October 2026 Edition

Welcome to the October 2026 edition of the AKS Newsletter.

This month brings 3 General Availability announcements and 6 new Preview announcements, alongside new NAP capabilities and operational changes. Here are some of the highlights:

• Anyscale on Azure is now generally available
• Managed StandardV2 NAT Gateway for AKS is now generally available
• Node Auto Provisioning (NAP) adds capabilities including Capacity Reservation Groups, node image controls, and Trusted Launch
• Windows node support for Node Auto Provisioning (NAP) enters public preview
• IPv4/IPv6 Dualstack support in Node Auto Provisioning (NAP) managed clusters enters public preview
• Updating node public IP prefixes enters public preview

Let's dive in.

Correction (October 30, 2026): An earlier version incorrectly described NAP and its October enhancements as new GA announcements. NAP's GA was announced in July 2025. The October release notes describe additional capabilities and provisioning changes, now covered below under Behavioral Changes.

✅ General Availability Announcements

• Anyscale on Azure: Anyscale on Azure is now generally available, giving teams a managed platform for Ray-based distributed workloads. For platform engineers supporting AI infrastructure, the key tradeoff is reduced cluster-management overhead versus operating Ray directly.

• Managed StandardV2 NAT Gateway for AKS: AKS now provisions and manages StandardV2 NAT Gateway for clusters using an AKS-managed virtual network. It becomes the default for new clusters using managedNATGateway in supported regions, so review egress infrastructure assumptions before creating clusters.

• Identity bindings: Identity bindings are now generally available, extending workload identity to address federated identity credential limits on user-assigned managed identities. This matters for platforms sharing Azure identities across many workload trust relationships, where credential limits otherwise constrain identity design.

🧪 Preview Feature Announcements

• Windows node support for Node Auto Provisioning (NAP) (preview): NAP now supports Windows nodes in preview, extending automated capacity provisioning to Windows workloads. For mixed-OS clusters, validate Windows scheduling constraints and provisioning behavior before expanding adoption.

• IPv4/IPv6 Dualstack support in Node Auto Provisioning (NAP) managed clusters (preview): NAP-managed clusters now support IPv4/IPv6 dual-stack networking in preview. Teams adopting IPv6 can evaluate it alongside automated node provisioning, with address planning and workload connectivity worth testing together.

• Updating node public IP prefixes (preview): Existing node pools can now have their node public IP prefixes updated in preview across public Azure regions. This adds flexibility when public IP allocations change, but firewall allowlists and dependencies on existing node addresses need careful coordination.

• Converting AKS Base clusters to AKS Automatic (preview): Conversion from AKS Base to AKS Automatic is now available in preview for clusters with managed system node pools. This provides a migration path for existing clusters; evaluate Automatic’s operational constraints against your current configuration before converting.

• Ubuntu 26.04 (preview): Ubuntu 26.04 is now available in preview on AKS, using Ubuntu Minimal as the baseline image for Kubernetes 1.36 and later. Audit node-level agents and bootstrap scripts for dependencies on preinstalled packages before testing the new image.

• Windows Server OS SKU migration (preview): AKS now supports migrating from Windows Server 2022 to Windows Server 2025 in preview. Treat this as a workload compatibility change, not just OS maintenance: validate Windows container image compatibility and node-level tooling before migration.

🔁 Behavioral Changes

• New NAP capabilities: October's release notes add capabilities to NAP, which was already generally available: Capacity Reservation Groups, the Capacity Buffers CRD for surplus nodes, osDiskType selection, node image pinning and Kubernetes version selection, Trusted Launch, Azure Container Linux, and managed GPU nodes. Review the controls relevant to your node lifecycle and workload requirements; this is an update to NAP, not a new GA announcement for the service.

• NAP provisioning changes: NAP adds instance-level public IP configuration and an AKS-managed aksmanagednap node pool, avoids VM SKUs within about six months of retirement, and changes default OS disk sizing and ephemeral disk eligibility checks. It also respects external load balancer exclusions when adding nodes. Review VM size retirement guidance and the Azure Karpenter provider issue for supporting context before evaluating the impact on existing provisioning policies.

• Istio Gateway API ConfigMap customization: Gateway customization now supports Service spec.ports and Deployment seccomp profiles for the Istio add-on and Application Routing with Istio. This gives platform teams explicit control over exposed ports and gateway container hardening.

