The documentation for the Azure Key Vault provider for the Secrets Store CSI Driver in Azure Kubernetes Service (AKS) has been updated to clarify the steps for creating and updating AKS clusters with Azure Key Vault support. Users can now find detailed Terraform configurations for both creating and updating AKS clusters, including the necessary commands to deploy these configurations. Additionally, the instructions for verifying the managed identity and key vault provider installation have been enhanced to ensure users can effectively manage their key vaults and secrets.

Updated the link for creating a free Azure account to a more relevant page. This change enhances the clarity of instructions for users without an Azure subscription.

The documentation now specifies that after creating the federated credential for the `keda-operator` ServiceAccount, users must annotate the ServiceAccount with the managed identity’s client ID to bind the identity to the pods. Additionally, a new command example for annotating the ServiceAccount has been added, providing clearer guidance on this process. Users will benefit from this enhanced clarity on the steps required to properly configure Workload Identity for the `keda-operator`.

Learn how to interpret and use vulnerability data from the AKS Vulnerability Data API for security reviews, compliance reporting, and upgrade planning.

The documentation now reflects updated support timelines for the asm-1-27 and asm-1-29 versions, clarifying that asm-1-27 is expected to be supported until May 2026, and asm-1-29 is expected to be supported until September 2026. Additionally, the list of supported versions for asm-1-29 has been expanded to include version 1.36, allowing users to utilize this newer version alongside the previously listed ones.

The documentation has been updated to reflect the new version of the ALB Controller, which is now version 1.10.28, replacing the previous version 1.10.26. This change may impact users by providing access to the latest features and improvements included in the updated version.

The documentation for the Advanced Container Networking Services (ACNS) guide has been significantly updated to enhance user experience in diagnosing and resolving network issues in Azure Kubernetes Service (AKS). The article now provides a user-first troubleshooting approach, detailing specific symptoms such as DNS failures, packet drops, traffic imbalances, and L7 errors, along with corresponding metrics and logs to check. Additionally, the guide emphasizes a task-oriented structure, allowing users to quickly navigate to relevant playbooks based on the symptoms they encounter, improving the overall efficiency of network issue resolution.

The documentation now clarifies that configuring HTTPS ingress access to HTTPS services via the `TLSRoute` resource is not currently supported, with plans for support to be added once AKS incorporates Istio 1.30. This update informs users that they will need to wait for the upcoming version to utilize the `TLSRoute` resource for SNI Passthrough functionality.

Learn about GPU partitioning in Azure Kubernetes Service (AKS), including AKS managed multi-instance GPU (MIG) or time-slicing and multi-processing service (MPS) with self-managed NVIDIA GPU Operator.

The documentation now includes new sections that explain how to control the order of cluster updates using member labels and update groups, emphasizing that member labels provide greater flexibility for selecting fleet members. Additionally, it clarifies that when a `memberSelector` is set at the stage level, all matching clusters form a single implicit group, and it specifies that the group name is only for display purposes when a `memberSelector` is defined at the group level. Users can now better understand how to manage cluster updates and concurrency settings effectively.

Learn how to use Azure Kubernetes Fleet Manager to set up multi-cluster networking for highly available global services and service discovery.

This document has been updated to include a comprehensive overview of cross-cluster networking capabilities, including architecture, use cases, and limitations. It highlights the importance of unified security policies and observability across multiple clusters.

The documentation now includes a new section on vertically scaling the keda-operator to address OOMKill errors, allowing users to enable the Vertical Pod Autoscaler (VPA) on their AKS cluster. Users can follow detailed steps to create a VPA configuration file and apply it, enabling automatic adjustments of CPU and memory limits for the keda-operator pods based on usage. Additionally, the link for creating a free Azure account has been updated for better clarity.

The documentation now includes a new **Managed Resource Lock Check** feature that verifies if resource locks are applied to the managed cluster resource group during upgrades. Additionally, the command for enabling the undrainable node behavior has been updated to `–undrainable-node-behavior`, providing clearer guidance for users to avoid upgrade blockers. The format for the `–upgrade-override-until` parameter has also been standardized to `yyyy-mm-ddT13:00:00Z`.

The updates to the node auto-drain documentation include new information on handling freeze events, emphasizing the need for opt-in configuration for pod eviction during such events. It also clarifies the actions taken during various scheduled events, including freeze and terminate, and provides links to related features and configurations.

