Repository navigation
docs: add AKS v20261023 release notes - #6043
Open
Dian Yu (dyu1208) wants to merge 2 commits into
Open
Dian Yu (dyu1208) wants to merge 2 commits into
Dian Yu (dyu1208) wants to merge 2 commits into
Conversation
Add the 2026-10-23 release section to CHANGELOG.md and the node image release notes it links, copied from AgentBaker. Co-Authored-By: Claude <noreply@anthropic.com>
Dian Yu (dyu1208)
marked this pull request as ready for review
October 23, 2026 21:35
Dian Yu (dyu1208)
requested review from
a team and
Jorge Palma (palma21)
as code owners
October 23, 2026 21:35
Dian Yu (dyu1208)
requested review from
Robbie Zhang (robbiezhang)
and
a balanced review from Copilot
October 23, 2026 21:35
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Regional rollout, feature availability, and disruptive migration claims require release-owner confirmation against the underlying release changes.
No open issues 🎉
What changed in this PR
Adds the AKS v20261023 release notes to the repository’s release history, with customer-facing changes and supporting node image inventories.
Changes:
- Documents Kubernetes availability, features, previews, behavioral changes, and bug fixes.
- Lists component updates and links the latest node image notes for each family.
- Adds build details and component inventories for node images.
| File | Description |
|---|---|
vhd-notes/AzureLinuxv3/202610.16.1.txt |
Adds Azure Linux 3 build inventory for October 16. |
vhd-notes/AzureLinuxv3/202610.08.0.txt |
Adds Azure Linux 3 build inventory for October 8. |
vhd-notes/AzureLinuxv3/202610.03.0.txt |
Adds Azure Linux 3 build inventory for October 3. |
vhd-notes/AzureContainerLinuxv3/202610.16.1.txt |
Adds Azure Container Linux build details for October 16. |
vhd-notes/AzureContainerLinuxv3/202610.08.0.txt |
Adds Azure Container Linux build details for October 8. |
vhd-notes/AzureContainerLinuxv3/202610.03.0.txt |
Adds Azure Container Linux build details for October 3. |
vhd-notes/AKSWindows/2022/20348.5761.261015.txt |
Adds Windows Server 2022 updates and image inventory. |
CHANGELOG.md |
Adds the October 23 release summary and node image links. |
Review effort: Balanced
| * [Updating node public IP prefixes](https://learn.microsoft.com/azure/aks/use-node-public-ips) on existing node pools is now available as preview in public Azure regions. Supports adding, replacing, and reordering IPv4 and IPv6 prefixes; changing prefixes recreates the affected nodes. Not yet available in sovereign clouds. | ||
| * Upgrade Insights is now available as preview in all Azure regions, including sovereign clouds. Register the `Microsoft.ContainerService/AKSUpgradeInsightsPreview` feature on your subscription to use it. | ||
| * [Confidential VM (CVM)](https://aka.ms/aks/cvm) node pools with Azure Container Linux are now available as preview. FIPS isn't yet supported on these node pools. | ||
| * [Kata confidential containers](https://learn.microsoft.com/azure/aks/confidential-containers-overview) are now available as preview on Azure Linux 3. New Kata confidential container node pools use Azure Linux 3 images; existing node pools keep their current image family. |
Contributor
There was a problem hiding this comment.
Ally Ford (@allyford) flora-taagen I think this needs to be pulled?
| * [Confidential VM (CVM)](https://aka.ms/aks/cvm) node pools with Azure Container Linux are now available as preview. FIPS isn't yet supported on these node pools. | ||
| * [Kata confidential containers](https://learn.microsoft.com/azure/aks/confidential-containers-overview) are now available as preview on Azure Linux 3. New Kata confidential container node pools use Azure Linux 3 images; existing node pools keep their current image family. | ||
| * [Converting AKS Base clusters to AKS Automatic](https://learn.microsoft.com/azure/aks/automatic/aks-automatic-managed-system-node-pools-about) with managed system node pools is now available as preview. Register the `Microsoft.ContainerService/NonHoboToHoboConversionPreview` feature, then run `az aks update --sku automatic`. Clusters that use a custom virtual network also need `--enable-hosted-system` and `--system-node-subnet-id`. | ||
| * [Kata VM Isolation V2](https://learn.microsoft.com/azure/aks/use-pod-sandboxing) is now available as preview with self-service registration. Register the `Microsoft.ContainerService/KataVMIsolationV2Preview` feature; subscription approval is no longer required. |
Contributor
There was a problem hiding this comment.
