The documentation for the Azure Arc gateway has been updated to clarify that it simplifies network configuration requirements, removing the mention of its preview status. Users can now find streamlined information regarding the endpoints required for AKS Arc clusters and other Arc-enabled scenarios, which may still require additional proxy configurations based on specific use cases.

This document has been updated to clarify the process for viewing and managing service health notifications in the Azure portal, enhancing user understanding of service health management.

The documentation now clarifies that WireGuard encryption is disabled by default even after enabling Advanced Container Networking Services (ACNS), and users must set the encryption type using the flag `–acns-transit-encryption-type wireguard` to enable it. Additionally, it specifies that WireGuard can be independently disabled without impacting other ACNS features by using the flag `–acns-transit-encryption-type=none`.

The documentation now clarifies that the Container Network Insights agent is supported in all Azure public regions where AKS is available, rather than just a limited list of regions. Additionally, it specifies that the extension is not available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds, providing users with a clearer understanding of where they can deploy this feature.

The documentation has been updated to reflect the upgrade of the ALB Controller Helm chart version from 1.10.23 to 1.10.26. Users can now utilize the latest features and improvements included in this version by specifying `–version 1.10.26` during installation. Additionally, the instructions for overriding namespaces during deployment have been clarified to enhance user understanding.

Learn how to deploy the MetalLB extension for Azure Arc-enabled Kubernetes clusters on Azure Local.

Learn how to troubleshoot Kubernetes applications in AKS desktop using the built-in Insights feature powered by Inspektor Gadget.

Learn how to set up a compatible Azure Kubernetes Service (AKS) cluster for AKS desktop.

This article details how to enable data encryption in transit for NFS Azure file shares by setting specific parameters in the StorageClass. It also provides examples for dynamic provisioning and existing persistent volumes.

The documentation now clarifies that when creating a new cluster or adding a node pool, the number of vCPUs determines the OS disk size by default, with specific details on the default sizes for various VM SKUs. Additionally, the example YAML manifest has been updated to reflect the use of the _managed-premium-retain_ storage class instead of _managed-premium_, which may impact users configuring persistent volume claims. Users can also find updated links to the Azure Disk and Azure Files documentation for better resource access.

The documentation now clarifies that when the Application Gateway for Containers add-on is enabled on an AKS cluster using the AKS-managed virtual network option, a subnet named `aks-appgateway` is automatically created with delegation enabled for `Microsoft.ServiceNetworking/TrafficController`. Additionally, users can verify that the GatewayClass has a condition indicating **Valid GatewayClass**, confirming that a default GatewayClass is set up and managed by the ALB Controller.

The documentation now includes detailed Terraform configurations for creating an AKS cluster with both system and user node pools, enhancing user guidance on isolating critical workloads. Users can now easily set up a dedicated system node pool with specific taints to prevent application workloads from being scheduled on it, as well as add user node pools for application separation. Additionally, instructions for changing the mode of existing node pools have been clarified, allowing users to switch between system and user modes directly in their Terraform configurations.

The documentation now includes an advisory for the CVE-2026-31431 vulnerability, detailing a local privilege escalation risk associated with the Linux kernel’s `algif_aead` module. Users are informed that all current AKS Linux nodes are exploitable, allowing attackers with code execution in any pod, including non-root pods, to escalate to root on the node. A mitigation is being deployed to block the module from auto-loading, but existing nodes created before the hotfix remain vulnerable, and users are advised to apply self-service mitigations as necessary.

The documentation for LocalDNS configuration in AKS has been updated to clarify that if a custom configuration file is not specified, AKS will automatically apply a default LocalDNS configuration. This change enhances user understanding of the default behavior of LocalDNS in AKS, ensuring they are aware of the automatic settings applied when no custom configurations are provided.

The documentation now emphasizes that Application Gateway for Containers has a migration utility to assist users in automatically translating AGIC Ingress to Gateway API, enhancing the migration process. Additionally, users are informed that they can deprecate the Application Gateway Ingress Controller after migrating all services, and they can delete or uninstall the AGIC add-on using specified commands. The text clarifies that certificates for Application Gateway for Containers must be local to the AKS cluster and cannot be mounted from external volumes, which impacts how users manage their certificate storage.

The documentation for outbound network and FQDN rules for Azure Kubernetes Service (AKS) clusters has been updated to clarify the requirements for accessing various services. Users can now see improved descriptions for accessing the Microsoft Container Registry in China Cloud, as well as updated details for Windows-related binaries installation and Microsoft Entra authentication. These changes enhance the clarity and accuracy of the information provided to users.

