Azure/AKS 2026-10-25

Release 2026-10-25

on GitHub

Release Notes - 2026-10-25

Monitor the release status by regions at AKS-Release-Tracker. This release is titled v20261025.

Announcements of upcoming changes and retirements

• Starting on June 1, 2027, AKS automatically upgrades any cluster that stays on an unsupported Kubernetes version after its 60-day platform support grace period ends.
  • What’s changing: AKS will be able to automatically initiate upgrades to help keep clusters supported, secure, and aligned with platform lifecycle requirements.
  • How to prepare now: Review upgrade channels, maintenance windows, and workload readiness so your clusters can absorb automated upgrade events with minimal disruption. See: Platform-initiated upgrades.
• Starting with Kubernetes 1.38, node pools that use the Ubuntu OS SKU will default to Ubuntu 26.04. To continue using Ubuntu 24.04 on Kubernetes 1.38, specify the Ubuntu2404 OS SKU. For more information, see Upgrade the OS version for your AKS node pools.

Release notes

Kubernetes versions

• Kubernetes version 1.37 is now generally available and designated as a Long-Term Support (LTS) version. Kubernetes 1.36 is now the default version for new clusters.
• Kubernetes patch versions 1.37.1, 1.36.5, 1.35.9, and 1.34.12 are now available.
• Community support for Kubernetes version 1.34 and LTS support for Kubernetes version 1.31 are going soon end of life by November 2026. Please review the calendar and platform support policy.

More information on supported versions and version support policy is available in documentation.

Features

• Node Auto Provisioning (NAP) now supports the following capabilities:
  • Capacity Reservation Groups.
  • The Capacity Buffers CRD, which specifies a fixed number of surplus nodes.
  • OS disk type selection with the osDiskType field in the AKSNodeClass CRD.
  • Pinning the current node image version and specifying Kubernetes versions.
  • Trusted Launch through the AKSNodeClass CRD.
  • Azure Container Linux as the node OS.
  • Managed GPU, enabled with a field in the AKSNodeClass CRD.
• Node Auto Provisioning (NAP) will now have the following changes:
  • Instance-level public IPs with the spec.nodePublicIP field in the AKSNodeClass CRD.
  • VM SKUs within about six months of retirement are no longer selected for new nodes. See document for details.
  • NAP-enabled clusters now include an AKS-managed aksmanagednap node pool, which represents NAP machines through the Machine API for better integration with other AKS features. See the Azure Karpenter Provider github issue for more details.
  • When osDiskSizeGB isn't specified, the default OS disk size now matches AKS behavior, including SKU-appropriate ephemeral disk sizing where supported.
  • Before choosing an ephemeral disk, NAP now checks eligible disk placements and accounts for Trusted Launch storage needs, preventing failed provisioning.
  • NAP now respects external load balancer exclusions when deciding whether to add nodes to external load balancers.

Preview features

• Windows node support for Node Auto Provisioning (NAP) is now available in preview. Supports Windows Server 2022 and Windows Server 2025 nodes; Cilium isn't supported on Windows nodes.
• IPv4/IPv6 Dualstack support in Node Auto Provisioning (NAP) managed clusters is now available in preview.
• Updating node public IP prefixes on existing node pools is now available as preview in public Azure regions. Supports adding, replacing, and reordering IPv4 and IPv6 prefixes; changing prefixes recreates the affected nodes. Not yet available in sovereign clouds.
• Converting AKS Base clusters to AKS Automatic with managed system node pools is now available as preview. See document for details.

Behavioral changes

• Istio Gateway API ConfigMap customization now supports Service spec.ports and Deployment seccomp profile settings for the Istio add-on and Application Routing with Istio.
• Istio-based service mesh add-on will now intercept both IPv4 and IPv6 workload traffic on dual-stack clusters. Restart existing workloads after the add-on update to apply the new proxy configuration.
• Application Routing Gateway API controller will now run on the managed system node pool in AKS Automatic clusters, improving isolation between the control plane and data plane.
• [AKS Automatic](https://learn.microsoft.com/azure/aks/intro-aks-automatic) clusters on Kubernetes 1.36+ now exclude protected system namespaces from customer mutating admission configurations to preserve the AKS Automatic security boundary: customer webhooks and policies can still mutate customer workloads, but they can’t mutate AKS-managed system workloads.
• Platform-managed keys for etcd encryption will now be enabled by default for new clusters on Kubernetes 1.37 and later, unless infrastructure encryption is explicitly configured.
• Azure Policy for Kubernetes can now evaluate DELETE operations on Kubernetes resources for policies that explicitly opt in. Existing policies don't enforce DELETE operations.
• Prepared Image Specification (preview) will now require the Microsoft.ContainerService/preparedImageSpecifications/versions/read permission for pinned image versions. Requests without this permission are rejected, and image bakes fail on authorization errors instead of falling back.
• Generation 2 VMs will now be selected for new Windows Server 2022 node pools when the VM size supports only Generation 2. Previously, node pool creation on these VM sizes could fail.
• Availability set (VMAS) node pools are now automatically migrated to Virtual Machines node pools during planned maintenance windows in 23 regions, as announced for the September 30, 2026 VMAS retirement. This includes clusters without an auto-upgrade channel. The migration reprovisions the node pool and may disrupt workloads; Basic Load Balancer and Basic public IP resources are converted to Standard. To control the timing, migrate your clusters before your next maintenance window by using az aks update --migrate-vmas-to-vms. The enabled regions are australiaeast, australiasoutheast, brazilsouth, canadacentral, centralindia, eastasia, francecentral, germanywestcentral, japaneast, northcentralus, polandcentral, southafricanorth, southcentralus, southeastasia, southindia, spaincentral, swedencentral, switzerlandnorth, uksouth, ukwest, westcentralus, westus, westus2. For more information, see Availability sets on AKS.
• Cilium, Hubble, and ACNS security agent images have been upgraded:
  • v1.18.14-260923 and v1.19.8-261006 on AKS 1.36 and earlier
  • v1.20.2-260921 on AKS 1.37 and later. Cilium 1.20 no longer enforces Kafka-aware network policies; remove Kafka-aware policy rules before upgrading from AKS 1.36.

