AKS Newsletter https://aksnewsletter.com Monthly curated updates on Azure Kubernetes Service — docs, features, blogs, releases, and more. en-us AKS Newsletter – June 2026 https://aksnewsletter.com/2026/2026-06.html https://aksnewsletter.com/2026/2026-06.html Sun, 28 Jun 2026 00:00:00 GMT 65 curated items covering documentation updates, feature announcements, community blogs, and more. Welcome to the June 2026 edition of the AKS Newsletter.

This month brings 7 features reaching General Availability and 2 new Preview announcements. Here are some of the highlights:

  • Generally available: Managed system node pools in AKS Automatic is now generally available
  • Application Gateway for Containers is now generally available
  • Ubuntu 22.04 node pools with FIPS 140-3 compliance is now generally available
  • Anyscale on Azure enters public preview
  • Application Gateway for Containers – Inference gateway enters public preview

Let's dive in.

✅ General Availability Announcements

  • Generally available: Managed system node pools in AKS Automatic: Managed system node pools are now generally available, simplifying the operational overhead of scaling, patching, and maintaining system-critical workloads. This feature ensures higher availability and reduced manual intervention for platform engineers.

  • Application Gateway for Containers – now generally available: Application Gateway for Containers is now fully supported, offering a managed ingress solution tailored for containerized workloads. This enables advanced traffic routing, SSL termination, and security features directly integrated with AKS.

  • Ubuntu 22.04 node pools with FIPS 140-3 compliance – now generally available: Ubuntu 22.04 node pools with FIPS 140-3 compliance are now GA, providing enhanced security for workloads requiring strict cryptographic standards. This is particularly relevant for regulated industries like finance and government.

  • Managed GPUs – now generally available: Managed GPU support in AKS is now generally available, enabling seamless provisioning and scaling of GPU-enabled node pools. This is a game-changer for teams running AI/ML workloads or other GPU-intensive applications.

  • Confidential VMs (CVM) – now generally available: Confidential VMs are now GA on AKS with Azure Linux, offering hardware-based encryption to protect data in use. This is a critical feature for organizations prioritizing data confidentiality and compliance.

  • Windows Server 2025 – now generally available: Windows Server 2025 is now supported in AKS, allowing teams to modernize their Windows-based applications while leveraging the latest OS features. This ensures better performance, security, and compatibility for Windows containers.

  • Azure Container Linux – now generally available: Azure Container Linux is now a GA OS option for AKS starting with version 1.34. This lightweight, secure, and optimized Linux distribution is tailored for containerized workloads, offering a streamlined experience for AKS users.

🧪 Preview Feature Announcements

  • Public Preview: Anyscale on Azure: Introduces a managed Ray platform for scaling Python-based machine learning workloads in the cloud. This preview empowers engineers to handle massive computational tasks with improved speed and control, making it a game-changer for AI-driven applications.

  • Public Preview: Application Gateway for Containers – Inference gateway: Expands the Application Gateway for Containers with AI inference capabilities, enabling seamless integration of machine learning models into containerized applications. This enhancement simplifies deploying and scaling AI-powered services in Kubernetes environments.

🔁 Behavioral Changes

  • Istio Service Mesh with Gateway API: Clusters running Kubernetes 1.36 or later can now disable the default application routing add-on with Gateway API to use the Istio-based service mesh add-on with Istio CNI. This provides flexibility for teams adopting Istio while maintaining control over their networking setup.

  • Deployment Safeguards: Enforce mode now applies default resource requests to DaemonSets and Jobs when those requests are missing, in addition to Deployments and StatefulSets. Additionally, with Pod Security Standards set to Baseline, pods on Automatic clusters can now read /var/log and /hostfs hostPath volumes (read-only), supporting log exporter scenarios while maintaining security.

  • Custom Prometheus Metric Scraping: Now supports metric scraping and log collection on AKS Automatic clusters using managed system node pools. This enhances observability for teams leveraging Prometheus in managed environments.

  • Azure CNI Static Block Allocation: VnetScale clusters no longer require explicit pod CIDR configuration. This simplifies network setup and reduces configuration errors for large-scale deployments.

  • Windows gMSA: Now validates CoreDNS configurations for conflicts when using group-managed service accounts. This ensures smoother integration and prevents runtime issues.

  • Pod Sandboxing (Kata): Pod sandboxing is now supported for workload runtime node pools, and node pools using Standard_DadsV7-series VM sizes are now available (resolving previous nested-virtualization validation issues). This expands both the isolation scope and hardware options for teams adopting Kata containers.

  • AKS Automatic: Managed system node pools are now available under the AKS Base SKU. This streamlines cluster management for teams leveraging AKS Automatic.

  • Istio CNI: Istio CNI integration now supports advanced networking features, enabling seamless service mesh deployment with enhanced network security and performance.

  • Migration Guide: Updated to provide detailed steps for migrating workloads to supported Windows Server versions. Essential for teams preparing for upcoming OS retirements.

  • Windows Server 2019 Retirement Guide: Comprehensive guidance on transitioning from Windows Server 2019, which is approaching its end-of-support date. A must-read for teams running legacy Windows workloads.

  • Azure Container Linux for AKS: Introduces a migration path to Azure Container Linux for AKS users. This is a significant update for teams looking to adopt a modern, secure, and optimized container OS.

  • Managed System Node Pools: Now generally available for AKS Automatic clusters. This feature simplifies operations by offloading node pool management to Azure.

  • LocalDNS: LocalDNS is now set to Required by default for new node pools in Automatic clusters. This change improves DNS resolution performance and reliability for Kubernetes workloads.

  • Edit the excludedNamespaces Field for Deployment Safeguards: Teams can now control which policies apply to specific namespaces on Automatic clusters by editing the excludedNamespaces field. This provides greater flexibility in policy enforcement.

