From 5824275991f167e3608af89a015a1f6c2f785919 Mon Sep 17 00:00:00 2001 From: Wilson Date: Wed, 10 Jun 2026 08:53:07 -0700 Subject: [PATCH 01/12] Update CHANGELOG.md Add NAP related updated for Machine API Integration --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3316016a0..266f4b769 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,6 +35,8 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * [Windows Server 2025](https://aka.ms/aks/upgrade-windows-os-version) is now generally available. You no longer need to register a feature flag to create Windows Server 2025 node pools. Windows Server 2025 node pools can be created in Kubernetes version 1.32+ with a minimum GA CLI version of 2.87.0. * [Azure Container Linux](https://learn.microsoft.com/azure/azure-linux/azure-container-linux-overview) is generally available (GA) as an OS option on AKS starting AKS v1.34. You can deploy ACL node pools in a new AKS cluster or add ACL node pools to your existing clusters. AKS also supports migrating existing node pools to ACL using in-place OS SKU migration or by creating new ACL node pools. For detailed migration steps, considerations, and rollback instructions, see [Migrate existing nodes to ACL](https://learn.microsoft.com/azure/azure-linux/tutorial-migrate-azure-container-linux-aks). * [Azure Policy add-on](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) now generates ValidatingAdmissionPolicies (VAP) for all customers. This enforces CEL-based policies inside the API server process for minimal latency and enables fail-closed enforcement. +* Node Auto Provisioning (NAP) managed clusters can now enable custom OS settings for Linux. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. +* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. #### Preview features @@ -51,6 +53,10 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. +* Use of specific labels for AKS nodes are prohibited from user-input, including "agentpool", "storageprofile", storagetier", "accelerator", and labels with a prefix of "kubernetes.azure.com". +* Node Auto Provisioning (NAP) managed clusters will now use the Machine API, where a node pool "aksmanagednap" will exist in your cluster to represent each NAP managed virtual machine instance. +* Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). +* The naming convention for Node Auto-Provisioning (NAP) managed nodes will change from - to aks-aksmanagedap--########-vm. #### Bug fixes From 1db667039357b5a14ec77bf5c8a07c0a0063f248 Mon Sep 17 00:00:00 2001 From: Wilson Date: Wed, 10 Jun 2026 08:56:16 -0700 Subject: [PATCH 02/12] Update CHANGELOG with NAP managed cluster details Clarified Node Auto Provisioning (NAP) changes regarding machine manager role and deletion policies in the changelog. --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 266f4b769..e4526c8ff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -54,7 +54,8 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. * Use of specific labels for AKS nodes are prohibited from user-input, including "agentpool", "storageprofile", storagetier", "accelerator", and labels with a prefix of "kubernetes.azure.com". -* Node Auto Provisioning (NAP) managed clusters will now use the Machine API, where a node pool "aksmanagednap" will exist in your cluster to represent each NAP managed virtual machine instance. +* Node Auto Provisioning (NAP) managed clusters will now use the Machine API, where a node pool "aksmanagednap" will exist in your cluster to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. +* New and existing clusters with Node Auto Provisioning (NAP) enabled will now have machine manager role granted on the cluster identity. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). * The naming convention for Node Auto-Provisioning (NAP) managed nodes will change from - to aks-aksmanagedap--########-vm. From 8994544b8dcd32ec98ed40dbe27c4d9c9704e45d Mon Sep 17 00:00:00 2001 From: Wilson Date: Wed, 10 Jun 2026 16:54:09 -0700 Subject: [PATCH 03/12] Update CHANGELOG for AKS feature changes Revise details on machine api node pool name in NAP clusters --- CHANGELOG.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e4526c8ff..99ee02e3e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -53,11 +53,11 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Use of specific labels for AKS nodes are prohibited from user-input, including "agentpool", "storageprofile", storagetier", "accelerator", and labels with a prefix of "kubernetes.azure.com". -* Node Auto Provisioning (NAP) managed clusters will now use the Machine API, where a node pool "aksmanagednap" will exist in your cluster to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. +* Use of specific labels for AKS nodes are prohibited from user-input, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com`. +* Node Auto Provisioning (NAP) managed clusters will now use the Machine API, where a managed machines-mode node pool named `aksmanagedap` will exist in your cluster to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. * New and existing clusters with Node Auto Provisioning (NAP) enabled will now have machine manager role granted on the cluster identity. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). -* The naming convention for Node Auto-Provisioning (NAP) managed nodes will change from - to aks-aksmanagedap--########-vm. +* The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. #### Bug fixes From 8b6e192484a6d753acb8736c7f8057410d324d9b Mon Sep 17 00:00:00 2001 From: Wilson Date: Wed, 10 Jun 2026 17:25:04 -0700 Subject: [PATCH 04/12] Update CHANGELOG with mixed SKU autoscaling feature Added information about mixed SKU autoscaling in Virtual Machine node pools to the changelog. --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 99ee02e3e..6734e384f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -43,6 +43,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * [Azure Linux 3.0 confidential VM (CVM)](https://learn.microsoft.com/azure/aks/use-azure-linux) is now available in preview in Fairfax (US Gov) regions. Register the `AzureLinuxCVMPreview` feature to enable it. * [In-place node pool resize](https://learn.microsoft.com/azure/aks/resize-node-pool) is now available in preview. Resize the VM size of an existing VMSS-based node pool in place via `az aks nodepool update --node-vm-size`, without manually creating and migrating to a new node pool. +* [Mixed SKU autoscaling in Virtual Machine node pools](https://learn.microsoft.com/azure/aks/virtual-machines-node-pools#cluster-autoscaler-with-virtual-machines-node-pools-preview) is now available in preview. This allows users to select multiple VM sizes in the same node pool using cluster autoscaler with virtual machine node pools. #### Behavioral changes From a88acf55d8f5a5885ee04f9dfed5074fb900d564 Mon Sep 17 00:00:00 2001 From: Wilson Date: Thu, 25 Jun 2026 06:19:46 -0700 Subject: [PATCH 05/12] Update CHANGELOG.md --- CHANGELOG.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6734e384f..a04a0e9b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,7 +36,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * [Azure Container Linux](https://learn.microsoft.com/azure/azure-linux/azure-container-linux-overview) is generally available (GA) as an OS option on AKS starting AKS v1.34. You can deploy ACL node pools in a new AKS cluster or add ACL node pools to your existing clusters. AKS also supports migrating existing node pools to ACL using in-place OS SKU migration or by creating new ACL node pools. For detailed migration steps, considerations, and rollback instructions, see [Migrate existing nodes to ACL](https://learn.microsoft.com/azure/azure-linux/tutorial-migrate-azure-container-linux-aks). * [Azure Policy add-on](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) now generates ValidatingAdmissionPolicies (VAP) for all customers. This enforces CEL-based policies inside the API server process for minimal latency and enables fail-closed enforcement. * Node Auto Provisioning (NAP) managed clusters can now enable custom OS settings for Linux. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. -* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. +* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, Nvidia GPU Operator and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. #### Preview features @@ -54,9 +54,9 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Use of specific labels for AKS nodes are prohibited from user-input, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com`. -* Node Auto Provisioning (NAP) managed clusters will now use the Machine API, where a managed machines-mode node pool named `aksmanagedap` will exist in your cluster to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. -* New and existing clusters with Node Auto Provisioning (NAP) enabled will now have machine manager role granted on the cluster identity. +* Use of specific labels for AKS nodes is restricted from user input, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com`. New subscriptions using NAP are no longer able to select these labels, and existing subscriptions will be restricted on 30 September 2026. For more information see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707) +* Node Auto Provisioning (NAP) managed clusters will now include a managed machines-mode node pool named `aksmanagedap`. This machine node pool is used to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. +* The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now have a `machine manager` role granted. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). * The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. From aeedc3e7cdc5209e813c7bf5681f6c3d29561a9a Mon Sep 17 00:00:00 2001 From: Wilson Date: Thu, 25 Jun 2026 06:27:47 -0700 Subject: [PATCH 06/12] Fix capitalization and grammar in CHANGELOG.md Corrected capitalization of 'Nvidia' to 'NVIDIA' and made minor grammatical adjustments in the changelog. --- CHANGELOG.