The documentation for Azure Kubernetes Fleet Manager has been updated to clarify that it extends the Kubernetes datapath across clusters, allowing endpoints to communicate directly with full network-policy enforcement and the option to configure global services. Additionally, the section on setting up multi-cluster layer 4 load balancing has been rephrased to "How to: Set up multi-cluster layer 4 load balancing across Azure Kubernetes Fleet Manager member clusters (preview)," providing clearer guidance for users.

The documentation now includes a new tip in the "Configure a static egress gateway" section, highlighting the option to specify the `–vnet-subnet-id` parameter when creating the gateway node pool. This enhancement allows users to allocate the gateway nodes’ private IPs from a custom subnet, improving network isolation and IP address planning for static private IPs used for egress.

The documentation now includes critical updates regarding security vulnerabilities in Azure Kubernetes Service (AKS). Specifically, the Azure Monitor Container Insights add-on is noted to require the `nodes/proxy` permission in Kubernetes versions earlier than 1.33, posing a remote code execution risk; users are advised to upgrade to AKS v1.33 or later to mitigate this risk. Additionally, a local privilege escalation vulnerability affecting the Linux kernel’s `algif_aead` module has been documented, with a recommendation for users to monitor the rollout of a mitigation that prevents the module from auto-loading on affected AKS nodes.

Changed the Azure free account link to the pricing options page, improving user guidance.

The documentation now includes a tip highlighting that users who do not require full control of the NVIDIA GPU Operator can utilize AKS-managed GPU node pools, which automatically install and maintain the NVIDIA driver, Kubernetes device plugin, and DCGM metrics exporter. Additionally, a comparison section has been added to clarify the benefits of using AKS-managed GPU node pools.

The documentation now clarifies that the health monitoring feature for GPU node pools specifically applies to AKS-managed GPU node pools, enhancing user understanding of the scope of the Node Problem Detector (NPD) functionality. Additionally, minor wording adjustments were made for consistency, ensuring that users are aware that NPD monitors the health of the NVIDIA device plugin service in these environments.

Learn CVE API endpoint definitions, request and response schemas, and data models for programmatically accessing vulnerability data for AKS‑managed platform components

Updated the link for creating a free Azure account to a more relevant page. This change improves user guidance for new users looking to set up an Azure subscription.

The documentation now clarifies that the Container Network Insights agent is supported in all Azure public regions where AKS is available, rather than just specific regions like centralus and eastus. This change allows users to deploy the agent in a broader range of Azure regions, enhancing flexibility in their configurations. Additionally, the command examples have been updated to reflect this expanded support.

The documentation now clarifies that the Azure Kubernetes Service (AKS) resource provider manages the client and server apps for Microsoft Entra ID authentication, simplifying the setup process for users. Additionally, it emphasizes that `kubectl` and `kubelogin` are automatically managed and upgraded with the Azure CLI and Azure PowerShell module, eliminating the need for users to run the `az aks install-cli` command.

Updated the content to provide guidance for migrating AWS workloads to Azure, enhancing the documentation’s relevance for users considering migration.

In this article, you learn how to create and manage storage resources for Azure Kubernetes Service (AKS) clusters in the Azure portal.

The documentation for the Azure Kubernetes Application Network has been updated to clarify the prerequisites for both existing and new AKS clusters. Users must now ensure that the Istio-based service mesh add-on is not enabled, and that the AKS-managed Microsoft Entra integration, OIDC issuer, and Managed Kubernetes Gateway API installation are enabled before joining a cluster. Additionally, the command for creating an AKS cluster has been updated to include the `–enable-gateway-api` flag, replacing the previous `–enable-managed-gateway-api` flag.

This update adds a note regarding Azure Portal permissions for adding member clusters, emphasizing that users need Contributor permissions for the resource group where Fleet Manager is deployed. It also clarifies that certain RBAC roles are not supported for Arc-enabled member clusters and specific Kubernetes Custom Resources.

This article provides guidance on updating existing Azure Kubernetes Service (AKS) clusters to utilize newer IP address management (IPAM) modes and data plane technologies, specifically Azure CNI Overlay and Azure CNI Powered by Cilium. It outlines the migration path and necessary steps for successful updates.

The documentation has been updated to clarify the security restrictions for managed system node pools in AKS. Users can now find detailed explanations of the specific restrictions that prevent changes to system resources, interactive access to system pods, and the scheduling of customer workloads on managed system nodes. This enhanced clarity helps users design applications that comply with AKS’s security boundaries and best practices.