  • Upstream Deprecation of Service externalIPs: Kubernetes has announced the deprecation of Service externalIPs in version 1.36. Platform engineers should evaluate their reliance on this feature and plan for alternative solutions.

🔎 Documentation Updates

📚 Community Blogs

🔗 Releases and Roadmap

  • AKS GitHub Releases: Stay updated with the latest AKS release notes, including new features, bug fixes, and security updates.
  • AKS Public Roadmap: Track upcoming features and enhancements planned for AKS, helping you align your infrastructure roadmap with Azure's development plans.

Release Highlights

  • Release - 2026-06-19: This release includes updates to five core components and addresses two critical CVEs. Platform engineers should review the CVE details to ensure their clusters remain secure and compliant.

  • Release - 2026-05-29: Packed with 14 CVE remediations, this release underscores Microsoft's commitment to security. Teams should prioritize upgrading to safeguard their workloads against known vulnerabilities.

Announcements

  • Windows Server 2022 Retirement Extended: The retirement date for Windows Server 2022 has been extended to June 30, 2028. After this date, AKS will cease producing new node images and security patches, and new node pools with this OS version will no longer be supported. Plan migrations to supported OS versions to avoid operational risks.

  • Istio Service Mesh Add-On Deprecation: Revision asm-1-27 of the Istio-based service mesh add-on is now deprecated. Upgrade to revision 1.28 or later using the Istio add-on upgrade guide to maintain support and access to the latest features.

  • Windows Server Annual Channel Retirement: Support for Windows Server Annual Channel for Containers on AKS ended on May 15, 2026. The final image (5B) is the last release for this channel. Transition to supported alternatives to ensure continued functionality and security.

🎥 Watch & Learn

🧠 Closing Thoughts

June 2026 showed continued investment across key areas of the AKS platform:

  • Networking capabilities
  • AI and GPU workloads
  • Scaling and node management

These updates reflect the platform's ongoing focus on production readiness, operational simplicity, and support for modern cloud-native workloads.

Stay tuned for next month's edition, and feel free to share feedback or suggestions for future coverage.

]]> AKS Newsletter – May 2026 https://aksnewsletter.com/2026/2026-05.html https://aksnewsletter.com/2026/2026-05.html Thu, 28 May 2026 00:00:00 GMT 70 curated items covering documentation updates, feature announcements, community blogs, and more. May was a packed month for AKS — headlined by a critical kernel CVE, a major shift away from Ingress NGINX, and strong momentum in GPU/AI observability. The platform continues to mature in networking, upgrade safety, and multi-cluster operations. This edition also features a full KubeCon EU 2026 Azure Pre-Day recap.

Let's dive in.

✅ General Availability Announcements

  • Application routing add-on with Gateway API – now generally available: The application routing add-on using the Kubernetes Gateway API is now GA. This is the strategic replacement for the legacy Ingress NGINX-based routing in AKS and aligns with the upstream retirement of the Ingress NGINX project. Teams should plan migration paths from Ingress to Gateway API.

  • AKS GitHub issue tracking – now generally available: The consolidated AKS issue tracking on GitHub is now the official channel for bug reports and feature requests. This provides a single, transparent backlog that platform teams can follow and upvote.

🧪 Preview Feature Announcements

  • Application Gateway for Containers managed add-on + AKS Automatic: Application Gateway for Containers is now available as a managed add-on integrated with AKS Automatic clusters. This gives teams a turnkey L7 ingress solution with native Azure integration, without needing to manage the ALB controller lifecycle separately.

  • NAT Gateway V2: The next generation of NAT Gateway enters preview for AKS clusters using managed outbound. It improves scalability and reliability for SNAT-heavy workloads and addresses known limitations in the original NAT Gateway architecture.

  • AKS List Available VM SKUs API: A new API allows querying which VM SKUs are available for node pool creation in a given region. This is useful for platform automation that needs to validate capacity and VM family availability before provisioning.

  • AKS-managed GPU metrics: GPU metrics (utilization, memory, temperature) are now collected by default in Azure Managed Prometheus when GPU node pools are present. This removes a long-standing operational gap where teams had to deploy custom exporters to get GPU observability.

  • Capacity Based Surge for node pool upgrades: A new surge strategy that adapts to available capacity during rolling upgrades. Instead of a fixed surge count, AKS will maximize the use of available quota, improving upgrade speed in constrained environments.

🔁 Behavioral Changes

  • AKS Automatic defaults to Gateway API: AKS Automatic clusters will now be preconfigured with the Kubernetes Gateway API via the application routing add-on, replacing Managed NGINX Ingress as the default. This is a direct consequence of the upstream Ingress NGINX retirement and affects all new AKS Automatic clusters.

  • Azure Kubernetes Application Network (preview): A new unified networking layer is being introduced for Kubernetes workloads on Azure. This consolidates ingress, egress, and service-to-service networking under a single umbrella, signaling a longer-term convergence of networking primitives.

  • CVE-2026-31431 – kernel local privilege escalation: A critical kernel vulnerability ("Copy Fail") allows any pod — including non-root pods with no special capabilities — to escalate to root on the underlying node. All AKS Linux nodes are affected until a node image upgrade or DaemonSet mitigation is applied. Immediate action required.

  • Ingress NGINX upstream retirement: Kubernetes SIG Network and the Security Response Committee announced the retirement of the Ingress NGINX project, with maintenance ending in March 2026. AKS teams still using Ingress NGINX should migrate to Gateway API or Application Gateway for Containers.

  • Long Term Support scope updated: The LTS documentation was refreshed to clarify version coverage and support timelines. Teams relying on LTS versions should review the updated lifecycle boundaries.