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d0245c015..9b676e609 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,14 +36,14 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * [Azure Container Linux](https://learn.microsoft.com/azure/azure-linux/azure-container-linux-overview) is generally available (GA) as an OS option on AKS starting AKS v1.34. You can deploy ACL node pools in a new AKS cluster or add ACL node pools to your existing clusters. AKS also supports migrating existing node pools to ACL using in-place OS SKU migration or by creating new ACL node pools. For detailed migration steps, considerations, and rollback instructions, see [Migrate existing nodes to ACL](https://learn.microsoft.com/azure/azure-linux/tutorial-migrate-azure-container-linux-aks). * [Azure Policy add-on](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) now generates ValidatingAdmissionPolicies (VAP) for all customers. This enforces CEL-based policies inside the API server process for minimal latency and enables fail-closed enforcement. * Node Auto Provisioning (NAP) managed clusters can now enable custom OS settings for Linux. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. -* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, Nvidia GPU Operator and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. +* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, NVIDIA GPU Operator, and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. * [AKS end of support notifications](https://learn.microsoft.com/azure/aks/aks-end-of-support-notifications) are now available. AKS automatically notifies you when your cluster's Kubernetes version is approaching or has passed its end of support date. Alerts are sent two weeks before end of support, one week before end of support, and then weekly after the support date passes—no monitoring add-on or maintenance window configuration required. Notifications are published to Azure Resource Graph and can be surfaced via email alerts or real-time Event Grid webhooks. #### Preview features * [Azure Linux 3.0 confidential VM (CVM)](https://learn.microsoft.com/azure/aks/use-azure-linux) is now available in preview in Fairfax (US Gov) regions. Register the `AzureLinuxCVMPreview` feature to enable it. * [In-place node pool resize](https://learn.microsoft.com/azure/aks/resize-node-pool) is now available in preview. Resize the VM size of an existing VMSS-based node pool in place via `az aks nodepool update --node-vm-size`, without manually creating and migrating to a new node pool. -* [Mixed SKU autoscaling in Virtual Machine node pools](https://learn.microsoft.com/azure/aks/virtual-machines-node-pools#cluster-autoscaler-with-virtual-machines-node-pools-preview) is now available in preview. This allows users to select multiple VM sizes in the same node pool using cluster autoscaler with virtual machine node pools. +* [Mixed SKU autoscaling in virtual machine node pools](https://learn.microsoft.com/azure/aks/virtual-machines-node-pools#cluster-autoscaler-with-virtual-machines-node-pools-preview) is now available in preview. This allows users to select multiple VM sizes in the same node pool using cluster autoscaler with virtual machine node pools. * [Automatic Pod Disruption Budget management](https://learn.microsoft.com/azure/aks/automatic-pod-disruption-budget-management) is now available in preview. The AKS extension automatically creates PDBs for deployments without PDBs and temporarily scales up replicas to unblock node drain when a PDB would prevent eviction, then scales back down—reducing the need for manual intervention during upgrade drain failures. #### Behavioral changes @@ -55,7 +55,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Use of specific labels for AKS nodes is restricted from user input, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com`. New subscriptions using NAP are no longer able to select these labels, and existing subscriptions will be restricted on 30 September 2026. For more information see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707) +* Use of specific labels for AKS nodes is restricted from user input, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/`. New subscriptions using NAP are no longer able to select these labels, and existing subscriptions will be restricted on 30 September 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). * Node Auto Provisioning (NAP) managed clusters will now include a managed machines-mode node pool named `aksmanagedap`. This machine node pool is used to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. * The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now have a `machine manager` role granted. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). From 11837a366a3f319bf287d930a40ccff883b65e74 Mon Sep 17 00:00:00 2001 From: Wilson Date: Mon, 6 Jul 2026 10:00:48 -0700 Subject: [PATCH 07/12] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b676e609..843578b4b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,9 +55,9 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Use of specific labels for AKS nodes is restricted from user input, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/`. New subscriptions using NAP are no longer able to select these labels, and existing subscriptions will be restricted on 30 September 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). -* Node Auto Provisioning (NAP) managed clusters will now include a managed machines-mode node pool named `aksmanagedap`. This machine node pool is used to represent each NAP managed virtual machine instance. This node pool cannot be user-deleted, and will be deleted during NAP-disable. -* The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now have a `machine manager` role granted. +* Use of specific labels for AKS nodes is restricted from being set by users, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/`. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). +* Node Auto Provisioning (NAP) managed clusters will now include a managed machines-mode node pool named `aksmanagedap`. This machine node pool is used to represent each NAP managed virtual machine instance. This node pool can't be deleted by you and will be deleted when you disable NAP. +* The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now be granted the `machine manager` role. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). * The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. From 8043c9ecaae8ae4d49d559d6781415640eec35d0 Mon Sep 17 00:00:00 2001 From: Wilson Date: Mon, 13 Jul 2026 09:05:52 -0700 Subject: [PATCH 08/12] Revise NAP features and documentation links in CHANGELOG Updated Node Auto Provisioning (NAP) features for Linux nodes and GPU support with additional documentation links. --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 843578b4b..c228c823c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,8 +35,8 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * [Windows Server 2025](https://aka.ms/aks/upgrade-windows-os-version) is now generally available. You no longer need to register a feature flag to create Windows Server 2025 node pools. Windows Server 2025 node pools can be created in Kubernetes version 1.32+ with a minimum GA CLI version of 2.87.0. * [Azure Container Linux](https://learn.microsoft.com/azure/azure-linux/azure-container-linux-overview) is generally available (GA) as an OS option on AKS starting AKS v1.34. You can deploy ACL node pools in a new AKS cluster or add ACL node pools to your existing clusters. AKS also supports migrating existing node pools to ACL using in-place OS SKU migration or by creating new ACL node pools. For detailed migration steps, considerations, and rollback instructions, see [Migrate existing nodes to ACL](https://learn.microsoft.com/azure/azure-linux/tutorial-migrate-azure-container-linux-aks). * [Azure Policy add-on](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) now generates ValidatingAdmissionPolicies (VAP) for all customers. This enforces CEL-based policies inside the API server process for minimal latency and enables fail-closed enforcement. -* Node Auto Provisioning (NAP) managed clusters can now enable custom OS settings for Linux. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. -* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, NVIDIA GPU Operator, and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass) for more information. +* Node Auto Provisioning (NAP) managed clusters can now enable custom OS settings for Linux nodes. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass#linux-custom-os-configuration-settings) for more information. +* Node Auto Provisioning (NAP) managed clusters can now support AMD GPU SKUs, NVIDIA GPU Operator, and custom driver installation via the AKSNodeClass. See our [AKSNodeClass documentation](https://learn.microsoft.com/azure/aks/node-auto-provisioning-aksnodeclass), and [GPU Operator on AKS documentation](https://learn.microsoft.com/azure/aks/nvidia-gpu-operator?tabs=nap-nodes) for more information. * [AKS end of support notifications](https://learn.microsoft.com/azure/aks/aks-end-of-support-notifications) are now available. AKS automatically notifies you when your cluster's Kubernetes version is approaching or has passed its end of support date. Alerts are sent two weeks before end of support, one week before end of support, and then weekly after the support date passes—no monitoring add-on or maintenance window configuration required. Notifications are published to Azure Resource Graph and can be surfaced via email alerts or real-time Event Grid webhooks. #### Preview features From f1c3bd0accf4ae9a1389040021caba5132a22d9d Mon Sep 17 00:00:00 2001 From: Wilson Date: Mon, 13 Jul 2026 09:09:46 -0700 Subject: [PATCH 09/12] Update CHANGELOG with preview features and changes --- CHANGELOG.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c228c823c..e40b37f14 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -43,7 +43,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * [Azure Linux 3.0 confidential VM (CVM)](https://learn.microsoft.com/azure/aks/use-azure-linux) is now available in preview in Fairfax (US Gov) regions. Register the `AzureLinuxCVMPreview` feature to enable it. * [In-place node pool resize](https://learn.microsoft.com/azure/aks/resize-node-pool) is now available in preview. Resize the VM size of an existing VMSS-based node pool in place via `az aks nodepool update --node-vm-size`, without manually creating and migrating to a new node pool. -* [Mixed SKU autoscaling in virtual machine node pools](https://learn.microsoft.com/azure/aks/virtual-machines-node-pools#cluster-autoscaler-with-virtual-machines-node-pools-preview) is now available in preview. This allows users to select multiple VM sizes in the same node pool using cluster autoscaler with virtual machine node pools. +* [Mixed SKU autoscaling in virtual machine node pools](https://learn.microsoft.com/azure/aks/virtual-machines-node-pools#cluster-autoscaler-with-virtual-machines-node-pools-preview) is