Starting in September 2025, Azure Kubernetes Service (AKS) will implement a quota system for all customers, limiting the maximum number of managed clusters that can be created per region. Existing customers will receive a default limit based on their current usage, while new subscriptions will also have a default limit. Users will be able to view their quota limits and usage in the Azure portal and request additional quota, but enforcement of these limits will only begin after the rollout is complete.

The document outlines the steps to configure container network metrics filtering in Azure Kubernetes Service (AKS). It specifies the minimum required versions of Azure CLI and the aks-preview extension, along with the registration of the AdvancedNetworkingDynamicMetricsPreview feature flag.

The documentation now specifies that Azure Kubernetes Fleet Manager is required for setting up layer 4 multi-cluster load balancing, clarifying the role of the Fleet Manager hub cluster. Additionally, the process for distributing the `ServiceExport` resource has been updated to emphasize the use of the Fleet Manager’s resource placement feature, enhancing user understanding of how to manage service awareness across clusters. Users can still create a `MultiClusterService` custom resource to configure load balancing, but the documentation now provides clearer guidance on the prerequisites and processes involved.

The documentation now clarifies that FQDN filtering is not supported with node-local DNS, which may impact users relying on this configuration. Additionally, it specifies that other Layer 7 policies are also not supported, providing clearer guidance on the limitations of current features.

Updated the Azure subscription link to the pricing options page, enhancing clarity for users.

This document provides security vulnerability advisories and mitigation guidance for AKS enabled by Azure Arc. It includes critical security advisories, ongoing investigations, and information on false positives and non-exploitable CVEs, along with a detailed advisory for a local privilege escalation vulnerability (CVE-2026-31431).

Changed the link for creating a free Azure account to a more suitable page, providing better guidance for users.

The documentation now specifies that the Azure region for deployment has changed from "westus" to "westus2," which may affect users’ deployment locations. Additionally, the text clarifies that the output will show specific pods running on a node in the user node pool, enhancing user understanding of the deployment results. Minor wording adjustments were also made for clarity throughout the document.

The documentation for container network metrics in Advanced Container Networking Services for Azure Kubernetes Service (AKS) has been updated to provide a clearer overview of metrics collection and filtering capabilities. Users can now utilize source-level filtering on Cilium clusters to define which namespaces, workloads, and metric types to collect before data leaves the node, enhancing cost efficiency and reducing noise in observability data. Additionally, the section on metrics collection now emphasizes the importance of pod-level metrics for troubleshooting and capacity planning, allowing users to pinpoint network issues at a granular level.

The documentation now clarifies that when scaling to the MaxSurge value is not feasible due to quota or capacity limitations, AKS will automatically attempt a surge of 1 node as a fallback. Additionally, a new section on "Capacity Based Surge" has been introduced, explaining how users can set both MaxUnavailable and MaxSurge values to optimize upgrades based on available capacity, with the requirement of the aks-preview Azure CLI extension to utilize this feature.

The documentation now includes a note that not all VM SKUs are accepted by AKS when creating node pools in specific locations, and that node pool creation will fail if the selected SKU doesn’t support the requested availability zones. Users can check the availability of VM SKUs by using the `az aks list-vm-skus` command, with an example provided for clarity.

The documentation now specifies that the "Ubuntu with containerd and CVM" node image is supported for Ubuntu 20.04 and Ubuntu 24.04, while it is not supported for Ubuntu 22.04. This change clarifies the compatibility of the node images with different Ubuntu versions for users utilizing Confidential VMs.

Updated the key vault update instructions to include a command example, enhancing clarity and usability for users managing their key vaults.

Updated the link for creating a free Azure account to a more relevant page, improving clarity for users without an Azure subscription.

Updated the link for creating an Azure subscription to point to the pricing options page instead of the free account page, enhancing clarity for users.

Updated the link for creating a free Azure account to a more relevant page, improving guidance for users setting up their Azure subscription.

The documentation now includes enhanced details on using member labels to group clusters for update strategies in Azure Kubernetes Fleet Manager, allowing for more flexible and dynamic management of cluster updates. Users can configure `memberSelector` at both the stage and group levels, enabling parallel updates with different concurrency limits. Additionally, the note emphasizes the recommendation to use member labels over update groups for better management of large fleets.