🔎 Documentation Updates

  • Best Practices for Cost Optimization: This guide was refreshed with current recommendations for AKS cost optimization, including guidance on AKS Automatic's built-in cost controls, FinOps practices, spot node pools, and autoscaler tuning. Directly relevant for teams reviewing cluster spend.

  • Configure rolling upgrades for node pools: Updated with the new Capacity Based Surge option and clearer guidance on drain timeout, soak time, and max-unavailable settings. Critical reading for teams managing large node pools with strict SLA requirements.

  • Application routing add-on with Gateway API: Refreshed to reflect GA status and include migration guidance from legacy Ingress NGINX. This is the primary reference for teams adopting Gateway API on AKS.

  • GPU Node Partitioning Strategies: Updated to cover AKS-managed MIG (multi-instance GPU) and time-slicing with MPS using the NVIDIA GPU Operator. Important for teams running inference or training workloads that need to share expensive GPU hardware efficiently.

  • Confidential Containers overview: Refreshed with current deployment guidance and security model details for running workloads inside encrypted, attestation-backed enclaves on AKS. Relevant for regulated industries handling sensitive data.

  • Upgrade Options and Recommendations: A new consolidated guide covering in-place upgrades, blue-green strategies, and scenario-based recommendations for common upgrade challenges. Helps teams pick the right upgrade approach for their risk profile.

  • Node Auto-Provisioning (NAP): Updated with current CLI and ARM template examples for enabling and disabling NAP. Important for teams using Karpenter-based provisioning at scale.

  • Advanced Container Networking Services overview: Refreshed to reflect the GA of metrics filtering and log aggregation features. This is the umbrella documentation for ACNS capabilities including Container Network Observability and Security.

  • Migrate from in-tree storage to CSI drivers: Updated migration guidance for moving from deprecated in-tree storage drivers to CSI. Clusters still using in-tree will face removal in upcoming Kubernetes versions.

  • List Available VM SKUs (Preview): New documentation for the VM SKU availability API, explaining how to query region-specific SKU constraints before provisioning node pools programmatically.

  • Istio service mesh add-on support policy: Refreshed to clarify supported Istio versions, upgrade expectations, and the boundary between managed and self-managed Istio components on AKS.

  • Node Images: Updated with current node OS image options including Ubuntu 24.04, Azure Linux, and Flatcar. Helps teams understand the tradeoffs between OS choices.

  • Confidential VMs (CVM): Updated guidance on creating CVM-backed node pools for workloads requiring hardware-level memory encryption and attestation.

  • Vulnerability Data API: New documentation for the AKS Vulnerability Data API, which provides programmatic access to CVE impact data for security reviews, compliance reporting, and upgrade planning.

  • Virtual Machines Node Pools: Updated to explain how to mix multiple VM types of the same family in a single node pool, improving flexibility for heterogeneous workloads.

  • Cluster Autoscaler: Refreshed with current best practices for autoscaler profiles, scale-down behavior, and integration with pod disruption budgets.

  • Upgrade the Control Plane: Updated with current guidance on control plane upgrade sequencing, API compatibility, and rollback options.

  • Supported Kubernetes Versions: Updated version table reflecting current GA and preview Kubernetes releases available in AKS, including LTS eligibility.

  • Long-Term Support Versions: Refreshed to reflect current LTS version coverage and extended support timelines.

  • Entra ID Authentication for the Control Plane: Updated integration guide for using Microsoft Entra ID as the identity provider for Kubernetes API server authentication. Important for teams enforcing centralized identity and conditional access policies.

  • Azure Key Vault Provider for Secrets Store CSI Driver: Refreshed with current configuration examples and best practices for injecting secrets from Key Vault into pods without application-level SDK changes.

  • System Node Pools: Updated with current sizing guidance and taint configuration to properly isolate system workloads from application pods.

  • Ingress Networking Concepts: Refreshed to reflect the Ingress NGINX deprecation and the shift toward Gateway API as the recommended ingress pattern.

  • Network Policies: Updated with current guidance on Azure Network Policy Manager and Cilium-based network policies for securing pod-to-pod traffic.

  • Update Azure CNI IPAM Mode and Data Plane: Updated guidance for migrating existing clusters to newer Azure CNI IPAM modes (overlay, dynamic IP allocation) and data plane technologies.

  • CNI Networking Concepts: Refreshed to reflect current CNI options including Azure CNI Overlay, Azure CNI with dynamic IP, and kubenet deprecation path.

  • AKS Core Concepts: Refreshed foundational documentation covering cluster architecture, node pools, networking, and identity fundamentals.

📚 Community Blogs

🔗 Releases and Roadmap

Release Highlights

  • Release 2026-04-28: This release includes Kubernetes patch versions 1.35.2 and 1.33.9, along with 2 CVE remediations. A maintenance release focused on security patching.

🎥 Watch & Learn

🧠 Closing Thoughts

May 2026 was dominated by a security imperative and a networking transition:

  • CVE-2026-31431 forced immediate action across all AKS Linux nodes, and Fleet Manager proved its value for multi-cluster remediation at scale
  • Gateway API reaching GA while Ingress NGINX enters retirement marks a clear inflection point — teams still on Ingress NGINX should be actively planning migration
  • GPU observability and AI inference continue to mature, with managed metrics, Dynamo-based autoscaling, and model weight distribution solving real operational pain
  • KubeCon EU 2026 Azure Pre-Day provided a concentrated view into AKS's 2026 strategy across networking, AI, sovereignty, and hybrid

For platform teams, the immediate priorities are clear: patch CVE-2026-31431, plan the Gateway API migration, and evaluate the new GPU metrics if running inference workloads.

