Welcome to the June 2026 edition of the AKS Newsletter.

This month brings 7 features reaching General Availability and 2 new Preview announcements. Here are some of the highlights:

• Generally available: Managed system node pools in AKS Automatic is now generally available
• Application Gateway for Containers is now generally available
• Ubuntu 22.04 node pools with FIPS 140-3 compliance is now generally available
• Anyscale on Azure enters public preview
• Application Gateway for Containers – Inference gateway enters public preview

Let's dive in.

✅ General Availability Announcements

• Generally available: Managed system node pools in AKS Automatic: Managed system node pools are now generally available, simplifying the operational overhead of scaling, patching, and maintaining system-critical workloads. This feature ensures higher availability and reduced manual intervention for platform engineers.

• Application Gateway for Containers – now generally available: Application Gateway for Containers is now fully supported, offering a managed ingress solution tailored for containerized workloads. This enables advanced traffic routing, SSL termination, and security features directly integrated with AKS.

• Ubuntu 22.04 node pools with FIPS 140-3 compliance – now generally available: Ubuntu 22.04 node pools with FIPS 140-3 compliance are now GA, providing enhanced security for workloads requiring strict cryptographic standards. This is particularly relevant for regulated industries like finance and government.

• Managed GPUs – now generally available: Managed GPU support in AKS is now generally available, enabling seamless provisioning and scaling of GPU-enabled node pools. This is a game-changer for teams running AI/ML workloads or other GPU-intensive applications.

• Confidential VMs (CVM) – now generally available: Confidential VMs are now GA on AKS with Azure Linux, offering hardware-based encryption to protect data in use. This is a critical feature for organizations prioritizing data confidentiality and compliance.

• Windows Server 2025 – now generally available: Windows Server 2025 is now supported in AKS, allowing teams to modernize their Windows-based applications while leveraging the latest OS features. This ensures better performance, security, and compatibility for Windows containers.

• Azure Container Linux – now generally available: Azure Container Linux is now a GA OS option for AKS starting with version 1.34. This lightweight, secure, and optimized Linux distribution is tailored for containerized workloads, offering a streamlined experience for AKS users.

🧪 Preview Feature Announcements

• Public Preview: Anyscale on Azure: Introduces a managed Ray platform for scaling Python-based machine learning workloads in the cloud. This preview empowers engineers to handle massive computational tasks with improved speed and control, making it a game-changer for AI-driven applications.

• Public Preview: Application Gateway for Containers – Inference gateway: Expands the Application Gateway for Containers with AI inference capabilities, enabling seamless integration of machine learning models into containerized applications. This enhancement simplifies deploying and scaling AI-powered services in Kubernetes environments.

🔁 Behavioral Changes

• Istio Service Mesh with Gateway API: Clusters running Kubernetes 1.36 or later can now disable the default application routing add-on with Gateway API to use the Istio-based service mesh add-on with Istio CNI. This provides flexibility for teams adopting Istio while maintaining control over their networking setup.

• Deployment Safeguards: Enforce mode now applies default resource requests to DaemonSets and Jobs when those requests are missing, in addition to Deployments and StatefulSets. Additionally, with Pod Security Standards set to Baseline, pods on Automatic clusters can now read /var/log and /hostfs hostPath volumes (read-only), supporting log exporter scenarios while maintaining security.

• Custom Prometheus Metric Scraping: Now supports metric scraping and log collection on AKS Automatic clusters using managed system node pools. This enhances observability for teams leveraging Prometheus in managed environments.

• Azure CNI Static Block Allocation: VnetScale clusters no longer require explicit pod CIDR configuration. This simplifies network setup and reduces configuration errors for large-scale deployments.

• Windows gMSA: Now validates CoreDNS configurations for conflicts when using group-managed service accounts. This ensures smoother integration and prevents runtime issues.

