Service (AKS) has been updated to include detailed descriptions of the two cluster modes: AKS Automatic and AKS Standard. Users can now better understand the differences between these modes, including management features, security defaults, and scaling options, allowing them to choose the most suitable configuration for their needs. Additionally, the article emphasizes the benefits of using AKS Automatic for quick onboarding and reduced operational overhead.

The documentation now clarifies that for associations created on or after April 23, 2026, Network Security Groups (NSGs) are fully supported on the Application Gateway for Containers association subnet, including both inbound and outbound rules. Additionally, it specifies that "Deny all" rules can block traffic on ports 80 and 443 unless explicit allow rules are defined, which may prevent access to the frontend and impact communication with the AKS cluster. Users are advised to ensure that the _AzureLoadBalancer_ service tag is allowed to maintain proper gateway operations.

The quickstart guide has been updated to improve clarity and usability for users pushing Docker images to Azure Container Registry.

Updates were made to the authentication documentation for container registries, including author metadata changes.

This article has been updated with new author metadata and improvements related to building tasks in Azure Container Registry, enhancing the guidance provided to users.

The documentation for the Vertical Pod Autoscaler has been updated to reflect the correct GitHub repository link for the hamster example, now pointing to the vpa-release-0.8 branch. This change ensures users access the appropriate version of the example, which may include important updates or fixes relevant to their implementation.

The document has been revised to include detailed explanations of LocalDNS, an advanced feature in AKS that improves DNS resolution. This update enhances the understanding of DNS management in AKS environments.

This document has been updated with author metadata changes, indicating a new author. This may enhance the document’s reliability and reflect current practices.

The document has been updated to reflect new considerations for MLOps in AKS, including guidance for both AKS Automatic and AKS Standard, enhancing the clarity of how to apply MLOps practices in Azure Kubernetes Service.

This update adds notes about access logs for Envoy on Gateway proxy pods and clarifies the limitations regarding non-Microsoft-managed sidecar injection for managed proxy pods, enhancing the documentation’s comprehensiveness.

The documentation for securing outbound traffic from Azure Kubernetes Service (AKS) has been updated to standardize terminology, specifically changing "addons" to "add-ons" throughout the article. Additionally, the requirements for the CSI Secret Store add-on pods to communicate with Azure Key Vault have been clarified, ensuring users understand the necessary endpoints and their significance for both standard and government cloud environments.

The tutorial has been enhanced with additional details on managing customer-managed keys for Azure Container Registry, providing users with clearer steps and considerations for implementation.

This article has been modified to include new author metadata and updates related to role-based access control (RBAC) for Azure Container Registry, which is essential for managing permissions effectively.

The documentation now clarifies that both Deployment Safeguards and Pod Security Standards can be enforced in either enforcement or warning mode, enhancing flexibility for users managing Kubernetes best practices in their AKS clusters. Additionally, it introduces the Istio-based service mesh add-on for AKS as an optional ingress gateway, providing users with more options for managing ingress traffic.

This update standardizes the terminology used for add-ons in the Azure Kubernetes Service documentation, improving consistency and clarity for users configuring Azure CNI.

This document has been revised to provide updated best practices for performance and scaling for large workloads in AKS, emphasizing the recommended use of AKS Automatic as the default for production workloads.

The document has been updated with author metadata changes, indicating a new author. This may reflect a change in content management or updates to the document’s maintenance.

The documentation has been updated to reflect new retirement dates for Windows Server 2022 in Azure Kubernetes Service (AKS). Users should note that support for Windows Server 2022 node pools will end on June 30, 2028, and it will not be supported in Kubernetes version 1.37 and later. Additionally, all existing node images for Windows Server 2022 will be removed on June 30, 2029, which will impact scaling operations.

The documentation now includes a new section on resizing a VMSS node pool in place, allowing users to change the VM size of an existing VMSS-based node pool with a single command using `az aks nodepool update –node-vm-size <new-size>`. This feature simplifies the process by performing a rolling upgrade, which surges new nodes, cordons and drains old nodes, and deletes them, eliminating the need for a manual workflow. Additionally, users are informed about prerequisites and unsupported combinations for the resize operation, ensuring they can effectively manage their node pools.

The documentation now includes standardized terminology for add-ons, specifically regarding the AzurePodIdentityException, which allows certain pods to access the Azure Instance Metadata Service without interception. This enhances the understanding of pod-managed identity in AKS.

The security concepts document has been updated to include new security components and practices in AKS, enhancing the understanding of identity, authorization, and workload protection.

This article has been updated with new author metadata and clarifies key concepts related to continuous patching in Azure Container Registry, which is crucial for maintaining security and compliance.

This update includes improvements to the documentation regarding the Node Problem Detector, enhancing user understanding of its functionality and usage in AKS.

This document has been updated with author metadata changes, indicating a new author. This may enhance the document’s reliability and reflect current best practices.

This document has been updated to provide clearer information on built-in roles for Azure Container Registry, improving compliance and governance.

This update standardizes the terminology for add-ons and includes important notes regarding Azure policy restrictions and resource locks that can affect cluster extensions. It emphasizes the need for proper configuration to manage extensions effectively.