]]> AKS Newsletter – April 2026 https://aksnewsletter.com/2026/2026-04.html https://aksnewsletter.com/2026/2026-04.html Tue, 28 Apr 2026 00:00:00 GMT 71 curated items covering documentation updates, feature announcements, community blogs, and more. April was a big month for AKS. Ten features hit General Availability, two new previews landed, and the community shipped an impressive volume of practical content — from AI inference on Arc-enabled clusters to securing Argo CD with Entra ID. There was also a notable set of behavioral changes that platform teams should review before their next upgrade cycle.

This month brings 10 features reaching General Availability and 2 new Preview announcements. Here are some of the highlights:

  • Disable HTTP proxy in AKS is now generally available
  • Azure Monitor for Azure Arc-enabled Kubernetes with OpenShift and Azure Red Hat OpenShift is now generally available
  • Configure AKS backup using a single Azure CLI command is now generally available
  • StandardV2 NAT Gateway as an outbound type for AKS enters public preview
  • NAT Gateway V2 enters public preview

Let's dive in.

✅ General Availability Announcements

  • Generally Available: Disable HTTP proxy in AKS: Organizations that use HTTP proxies to control outbound traffic can now remove or modify those settings on running clusters without recreation. This was a long-standing pain point — previously, changing proxy configuration required rebuilding the cluster, which is disruptive and operationally expensive. This GA release directly reduces operational friction for enterprise environments with evolving network requirements.

  • Generally Available: Azure Monitor for Azure Arc-enabled Kubernetes with OpenShift and Azure Red Hat OpenShift: Azure Monitor now fully supports monitoring Azure Arc-enabled Kubernetes clusters running OpenShift and Azure Red Hat OpenShift. This closes an observability gap for hybrid environments — teams running mixed AKS and OpenShift clusters can now use a single monitoring plane with consistent metrics, logs, and alerts across all their Kubernetes infrastructure.

  • Generally Available: Configure AKS backup using a single Azure CLI command: Azure Backup now provides a one-command CLI experience for configuring AKS cluster backup. Previously, setting up backup required multiple steps across different Azure services. This simplification makes it much more likely that teams will actually enable backup as part of their standard cluster provisioning workflow rather than treating it as an afterthought.

  • MIG (multi-instance GPU) profiles – now generally available: Multi-instance GPU partitioning is now GA on AKS agent pools, enabling H100 GPUs to be partitioned into smaller instances (MIG1g through MIG7g). This is a significant cost optimization for AI and ML workloads — instead of dedicating an entire H100 to a single workload, teams can now share GPU resources across multiple tenants or smaller inference jobs, dramatically improving GPU utilization.

  • StorageClass – now generally available: AKS 1.35 clusters in supported regions now ship with built-in StorageClass definitions that provide sensible defaults for Premium SSD v2. This removes the need to create custom StorageClasses for common storage scenarios, reducing boilerplate and configuration drift across clusters.

  • API Server VNET Integration – now generally available: API Server VNet Integration is now available in the Malaysia South region. This extends the regional footprint for teams that need the API server to be reachable only through their virtual network, eliminating public endpoint exposure.

  • Vertical Pod Autoscaler (VPA) – now generally available: VPA now supports the Recreate update mode in GA. This allows VPA to automatically restart pods with updated resource requests and limits when it detects that current allocations do not match actual usage. It is a practical tool for right-sizing workloads that have unpredictable or evolving resource patterns.

  • Istio-based service mesh – now generally available: Gateway proxy pods for the Istio-based service mesh add-on are now generally available. This means teams can now run full Istio gateway functionality — including ingress, egress, and east-west traffic management — as a fully supported, production-ready feature on AKS.

  • Disable HTTP Proxy – now generally available: This is the companion GA announcement for the ability to disable HTTP proxy configuration on existing AKS clusters. Combined with the proxy configuration update, this provides full lifecycle management of proxy settings without requiring cluster recreation.

  • AKS Managed API Server Guard – now generally available: AKS Managed API Server Guard is now GA. This feature protects the API server from excessive load by automatically throttling requests that could destabilize the control plane. It is an important safety net for clusters running workloads that generate high volumes of API calls — such as controllers, operators, or CI/CD pipelines.

🧪 Preview Feature Announcements

  • Public Preview: StandardV2 NAT Gateway as an outbound type for AKS: AKS now supports StandardV2 NAT Gateway as an outbound type for both managed and BYO VNets. This is a meaningful upgrade for egress-heavy workloads — StandardV2 offers higher throughput, improved reliability, and better scaling characteristics compared to the original NAT Gateway SKU. Teams designing new clusters with predictable outbound IP requirements should evaluate this option.

  • NAT Gateway V2 (preview): NAT Gateway V2 support is now available in public preview across supported public Azure regions, with automatic exclusion in sovereign clouds and regions where StandardV2 is not yet available. This complements the outbound type preview and gives operators a next-generation NAT experience with improved performance characteristics.

🔁 Behavioral Changes

  • Azure CNI Powered by Cilium: AKS now includes a new managed cilium-fluent-bit component in clusters running Azure CNI Powered by Cilium. This improves supportability by enabling better log collection and troubleshooting for the Cilium dataplane. Operators should be aware that this adds a new system component to the cluster that consumes a small amount of node resources.

  • HTTP proxy configuration: The validation rules for HTTP proxy configuration have been relaxed, making it easier to update proxy settings on running clusters. This aligns with the new GA capability to disable and modify proxy configurations without cluster recreation.

  • HTTP Proxy: AKS now enforces a limit of 20 Trusted CA Certificates for HTTP proxy configurations. Teams that manage a large number of custom CAs for outbound traffic inspection should consolidate their certificate chains to stay within this limit.