The documentation now includes a new section on LoadAwareConfig, which defines the configuration for load-aware routing, detailing fields such as blackoutPeriod, metricExpirationPeriod, errorUtilizationPenalty, and namedMetrics. Users can now understand how to influence load balancing decisions based on reported load metrics and utilize custom metrics for better performance. Additionally, the health check protocol behavior has been clarified, stating that it uses the same protocol by default and is plaintext if different.

Learn how to cache container images from one Azure Container Registry in another using managed identity authentication with Azure CLI and Bicep.

The documentation now includes a critical note stating that node image versions are only valid for 90 days from their original publish date, which is essential for users to avoid potential upgrade failures for member clusters. Additionally, the guide has been updated to clarify that the generated update run is not automatically started, allowing users to review it before proceeding. Users can also utilize the `az fleet autoupgradeprofile generate-update-run` command to generate new update runs based on the current AKS-published Kubernetes or node image version.

This new article introduces access and identity management options for Kubernetes clusters in AKS on Azure Local. It covers the use of Kubernetes RBAC for securing cluster access and outlines current limitations regarding Azure RBAC and other identity features.

The documentation for configuring container network logs in Azure Kubernetes Service (AKS) has been updated to clarify the setup process and enhance user understanding. Users can now configure container network logs in both stored and on-demand modes, with detailed instructions on applying the `ContainerNetworkLog` custom resource definition (CRD) to specify traffic capture criteria. Additionally, the documentation emphasizes that enabling Azure Monitor is optional for log generation, allowing users to directly access host-local logs or forward them to compatible logging services.

Learn about different load balancing strategies to help build resilient and performant workloads.

The documentation now clarifies that the container network insights agent extension is only supported in Azure public regions and is not available in sovereign cloud regions such as Azure Government or Microsoft Azure operated by 21Vianet. Users are instructed to verify that their cluster is in an Azure public region where AKS is supported, rather than just listing specific regions. This change enhances user understanding of regional limitations for the extension.

Learn about Projects in AKS desktop, the application-centric grouping of Kubernetes resources that simplifies deployment and management of applications on Azure Kubernetes Service (AKS).

The documentation for AKS Edge system requirements has been updated to reflect an increase in the minimum disk space requirement from 14 GB to 19 GB. Users should ensure that their systems meet this new requirement for optimal performance and functionality.

Learn how to deploy an AKS enabled by Azure Arc cluster on Azure Local (multi-rack) using an Azure Resource Manager template (ARM template).

The documentation for creating Azure Disks has been updated to reflect changes in the storage class names, specifically replacing "managed-csi" with "managed-csi-premium." Additionally, users are now instructed to request a disk size of 10 GB instead of 5 GB in the `azure-pvc.yaml` manifest. Other minor adjustments include clarifications in parameter descriptions and formatting corrections for consistency.

The documentation for AKS Desktop has been updated to clarify its purpose and benefits, emphasizing that it simplifies application deployment and management on Azure Kubernetes Service (AKS) without requiring deep Kubernetes expertise. Users can now leverage features such as guided workflows for deploying applications, natural language troubleshooting, and unified observability, which collectively enhance the management experience for development teams. Additionally, the documentation now highlights the integration with existing tools like Visual Studio Code and GitHub, allowing for a more seamless workflow.

The documentation for the Application Gateway for Containers Service Mesh Integration has been updated to reflect a new version (1.10.26) of the ALB Controller Istio Extension, enhancing compatibility and functionality. Users are now instructed to define a namespace for Istio sidecar injection and can utilize specific labels for mutual authentication, depending on their Istio installation method. Additionally, commands and examples have been updated to reference the new namespace "test-infra" instead of "istio-example-namespace," ensuring clarity in configuration steps.

The documentation for AKS reserved labels has been updated to clarify the usage of certain labels, including the introduction of a new label, `kubernetes.azure.com/priority`, which replaces the deprecated `kubernetes.azure.com/scalesetpriority`. Users can now refer to the updated table for recommended substitutes for deprecated labels, enhancing clarity on which labels to use for their configurations. Additionally, the formatting of example outputs has been improved for better readability.

A new document has been added that describes the network requirements for deploying AKS enabled by Azure Arc clusters on Azure Local. It includes details on logical network configuration, IP address requirements, and port requirements necessary for successful deployment.