The documentation for the Istio-based service mesh add-on in Azure Kubernetes Service has been updated to standardize terminology, specifically changing "addon" to "add-on." Additionally, it clarifies that for existing clusters using a self-signed root certificate generated by Istio CA, switching to a plugin CA is not supported without first disabling and then re-enabling the mesh. Users can now better understand the requirements for using their own certificates and keys with the Istio CA.

Author updates were made to the cluster autoscaler documentation, improving clarity and accuracy regarding the content. This includes a change in the author’s metadata.

The document has been updated with new author metadata and provides essential prerequisites for transferring container images between registries, ensuring users have the necessary information to perform these operations successfully.

The documentation now includes important notes regarding the inability to enable Windows support on clusters created without it. It also clarifies the requirements for adding Windows node pools and the constraints on changing VM sizes and max pods settings.

The documentation now specifies to replace `<AZURE_KEYVAULT_CLIENTID>` with the identity client ID of the `azureKeyvaultSecretsProvider` add-on, enhancing clarity for users.

The document has been updated with new author metadata and improvements to the content regarding monitoring Azure Container Registry, which is essential for users to ensure their registries are performing optimally.

The documentation now includes important notes regarding the configuration of the Istio add-on for Azure Load Balancer annotations, specifically when setting `spec.externalTrafficPolicy` to "Local." Users must unset certain annotations in the `GatewayClass` or per-`Gateway` ConfigMap to ensure proper health probe configuration. Additionally, it is now clearly stated that injecting non-Microsoft-managed sidecars into Istio ingress gateway proxy pods is not officially supported, with Microsoft providing only best-effort support for related issues.

This file has been updated with author metadata changes, ensuring that the documentation reflects the latest contributions and maintains accuracy.

The description for the virtual nodes add-on has been standardized, changing ‘addon’ to ‘add-on’, which enhances the clarity and consistency of the documentation.

This document has been updated to include new instructions and best practices for setting up geo-replication in Azure Container Registry, improving the guidance for users looking to implement this feature.

This update includes significant changes to the update orchestration concepts for Azure Kubernetes Fleet Manager, enhancing the clarity and detail of update runs, stages, and groups. It introduces new terminology and clarifies the behavior of update strategies, including maximum concurrency and approval gates.

The document has been updated to include new features related to approval gates in Azure Kubernetes Fleet Manager Update Strategies. It now provides clearer instructions and applies to both the Azure portal and CLI, enhancing user guidance.

This article has been revised to clarify the use of Managed Fleet Namespaces for multi-cluster multi-tenancy, including updates to the date and author information. It emphasizes the importance of resource quotas and network policies across multiple clusters.

The overview of Azure Kubernetes Fleet Manager has been updated to reflect the latest statistics and improvements, including the number of clusters and update runs. It now provides a more comprehensive description of the service’s capabilities.

This document has been enhanced with additional details on configuring events for approval gates in Azure Kubernetes Fleet Manager, including examples of integration scenarios and the necessary RBAC roles.

The conceptual overview of update orchestration has been improved with new details on managing updates across multiple clusters, including the introduction of new update strategies and flow controls.

The documentation now reflects that both Managed Namespaces and Managed Namespace RBAC have reached General Availability (GA), indicating that users can rely on these features for production use. Previously, these features were only in Preview, which may have limited their adoption and usage in live environments.

The documentation now specifies that the updates apply to both the Fleet Manager and Fleet Manager with hub cluster, enhancing clarity for users regarding the scope of the content. Additionally, a note has been added indicating that an Azure portal experience will be available prior to the general availability of this capability, informing users about upcoming features.

The documentation for creating and configuring Managed Fleet Namespaces has been updated to remove the "preview" designation, indicating that this feature is now generally available. Users can now utilize this feature without the previous limitations associated with preview features, enhancing their ability to manage namespaces effectively.

The documentation now clarifies that users can select either the Stable or Rapid Kubernetes release channels to automatically increment the Kubernetes minor version upon new releases. Additionally, users seeking only patch releases for a minor version can utilize the Target Kubernetes minor version channel, which is currently in preview. This update enhances user understanding of version management options within the Fleet Manager and Fleet Manager with hub cluster.

The documentation now includes an updated end-of-life date for Kubernetes version 1.33, extending it to July 2026, and adds a release calendar entry for Kubernetes version 1.37, which is in preview as of September 2026 and expected to reach general availability in October 2026. Additionally, a new table detailing breaking changes for Kubernetes version 1.36 has been added, highlighting specific updates to AKS managed add-ons and components, which users should review to understand potential impacts on their deployments.

The documentation now clarifies that users can utilize the `–target-kubernetes-version` parameter to specify a defined target Kubernetes minor version for upgrades, with Fleet Manager Auto-upgrade automatically applying the latest patch release of that version when available. Additionally, the section title has been updated to remove the "preview" designation, indicating that this feature is now fully supported. Users can also expect improved guidance on how auto-upgrade runs respect planned maintenance windows set at the AKS cluster level.

The documentation now clarifies that the **NodeSecurityPatch** feature provides AKS-managed security patches applied to the existing VHD running on the node, and it has been updated to remove the "preview" label. Additionally, the **Unmanaged** option for node image OS updates is specified to apply directly through OS in-built patching for Linux nodes, with a note indicating that there are currently no plans for Fleet Manager to support this option.