  • Ubuntu 22.04 Retirement: Ubuntu 22.04 is being retired as a node OS image for AKS. Operators should plan their migration to Ubuntu 24.04, which is now the recommended LTS option. This is a routine lifecycle transition, but teams running custom node configurations or hardened images should validate their tooling against the newer OS before the retirement date.

  • Kubelet Serving Certificate Rotation (KSCR): Kubelet Serving Certificate Rotation is now enabled by default, regardless of the node pool tag setting. This is a security improvement — it ensures that kubelet serving certificates are automatically rotated, reducing the risk of expired certificates causing node communication failures.

  • Teleport (preview): The Teleport preview feature has been removed from both Azure Container Registry and AKS. Teams that were using Teleport for accelerated image pulling should migrate to standard pull mechanisms. This is a clean deprecation — the feature never reached GA and has been fully decommissioned.

  • What's new with Microsoft in open source and Kubernetes at KubeCon + CloudNativeCon Europe 2026: This summary covers Microsoft's announcements at KubeCon Europe 2026, including several AKS features that are reflected in this month's preview and GA sections. It provides broader context for the platform direction and upstream Kubernetes contributions from Microsoft.

🔎 Documentation Updates

📚 Community Blogs

  • Securing Argo CD with Microsoft Entra ID: A Step-by-Step Guide: With the Argo CD extension now in public preview on AKS and Azure Arc, this post walks through integrating Argo CD authentication with Microsoft Entra ID. This is essential reading for teams adopting Argo CD on AKS — centralizing GitOps authentication through Entra ID eliminates the need for separate credential management and aligns with enterprise identity policies.

  • Control AI spend with per-application token rate limiting using Application Network and agentgateway: As AI workloads scale, controlling token consumption becomes a real operational challenge. This post shows how to use Application Network and agentgateway to enforce per-application token rate limits. It is highly relevant for platform teams managing shared AI inference infrastructure where cost attribution and blast radius control are critical.

  • AI Inference on AKS enabled by Azure Arc: Generative AI using Triton and TensorRT‑LLM: Part 5 of the AI inference series covers deploying NVIDIA Triton Inference Server with TensorRT-LLM on Arc-enabled AKS clusters. This is the most advanced post in the series — it demonstrates how to serve generative AI models at the edge with production-grade inference infrastructure, bridging the gap between cloud and on-premises AI deployment.

  • Azure Container Storage v2.1.0: Now GA with Elastic SAN: Azure Container Storage v2.1.0 reaches GA with Elastic SAN integration, providing higher performance and larger scale for stateful workloads. This release is significant for teams running databases, message queues, or other storage-intensive applications on AKS — Elastic SAN delivers consistent high-throughput storage without managing individual disks.

  • Turn your agents into AKS experts: Agent Skills for AKS: Agent Skills bring production-grade AKS guidance, troubleshooting checklists, and guardrails directly into AI agents. This is a novel approach to operationalizing platform knowledge — instead of relying solely on documentation, teams can embed AKS best practices into their AI-assisted workflows for faster and more consistent troubleshooting.

  • AI Inference on AKS enabled by Azure Arc: Predictive AI using Triton and ResNet-50: Part 4 of the series deploys Triton Inference Server with ResNet-50 in ONNX format on Arc-enabled AKS. It demonstrates how to run predictive AI at the edge for image classification scenarios — a practical reference for manufacturing, retail, and IoT use cases where low-latency inference on on-premises hardware is required.

  • AI Inference on AKS enabled by Azure Arc: Generative AI with Open‑Source LLM Server: This post covers deploying open-source LLM servers on Arc-enabled AKS for generative AI inference. It is aimed at teams that want to run LLMs on their own infrastructure without depending on cloud-hosted model APIs — a growing requirement for data-sovereign and air-gapped environments.

  • AI Inference on AKS enabled by Azure Arc: Series Introduction and Scope: This post sets the scope for the AI inference series, covering the architecture, prerequisites, and design decisions behind running AI workloads on Arc-enabled AKS clusters. It is the right starting point for teams evaluating edge AI deployment strategies.

  • AI Inference on AKS enabled by Azure Arc: Bringing AI to the Edge and On‑Premises: The series opener explains why running AI inference at the edge matters — latency, data residency, and compliance often make cloud-based inference impractical. It frames the entire series around real-world constraints that drive organizations to bring AI to their own infrastructure rather than relying exclusively on cloud endpoints.

  • Optimizing RDMA performance for AI workloads on AKS with DRANET: RDMA is critical for high-throughput GPU-to-GPU communication in distributed AI training. This post explains how DRANET optimizes RDMA performance on AKS, directly addressing the network bottlenecks that limit large-scale AI training workloads. It is required reading for teams running multi-node GPU clusters.

  • Simplifying gMSA for Windows Containers on AKS: Open-Source Tooling Now Available: Group Managed Service Accounts (gMSA) have historically been painful to configure for Windows containers on AKS. This post introduces open-source tooling that simplifies the setup process. For teams running Active Directory-authenticated Windows workloads on Kubernetes, this removes one of the biggest operational barriers.

  • Autonomous AKS Incident Response with Azure SRE Agent: From Alert to Verified Recovery in Minutes: This post demonstrates how the Azure SRE Agent can autonomously handle AKS incident response — from alert detection to verified recovery. It represents a significant shift in incident management, moving from reactive human-driven triage to AI-driven automated response for common failure scenarios.

  • AKS App Routing's Next Chapter: Gateway API with Istio: With the deprecation of Ingress NGINX, this post explains how AKS App Routing is evolving to use Gateway API with Istio as the recommended ingress path. It provides the migration rationale and architectural context that teams need to plan their transition from traditional Ingress controllers.

  • Introducing the Container Network Insights Agent for AKS: Now in Public Preview: The Container Network Insights Agent brings AI-powered network troubleshooting directly into AKS. Instead of manually correlating logs and metrics across tools, engineers can use natural language to diagnose networking issues. This is a meaningful step toward reducing the expertise barrier for Kubernetes networking operations.