Modified the Azure subscription link to direct users to the pricing options page, enhancing user guidance.

The documentation now specifies that starting May 2025, AKS will dynamically select the default VM SKU and size based on available capacity and quota if the parameter is left blank during deployment. Additionally, the term "system node pool" is now emphasized in the context of hosting critical system pods, and the documentation clarifies that deploying applications to the `kube-system` namespace is not recommended, with a reference to an FAQ for exceptional cases.

Updated the Azure subscription link to the pricing options page, enhancing clarity for users.

The documentation now specifies that when creating a key in the key vault, users must ensure that the `encrypt` and `decrypt` key operations are enabled. This clarification helps users understand the necessary configurations for proper key functionality in KMS data encryption.

Updated the link for creating a free Azure account to a more relevant page, enhancing the onboarding experience for new users.

Changed the Azure subscription link to the pricing options page, improving user guidance.

Clarified the regions where AKS Automatic is available, ensuring users have accurate information on service availability.

The documentation now clarifies that the container network insights agent is only supported in Azure public regions, explicitly stating that it is not available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds. Additionally, users are instructed to verify that their cluster is in an Azure public region rather than just listing specific regions.

Added a new section clarifying that the AKS planned maintenance window does not apply to Azure platform-level maintenance, providing users with important operational information.

The documentation now clarifies that the AKS-ACR integration via the `az aks –attach-acr` command is not supported for ABAC-enabled ACR registries, which require the `Container Registry Repository Reader` role instead of the `AcrPull` role. Additionally, users are advised to pre-create a user-assigned identity to avoid latency issues when granting the `AcrPull` role to Microsoft Entra groups. The article also includes updated commands and examples for both Azure CLI and Terraform, ensuring users can effectively integrate AKS with ACR.

The documentation for the Center for Internet Security (CIS) benchmarks for Ubuntu images used by Azure Kubernetes Service (AKS) has been updated to clarify that the guidance now applies to both Ubuntu 24.04 and Ubuntu 22.04 images. Additionally, the structure of the recommendation table has been expanded to include a new severity level (L2) for stricter security requirements, allowing users to better understand the compliance status and operational impacts of various recommendations.

Updated the Azure subscription link to the pricing options page, enhancing clarity for users.

The documentation for cross-cluster networking has been updated to clarify that Kubernetes Services can be made globally available only when both the Namespace and the Service have specific annotations set to true. Additionally, it now notes that Fleet Manager’s managed Cilium installation requires explicit opt-in for global namespace settings, improving scalability by limiting synchronized resources across clusters. Users can also temporarily remove a Service from a load-balanced global service by adjusting the relevant annotations.

The documentation has been updated to reflect a change in the URL for the Grafana dashboard configuration for the vLLM project, now directing users to the observability section instead of the online serving section. This change ensures that users can access the correct resources for monitoring inference workloads using the `grafana.json` file.

Learn how to view VM SKUs that are available for AKS node pool creation in a specific Azure region.

Updated the link for creating a free Azure account to a more relevant page, enhancing the user experience for new users.

The documentation for container network logs in Azure Kubernetes Service (AKS) has been updated to reflect significant changes in component naming for improved clarity. Users will need to update their Azure CLI and the preview CLI extension, disable and re-enable monitoring, and apply new naming conventions for the `ContainerNetworkLog` custom resource definition (CRD) and associated commands. Additionally, the documentation now emphasizes the importance of using Azure Monitor for log storage to ensure long-term retention and advanced analytics capabilities.

Modified the link for creating a free Azure account to ensure users are directed to the correct resource, improving user experience.

Updated the Azure subscription link to point to the pricing options page, enhancing user experience.

Updated the documentation to reflect the latest changes in DNS load balancing for Kubernetes fleets, ensuring users have the most current information.

The documentation now clarifies that blue-green upgrades for AKS node pools involve adding new _green_ nodes with updated configurations to the existing node pool, rather than creating a separate _green_ pool. Additionally, it specifies that this strategy can be used for updates beyond just Kubernetes and node image versions, such as certificate rotation and kubelet/OS configuration changes. Users are also reminded that they will incur costs for both _blue_ and _green_ nodes during the upgrade process, and the rollback process has been updated to reflect the new terminology and procedures.

