Welcome to the September 2026 edition of the AKS Newsletter.

This month brings 1 feature reaching General Availability and 6 new Preview announcements. Here are some of the highlights:

• Autoscaling for Virtual Machines node pools, including multi-SKU autoscaling, is now generally available
• Flex Nodes for AKS enters public preview
• Ubuntu 26.04 support in AKS enters public preview
• Converting existing clusters to managed system node pools enters preview

Let's dive in.

✅ General Availability Announcements

• Autoscaling for Virtual Machines node pools – now generally available: Autoscaling for Virtual Machines node pools is generally available, including support for pools with multiple VM SKUs.

🧪 Preview Feature Announcements

• Public Preview: Flex Nodes for AKS: Flex Nodes introduce a flexible deployment model allowing hybrid and edge infrastructure to seamlessly integrate as worker nodes with an AKS control plane in Azure. This is crucial for teams looking to leverage diverse environments without compromising on the centralized management offered by AKS.

• Public Preview: Ubuntu 26.04 support in AKS: With Ubuntu 26.04 support, AKS users can align with the latest LTS releases, ensuring enhanced security and compatibility. This update is vital for maintaining a secure and efficient Kubernetes environment as new features and patches are introduced.

• Convert existing clusters to managed system node pools (preview): Existing clusters can be converted in supported regions after registering the required preview feature.

• Blue-Green Upgrade (preview): Node pools with a blue-green upgrade in progress can now switch safely to the rolling upgrade strategy, giving operators another recovery path during an upgrade.

• Cluster Health Monitor (preview): On-Demand Monitor adds node health checks and remediation in preview. Teams can use it to investigate and address unhealthy nodes without assuming that every issue will be resolved automatically.

• AKS Hyperscale Configuration (preview): H2, H4, and H8 profiles let teams preprovision control plane capacity for large AI, HPC, and batch workloads. The goal is more predictable API responsiveness and scheduling throughput during scale-out and recovery.

🔁 Behavioral Changes

• LocalDNS: Starting with Kubernetes 1.37, LocalDNS is enabled automatically on supported networking configurations. Clusters using bring-your-own CNI, unsupported network policy configurations, or existing custom DNS aren't changed.

• HTTP proxy: New clusters using an HTTP proxy or Custom Certificate Authority reject CA certificate content larger than 35 KB to keep node bootstrap data within platform limits. Existing clusters aren't affected.

• Managed namespace: Creating a managed namespace now rejects names beginning with the reserved kube- or aks-istio- prefixes.

• Static Egress Gateway: Nodes now deregister from the load balancer before a node-image upgrade reimages them, reducing the risk of interrupted egress traffic.

• KMS encryption-at-rest for Kubernetes secrets handled by K8s API with customer managed key: AKS now returns a validation error when enabling customer-managed KMS encryption on Kubernetes 1.37 clusters with a versioned Key Vault key ID. Use a versionless key ID instead.

• Azure Monitor managed service for Prometheus: On Kubernetes 1.37 and later, ama-metrics uses namespace-scoped access to secrets. Configure access before upgrading if your PodMonitor or ServiceMonitor references Kubernetes secrets for authentication.

• Azure Linux with OS Guard retirement: This preview OS option retires on December 10, 2026; AKS will stop publishing images and security patches, then remove existing images on March 10, 2027. Plan a move to Azure Container Linux before scaling or remediation is affected.

🔎 Documentation Updates

• Secure Pod Traffic with Network Policies in Azure Kubernetes Service (AKS): This guide has been updated to include more comprehensive instructions on implementing network policies in AKS, focusing on securing pod traffic by adhering to the principle of least privilege. Essential for engineers aiming to enhance security posture within their Kubernetes environments.

• Recommended active-active high availability solution overview for Azure Kubernetes Service (AKS): The documentation now provides a detailed overview of active-active high availability solutions for AKS, offering insights into maintaining service continuity and reliability across multiple regions. This is crucial for enterprises seeking to minimize downtime and ensure robust disaster recovery strategies.

• Network isolated AKS clusters: Updated to reflect changes in unsupported extensions for network isolated clusters, this documentation is vital for engineers looking to enhance security by isolating their AKS clusters from the public internet while maintaining necessary functionality.

• Use the Cluster Autoscaler in Azure Kubernetes Service (AKS): The guide replaces "capacity" with "resource" terminology to align with upstream usage. The Cluster Autoscaler adjusts the number of nodes as workloads' resource needs change; it does not scale the workloads themselves.