• Pod Sandboxing (Kata): Pod sandboxing is now supported for workload runtime node pools, and node pools using Standard_DadsV7-series VM sizes are now available (resolving previous nested-virtualization validation issues). This expands both the isolation scope and hardware options for teams adopting Kata containers.

• AKS Automatic: Managed system node pools are now available under the AKS Base SKU. This streamlines cluster management for teams leveraging AKS Automatic.

• Istio CNI: Istio CNI integration now supports advanced networking features, enabling seamless service mesh deployment with enhanced network security and performance.

• Migration Guide: Updated to provide detailed steps for migrating workloads to supported Windows Server versions. Essential for teams preparing for upcoming OS retirements.

• Windows Server 2019 Retirement Guide: Comprehensive guidance on transitioning from Windows Server 2019, which is approaching its end-of-support date. A must-read for teams running legacy Windows workloads.

• Azure Container Linux for AKS: Introduces a migration path to Azure Container Linux for AKS users. This is a significant update for teams looking to adopt a modern, secure, and optimized container OS.

• Managed System Node Pools: Now generally available for AKS Automatic clusters. This feature simplifies operations by offloading node pool management to Azure.

• LocalDNS: LocalDNS is now set to Required by default for new node pools in Automatic clusters. This change improves DNS resolution performance and reliability for Kubernetes workloads.

• Edit the excludedNamespaces Field for Deployment Safeguards: Teams can now control which policies apply to specific namespaces on Automatic clusters by editing the excludedNamespaces field. This provides greater flexibility in policy enforcement.

• Upstream Deprecation of Service externalIPs: Kubernetes has announced the deprecation of Service externalIPs in version 1.36. Platform engineers should evaluate their reliance on this feature and plan for alternative solutions.

🔎 Documentation Updates

• Configure Azure CNI Powered by Cilium in Azure Kubernetes Service (AKS): Updated to reflect the inclusion of Azure CNI powered by Cilium as the default networking configuration for AKS Automatic clusters. This change simplifies networking setup while offering enhanced scalability and performance for Kubernetes workloads.

• Use a Microsoft Entra Workload ID on Azure Kubernetes Service (AKS): Expanded with details on how Microsoft Entra Workload ID is preconfigured in AKS Automatic clusters. This update is crucial for teams looking to streamline identity management and secure application authentication.

• Use GPUs on Azure Kubernetes Service (AKS): Refreshed with guidance on leveraging managed GPU features as the primary approach for GPU workloads, while also detailing self-managed alternatives. This ensures optimal performance for compute-intensive applications.

• Configure AKSNodeClass Resources for Node Auto-Provisioning (NAP) in Azure Kubernetes Service (AKS): Updated to include the latest default OS version information for Ubuntu in AKSNodeClass configurations. This is essential for teams using node auto-provisioning to ensure compatibility and security.

• Configure Scheduler Profiles on Azure Kubernetes Service (AKS) (preview): Enhanced with updated instructions for configuring scheduler profiles, enabling more advanced scheduling behaviors. This is a key feature for optimizing workload placement and resource utilization.

• Kubernetes on Azure tutorial - Deploy an application to Azure Kubernetes Service (AKS): Refined to include the latest RabbitMQ version and streamlined configurations for deploying multi-container applications. This ensures a smoother onboarding experience for new AKS users.

• Introduction to Azure Kubernetes Service (AKS) Automatic: Updated to remove outdated limitations and provide a clearer overview of AKS Automatic features. This is a must-read for teams seeking simplified containerized application management.

• Use instance-level public IPs in Azure Kubernetes Service (AKS): Clarified feature flag registration requirements for enabling dual-stack IPs. This is critical for teams managing public-facing workloads with complex networking needs.

• Long-Term Support for Azure Kubernetes Service (AKS) Versions: Updated to document that ACC SGX is not supported for AKS Long-Term Support (LTS) versions. This ensures clarity for teams relying on LTS for stability and compliance.

• Configure LocalDNS in Azure Kubernetes Service (AKS): Added a note about TCP connection caps when using LocalDNS. This update is crucial for teams optimizing DNS resolution performance and resiliency in their clusters.

