Skip to content

Release 2026-08-07

Latest
Latest

Choose a tag to compare

View all tags
@allyford allyford released this 11 Aug 22:09
2026-08-07
4e01af7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes - 2026-08-07

Monitor the release status by regions at AKS-Release-Tracker. This release is titled v20260807.

Release notes

Features

  • Node Auto Provisioning can now be enabled on clusters with restricted publicNetworkAccess, including private API server VNet-integrated clusters using UDR, as long as the existing AKS-wide networking guardrails pass.
  • Automatic availability zone placement is now enabled globally. Customers can create new VMSS or VirtualMachines node pools with availabilityZones=["auto"], and existing VMSS node pools can be updated to availabilityZones=["auto"] after rollout completes.
  • AKS now allows control-plane only upgrades to AKS Long Term Support (LTS) as long as the version skew policy is satisfied. This allows user to more safely upgrade into LTS by first upgrading the control plane, validating functionality, and then upgrading node pools.
  • AKS Node pool Rollback is now generally available. AKS node pool version rollback lets you restore a node pool to its previous Kubernetes version and node image after an upgrade issue, minimizing downtime and maintaining business continuity.

Preview features

  • Prepared Image Specification (PIS) is now available in public preview. PIS allows you to create preconfigured node images with your required container images and node customizations already applied, helping to reduce node startup times.
  • Customers using preview API version 2026-01-02-preview or later can associate a Capacity Reservation Group with an existing node pool. Zonal node pools perform a rolling cordon, drain, and reboot; non-zero regional pools must still be scaled to zero first.

Behavioral changes

  • For AKS clusters running Kubernetes 1.37 or later, SSH node access configuration changes now trigger an immediate node reimage. Use Node Disruption Policy to block the reimage or schedule it during a maintenance window.
  • For AKS clusters running Kubernetes 1.37 or later, changes to IMDS restriction, network-isolated bootstrap profile, or cluster outbound type now trigger an immediate node reimage. Use Node Disruption Policy to control when the reimage is allowed.
  • VMSS rolling upgrade concurrency for percentage-based maxSurge, maxUnavailable, and maxBlockedNodes is now calculated from current VMSS capacity and capped to the remaining VMs to upgrade, making partial upgrades match the remaining upgrade work. For more details see the documentation on rolling upgrade behaviors.
  • Updating a cluster from service principal authentication to managed identity now triggers node reimages across node pools. Configure Node Disruption Policy to control when reimages that can disrupt workloads are allowed.
  • AKS upgrade validation now rejects node pool upgrades where current pool size plus effective surge would exceed the VMSS 1,000-instance limit, preventing mid-upgrade Azure Compute failures. See 'Configure rolling upgrade settings' for more details.
  • Istio Gateway API deployments now set automountServiceAccountToken to false, improving the default security posture and unblocking environments with Azure Policies that require pods to disable service account token auto-mounting.
  • AKS now validates GPU MIG instance profile slice width against VM SKU capacity, preventing unsupported MIG profiles from being accepted on lower-capacity GPU SKUs.
  • The Application Gateway for Containers ALB add-on is now aligned with AKS minor versions. AKS automatically selects the compatible ALB controller image during cluster upgrades, reducing controller and feature-flag incompatibilities.
  • AKS now rejects Entra ID SSH configuration on AzureContainerLinux node pools because the extension is incompatible with immutable OS nodes and can make nodes unreachable.

Bug fixes

  • Fixed an AKS Automatic issue where App Routing on Kubernetes 1.36+ clusters could incorrectly default to NGINX instead of Istio/Gateway API mode during cluster creation.

Component updates

  • Node Auto Provisioning has been updated to Karpenter provider Azure v1.14.0, adding support for the Balanced consolidation policy to reduce node churn during consolidation.
  • Azure Policy add-on components were updated: Gatekeeper was bumped to 3.23.0, and Azure Policy add-on was bumped to 1.17.0.
  • Azure File CSI Driver has been upgraded to v1.34.7 on AKS 1.34 and v1.35.6 on AKS 1.35 and 1.36.
  • Azure Blob CSI Driver has been upgraded to v1.26.16 on AKS 1.33 and v1.27.9 on AKS 1.34 and later.
  • Azure Disk CSI Driver has been upgraded to v1.33.11 on AKS 1.34 and v1.34.5 on AKS 1.35 and 1.36.
  • Azure Monitor managed service for Prometheus add-on was updated to the 07-27-2026 release, including collector image updates and kube-state-metrics v2.19.1-2.
  • Container Insights has been upgraded to 3.6.0.
  • AKS Azure Linux images:
  • AKS Azure Container Linux images:
  • AKS Ubuntu images:
Assets 2
Loading