Ally Ford (@allyford) flora-taagen this is embargoed until Ignite? Martin mentioned he didn't realize he shouldn't have checked the external impact box
| * Upgrade Insights is now available as preview in all Azure regions, including sovereign clouds. Register the `Microsoft.ContainerService/AKSUpgradeInsightsPreview` feature on your subscription to use it. | ||
| * [Confidential VM (CVM)](https://aka.ms/aks/cvm) node pools with Azure Container Linux are now available as preview. FIPS isn't yet supported on these node pools. | ||
| * [Kata confidential containers](https://learn.microsoft.com/azure/aks/confidential-containers-overview) are now available as preview on Azure Linux 3. New Kata confidential container node pools use Azure Linux 3 images; existing node pools keep their current image family. | ||
| * [Converting AKS Base clusters to AKS Automatic](https://learn.microsoft.com/azure/aks/automatic/aks-automatic-managed-system-node-pools-about) with managed system node pools is now available as preview. Register the `Microsoft.ContainerService/NonHoboToHoboConversionPreview` feature, then run `az aks update --sku automatic`. Clusters that use a custom virtual network also need `--enable-hosted-system` and `--system-node-subnet-id`. |
Contributor
There was a problem hiding this comment.
Steve Griffith (@swgriffith) is working on migration docs
|
|
||
| #### Features | ||
|
|
||
| * [Node Auto Provisioning (NAP)](https://learn.microsoft.com/azure/aks/node-auto-provisioning) now supports the following capabilities: |
Contributor
There was a problem hiding this comment.
Wilson (@wdarko1) some of these are tagged for ignite, please check and remove anything that is an ignite announcement
| * [Windows node support for Node Auto Provisioning (NAP)](https://learn.microsoft.com/azure/aks/node-autoprovision-aksnodeclass) is now available as preview. Supports Windows Server 2022 and Windows Server 2025 nodes; Cilium isn't supported on Windows nodes. | ||
| * [Updating node public IP prefixes](https://learn.microsoft.com/azure/aks/use-node-public-ips) on existing node pools is now available as preview in public Azure regions. Supports adding, replacing, and reordering IPv4 and IPv6 prefixes; changing prefixes recreates the affected nodes. Not yet available in sovereign clouds. | ||
| * Upgrade Insights is now available as preview in all Azure regions, including sovereign clouds. Register the `Microsoft.ContainerService/AKSUpgradeInsightsPreview` feature on your subscription to use it. | ||
| * [Confidential VM (CVM)](https://aka.ms/aks/cvm) node pools with Azure Container Linux are now available as preview. FIPS isn't yet supported on these node pools. |
Contributor
There was a problem hiding this comment.
Let's remove this entirely - it will be announced at KubeCon
| * Azure Blob CSI driver to [`v1.27.11`](https://github.com/kubernetes-sigs/blob-csi-driver/releases/tag/v1.27.11) | ||
| * Cilium, Hubble, and ACNS security agent images have been upgraded: | ||
| * [`v1.18.14-260923`](https://github.com/cilium/cilium/releases/tag/v1.18.14) and [`v1.19.8-261006`](https://github.com/cilium/cilium/releases/tag/v1.19.8) on AKS 1.36 and earlier | ||
| * [`v1.20.2-260921`](https://github.com/cilium/cilium/releases/tag/v1.20.2) on AKS 1.37 and later. Cilium 1.20 no longer enforces Kafka-aware network policies; remove Kafka-aware policy rules before upgrading from AKS 1.36. |
Contributor
There was a problem hiding this comment.
this line should be under behavior changes section
| * [`v1.8.15`](https://github.com/Azure/azure-container-networking/releases/tag/v1.8.15) on AKS 1.35 and 1.36 | ||
| * [`v1.9.3`](https://github.com/Azure/azure-container-networking/releases/tag/v1.9.3) on AKS 1.37 and later | ||
| * Azure CSI drivers have been upgraded: | ||
| * Azure Disk CSI driver to [`v1.33.15`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.33.15), [`v1.34.9`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.34.9), and [`v1.36.1`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.36.1) |
Contributor
There was a problem hiding this comment.
CSI driver versions don't say which Kubernetes versions get them. Can we add them
| * Azure CSI drivers have been upgraded: | ||
| * Azure Disk CSI driver to [`v1.33.15`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.33.15), [`v1.34.9`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.34.9), and [`v1.36.1`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.36.1) | ||
| * Azure File CSI driver to [`v1.34.11`](https://github.com/kubernetes-sigs/azurefile-csi-driver/releases/tag/v1.34.11) and [`v1.35.11`](https://github.com/kubernetes-sigs/azurefile-csi-driver/releases/tag/v1.35.11) | ||
| * Azure Blob CSI driver to [`v1.27.11`](https://github.com/kubernetes-sigs/blob-csi-driver/releases/tag/v1.27.11) |
Contributor
There was a problem hiding this comment.
Blob CSI driver 1.27.11 if I remember correctly was in the last release notes too no?