• Istio-based service mesh add-on: The add-on now intercepts both IPv4 and IPv6 workload traffic on dual-stack clusters. Restart existing workloads after the update to apply the new proxy configuration and avoid leaving IPv6 traffic outside mesh interception.

• Application Routing Gateway API: The controller now runs on the managed system node pool in AKS Automatic clusters, strengthening control-plane and data-plane isolation. Account for this placement when troubleshooting controller scheduling and availability.

• AKS Automatic: On Kubernetes 1.36+, protected system namespaces are excluded from customer mutating admission configurations. Customer webhooks and policies can still mutate customer workloads, but platform teams must stop relying on them to modify AKS-managed system workloads.

• Platform-managed keys for etcd encryption: New clusters on Kubernetes 1.37+ enable platform-managed keys for etcd encryption by default unless infrastructure encryption is explicitly configured. Review provisioning templates and compliance checks so they reflect the new encryption baseline.

• Azure Policy for Kubernetes: Policies can now explicitly opt into evaluating DELETE operations, extending admission controls to resource removal. Existing policies do not enforce deletes automatically; review exemptions and cleanup workflows before enabling deletion restrictions.

• Flatcar preview retirement: Flatcar Container Linux node images have been removed, causing scaling, reimage, and redeploy operations to fail for affected pools. Migration to a supported node OS is now an operational requirement, not just lifecycle housekeeping.

• Cloud Provider Azure release notes: On Kubernetes 1.37, external LoadBalancer Services with invalid or non-public load balancer IP addresses now fail validation early. Check Service manifests and deployment templates rather than troubleshooting public IP lookup failures downstream.

• Cloud Provider Azure 1.36.6: The service.beta.kubernetes.io/azure-pip-tags annotation no longer overrides controller-managed public IP tags, including cluster, Service, and DNS-label ownership tags. Reserved keys are ignored case-insensitively and emit an IgnoredPIPTagKeys warning; remove those overrides from manifests.

• Platform support grace period: Starting June 1, 2027, AKS will automatically upgrade clusters that remain on unsupported Kubernetes versions after their 60-day platform support grace period expires. Treat that deadline as an upgrade boundary, not an indefinite extension.

• Platform-initiated upgrades: AKS is introducing platform-initiated upgrades to move clusters off unsupported Kubernetes versions. Review upgrade channels, maintenance windows, and workload readiness before enforcement begins; postponing a planned upgrade will no longer prevent a platform-triggered one.

• Upgrade the OS version for your AKS node pools: Starting with Kubernetes 1.38, the Ubuntu OS SKU defaults to Ubuntu 26.04. Explicitly select Ubuntu2404 to retain Ubuntu 24.04, and validate OS-sensitive workloads before accepting the new default.

• Windows Server 2022 retirement: Windows Server 2022 is unsupported on Kubernetes 1.37 and later. Plan a move to a supported Windows node OS before crossing that Kubernetes version boundary, with application compatibility checks included in the upgrade rollout.

🔎 Documentation Updates

• Configure dual-stack networking: Updated NAT Gateway guidance for dual-stack clusters. Validate the documented outbound networking constraints before assuming IPv4 and IPv6 traffic can use the same egress design.

• Configure NAP disruption policies: Corrected the weekend-only disruption budget example. Teams restricting voluntary node disruption to maintenance windows should check their policies against the revised configuration.

• Configure the Istio-based service mesh add-on: Clarified which MeshConfig fields are configurable in the managed add-on. Treat that supported configuration surface—not upstream Istio capabilities—as the boundary for mesh customization.

• Configure multiple ingress controllers and NGINX annotations: Clarified that managed NGINX ingress does not provide tenant isolation by namespace. Separate namespaces alone are not a sufficient security boundary for a shared ingress deployment.

• Configure NAP node pools: Updated the default node pool documentation to match what AKS actually deploys. This gives platform teams a more reliable baseline before tuning provisioning constraints, limits, and pool weights.

• AKS security bulletins: The bulletin index received review-driven revisions; the supplied change summary identifies no new vulnerability or remediation. Use the individual advisories to determine exposure and required action rather than treating an index edit as a security event.