The documentation now clarifies that users can opt into Long-Term Support (LTS) for their AKS clusters while still in community support without incurring additional Premium-tier charges until the LTS support window begins. It also specifies that LTS Premium-tier billing starts only after the Kubernetes minor version exits community support, ensuring users are not charged prematurely. Additionally, the examples and commands have been updated for clarity, including the transition to Premium-tier billing and the process for disabling LTS.

The documentation now specifies that users must install Azure CLI version 2.86.0 or later to enable Istio CNI for the Azure Kubernetes Service (AKS). Additionally, users can enable Istio CNI during a new mesh installation by using the `–proxy-redirection-mechanism CNIChaining` parameter, and for existing installations, they can switch to Istio CNI with the command `az aks mesh proxy-redirection-mechanism –mechanism CNIChaining`. Users are also advised to restart their deployments after enabling Istio CNI to ensure pods pick up the changes.

Changed the Azure subscription link to the pricing options page, providing clearer instructions for users.

Updated the link for creating a free Azure account to a more relevant page, enhancing user guidance for new Azure users.

Updated the Azure account link to the pricing options page, providing clearer instructions for users.

The documentation now highlights the option for users to utilize AKS-managed GPU node pools, which allows Azure Kubernetes Service to automatically install and maintain the NVIDIA driver, device plugin, and DCGM metrics exporter. This provides a more streamlined and managed experience for users deploying GPU workloads in AKS.

Modified the Azure subscription link to direct users to the pricing options page, improving user guidance.

Updated the link for creating a free Azure account to a more relevant page, enhancing the clarity of instructions for users.

Updated the reference link for the Azure free account, ensuring users are directed to the correct resource for account creation.

The documentation now highlights that Azure Kubernetes Service (AKS) supports fully managed GPU nodes in preview, which automatically installs and maintains the NVIDIA GPU driver, device plugin, and Data Center GPU Manager metrics exporter. Users can create a managed GPU node pool in a single step by using the `–enable-managed-gpu=true` flag, simplifying the process compared to previous manual installations. Additionally, new parameters `managementMode` and `migStrategy` allow users to control the installation of the GPU stack and configure Multi-Instance GPU strategies during node pool creation.

The documentation for the "Kubernetes on Azure tutorial – Prepare an Application for Azure Kubernetes Service (AKS)" has been updated to clarify the use of the `docker compose down` command instead of the previously mentioned `docker-compose down`. Additionally, the section titles have been standardized to improve clarity, specifically renaming "Docker" and "Azure Developer CLI" sections for consistency. Users can now find clearer instructions and improved section headings throughout the tutorial.

Updated the Azure subscription link to the pricing options page, providing clearer instructions for users.

The documentation for using system node pools in Azure Kubernetes Service (AKS) has been updated to clarify that a production AKS cluster with a single system node pool should ideally have at least three nodes for better fault tolerance. Additionally, users are now informed that they need Azure CLI version 2.31 or later installed and configured, and the Terraform configuration examples have been enhanced to include detailed steps for creating and managing both system and user node pools, including specific commands and configurations.

The documentation now clarifies that configuring HTTPS ingress access to HTTPS services using the `TLSRoute` resource is not supported on Istio service mesh add-on revision `asm-1-29`. It also specifies that support for the `TLSRoute` resource will be available starting with revision `asm-1-30`, providing users with a clearer timeline for when this feature will be accessible.

Updated the link for creating a free Azure account to a more relevant page, enhancing user guidance for new users.

The documentation now specifies that Azure CLI version 2.48.1 or later is required to assign IP addresses from an overlay network or a virtual network, and version 2.69.0 or later is necessary for assigning IP addresses from the node subnet. Additionally, it clarifies that Local Redirect Policy (LRP) is supported from Kubernetes v1.29 and above, and provides updated YAML examples for configuring Cilium Network Policies, including how to allow pod egress to LocalDNS IP addresses.

The documentation now specifies that users can deploy workloads to member clusters using Fleet Manager’s resource placement capability, replacing the previous term "cluster resource placement (CRP)." Additionally, the API version has been updated from `v1alpha1` to `v1`, which may affect how users interact with the Fleet Manager’s API.

The documentation now includes updated tables for `karpenter.azure.com` SKU selectors and `kubernetes.io` well-known labels that can be used in the `spec.requirements` section of the `NodePool` API. Users can now specify additional parameters such as `karpenter.azure.com/sku-series`, `kubernetes.azure.com/cluster`, and `kubernetes.azure.com/mode`, enhancing their ability to define VM characteristics and node configurations more precisely.