  • Announcing One‑Command Backup Configuration for AKS with Azure Backup: This companion blog explains the one-command AKS backup experience in detail. It covers the simplified CLI workflow, what gets backed up, and how to restore. The reduction from a multi-step process to a single command makes it realistic to include backup in standard cluster provisioning pipelines.

  • Passwordless AKS Secrets: Sync Azure Key Vault with ESO + Workload Identity: This post shows how to sync Azure Key Vault secrets into Kubernetes using External Secrets Operator (ESO) with Workload Identity — no passwords or service principal credentials required. It is a clean, modern pattern for secret management that aligns with zero-trust principles and eliminates long-lived credentials from the cluster.

  • Service Mesh-Aware Request Tracing in AKS with Istio and Application Insights: This article explains how to enable distributed request tracing that is aware of the Istio service mesh, using Application Insights as the backend. It bridges the observability gap between mesh-level traffic routing and application-level telemetry, providing end-to-end visibility for microservice architectures.

  • Secure HTTP‑Only AKS Ingress with Azure Front Door Premium, Firewall DNAT, and Private AGIC: This post walks through a production-grade ingress architecture using Azure Front Door Premium, Azure Firewall DNAT, and a private Application Gateway Ingress Controller. It is one of the more complex but realistic enterprise patterns for securing inbound traffic to AKS clusters while maintaining end-to-end encryption and WAF protection.

  • AKS cluster with AGIC hits the Azure Application Gateway backend pool limit (100): This post documents a real-world scaling issue where an AKS cluster using AGIC hit the 100 backend pool limit on Azure Application Gateway. It provides practical workarounds and architectural guidance for teams running large numbers of services behind AGIC — a common pain point that is poorly documented elsewhere.

  • DevSecOps on AKS: Governance Gates That Actually Prevent Incidents: This post focuses on implementing governance gates in AKS that go beyond policy-as-code to actually prevent production incidents. It covers deployment safeguards, admission policies, and supply chain controls — practical DevSecOps patterns that move security from reactive detection to proactive prevention.

🔗 Releases and Roadmap

  • AKS GitHub Releases: Track the latest AKS release notes, including Kubernetes version updates, component upgrades, CVE remediations, new features, behavioral changes, and bug fixes.
  • AKS Public Roadmap: View upcoming features, planned improvements, and the delivery timeline for Azure Kubernetes Service on the official public roadmap.

Release Highlights

  • Release 2026-04-02: This release includes Kubernetes patch versions 1.35.1 and 1.33.8, along with 3 component updates. It is a maintenance release focused on keeping supported Kubernetes versions current with upstream patches.

🎥 Watch & Learn

🧠 Closing Thoughts

April 2026 was one of the more significant months for AKS in recent memory. Ten GA announcements in a single month signals strong platform maturation, particularly in areas that directly impact day-to-day operations.

The recurring themes are clear:

  • Egress and networking are getting more flexible with StandardV2 NAT Gateway and relaxed proxy configuration
  • Identity and security continue to deepen with Entra ID authorization, Conditional Access, and structured authentication for external identity providers
  • AI and GPU workloads are expanding beyond cloud-only — the Arc-enabled inference series shows that edge AI on Kubernetes is becoming a first-class scenario
  • Operational simplicity is a priority — from one-command backup to AKS Desktop to the SRE Agent, the platform is actively reducing the expertise barrier for common tasks
  • Observability is evolving with AI-powered troubleshooting through the Container Network Insights Agent and AKS Desktop's natural language diagnostics

For platform teams, the message is clear: AKS is investing in making Kubernetes operations more accessible while simultaneously expanding the platform's capabilities for advanced workloads. The balance between simplicity and power is what makes this month's updates particularly valuable.

Stay tuned for next month's edition, and feel free to share feedback or suggestions for future coverage.

]]> AKS Newsletter – March 2026 https://aksnewsletter.com/2026/2026-03.html https://aksnewsletter.com/2026/2026-03.html Sat, 28 Mar 2026 00:00:00 GMT 54 curated items covering documentation updates, feature announcements, community blogs, and more. Welcome to the March 2026 edition of the AKS Newsletter.

This month brings 6 features reaching General Availability and 9 new preview announcements. Here are some of the highlights:

  • Container network logs in AKS are now generally available
  • Container network metrics filtering for AKS is now generally available
  • Azure Container Storage v2.1.0, now with Elastic SAN integration and on-demand installation, is now generally available
  • Blue-green agent pool upgrades in AKS enter public preview
  • Cross-cluster networking in Azure Kubernetes Fleet Manager enters public preview
  • AKS managed GPU metrics in Azure Monitor enters public preview

Let's dive in.

✅ General Availability Announcements

🧪 Preview Feature Announcements

🔁 Behavioral Changes

🔎 Documentation Updates

📚 Community Blogs

🔗 Releases and Roadmap

  • AKS GitHub Releases: Track the latest AKS release notes, including Kubernetes version updates, component upgrades, CVE remediations, new features, behavioral changes, and bug fixes.
  • AKS Public Roadmap: View upcoming features, planned improvements, and the delivery timeline for Azure Kubernetes Service on the official public roadmap.

Release Highlights

  • Release Notes - 2026-03-05: This release includes Kubernetes patch versions 1.32.11, 1.34.3, 37 component updates, 52 CVE remediations.

🎥 Watch & Learn

🧠 Closing Thoughts

March 2026 showed continued investment across key areas of the AKS platform:

  • Networking capabilities
  • Observability and monitoring
  • AI and GPU workloads
  • Scaling and node management
  • Storage
  • Multi-cluster and fleet management

These updates reflect the platform's ongoing focus on production readiness, operational simplicity, and support for modern cloud-native workloads.