now available in preview. This allows users to select multiple VM sizes in the same node pool using cluster autoscaler with virtual machine node pools. * [Automatic Pod Disruption Budget management](https://learn.microsoft.com/azure/aks/automatic-pod-disruption-budget-management) is now available in preview. The AKS extension automatically creates PDBs for deployments without PDBs and temporarily scales up replicas to unblock node drain when a PDB would prevent eviction, then scales back down—reducing the need for manual intervention during upgrade drain failures. #### Behavioral changes @@ -55,8 +55,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Use of specific labels for AKS nodes is restricted from being set by users, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/`. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). -* Node Auto Provisioning (NAP) managed clusters will now include a managed machines-mode node pool named `aksmanagedap`. This machine node pool is used to represent each NAP managed virtual machine instance. This node pool can't be deleted by you and will be deleted when you disable NAP. +* Setting certain labels on AKS nodes is now restricted including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/` which are not well-known labels. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). * The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now be granted the `machine manager` role. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). * The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. From 54cf1b2ccb1ca63d562bcde372d7be2abae88ebd Mon Sep 17 00:00:00 2001 From: Wilson Date: Wed, 22 Jul 2026 12:07:28 -0700 Subject: [PATCH 10/12] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e40b37f14..3f9435c44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,8 +55,8 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Setting certain labels on AKS nodes is now restricted including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/` which are not well-known labels. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). -* The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now be granted the `machine manager` role. +* Setting certain labels on AKS nodes is now restricted, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/` that aren't well-known labels. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). +* The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now be granted the `AKS Nodepool Machine Manager` role. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). * The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. From 80986335c4c162f9834360f5468b6bd8d151183b Mon Sep 17 00:00:00 2001 From: Wilson Date: Fri, 24 Jul 2026 07:59:02 -0700 Subject: [PATCH 11/12] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f9435c44..2b8a280ff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,7 +55,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Setting certain labels on AKS nodes is now restricted, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/` that aren't well-known labels. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). +* On Node Auto Provisioning (NAP) clusters, setting certain node labels is now restricted, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/` that aren't among the well-known labels. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). * The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now be granted the `AKS Nodepool Machine Manager` role. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). * The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. From df35114cd31caeb3fa827fafaeb8d72453ce67eb Mon Sep 17 00:00:00 2001 From: Wilson Date: Fri, 24 Jul 2026 10:15:21 -0700 Subject: [PATCH 12/12] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2b8a280ff..8bdaf4b7a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -58,7 +58,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * On Node Auto Provisioning (NAP) clusters, setting certain node labels is now restricted, including `agentpool`, `storageprofile`, `storagetier`, `accelerator`, and labels with a prefix of `kubernetes.azure.com/` that aren't among the well-known labels. New subscriptions using NAP can no longer set these labels, and existing subscriptions will be restricted on September 30, 2026. For more information, see [Azure Karpenter Provider Issue #1707](https://github.com/Azure/karpenter-provider-azure/issues/1707). * The cluster identity of Node Auto Provisioning (NAP) enabled clusters will now be granted the `AKS Nodepool Machine Manager` role. * Custom subnets are no longer permitted on Node Auto Provisioning (NAP) managed clusters using system-assigned identities. For custom subnets with NAP managed clusters, use user-assigned identities. To set up a user-assigned identity, see our [documentation](https://learn.microsoft.com/azure/aks/user-assigned-managed-identity). -* The naming convention for Node Auto Provisioning (NAP) managed nodes will change from `nodepool-name-hash` to `aks-aksmanagedap-nodepool-name-########-vm`. +* The naming convention for Node Auto Provisioning (NAP) managed nodes is now `aks-aksmanagedap-nodepool-name-########-vm` instead of `nodepool-name-hash`. #### Bug fixes