The documentation has been updated to clarify the process of selecting clusters for update strategies, now emphasizing the use of member labels as the recommended method for flexibility. Users can apply labels to fleet members using the `az fleet member create` and `az fleet member update` commands, allowing for more precise control over cluster selection in update strategies. Additionally, the structure for creating an update strategy has been enhanced with detailed examples, including the use of `maxConcurrency` settings to manage upgrade speeds across clusters.

The documentation has been enhanced with a new section on fine-grain control over the Application Gateway for Containers’ association subnet with route table rules, including warnings about potential misconfigurations that could lead to asymmetrical routing.

Updated the link for creating a free Azure account to a more relevant page, improving the user experience for new users.

Updated the link for creating a free Azure account to a more relevant page, improving clarity for users without an Azure subscription.

The documentation now clarifies that users can create an AKS cluster without specifying a patch version, which will automatically run the latest GA patch of the specified minor version. Additionally, it highlights the upgrade process for patch versions within the same minor version using the autoupgrade feature. Users should note the updated supported Kubernetes versions and their corresponding components, including the latest versions for cloud-provider-node-manager and coredns.

Updated the Azure subscription link to the pricing options page, enhancing clarity for users.

The documentation now includes a new section on Cross Cluster Networking (Preview), which allows for direct pod-to-pod communication across multiple AKS clusters. This feature enhances east-west connectivity, multi-cluster observability, and security enforcement by utilizing Cilium Cluster Mesh through Azure Kubernetes Fleet Manager, enabling a flat pod network without the need for overlays or gateways. Users can refer to the updated links for more detailed use cases related to this functionality.

The documentation now includes a critical note regarding the `cachingmode` parameter for the target CSI StorageClass. Users are instructed to include the `cachingmode` value in the static PV `volumeAttributes`; otherwise, the Azure Disk CSI driver defaults to `ReadOnly`. This change ensures that users can configure their storage classes more effectively to meet their performance needs.

The documentation now emphasizes the recommendation to use Cilium for Kubernetes-native policies, highlighting its advantages over iptables-based solutions. Additionally, there are corrections in the command syntax for creating a pod and applying a policy file, ensuring users have accurate instructions for executing these tasks.

The documentation for creating an internal load balancer in Azure Kubernetes Service (AKS) has been updated to clarify that users should now add the `LoadBalancerIP` property to the load balancer YAML manifest, which is being deprecated in favor of using service annotations. Additionally, the command examples have been standardized to use `bash` instead of `azurecli-interactive`, enhancing clarity for users executing commands. Users are also reminded that the AKS cluster identity needs permission to manage network resources when using existing subnets or resource groups.

The documentation now specifies that beta APIs are disabled by default when upgrading to Kubernetes version 1.30 and 1.27 LTS versions, which is crucial for users to understand the implications of their upgrade choices. Additionally, the command for confirming a successful upgrade has been corrected to use the proper syntax for the `Get-AzAksCluster` cmdlet.

The documentation now clarifies that AKS supports AMD-based Confidential VMs utilizing AMD SEV-SNP technology, which offers a hardware-based Trusted Execution Environment without requiring code changes. Additionally, it explicitly states that Intel TDX-based Confidential VMs are not currently supported on AKS, providing users with clearer guidance on available options. The default Ubuntu versions for different Kubernetes versions have also been updated for accuracy.

The documentation for Virtual Machine node pools has been updated to clarify that users can now utilize multi-SKU autoscaling, allowing up to five same-family VM SKUs in a single node pool. Additionally, when creating a new node pool, users can include multiple scale profiles, with at least one being a manual or auto scale profile. The requirements for enabling the cluster autoscaler have also been revised to reflect these changes.

Updated the link for creating a free Azure account to a more relevant page, enhancing user guidance for new Azure users.

The documentation now clarifies that virtual networks (VNets) are used for conserving IP address space by employing logically separate Classless Inter-Domain Routing (CIDR) ranges for pods. Additionally, it specifies that overlay networking assigns pod IPs from a separate pod CIDR distinct from the node subnet in the VNet, enhancing scalability. Users can also find improved descriptions of the Azure CNI networking models, including their benefits and limitations.

The documentation now specifies that the supported Kubernetes versions have been updated to 1.33.4 and 1.33.5, replacing the previous versions. Additionally, it clarifies that Windows node pools and GPUs are not supported, providing clearer guidance for users regarding the limitations of the service.