• Attach a flex node to an AKS cluster (preview): This documentation has been updated to make the environment file the single source of truth for WORK_DIR, streamlining the process of attaching a flex node to an AKS cluster. This change simplifies node management for engineers working with dynamic environments.

• Configure an Azure Kubernetes Service (AKS) Cluster for AKS Desktop: Refreshed during a content audit; use it when preparing a cluster for AKS desktop.

• Quickstart: Create a private Azure Kubernetes Service (AKS) Automatic cluster in a custom virtual network: Refreshed during a content audit; the quickstart covers creating a private AKS Automatic cluster in a custom virtual network.

• API Server VNet Integration in Azure Kubernetes Service (AKS): This documentation now includes links for az-aks-stop and az-aks-start, offering a more comprehensive view of API Server VNet Integration in AKS. This is important for engineers looking to optimize network configurations and manage cluster accessibility.

• Create a Kubernetes deployment using Automated Deployments in the Azure Kubernetes Service (AKS) extension for Visual Studio Code: Refreshed during a content audit; the guide covers creating a Kubernetes deployment through the AKS extension for Visual Studio Code.

• Fine-tune and deploy an AI model on Azure Kubernetes Service (AKS) with the AI toolchain operator add-on: Refreshed during a content audit; the walkthrough covers fine-tuning and deploying a model with the AI toolchain operator add-on.

• Configure Node Pools for Node Auto-Provisioning (NAP) in Azure Kubernetes Service (AKS): This guide now resolves a bookmark warning and offers detailed instructions on configuring node pools for Node Auto-Provisioning, including SKU selectors, limits, and weights, essential for optimizing resource allocation.

• Istio-based service mesh add-on for Azure Kubernetes Service: The documentation now generalizes the auto-upgrade caveat beyond AKS Automatic, providing a more comprehensive understanding of Istio-based service mesh add-ons. This is vital for engineers implementing service meshes to enhance microservices communication.

• DNS in Azure Kubernetes Service (AKS): Updated with batched suggestions from a code review, this guide offers improved insights into DNS operations in AKS and the benefits of LocalDNS, crucial for enhancing performance and reliability in Kubernetes environments.

• Supported Kubernetes Versions in Azure Kubernetes Service (AKS): This documentation now includes details on Kubernetes 1.37 components and a Prometheus breaking change, providing essential information for engineers managing version upgrades and compatibility.

• Create an AKS-managed GPU node pool on Azure Kubernetes Service (AKS): Now with added details on using GPUs via NAP on AKS Automatic, this guide is crucial for teams looking to leverage GPU resources for high-performance computing tasks in Kubernetes.

• Assign Capacity Reservation Groups to Node Pools in Azure Kubernetes Service (AKS): The documentation clarifies RBAC requirements for CRG assignment, providing essential guidance for ensuring allocated capacity in node pools, which is critical for maintaining service reliability.

• Upgrade Operating System (OS) Version in Azure Kubernetes Service (AKS) Clusters: Updated to include the Ubuntu 26.04 preview CLI version, this guide offers comprehensive support, testing, and rollback instructions for OS version upgrades, crucial for maintaining cluster stability.

• Configure LocalDNS in Azure Kubernetes Service (AKS): This documentation now includes updated LocalDNS behavior details for AKS Standard, providing engineers with enhanced strategies for improving DNS resolution performance and resiliency.

• Quickstart: Create an Azure Kubernetes Service (AKS) Automatic cluster: With fixes for broken links and documentation errors, this quickstart guide facilitates the rapid deployment of Kubernetes clusters, essential for teams needing swift and reliable cluster setups.

• Use Virtual Machines Node Pools in Azure Kubernetes Service (AKS): Updated to document availability zone support for Virtual Machines node pools, this guide is crucial for engineers looking to enhance fault tolerance and resource distribution in their AKS clusters.

• Azure Kubernetes Service (AKS) Application Routing Add-On with the Kubernetes Gateway API: The documentation now clarifies canary upgrades for ingress-only Istio, providing essential insights for managing ingress traffic using the Kubernetes Gateway API, crucial for optimizing application routing.

• Configure rolling upgrades for Azure Kubernetes Service (AKS) node pools: This guide now unpins the REST API reference link, offering clearer instructions on configuring rolling upgrades, including surge settings and drain timeout, which are vital for maintaining service availability during updates.

• Node Disruption Policy in Azure Kubernetes Service (AKS) (Preview): Updated for Kubernetes 1.37, this documentation provides insights into controlling node reimage operations, essential for maintaining stability and minimizing disruptions in AKS environments.