Stay tuned for next month's edition, and feel free to share feedback or suggestions for future coverage.

]]> AKS Newsletter – February 2026 https://aksnewsletter.com/2026/2026-02.html https://aksnewsletter.com/2026/2026-02.html Sat, 28 Feb 2026 00:00:00 GMT 41 curated items covering documentation updates, feature announcements, community blogs, and more. February continued with a strong focus on AI/ML workloads, VM convergence, and platform security hardening. This edition covers new AKS Engineering Blog posts on scaling Ray workloads, deploying KubeVirt, and autoscaling KAITO inference with KEDA. The release notes bring meaningful behavioral changes including LocalDNS defaulting on for Kubernetes 1.35+, new security annotations on nodes, and important Windows Server retirement timelines. Documentation updates span storage, networking, identity bindings, and Agentic CLI support.

Let's dive in.

✅ General Availability Announcements

  • API Server VNET Integration – new regions: API Server VNET Integration is now available in eastus2, eastus3, and belgiumcentral. This expands the geographic availability for teams requiring private API server access through VNET integration.

  • HTTP Proxy and Custom CA support in NAP clusters: HTTP Proxy and Custom Certificate Authority (CA) are now supported in Node Auto-Provisioning (NAP) enabled clusters. This removes a gap for enterprises requiring proxy-based egress control and custom certificate chains.

🧪 Preview Feature Announcements

  • Managed GPU profiles (public preview): Managed GPU profiles are now available in public preview via API version 2026-01-02-preview. This simplifies GPU workload configuration by providing pre-defined profiles optimized for common AI/ML scenarios.

🔁 Behavioral Changes

  • LocalDNS enabled by default on Kubernetes 1.35+: LocalDNS is now enabled by default for clusters running Kubernetes 1.35 or newer. This is a significant operational change — teams should validate DNS resolution behavior before upgrading to 1.35.

  • Security patch timestamp annotation on nodes: Nodes are now annotated with kubernetes.azure.com/security-patch-timestamp during security VHD reboot upgrades. This gives operators a unified way to verify when the last security patch was applied to each node.

  • NSG management changes for Application Gateway for Containers: AKS no longer creates or updates Network Security Groups on subnets delegated for Application Gateway for Containers. This improves reliability in policy-managed environments but may require teams to manage NSG rules directly.

  • AKS Automatic – nodes/proxy defense hardening: AKS Automatic has added multiple layers of defense against remote code execution via nodes/proxy permissions, including a ValidatingAdmissionPolicy blocking nodes/proxy grants and an authorization policy denying nodes/proxy by default.

  • Deployment Safeguards probe policy relaxed on AKS Automatic: AKS Deployment Safeguards no longer deny missing startup, liveness, and readiness probe requirements on AKS Automatic clusters. The policy has been changed to warn only.

  • Gateway API CRDs without gateway implementation: Gateway API CRDs can now be enabled directly without first requiring a supported gateway implementation such as the Managed Istio service mesh add-on. This reduces friction for teams adopting Gateway API incrementally.

  • Windows Server 2019 retirement – March 1, 2026: Windows Server 2019 is scheduled for retirement on March 1, 2026. After that date, AKS will no longer produce new node images or provide security patches. Teams must transition to Windows Server 2022 or newer.

  • Windows Server Annual Channel retirement – May 15, 2026: Windows Server Annual Channel (Preview) will be retired on May 15, 2026. Teams should transition to the Long Term Servicing Channel (LTSC).

  • Istio add-on revision asm-1-25 deprecated: Istio-based service mesh add-on revision asm-1-25 has been deprecated. Revision asm-1-28 is now supported.

🔎 Documentation Updates

  • Instant access snapshot support for Premium SSD v2 and Ultra Disk: New documentation covers how to use instant access snapshots with Premium SSD v2 and Ultra Disk in AKS. This enables faster volume snapshot and restore operations for performance-critical stateful workloads.

  • NVMe storage best practices for AKS: The documentation for emptyDir volumes was updated to clarify NVMe-based usage patterns and best practices. This is relevant for teams using NVMe-backed local storage for ephemeral or scratch workloads.

  • Container comparison article added to AKS docs: A new article comparing container options was added to the AKS documentation. It helps teams evaluate Azure Container Apps, AKS, and other container hosting options side by side.

  • NPM retirement documentation: Documentation was updated to reflect the retirement of Azure Network Policy Manager (NPM). Teams relying on NPM should plan their migration to Cilium-based or Calico-based network policies.

  • Ubuntu 24.04 containerd 2.0 and version updates: The Ubuntu 24.04 documentation was refreshed with containerd 2.0 details and version consistency fixes. This is important for teams planning OS upgrades.

  • Identity bindings updates for .NET, Go, and JavaScript: The identity bindings documentation was expanded with language-specific guidance for Go, JavaScript, and .NET. This makes it easier for application developers to adopt the new identity bindings model.

  • LocalDNS Preferred mode and node reimage impact: The LocalDNS documentation now clarifies Preferred mode behavior and the impact of node reimage on DNS configuration. This is important context given that LocalDNS now defaults to enabled on Kubernetes 1.35+.

  • Node auto-provisioning disk encryption and metrics: Documentation was updated to cover disk encryption support and metrics for node auto-provisioning (NAP). This fills a gap for security-conscious teams using NAP.

  • AKS MCP (Model Context Protocol) documentation: New documentation introduces the AKS MCP server and Agentic CLI. This enables AI-assisted cluster management and troubleshooting through natural language interfaces.

  • Managed Gateway API content updates: The Managed Gateway API documentation received a content development review and editorial updates. Gateway API CRDs can now be enabled directly without requiring a supported gateway implementation to be installed first.