The documentation now specifies that the sample workload can be deployed from the Fleet Manager hub cluster to member clusters using Fleet Manager resource placement, enhancing clarity on deployment methods. Users can still opt to deploy Kubernetes configurations to each member cluster separately, but the updated language emphasizes the role of the Fleet Manager in this process.

New page added.

This article explains how to set up container network logs for Azure Kubernetes Service (AKS), detailing the options for log storage and the benefits of using Azure Monitor for enhanced observability and analytics.

This article provides insights into monitoring correlated GPU metrics to help improve long term GPU node utilization and performance on AKS.

The documentation now provides a clearer focus on how to monitor NVIDIA DCGM GPU metrics on Azure Kubernetes Service (AKS), shifting from a conceptual overview to a practical how-to guide. Users can now create and apply a ConfigMap to enable or disable automatic scraping of GPU metrics by the Azure Monitor managed Prometheus agent, allowing for more control over metric collection. Additionally, the section on monitoring GPU metrics in the Azure portal has been updated to include specific steps for accessing the relevant Grafana dashboard, enhancing user experience in tracking real-time GPU performance.

Changed the Azure free account link to the pricing options page, improving user guidance.

Learn about cross-cluster networking use cases for Azure Kubernetes Fleet Manager (Fleet), including high availability, shared services, and multi-cluster observability across AKS clusters.

The documentation has been updated to reflect the new Helm chart version for the Application Gateway for Containers, changing from version 1.10.26 and 1.10.27 to 1.10.28 across multiple commands. Users should now use the updated version when deploying the Application Gateway for Containers to ensure compatibility and access to the latest features and fixes.

The documentation now clarifies that the Application Gateway for Containers supports mutual TLS (mTLS) for backend targets, enhancing security for users implementing this feature. Additionally, the Static IP address configuration is now available for the Application Routing addon, allowing users to assign a static IP address more effectively. These updates improve the overall functionality and security options for users working with ingress solutions in Azure Kubernetes Service.

The documentation now clarifies that the feature discussed is not compatible with API Server VNet Integration, providing users with important information regarding the limitations of using these features together. This change helps users avoid potential configuration issues when setting up their Azure Kubernetes Service environments.

The documentation now includes updated information on AKS reserved labels, specifically highlighting the deprecation of certain labels such as `kubernetes.azure.com/scalesetpriority` in favor of `kubernetes.azure.com/priority`. Users can now refer to the new table for recommended substitutes for deprecated labels, enhancing clarity on which labels to use for their configurations. Additionally, the example output from the `az aks nodepool list` command has been clarified to improve understanding of node pool statuses.

The document discusses the implementation of FQDN filtering in Azure Container Networking Services (ACNS) and its support through Cilium. It emphasizes resilient policy enforcement and the ability to apply cluster-wide policies using CiliumClusterwideNetworkPolicy.

The documentation now includes important clarifications regarding the impact of disabling Azure Resource Manager (ARM) authentication for Azure Container Registry (ACR) when used with Web Apps. Users are informed that disabling ARM authentication will lead to image pull failures, emphasizing the reliance on ARM-scoped credentials for successful image pulls.

The documentation now clarifies that the application deployment manifest and ingress deployment both declare and mount the provider volume, ensuring that the TLS certificate is only available when the application or ingress controller is deployed. Additionally, users can now bind the certificate to both the application and ingress controller using the `helm install` command, referencing the Secrets Store CSI Driver’s Azure Key Vault provider.

The ALB Controller release notes have been updated to include version 1.10.28, which introduces important security updates. Additionally, version 1.10.27 is noted for a hotfix addressing a pod crash issue, linked to GitHub issue 5758. Users should review these updates to ensure their deployments are secure and stable.

Modified the Azure subscription link to direct users to the pricing options page, improving user guidance.

The documentation now specifies that enabling the Azure Key Vault provider for the Secrets Store CSI Driver on your AKS Cluster involves creating a user identity when you create an AKS cluster, rather than updating an existing one. This clarification helps users understand the process better and ensures they follow the correct steps for identity management in their security model.

Updated the Azure subscription link to the pricing options page, improving clarity for users.

The documentation now includes an important notice that the Confidential Containers preview is set to sunset in March 2026, after which users will experience reduced functionality and will not be able to create new nodes with the `KataCcIsolation` runtime. Users currently utilizing Confidential Container node pools can continue their operations but are encouraged to consider alternative solutions such as Confidential VMs on AKS or Azure Container Instances for future deployments.