• Quickstart: Deploy an Azure Kubernetes Service (AKS) cluster using Azure PowerShell: Refreshed to ensure the PowerShell quickstart guide remains accurate and up-to-date. A great resource for rapidly deploying AKS clusters via scripting.

• Assign Capacity Reservation Groups to Node Pools in Azure Kubernetes Service (AKS): Improved with better code block formatting and corrected author attribution. This update helps teams guarantee capacity for critical workloads.

• Supported Kubernetes Versions in Azure Kubernetes Service (AKS): Expanded with a breaking changes table for Kubernetes 1.36 component versions. This is essential for planning upgrades and avoiding disruptions.

• Kubernetes Gateway API Ingress for Istio Service Mesh Add-on for Azure Kubernetes Service (AKS): Updated with new configurations for GatewayClass and Gateway resources. This is vital for teams using Istio with Kubernetes Gateway API for ingress management.

• Azure Kubernetes Service (AKS) application routing add-on with the Kubernetes Gateway API: Enhanced with notes on access logs for the application routing add-on. This helps teams monitor and troubleshoot ingress traffic more effectively.

• AKS end of support notifications: Refined metadata and instructions for setting up alerts on Kubernetes version end-of-support notifications. This ensures teams stay ahead of deprecation timelines.

• Create Node Pools in Azure Kubernetes Service (AKS): Updated with the latest guidance on configuring multiple node pools in AKS. A must-read for teams scaling their clusters efficiently.

• Network isolated AKS clusters: Revised to address limitations related to bring-your-own Azure Container Registry (ACR) in network-isolated clusters. This is critical for teams prioritizing security and compliance in their deployments.

📚 Community Blogs

• Deploy Anyscale on Azure with Terraform: a step-by-step guide: This guide walks through deploying Anyscale on Azure using Terraform, enabling distributed AI/ML workloads with Ray on AKS. The integration with Microsoft Entra ID for SSO and the operator-based deployment model make it a compelling choice for platform engineers managing enterprise-scale AI.

• App Routing Gateway API is GA: Here's a Demo: The AKS App Routing add-on now fully supports the Kubernetes Gateway API with its GA release. This milestone ensures first-class support for Gateway API CRDs, controllers, and data planes, streamlining ingress management for modern Kubernetes applications.

• Announcing the public preview of AKS on bare metal: AKS expands its reach with support for bare metal, targeting edge deployments and high-performance workloads. This preview is a game-changer for teams needing Kubernetes in environments where traditional cloud infrastructure isn't viable.

• Scaling multi-node LLM inference with NVIDIA Dynamo-Grove on AKS (Part 4): NVIDIA engineers detail how to scale large language model (LLM) inference across multiple nodes using Dynamo-Grove on AKS. This deep dive is essential for teams working on high-demand AI applications requiring distributed GPU workloads.

• Secure containers from code to runtime | Microsoft Defender: This post highlights container security best practices, from development to runtime, using Microsoft Defender. It emphasizes mitigating supply chain risks and securing workloads running on AKS.

• Accelerating AKS troubleshooting with the Azure Copilot Observability Agent: The Azure Copilot Observability Agent simplifies troubleshooting for AKS by providing unified telemetry and actionable insights. Platform engineers can leverage this tool to quickly diagnose and resolve issues in Kubernetes environments.

• Closing the loop on container security: From code to runtime in the AI era: With AI workloads increasingly running in containers, this blog explores end-to-end security strategies for AKS, EKS, and GKE. It underscores the importance of securing the entire lifecycle, from development to deployment.

• Getting Secrets Out of YAML: Implementing Azure Key Vault CSI Driver on AKS with Workload Identity: This blog demonstrates how to replace hardcoded secrets in YAML files with the Azure Key Vault CSI Driver and Workload Identity. It's a must-read for teams looking to enhance security and simplify secret management in AKS.