The documentation for setting up permissions and role-based access control (RBAC) in AKS Desktop has been updated to clarify how users can manage RBAC permissions based on their roles as cluster operators or developers. Users can now provide environments for developers to deploy and manage applications, and the article emphasizes the need to use the Azure portal or Azure CLI for updating permissions after project creation, as there is currently no UI option for this. Additionally, the requirements for Azure CLI and the types of AKS clusters supported have been specified to enhance user understanding.

The documentation now includes details about WireGuard encryption for AKS, which is part of the Advanced Container Networking Services feature set. This update clarifies the implementation and the types of traffic flows that are secured within Kubernetes clusters.

The ALB Controller release notes have been updated to reflect the new version 1.10.26, which includes an Istio service mesh integration fix along with security patches. Users can now benefit from improved integration with Istio and enhanced security measures in their deployments. Additionally, the documentation clarifies that updates for users utilizing the AKS add-on are automatically applied to the cluster.

The documentation now includes a new section on planning subnet IP capacity for Azure Container Registry (ACR) private endpoints, detailing how each private endpoint consumes IP addresses and the implications of geo-replication and regional endpoints on IP usage. Users are advised to ensure sufficient IP capacity in their subnets before adding replicas, with specific recommendations for subnet sizes. Additionally, the error handling for geo-replication failures due to IP exhaustion has been clarified, emphasizing that the error message will not specify which subnet is exhausted, requiring users to verify capacity independently.

The documentation now clarifies that the `microsoft.containernetworkingagent` AKS extension is available in all Azure public regions where AKS is supported, rather than being limited to specific regions like centralus, eastus, and others. Additionally, it specifies that the extension is not available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds, providing users with clearer deployment options and limitations.

The documentation for configuring container network metrics filtering for Azure Kubernetes Service (AKS) has been updated to reflect new minimum version requirements. Users must now use Azure CLI version **2.85.0** and the `aks-preview` Azure CLI extension version **20.0.0b4** to complete the steps outlined in the article. Additionally, the required Kubernetes version has been updated to **1.33**.

The documentation for container network logs in Advanced Container Networking Services for Azure Kubernetes Service (AKS) has been updated to reflect a renaming of components for clarity. Users will need to update their configurations to use the new naming conventions, including changing the Custom Resource Definition (CRD) from `RetinaNetworkFlowLogs` to `ContainerNetworkLog`, and updating CLI flags and Log Analytics table names accordingly. Additionally, the documentation now emphasizes the importance of enabling the Azure Monitor add-on for enhanced log management and analysis capabilities.

The documentation for configuring AKS availability zones has been updated to clarify that not all VM SKUs are accepted when creating node pools in a specified location. Users are now informed that node pool creation will fail if the selected VM SKU does not support the requested availability zones in that region, and they can check SKU availability using the `az aks list-vm-skus` command with specific parameters.

Plan the IP addresses needed to deploy AKS enabled by Azure Arc clusters on Azure Local (multi-rack), including node IPs, control plane endpoints, and load balancer addresses.

The documentation now clarifies the process of enabling Cilium on a cluster that uses another network policy engine, such as Azure Network Policy Manager or Calico. It emphasizes that the existing engine will be uninstalled and replaced by Cilium, which may impact network policy behavior, and provides a link for further information on migration.

The documentation now includes a new section on Network Security Groups (NSGs) for the Application Gateway for Containers association subnet. Users can fully utilize NSGs for associations created on or after April 23, 2026, allowing for both inbound and outbound rules. For associations created before this date, while inbound NSG rules can be configured, inbound traffic on ports 80 and 443 will always be allowed, which may affect access unless explicit allow rules are defined.

A new section has been added to clarify that the AKS planned maintenance window is specifically for scheduling AKS cluster and node image upgrades, and does not apply to Azure platform-level maintenance. This distinction is important for users managing their AKS environments.

The link to enable Microsoft Sentinel workspace has been updated to reflect the correct path, improving the clarity and accuracy of the documentation.

Learn about the architecture of AKS enabled by Azure Arc on Azure Local (multi-rack), including how clusters are deployed, managed, and connected to Azure.

The documentation now specifies that Docker Hardened Images (`dhi.io`) and Azure Container Registry (`azurecr.io`) support only authenticated pulls, while NVIDIA NGC Container Registry (`nvcr.io`) supports both authenticated and unauthenticated pulls. This clarification impacts how users can access images from these registries using the Azure CLI and Azure portal.

Learn how to use the AI-powered troubleshooting assistant in AKS desktop to diagnose and resolve Kubernetes issues using natural language.

This document provides a comprehensive guide on how to list available VM SKUs for Azure Kubernetes Service (AKS) clusters. It includes prerequisites, installation instructions for the aks-preview CLI extension, and detailed commands for listing and filtering SKUs based on various criteria. The updates also clarify that the feature does not consider current quota or real-time available capacity.