The documentation for automatic managed system node pools in Azure Kubernetes Service (AKS) has been updated to reflect changes in the supported regions. Specifically, the region `australiacentral` has been removed from the list of available regions for node pools, which may impact users who were planning to deploy in that region. Users should review the updated list to ensure their deployments align with the current supported regions.

The documentation now clarifies that for .NET, identity bindings support is available in both **Azure.Identity v1.18.0-beta.3** and **Azure.Core v1.55.0** or later, expanding the options for users. Additionally, it emphasizes that the `WorkloadIdentityCredential` identity binding mode is disabled by default, and users must set `WorkloadIdentityCredentialOptions.IsAzureProxyEnabled` to `true` to enable it.

The documentation for using the Cluster Autoscaler in Azure Kubernetes Service (AKS) has been updated to clarify commands and parameters. Users can now find improved instructions for creating and updating AKS clusters with the `az aks create` and `az aks update` commands, including enabling the cluster autoscaler and setting the `cluster-autoscaler-profile`. Additionally, the section on retrieving cluster autoscaler logs has been refined to specify enabling control plane logging for better diagnostics.

The documentation now specifies that multi-instance GPU is supported on NVIDIA A100, H100, and H200 series GPU VM sizes in AKS, expanding the range of supported hardware. Additionally, users can now access a new section on creating managed GPU node pools for a fully managed Multi-Instance GPU experience, which includes automatic installation and maintenance of the NVIDIA driver and related components.

The documentation now includes a new section on migrating from self-hosted open-source Karpenter to managed node auto-provisioning (NAP). Users can follow detailed steps to ensure a smooth transition, including commands to remove specific Helm labels, uninstall the Helm chart, and enable NAP on their cluster. Additionally, important warnings are provided to prevent the accidental deletion of Karpenter CRDs, which could disrupt workloads.

The documentation now specifies that the `microsoft.containernetworkingagent` AKS extension is available in all Azure public regions where AKS is supported, expanding user awareness of its availability. Additionally, it clarifies that the extension is not available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds, which may impact deployment decisions for users in those environments.

The documentation now reflects a schema v2 change, where the configuration for targets is separated into `cluster-metrics` and `controlplane-metrics`, allowing users to manage ingestion volumes for cluster-level and control plane targets independently. Users migrating from v1 should update their configurations accordingly, including changing the key name from ‘default-scrape-settings-enabled’ to ‘default-targets-scrape-enabled’ and removing the "controlplane-" prefix from target names. Additionally, the settings for minimal ingestion profiles have been updated to reflect the new structure, enhancing clarity on how to configure metrics collection.

The documentation now includes guidance for users planning to migrate AWS workloads to Azure, directing them to the "Migrate compute from Amazon Web Services to Azure" section, which features example migration scenarios relevant to their use cases. Additionally, the link for Azure free account information has been updated to provide users with more accurate pricing and purchase options.

Modified the link for creating a free Azure account to direct users to a more appropriate page, improving clarity for new users.

Modified the Azure subscription link to direct users to the pricing options page, improving user guidance.

This document introduces a new feature in Azure Kubernetes Service (AKS) that allows cluster operators to evict sensitive pods before freeze events occur on underlying virtual machines. It details the configuration process for both cluster-level and pod-level settings, including the use of a ConfigMap and specific pod labels for eviction. The document also outlines prerequisites, troubleshooting steps, and related content for effective implementation.

Modified the Azure subscription link to direct users to the pricing options page, improving user guidance.

Updated the link for creating a free Azure account to a more relevant page, improving guidance for users setting up their Azure subscription.

The documentation now includes a note about node image versions in the section on configuring and executing update runs, which provides users with important context regarding compatibility. Additionally, the language has been slightly refined for clarity in the sections about auto-upgrade profiles and the command for generating update runs, ensuring users have a better understanding of the process and its implications.

The documentation now specifies that when creating a key using the `az keyvault key create` command, users must ensure that the `encrypt` and `decrypt` key operations are enabled. Additionally, the link for creating an Azure account has been updated to direct users to a more relevant page regarding pricing and purchase options.

Updated the quickstart guide for creating a fleet and members portal in Azure Kubernetes Service. Added a permissions reference for Azure RBAC Contributor, enhancing clarity on required roles for users.