📚 Community Blogs

• AKS on bare metal now on Ubuntu: Azure Kubernetes Service can now be deployed directly on customer-owned Ubuntu infrastructure, offering bare metal performance and flexible hardware choices. This development is significant for engineers seeking high-performance, cost-effective Kubernetes deployments outside the traditional Azure environment.

• AKS desktop evolves with AI troubleshooting and plugins: The AKS desktop has been enhanced with AI-driven troubleshooting and plugin capabilities, addressing a critical need for intuitive problem-solving tools. This evolution empowers engineers to quickly diagnose and resolve issues, improving operational efficiency.

• Announcing the public preview of flex nodes for AKS: Flex nodes extend an existing AKS cluster with worker nodes in other Azure regions, on-premises, or at the edge. They connect over an encrypted overlay network while retaining the cluster's scheduler, RBAC, policy, and observability.

• Running GitHub Actions Runner Controller on AKS Automatic: This guide demonstrates setting up the GitHub Actions Runner Controller on AKS Automatic, enabling ephemeral runner pods for GitHub Actions jobs. It's a valuable resource for engineers automating CI/CD workflows within Kubernetes environments.

• AKS Configurable Scheduler Profiles: The introduction of configurable scheduler profiles in AKS addresses the challenge of underutilized resources by optimizing workload placement. Engineers can now fine-tune scheduling to improve cluster efficiency and reduce infrastructure costs.

• Sending Email from an AKS Pod Without a Single Secret: This article explores a method for sending emails from an AKS pod without storing secrets, enhancing security and simplifying management. It's a must-read for engineers focused on secure and efficient Kubernetes operations.

• CoreDNS in AKS: service discovery, upstream DNS, and failover: The article delves into CoreDNS's role within AKS, covering service discovery, upstream DNS, and failover mechanisms. Engineers will gain insights into optimizing DNS configurations for robust Kubernetes networking.

• Run and scale AI applications on AKS – the latest product innovations: This piece highlights the latest innovations in running and scaling AI applications on AKS, offering engineers new tools and strategies to enhance AI workload performance and scalability.

• Virtual nodes on Azure Container Instances: a new compute layer for AKS: Virtual nodes on Azure Container Instances introduce a new compute layer for AKS, providing scalable and flexible compute resources. This development is critical for engineers seeking to optimize resource utilization and cost-efficiency in Kubernetes environments.

• Generally Available: Certificate Management for Azure Arc-enabled Kubernetes: The general availability of certificate management for Azure Arc-enabled Kubernetes simplifies the management of secure communications across diverse environments. This feature is essential for engineers maintaining compliance and security standards in multi-cloud deployments.

🔗 Releases and Roadmap

• AKS GitHub Releases: Stay updated with the latest AKS releases, including new features, bug fixes, and component updates that can impact your cluster management strategies.
• AKS Public Roadmap: Explore the future of AKS with insights into upcoming features and planned enhancements, helping you align your infrastructure planning with Azure's roadmap.

Release Highlights

• Release 2026-09-04: Kubernetes 1.37 Preview begins rolling out, with patches 1.36.3, 1.35.7, and 1.34.10 also available. The notes flag the September 30 automatic migration of deprecated Availability Sets (VMAS) clusters to Virtual Machines node pools and the upcoming Azure Linux with OS Guard retirement.

🎥 Watch & Learn

• Debug Kubernetes with AI: Fix a Broken App in AKS desktop: Your Kubernetes pods are running, but your app is broken. See how the AI Assistant in AKS desktop helps troubleshoot an Azure Kubernetes Service application and fix a workload identity configuration issue.

• AKS Community Calls - September 2026: Catch up with the September AKS Community Call.

• Secure AI Workloads on AKS with Chainguard Container Images: CN Partner Showcase: Azure Kubernetes: In this Cloud Native Partner Showcase episode, Microsoft and Chainguard discuss how Chainguard is the trusted source for open source. David Giard talks to Hannah Hawken & Manfred Moser from Chainguard to explore how secure-by-default container...

🧠 Closing Thoughts

September's changes put upgrades and cluster operations in focus. Virtual Machines node pool autoscaling reached GA, while previews added flex nodes, control plane capacity profiles, and new paths for node health checks and upgrades.

Before moving to Kubernetes 1.37, check whether LocalDNS will be enabled in your cluster and whether your Prometheus scrape configurations need namespace-scoped secret access. Teams using Azure Linux with OS Guard should also plan their migration ahead of its December retirement.