• Token economics–driven architecture: hybrid models, AI Runway, AKS Kata MicroVM, MCP: This post explores how token economics influence hybrid cloud architectures, with a focus on AKS, Kata MicroVMs, and AI Runway. It provides insights into designing cost-efficient and scalable infrastructures for modern workloads.

• Anyscale on Azure: Powering Enterprise AI at Massive Scale on Azure Kubernetes Service: Anyscale on Azure leverages AKS to deliver robust, scalable infrastructure for enterprise AI workloads. This blog highlights its operational benefits, including managed cluster operations and enterprise-grade support.

• Announcing Anyscale on Azure public preview: Powered by Ray on AKS: The public preview of Anyscale on Azure introduces a managed platform for distributed AI/ML workloads using Ray on AKS. This co-engineered solution simplifies deployment and scales seamlessly for enterprise AI needs.

• What's new in Azure Kubernetes Service at Microsoft Build 2026: This roundup from Microsoft Build 2026 highlights AKS updates focused on cost, latency, and reliability for AI and data workloads. Key announcements address the evolving needs of platform engineers managing large-scale Kubernetes clusters.

• Kubernetes Center: Security & LTS/Out-of-Support Version Insights Now Available: The Kubernetes Center now offers detailed insights into security, long-term support (LTS), and out-of-support versions across all AKS clusters. This centralized view helps teams ensure compliance and streamline cluster lifecycle management.

🔗 Releases and Roadmap

• AKS GitHub Releases: Stay updated with the latest AKS release notes, including new features, bug fixes, and security updates.
• AKS Public Roadmap: Track upcoming features and enhancements planned for AKS, helping you align your infrastructure roadmap with Azure's development plans.

Release Highlights

• Release - 2026-06-19: This release includes updates to five core components and addresses two critical CVEs. Platform engineers should review the CVE details to ensure their clusters remain secure and compliant.

• Release - 2026-05-29: Packed with 14 CVE remediations, this release underscores Microsoft's commitment to security. Teams should prioritize upgrading to safeguard their workloads against known vulnerabilities.

Announcements

• Windows Server 2022 Retirement Extended: The retirement date for Windows Server 2022 has been extended to June 30, 2028. After this date, AKS will cease producing new node images and security patches, and new node pools with this OS version will no longer be supported. Plan migrations to supported OS versions to avoid operational risks.

• Istio Service Mesh Add-On Deprecation: Revision asm-1-27 of the Istio-based service mesh add-on is now deprecated. Upgrade to revision 1.28 or later using the Istio add-on upgrade guide to maintain support and access to the latest features.

• Windows Server Annual Channel Retirement: Support for Windows Server Annual Channel for Containers on AKS ended on May 15, 2026. The final image (5B) is the last release for this channel. Transition to supported alternatives to ensure continued functionality and security.

🎥 Watch & Learn

• How we solved AKS cluster sprawl - Kube & Tell - June 2026 - Azure Kubernetes Service: What do you do when hundreds of Kubernetes clusters are spreading across your org, each team running its own version of "what good looks like," with no consistent way to stay on top of security, versions, or cost?

• eBPF Host Routing in AKS: Faster, Low-Latency Networking with Azure CNI & ACNS: Deep dive into how eBPF Host Routing in Advanced Container Networking Services (ACNS) delivers a high-performance data path by moving routing logic into eBPF programs. Essential viewing for teams looking to reduce networking latency in their AKS clusters.

• AKS Community Call - US & Europe (May 2026) - Azure Kubernetes Service: Welcome to the AKS Community Calls! These sessions foster direct interaction between our product teams and the AKS community.

🧠 Closing Thoughts

June 2026 showed continued investment across key areas of the AKS platform:

• Networking capabilities
• AI and GPU workloads
• Scaling and node management

These updates reflect the platform's ongoing focus on production readiness, operational simplicity, and support for modern cloud-native workloads.

Stay tuned for next month's edition, and feel free to share feedback or suggestions for future coverage.