The documentation now includes a clearer section on validating and troubleshooting secret encryption for AKS Edge Essentials clusters. Additionally, it provides a direct reference to the official documentation for deploying a new AKS Edge Essentials cluster, enhancing user guidance on deployment instructions.

The guide provides detailed steps for setting environment variables to simplify command usage, enhancing the user experience for deploying applications on Azure Kubernetes Service.

Learn about scale requirements for AKS on Azure Local, Rack Scale deployments, including cluster, node pool, and node limits.

The article has been updated to reflect the security OS configuration applied to both Ubuntu 24.04 and Ubuntu 22.04 images used by AKS. It includes new recommendation statuses and guidance based on the latest CIS benchmarks, ensuring compliance with security standards such as SOC, ISO, PCI DSS, and HIPAA.

The document has been updated to include a note about the 90-day validity of node image versions, which is important for ensuring successful upgrades. It also emphasizes the orchestration of updates across multiple clusters using Azure Kubernetes Fleet Manager.

The documentation now includes a dedicated section on Cilium mTLS Encryption, which offers users the ability to implement transparent mutual TLS encryption and authentication for pod-to-pod traffic in Kubernetes without needing to modify applications or add extra networking layers. Additionally, the WireGuard Encryption section has been updated to reflect its current status, enhancing clarity for users regarding these encryption options.

The documentation for deploying applications using AKS Desktop has been updated to clarify that users can now deploy containerized applications without writing Kubernetes manifests. Additionally, the prerequisites have been refined to specify the need for an existing AKS Automatic cluster with Microsoft Entra authentication and Azure CLI version 2.64.0 or later. Users are also guided to create a new Project when deploying applications, with detailed steps for configuring various settings during the deployment process.

A new document has been added that outlines the process for upgrading an Azure Kubernetes Service (AKS) cluster on Azure Local for multi-rack deployments. It details the steps for performing upgrades, including version compatibility and the importance of sequential upgrades.

The documentation now includes significant updates for AKS Edge Essentials version 1.12.269.0, which introduces support for cross-distribution upgrades within the same release version of Kubernetes. Additionally, the KMS provider is enabled by default for new deployments, simplifying the setup process as no further configuration is required. Users should also be aware of the new upgrade paths and the recommendation to ensure 19GB of free disk space before upgrading or installing.

The documentation for the `NodePool` API has been updated to include new SKU selectors and well-known labels that users can utilize to define VM characteristics. Notably, the `karpenter.azure.com/sku-series` selector has been added, allowing users to specify the VM SKU series, enhancing their ability to customize node configurations. Additionally, the documentation now includes examples for new labels such as `kubernetes.azure.com/cluster` and `kubernetes.azure.com/mode`, providing users with more options for defining node characteristics.

The documentation for the Advanced Container Networking Services (ACNS) has been updated to enhance user guidance on diagnosing and resolving network issues in Azure Kubernetes Service (AKS). Key changes include a restructured title and description that emphasize a user-first troubleshooting approach, along with detailed playbooks for addressing specific symptoms such as DNS failures, packet drops, traffic imbalances, and L7 errors. Additionally, the guide now organizes content around tasks rather than features, making it easier for users to navigate directly to the relevant solutions for their network issues.

The documentation for customizing cluster egress with outbound types in Azure Kubernetes Service (AKS) has been updated to clarify the selection of `managedNATGatewayV2` or `managedNATGateway` when using managed virtual networks, emphasizing the benefits of the StandardV2 NAT gateway. Additionally, the section on supported migration paths has been revised for clarity, ensuring users understand the migration possibilities between outbound types for both managed and BYO virtual networks. Users can now more easily navigate the commands and parameters related to updating their cluster’s outbound configuration.

The documentation for container network metrics in Advanced Container Networking Services for Azure Kubernetes Service (AKS) has been updated to clarify the collection and filtering capabilities of network metrics. Users can now utilize source-level filtering on Cilium clusters to define which namespaces, workloads, and metric types to collect before data leaves the node, enhancing visibility and reducing unnecessary data ingestion. Additionally, the overview now emphasizes the importance of pod-level metrics for troubleshooting and planning, allowing users to isolate issues more efficiently.

The documentation has been updated to reflect the latest versions of the K8s and K3s installers, now listing K8s installer version 1.33.5 and K3s installer version 1.33.5. Users can now access the most recent installation packages through the provided links, ensuring they are using the latest features and improvements available for AKS Edge.