• Istio add-on support policy: Added asm-1-31 and moved asm-1-29 end of life to December 2026. Update mesh upgrade schedules against these revision-specific deadlines rather than assuming the Kubernetes lifecycle covers them.

• Supported Kubernetes versions: Added preview and general availability dates for Kubernetes 1.38 on AKS. These dates help separate early compatibility testing from production upgrade planning.

• Migrate application routing from Ingress-Nginx to Gateway API: Expanded the initial discovery step to identify multiple Ingress resources. Inventory every route before migration; overlooking a secondary ingress can leave traffic behind during cutover.

• AKS cluster extensions: Updated the extension catalog with Kueue and Azure Monitor information. Check the managed extension options before committing to a self-managed deployment and its associated lifecycle burden.

• Secure pod traffic with network policies: The reported revision reverts unrelated Markdown formatting rather than changing network policy behavior. Namespace boundaries still need explicit traffic controls where workload isolation is required.

• Persistent volumes with Azure Files: The Azure Files CSI guidance received an authoring revision, with no storage behavior change identified in the supplied summary. For shared persistent storage, the engineering decision remains whether file-share semantics and access requirements fit the workload.

• Persistent volumes with Azure Disks: The Azure Disk CSI guidance received an authoring revision, with no functional change identified in the supplied summary. Disk-backed volume planning still needs to account for workload placement and attachment requirements—not just requested capacity.

• Install Kueue on AKS: Installation guidance received review-driven revisions and covers both the managed Kueue extension and the upstream Helm chart. Choose deliberately: the installation path determines how much component lifecycle management your platform team owns.

• Configure managed Kueue queues with default workload priority: Documents queue configuration using automatically generated resource flavors and default workload priority classes. This reduces configuration overhead, but queue quotas and admission priorities still need to reflect how teams should share scarce capacity.

• Run Ray AI workloads with Kueue: Added a direct reference to managed Kueue installation from the Ray workload guidance. Establish admission control before submitting competing AI workloads; queueing is a capacity-management decision, not just an installation detail.

• Bin-pack nodes with scheduler profiles: Removed the preview designation from the bin-packing guidance. Denser placement can reduce idle capacity, but evaluate the tradeoff against workload contention and failure concentration before changing scheduling behavior.

• AKS monitoring data reference: Corrected announcement content in the monitoring reference; the supplied summary identifies no metric or schema change. Use the reference to verify available signals before building alerts, rather than interpreting the announcement edit as new telemetry.

• Azure CNI Pod Subnet networking concepts: Refreshed following documentation review, covering dynamic IP allocation and static block allocation. Compare their address-allocation models against expected pod growth before sizing subnets; IP planning can become a hard scaling constraint.

• Monitor AKS: Removed the outdated preview label from AKS control plane metrics monitoring to reflect general availability. Teams that deferred adoption over preview status should reassess it for control plane visibility.

• Enable FIPS for AKS node pools: Added Azure Linux (ACL) version requirements to the FIPS guidance. Verify the supported OS version before selecting a node image; enabling FIPS is not a substitute for meeting the documented platform prerequisites.

• Create an AKS-managed GPU node pool: Removed the documented cluster autoscaler exclusion for managed GPU node pools. Revisit designs that assumed fixed GPU capacity, while accounting for GPU availability and provisioning latency in scaling expectations.

• Configure AKSNodeClass resources for NAP: Completed the LocalDNS configuration block in the comprehensive AKSNodeClass example. This provides a clearer reference for carrying DNS configuration into automatically provisioned nodes.

• Prepare a flex node host and identity (preview): Updated the host requirements for AKS flex nodes. Revalidate candidate Linux hosts against those prerequisites before configuring identity and cluster access; attachment preparation cannot compensate for an unsupported host.

• Pod sandboxing on AKS: Removed an obsolete feature-registration step from the deployment guidance. Update provisioning automation accordingly so stronger workload isolation does not depend on a stale prerequisite.

• Trusted Launch on AKS: Added a NAP-specific note to the Trusted Launch guidance. Check that qualification before assuming automatically provisioned nodes inherit the boot protections expected by your security baseline.

📚 Community Blogs

• Reducing AKS cold starts with Prepared Image Specification: Prepared Image Specification targets the image and runtime preparation delays that leave newly provisioned nodes unable to serve traffic. Worth evaluating when large images make autoscaling too slow and keeping spare capacity becomes an expensive workaround.