Bug fixes

• Fixed an issue where flex node pool upgrades failed when a customer-managed host was temporarily offline and had no registered Kubernetes node. Unregistered hosts now count against maxUnavailable, and the remaining hosts continue upgrading.
• Fixed an issue where the Microsoft Defender for Containers collector pod restarted repeatedly after running out of memory when antimalware was enabled. The antimalware collector has been updated to 1.0.27.

Component updates

• Cloud Provider Azure components, including cloud-controller-manager and cloud-node-manager, have been upgraded:
  • v1.31.17-1 on AKS 1.31
  • v1.32.23-1 on AKS 1.32
  • v1.33.20-1 on AKS 1.33
  • v1.34.16-1 on AKS 1.34
  • v1.35.11-1 on AKS 1.35
  • v1.36.8-1 on AKS 1.36
  • v1.37.1-1 on AKS 1.37, which rejects managed frontend IPs in the service.beta.kubernetes.io/azure-additional-public-ips annotation. Correct affected Service annotations before upgrading.
• Azure CNI and CNS have been upgraded:
  • v1.8.15 on AKS 1.35 and 1.36
  • v1.9.3 on AKS 1.37 and later
• Azure CSI drivers have been upgraded:
  • Azure Disk CSI driver to v1.33.15 on AKS 1.34, v1.34.9 on AKS 1.35 and 1.36, and v1.36.1 on AKS 1.37 and later
  • Azure File CSI driver to v1.34.11 on AKS 1.34 and v1.35.11 on AKS 1.35 and later
  • Azure Blob CSI driver to v1.27.11 on AKS 1.34 and later
• Istio-based service mesh add-on revision asm-1-31 is now available, and revisions asm-1-29 and asm-1-30 have been updated with patch releases 1.29.8-3 and 1.30.5-3. To adopt the patch updates, restart workloads to trigger sidecar re-injection of the new istio-proxy version. For more information, see Upgrade the Istio-based service mesh add-on.
• Konnectivity has been updated to v0.37.0, which includes improved backend dial handling and graceful connection draining.
• Ratify has been updated to v1.4.7.
• Retina has been updated to v1.2.9.
• The NVIDIA GRID driver for Windows GPU node pools has been updated to 582.78 in public Azure regions.
• kube-apiserver, kube-controller-manager, kube-scheduler, and kube-proxy images have been updated with new AKS builds across Kubernetes 1.31 to 1.37 patch versions.
• CoreDNS images have been upgraded:
  • v1.11.3-41 on AKS 1.32
  • v1.12.1-36 on AKS 1.33
  • v1.13.1-33 on AKS 1.34 and 1.35
  • v1.14.3-27 on AKS 1.36
  • v1.14.7-6 on AKS 1.37 and later
• Cluster autoscaler images have been upgraded:
  • v1.30.7-aks-17 on AKS 1.30
  • v1.31.5-aks-19 on AKS 1.31
  • v1.32.7-aks-20 on AKS 1.32
  • v1.33.6-aks-11 on AKS 1.33
  • v1.34.5-aks-10 on AKS 1.34
  • v1.35.2-aks-11 on AKS 1.35 and later
• KEDA add-on images have been upgraded:
  • 2.14.1-31 on AKS 1.30 and 1.31
  • 2.16.1-32 on AKS 1.32
  • 2.17.3-25 on AKS 1.33 to 1.35
  • 2.19.0-24 on AKS 1.36
  • 2.20.2-12 on AKS 1.37 and later
• Metrics Server images have been upgraded:
  • v0.7.2-37 on AKS 1.32 and 1.33
  • v0.8.0-30 on AKS 1.34 and later
• Workload identity webhook has been updated to v1.5.1-24 on all supported AKS versions.
• Azure Key Vault provider for Secrets Store CSI Driver has been updated to v1.8.2-13 on all supported AKS versions.
• Application routing NGINX ingress controller images have been updated to v1.13.10-13 and v1.15.1-23, and ExternalDNS has been updated to v0.21.0-15, on all supported AKS versions.
• Static Egress Gateway has been updated to v0.1.9-3 on AKS 1.34 and later.
• NVIDIA device plugin has been updated to v0.18.2-24 on all supported AKS versions.
• AKS Windows images:
  • Windows Server 2022 - 20348.5761.261015.
  • Windows Server 2025 - 26100.33650.261015.
• AKS Azure Linux images:
  • v3.0 - 202610.16.1.
• AKS Azure Container Linux images:
  • ACLv3 - 202610.16.1.
• AKS Ubuntu images:
  • Ubuntu 22.04 - 202610.16.1.
  • Ubuntu 24.04 - 202610.16.1.
  • Ubuntu 26.04 - 202610.16.1.