  • ACStor v2 documentation: The Azure Container Storage documentation was updated to reflect ACStor v2. This brings updated guidance for storage pool management and volume provisioning.

  • Windows Annual Channel retirement notice: A retirement notice was added for Windows Server Annual Channel (Preview), scheduled for May 15, 2026. Teams using Annual Channel should migrate to LTSC.

📚 Community Blogs

  • Scaling Anyscale Ray Workloads on AKS: This post covers running Anyscale's managed Ray service on AKS with multi-cluster multi-region GPU capacity aggregation, unified BlobFuse2 storage for ML/AI pipelines, and automated service principal authentication. It is especially relevant for teams running distributed training and inference at scale across GPU-constrained regions.

  • Deploying KubeVirt on AKS: This post walks through deploying KubeVirt on AKS for running virtual machines alongside containerized workloads. It covers prerequisites including nested virtualization support, KubeVirt operator installation with AKS-specific node placement, and VM migration using Forklift. This is a key reference for organizations with legacy VM workloads exploring Kubernetes-based unified infrastructure management.

  • Autoscale KAITO inference workloads on AKS using KEDA: This post introduces the new KAITO InferenceSet CRD and KEDA KAITO Scaler for event-driven autoscaling of LLM inference workloads. It shows how to configure both time-based and metric-based scaling (using vLLM metrics like num_requests_waiting) to dynamically scale GPU inference instances. This directly addresses GPU cost optimization for production AI workloads.

  • Accelerating AKS Upgrades with Fleet Manager: Finding the Right Balance: This post explores the trade-offs between speed and safety when orchestrating AKS upgrades at scale using Azure Fleet Manager. It covers update runs, stages, and groups, and explains why reducing stages risks blast radius while increasing parallel update groups can hit capacity constraints.

  • Seamless Migrations From Self Hosted Nginx Ingress To The AKS App Routing Add-On: With the upstream Nginx Ingress controller retiring in March 2026, this post walks through a zero-downtime migration to the AKS App Routing add-on. It covers running both controllers in parallel with separate IngressClasses and cutting over DNS without disrupting production traffic.

  • Regional Endpoints for Geo-Replicated Azure Container Registries (Private Preview): Regional endpoints now let teams target specific ACR geo-replicated regions directly, bypassing Azure-managed routing. This enables predictable regional affinity for AKS clusters, client-side failover strategies, and easier troubleshooting of image pull behavior.

  • Beyond iptables: Scaling AKS Networking with nftables and Project Calico: This post explains the transition from iptables to nftables in AKS Ubuntu 24.04 nodes. It covers how Project Calico adapts to nftables-based dataplane rules and what operators need to know about compatibility, performance gains, and troubleshooting in the new networking stack.

  • Hardening Spring Boot Health Probes on AKS: How to Prevent Restart Storms Before They Start: This post dives into common misconfiguration patterns with Spring Boot liveness and readiness probes on AKS that can trigger cascading pod restarts under load. It provides guidance on tuning probe timing, separating health check dependencies, and avoiding restart storms in production.

  • AKS Tenant Migration: Considerations and Approach: A detailed guide on migrating AKS clusters between Azure AD tenants. It covers planning considerations, resource group moves, identity reconfiguration, and step-by-step migration procedures for clusters with managed identities and RBAC dependencies.

  • Reference Architecture for Highly Available Multi-Region Azure Kubernetes Service (AKS): This reference architecture post outlines a multi-region AKS deployment pattern for high availability, covering Azure Front Door for global load balancing, cross-region state management, and failover strategies for mission-critical workloads.

  • From Ingress to Gateway API: A Pragmatic Path Forward: This post covers the evolution from Kubernetes Ingress to the Gateway API, explaining the practical benefits and migration path for AKS users. It covers HTTPRoute, TLSRoute, and how the new API model enables more expressive traffic management.

  • Retina 1.0 Is Now Available: Retina, the open-source cloud-native container networking observability platform, has reached 1.0. This release includes production-ready distributed packet captures, flow-level metrics with Hubble integration, and support for both AKS and self-managed Kubernetes clusters.

🔗 Releases and Roadmap

Release Highlights

  • Release 2026-02-08: This release brings Kubernetes patch versions 1.34.2, 1.33.6, and 1.32.10. Key component updates include Konnectivity v0.31.4-6, Karpenter v1.6.8, Cilium updates to v1.16.16 and v1.17.9 resolving multiple CVEs, Application Routing operator v0.2.17 addressing ingress-nginx vulnerabilities, and Managed Prometheus add-on v6.24.2. The release also includes significant security hardening across etcd, kube-apiserver, and kube-egress-gateway components.

🎥 Watch & Learn

🧠 Closing Thoughts

February was defined by three clear themes: AI/ML workload maturity, platform security hardening, and operational convergence.

The KAITO InferenceSet with KEDA integration, Ray on AKS with Anyscale, and managed GPU profiles all point to AKS becoming a first-class platform for AI/ML at scale. The investment in event-driven autoscaling for inference workloads directly addresses GPU cost optimization — a top concern for every team running LLMs in production.

On the security front, the nodes/proxy hardening in AKS Automatic, new security patch timestamp annotations, and extensive CVE remediation across Cilium, Konnectivity, and egress gateway components show a consistent push toward defense-in-depth.

The KubeVirt support signals that AKS is also evolving as a convergence platform for teams managing both containerized and VM-based workloads. Combined with the new MCP/Agentic CLI documentation, AKS is expanding its operational surface in meaningful ways.

For platform teams: pay close attention to the LocalDNS default change on Kubernetes 1.35+ and the Windows Server 2019 retirement deadline of March 1, 2026. Both require proactive planning.

]]>