• Announcing StandardV2 NAT Gateway for AKS-managed egress: StandardV2 NAT Gateway is generally available for AKS-managed egress: with API version 2026-06-01 or later, new clusters using managedNATGateway receive StandardV2 where available and Standard elsewhere. Platform teams should account for that regional difference rather than assume identical egress infrastructure across deployments.

• AKS Pod Scheduling Demystified: Breaks down pod placement in AKS, where apparently available cluster capacity does not necessarily mean a workload can be scheduled. A useful engineering lens for distinguishing resource shortages from placement constraints before adding more nodes.

• GPU Memory Profiling on AKS: Find the Code Behind Memory Pressure: Focuses on tracing GPU memory pressure back to application code rather than treating it solely as an infrastructure capacity problem. That distinction matters when the alternatives are shrinking workloads, buying larger GPUs, or repeatedly restarting jobs without addressing the cause.

• Multi-NIC Support on AKS powered by DRANET – Now in Public Preview: DRANET-powered multi-NIC support enters public preview, addressing networking requirements that previously required manually integrating multiple components. Relevant for workloads needing multiple network interfaces, but preview status makes compatibility and operational validation essential before production adoption.

• Public Preview: Onboard Kubernetes Clusters to Azure Arc with the Multicloud Connector: The Multicloud Connector preview provides a path to onboarding Kubernetes clusters into Azure Arc, making them Azure resources eligible for centralized governance and security management. The practical value is extending consistent controls, including Azure Policy for Kubernetes, across a mixed cluster estate.

• GitOps with Argo CD extension for AKS is Now Generally Available: The Argo CD extension for AKS reaches general availability, providing an extension-based option for adopting Argo CD GitOps workflows. For platform teams standardizing deployment reconciliation, this is a useful point to reassess extension lifecycle management versus maintaining their own installation.

• When AI Starts Taking Action: Building Execution Boundaries with OpenSandbox and AKS: Examines execution boundaries for action-taking AI using OpenSandbox and AKS. The engineering priority is treating agent-generated execution as a separate trust boundary, with deliberate limits on permissions, resource consumption, and access to surrounding services.

🔗 Releases and Roadmap

• AKS GitHub Releases: The source of record for AKS release notes, component updates, and retirement notices. Check regional rollout status before assuming an announced change is available in your clusters.
• AKS Public Roadmap: Track planned AKS capabilities and their delivery status to inform platform engineering priorities. Treat roadmap entries as planning signals, not availability guarantees.

Release Highlights

• Release 2026-10-25: Announces automatic upgrades starting June 1, 2027, for clusters that remain on unsupported Kubernetes versions beyond the 60-day platform support grace period. Review upgrade channels, maintenance windows, and workload readiness now—leaving clusters unsupported will no longer defer upgrades indefinitely.

• Release Notes 2026-09-25: Announces automatic migration of deprecated Availability Sets (VMAS) clusters to Virtual Machines node pools starting September 30, 2026, and flags that Windows Server 2022 is unsupported on Kubernetes 1.37 and later. Verify migration status for legacy clusters and account for Windows OS compatibility before scheduling Kubernetes upgrades.

🎥 Watch & Learn

• AKS Community Calls - October 2026: October’s community call offers a checkpoint for reviewing AKS updates against your platform roadmap. Prioritize changes that need validation in your environment over announcements that do not affect your operating model.

• Introducing AKS Multi-NIC with DRANET: Now in public preview, AKS Multi-NIC with DRANET gives pods multiple network interfaces and manages network devices as first-class Kubernetes resources. Worth evaluating for workloads that need distinct network paths, but preview status makes production readiness and operational tooling important adoption gates.

🧠 Closing Thoughts

October 2026 brought 3 GA announcements and 6 preview announcements, plus capabilities and provisioning changes for the already generally available NAP service.

The strongest threads in this edition were Networking capabilities, Observability and monitoring, Security and identity, AI and GPU workloads, Scaling and node management, and Storage.

The supporting coverage spans behavioral changes, documentation improvements, community perspectives, and hands-on videos, giving platform teams both the product changes and the context to act on them.

Use this edition as a starting point for reviewing the changes most relevant to your AKS environments before the next monthly update.