Azure Kubernetes Service

Autoscaling for Virtual Machines node pools, including multi-SKU autoscaling, is now generally available, and a new Hyperscale Configuration preview lets clusters preprovision control plane capacity for large AI, HPC, and batch workloads. This release also breaks existing behavior: AKS now rejects updates that remove IPv6 from dual-stack clusters, rejects CA certificates over 35 KB on new HTTP proxy or Custom CA clusters, and requires namespace-scoped secret access to be configured before upgrading to Kubernetes 1.37 if ServiceMonitor or PodMonitor configurations use basicAuth or bearerToken secrets.

Matters for: Teams running dual-stack networking, custom CA or HTTP proxy configurations, or Azure Monitor managed Prometheus with secret-based ServiceMonitor/PodMonitor auth on AKS clusters upgrading to Kubernetes 1.37.

AppNet, the managed Istio-based service mesh for AKS, is now available in additional Azure regions and now validates cluster prerequisites at join time, returning clear errors instead of failing opaquely, while also fixing certificate rotation failures, missing multicluster network labels, Microsoft Entra authentication rejections on update, orphaned mesh resources, and stuck member deletions. AppNet 1.3 and 1.4 were updated to newer Istio patch versions and a new AppNet 1.5 (Istio 1.30.3) is available, while AppNet 1.0 through 1.2 have been retired, so self-managed upgrade mode users on those versions must upgrade to a supported version following the AppNet upgrade guide.

Matters for: Teams running multicluster AKS deployments with Microsoft Entra-based cluster authentication and AKS managed Gateway API add-ons.

On AKS clusters running Kubernetes 1.37 or later, changing SSH node access configuration, IMDS restriction, network-isolated bootstrap profile, or cluster outbound type now triggers an immediate node reimage, and migrating a cluster from service principal authentication to managed identity also triggers reimages across all node pools. Teams must configure a Node Disruption Policy to block or schedule these reimages during a maintenance window, since changes that previously did not reimage nodes will now do so immediately and can disrupt running workloads.

Matters for: Operators running AKS clusters with defined maintenance windows or custom outbound networking who need to avoid unplanned workload disruption during authentication or network configuration changes.

Managed system node pools are now generally available for AKS Automatic, with new clusters preconfiguring them and LocalDNS set to Required by default, and admins can now edit the excludedNamespaces field to control deployment safeguards per namespace. Existing Automatic clusters without managed system node pools must be recreated and their workloads migrated, and new clusters now block customer-supplied SSH keys, deny kubectl port-forward and secret reads on the managed system node pool, and enforce a policy blocking Service spec.externalIPs.

Matters for: Teams running AKS Automatic clusters that rely on custom SSH key access, port-forwarding, or externalIPs-based Services for cluster administration.