KAARTHIKEYAN SUBRAMANIAN (kaarthis)
requested changes
Oct 23, 2026
KAARTHIKEYAN SUBRAMANIAN (kaarthis)
left a comment
KAARTHIKEYAN SUBRAMANIAN (kaarthis)
left a comment
Contributor
There was a problem hiding this comment.
PTAL few announcements and corrections
|
|
||
| ### Announcements of upcoming changes and retirements | ||
|
|
||
| * Starting with Kubernetes 1.38, node pools that use the `Ubuntu` OS SKU will default to Ubuntu 26.04. To continue using Ubuntu 24.04 on Kubernetes 1.38, specify the `Ubuntu2404` OS SKU. For more information, see [Upgrade the OS version for your AKS node pools](https://aka.ms/aks/upgrade-os-version). |
Contributor
There was a problem hiding this comment.
THis needs to go in - Coming by June 2027: Platform-initiated upgrades for AKS.
What’s changing: AKS will be able to automatically initiate upgrades to help keep clusters supported, secure, and aligned with platform lifecycle requirements.
How to prepare now: Review upgrade channels, maintenance windows, and workload readiness so your clusters can absorb automated upgrade events with minimal disruption. Start here: Platform-initiated upgrades.
https://learn.microsoft.com/en-us/azure/aks/platform-initiated-upgrades
| * Kubernetes patch versions [1.37.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md), [1.36.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md), [1.35.9](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.35.md), and [1.34.12](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md) are now available. | ||
|
|
||
| More information on supported versions and version support policy is available in [documentation](https://learn.microsoft.com/azure/aks/supported-kubernetes-versions?tabs=azure-cli#kubernetes-version-support-policy). | ||
|
|
Contributor
There was a problem hiding this comment.
1.34 community version and 1.31 LTS is going soon end of life by November 2026 . Please review the calendar and platform support policy https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#aks-kubernetes-release-calendar-and-upcoming-versions
|
|
||
| #### Behavioral changes | ||
|
|
||
| * [Node Auto Provisioning (NAP)](https://learn.microsoft.com/azure/aks/node-autoprovision) will now have the following changes: |
Contributor
There was a problem hiding this comment.
Feel like all the NAP announcements should be lumped together in one NAP mega bullet / header and sub points for easier consumption. Wilson (@wdarko1) Dian Yu (@dyu1208)
| * [Azure Policy for Kubernetes](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) can now evaluate DELETE operations on Kubernetes resources for policies that explicitly opt in. Existing policies don't enforce DELETE operations. | ||
| * [Prepared Image Specification (preview)](https://learn.microsoft.com/azure/aks/prepared-image-specification) will now require the `Microsoft.ContainerService/preparedImageSpecifications/versions/read` permission for pinned image versions. Requests without this permission are rejected, and image bakes fail on authorization errors instead of falling back. | ||
| * Managed DRANET will now validate requirements when it's enabled. Requests that don't meet these requirements are rejected; existing Managed DRANET node pools remain manageable: | ||
| * The node pool must run Kubernetes 1.35 or later. Upgrade the node pool before enabling Managed DRANET. |
Contributor
There was a problem hiding this comment.
Feels like the DRANET is coming as two bullets pls rectify to make it unified and crisp.
| * [Istio Gateway API ConfigMap customization](https://learn.microsoft.com/azure/aks/istio-gateway-api#configmap-customizations) now supports Service `spec.ports` and Deployment seccomp profile settings for the Istio add-on and Application Routing with Istio. | ||
| * [Istio-based service mesh add-on](https://learn.microsoft.com/azure/aks/istio-about) will now intercept both IPv4 and IPv6 workload traffic on dual-stack clusters. Restart existing workloads after the add-on update to apply the new proxy configuration. | ||
| * [Application Routing Gateway API](https://learn.microsoft.com/azure/aks/app-routing-gateway-api) controller will now run on the managed system node pool in AKS Automatic clusters, improving isolation between the control plane and data plane. | ||
| * [AKS Automatic](https://learn.microsoft.com/azure/aks/intro-aks-automatic) clusters on Kubernetes 1.36 and later will now exclude protected system namespaces from customer mutating admission configurations. Customer webhooks and policies can no longer change system workloads. |
Contributor
There was a problem hiding this comment.
why this change please explain Steve Griffith (@swgriffith)
| #### Behavioral changes | ||
|
|
||
| * [Node Auto Provisioning (NAP)](https://learn.microsoft.com/azure/aks/node-autoprovision) will now have the following changes: | ||
| * VM SKUs within about six months of retirement are no longer selected for new nodes. |
Contributor
There was a problem hiding this comment.
