Skip to content

Release 2026-07-17

Latest
Latest

Choose a tag to compare

View all tags
@alvinli222 alvinli222 released this 24 Jul 18:39
2026-07-17
6c24387
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes - 2026-07-17

Monitor the release status by regions at AKS-Release-Tracker. This release is titled v20260717.

Announcements of upcoming changes and retirements

  • On September 14, 2026, the preview property enableCustomCATrust will retire. After that date, the enableCustomCATrust=true node pool level field will no longer enable Custom Certificate Authority (CA). To avoid failures during scaling and certificate updates, update the impacted clusters and node pools and remove the preview property (--disable-custom-ca-trust).
  • AKS no longer supports creating node pools with Windows Server Annual Channel for Containers. Existing WSAnnual node pools are unaffected. For more information, see Windows Annual Channel retirement.
  • AKS no longer supports creating node pools or clusters with Flatcar Container Linux for AKS. Existing node pools are unaffected. For more information, see Flatcar preview retirement.
  • Customers using NVadsA10v5 or NCadsA10v4 node pools should verify they are running AKS node image version 202606.08.1 or later to maintain compatibility with updated NVIDIA v18.x host drivers. Clusters running older node images may encounter host/guest GPU driver compatibility issues and move into an unsupported configuration. For upgrade guidance, see the AKS node image upgrade documentation. See Github issue for more information.

Release notes

Kubernetes versions

Features

  • Artifact Streaming is now generally available. The feature allows you to stream container images from Azure Container Registry (ACR) to Azure Kubernetes Service (AKS). AKS only pulls the necessary layers for initial pod startup, reducing the time it takes to deploy your workloads.
  • Secure TLS bootstrapping is now enabled by default in westcentralus and eastasia. See regional updates on AKS GitHub Issues.
  • Secure Boot is now supported when using GPUs with Azure Linux OS.
  • Trusted Launch (vTPM and Secure Boot) can now be enabled and disabled on existing Linux node pools.

Preview features

  • Node Disruption Policy is now available in public preview. Node Disruption Policy lets you control when reimage-triggering operations are allowed so disruptive changes happen during windows you define.
  • NAT Gateway V2 is now available in public preview using outboundType: managedNATGateway with natGatewayProfile.sku: standardV2 (API version 2026-06-01).
  • Automatic zone placement is now available in public preview. Automatic zone placement in AKS dynamically selects the best set of availability zones for a node pool. You don't need to specify the zones manually for each region and VM SKU combination.

Behavioral changes

  • Starting with Kubernetes 1.37 (expected to be available in October 2026), Windows Server 2025 is the default and recommended OS SKU for new Windows node pools when no OS SKU is specified. For more information, see Windows best practices.
  • For Node Auto Provisioning enabled clusters, AKS now sets kubernetes.azure.com/mode: user on the default NodePool to help prevent pending system workloads from causing user node scale-up.
  • Node Auto-Provisioning enabled clusters now use an In-VM spot rebalancing signal, which allows for an improved spot eviction notification and proactive spot replacement.
  • AKS now rejects kube-proxy nftables mode at request time on clusters running Kubernetes versions older than 1.33, instead of accepting the request and silently falling back to iptables.
  • AKS now accepts mixed-case networkPlugin values for supported network plugin options during cluster creation.
  • The until field in upgrade override settings can now be set to any future date; AKS no longer rejects values more than 30 days in the future.
  • CNI Overlay Dual-Stack on Windows no longer requires a preview feature registration.

Bug fixes

  • Fixed an issue where API Server Authorized IP Ranges using only service tags were not enforced on API Server VNet Integration clusters.
  • Fixed Container Insights onboarding through AzureMonitorProfile so re-enabling Container Insights uses AAD auth and blocks unsafe Log Analytics Workspace changes under legacy auth.
  • Fixed an issue where clusters with an existing kube-proxy configuration object could not be updated unless KubeProxyConfigurationPreview was registered, even when the update did not change kube-proxy configuration.
  • Fixed App Routing Istio manifest values so resource requests and limits are populated correctly.
  • Fixed Static Egress Gateway VMSS model reconciliation so secondary egress IP configurations are preserved.
  • Re-enabled Cilium source IP verification on Cilium v1.17+ to restore dataplane anti-spoofing protection.
  • Fixed AKS support for Istio 1.30 mutating webhook configuration updates on Automatic clusters.
  • Fixed Node Auto Provisioning issue where load balancer deletion could block node provisioning.
  • Fixed Node Auto Provisioning to normalize CSI empty-zone topology value to regional zone "0".

Component updates

Assets 2
Loading