Not very clear what is the value prop of this and Link ?
| * [Prepared Image Specification (preview)](https://learn.microsoft.com/azure/aks/prepared-image-specification) will now require the `Microsoft.ContainerService/preparedImageSpecifications/versions/read` permission for pinned image versions. Requests without this permission are rejected, and image bakes fail on authorization errors instead of falling back. | ||
| * Managed DRANET will now validate requirements when it's enabled. Requests that don't meet these requirements are rejected; existing Managed DRANET node pools remain manageable: | ||
| * The node pool must run Kubernetes 1.35 or later. Upgrade the node pool before enabling Managed DRANET. | ||
| * The cluster must use Azure CNI, including Azure CNI Powered by Cilium. Clusters that use kubenet, bring your own (BYO) CNI, or the Calico network policy can't enable Managed DRANET. |
Contributor
There was a problem hiding this comment.
What cluster must use and why ?
| * Managed DRANET will now validate requirements when it's enabled. Requests that don't meet these requirements are rejected; existing Managed DRANET node pools remain manageable: | ||
| * The node pool must run Kubernetes 1.35 or later. Upgrade the node pool before enabling Managed DRANET. | ||
| * The cluster must use Azure CNI, including Azure CNI Powered by Cilium. Clusters that use kubenet, bring your own (BYO) CNI, or the Calico network policy can't enable Managed DRANET. | ||
| * Windows node pools aren't supported. |
Contributor
There was a problem hiding this comment.
is this correct ? seems broken
| * [`v1.9.3`](https://github.com/Azure/azure-container-networking/releases/tag/v1.9.3) on AKS 1.37 and later | ||
| * Azure CSI drivers have been upgraded: | ||
| * Azure Disk CSI driver to [`v1.33.15`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.33.15), [`v1.34.9`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.34.9), and [`v1.36.1`](https://github.com/kubernetes-sigs/azuredisk-csi-driver/releases/tag/v1.36.1) | ||
| * Azure File CSI driver to [`v1.34.11`](https://github.com/kubernetes-sigs/azurefile-csi-driver/releases/tag/v1.34.11) and [`v1.35.11`](https://github.com/kubernetes-sigs/azurefile-csi-driver/releases/tag/v1.35.11) |
Contributor
There was a problem hiding this comment.
same comment as above, we should add details on which K8s version
Co-authored-by: Ally Ford <37671069+allyford@users.noreply.github.com>
| * Konnectivity has been updated to [`v0.37.0`](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.37.0), which includes improved backend dial handling and graceful connection draining. | ||
| * Ratify has been updated to [`v1.4.7`](https://github.com/notaryproject/ratify/releases/tag/v1.4.7). | ||
| * Retina has been updated to [`v1.2.9`](https://github.com/microsoft/retina/releases/tag/v1.2.9). | ||
| * The pause container image has been updated to `3.10.2` on Linux and Windows nodes. |
Contributor
There was a problem hiding this comment.
do we need this? this seems like an implementation detail
Comment on lines
+97
to
+98
| * CoreDNS images have been upgraded: | ||
| * `v1.11.3-41`, `v1.12.1-36`, `v1.13.1-33`, `v1.14.3-27`, and `v1.14.7-6` |
Contributor
There was a problem hiding this comment.
can we specify on which Kubernetes versions too?
Comment on lines
+99
to
+107
| * Cluster autoscaler images have been upgraded: | ||
| * `v1.30.7-aks-17`, `v1.31.5-aks-19`, `v1.32.7-aks-20`, `v1.33.6-aks-11`, `v1.34.5-aks-10`, and `v1.35.2-aks-11` | ||
| * KEDA add-on images have been updated to `2.14.1-31`, `2.16.1-32`, `2.17.3-25`, `2.19.0-24`, and `2.20.2-12`. | ||
| * Metrics Server images have been updated to `v0.7.2-37` and `v0.8.0-30`. | ||
| * Workload identity webhook has been updated to `v1.5.1-24`. | ||
| * Azure Key Vault provider for Secrets Store CSI Driver has been updated to `v1.8.2-13`. | ||
| * Application routing NGINX ingress controller images have been updated to `v1.13.10-13` and `v1.15.1-23`, and ExternalDNS has been updated to `v0.21.0-15`. | ||
| * Static Egress Gateway has been updated to `v0.1.9-3`. | ||
| * NVIDIA device plugin has been updated to `v0.18.2-24`. |
Contributor
There was a problem hiding this comment.
same comment on all these lines. can we specify the target Kubernetes versions for these?
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Draft the AKS
v20261023release notes.## Release Notes - 2026-10-23section toCHANGELOG.md: an announcement, Kubernetes versions, features, preview features, behavioral changes, bug fixes, and component updates.vhd-notes/, copied verbatim from AgentBaker. The section links the latest image for each family.The section was drafted from the customer-facing
aks-rpPRs in the release, then edited to the release-note format. Where a PR description had release-note text from its Feature PM, that text is used.Validation
vhd-notes/file matches its AgentBaker source byte for byte, and everyvhd-notes/link in the new section resolves to a file in this PR.