Microsoft just made two platform moves that change how you should build and access AKS clusters: eBPF host routing in Advanced Container Networking Services is GA, and AKS can now be reached via Azure Bastion without punching holes in your control plane or node network. Both are small-sounding bullets on a release page, but together they shrink operational surface area and nudge platform teams away from legacy patterns you can still find in production.
eBPF host routing isn't theoretical anymore — it's a supported GA path for AKS customers to replace the traditional kube-proxy datapath on nodes and push forwarding logic into an eBPF datapath on the host. Practically that means fewer packets traversing user-space proxies, lower tail latency for east-west calls, and simpler packet-flow reasoning because forwarding runs where the kernel already makes routing decisions. If you're still running kube-proxy in 2026, this should change your upgrade plans: cloud vendors are productizing eBPF-based dataplanes (see how projects like Cilium implemented the model in practice: /article/cilium-1-20-ebpf-datapath-plugins-gateway-api/).
The network improvement pairs neatly with a security-critical feature: Azure Bastion can provide browser-based, audited access paths to private clusters and to node VMs without assigning public IPs to control planes or worker nodes. That removes the most common impulse — slap a public IP on the API server or a node and accept the risk — and replaces it with jump-host-style access aligned with zero-trust principles. For incident response and day-to-day ops this is huge: safe ad-hoc access, central session logs, and no SSH keys floating around.
Storage and identity improvements follow the same theme. The Azure Files CSI driver now supports workload identity (Entra) for mounts in GA, which addresses the common anti-pattern of baking storage account keys into pods or relying on long-lived mount secrets. With Entra-backed mounts you get shorter credential lifetimes, per-workload RBAC, and a cleaner audit trail, letting platform teams reduce secret sprawl and the blast radius of leaked credentials.
On the DevOps side Microsoft expanded Entra-backed service connections for Azure DevOps, shifting integrations away from PATs and long-lived tokens toward federated or managed identities. Moving CI/CD service connections to workload identity is overdue — it's the same trajectory other clouds adopted for short-lived, auditable service-to-service auth. If you want the vendor rationale and implications for agent-based automation, see the companion write-up on broader hosted endpoint rollouts: /article/azure-devops-remote-mcp-server-ga-hosted-mcp-endpoint-copilot-agents/.
One last piece: the recent azd updates continue to bake Azure-native deployment patterns for container and AI workloads into the CLI. Not flashy, but standardizing on azd templates and Entra-first patterns will reduce brittle homegrown scripts and improve reproducibility across dev and platform teams.
Opinion: this is the right call from Azure. Migrating the datapath into eBPF and consolidating access and identities into Bastion-like, Entra-backed primitives solves two classes of production pain — network performance and credential sprawl — with manageable migration paths. Teams that keep old habits (kube-proxy, storage keys, PATs) will pay operational tax in latency, incident scope, and audit complexity.
If you run AKS, start planning two migrations this quarter: move stateful mounts to the Azure Files CSI workload identity, and evaluate the eBPF host routing option on a canary node pool (measure latency, conntrack footprint, and observability gaps). Then flip your access model to Bastion-first for ephemeral troubleshooting. Azure's push here isn't just feature-additive; it's rewriting the recommended operational baseline for Kubernetes on Azure. Expect more managed eBPF features and Entra-first integrations next — and the teams that adapt now will be able to retire a lot of cruft later.
Sources
- Azure updates – AKS-related announcements (eBPF host routing and Bastion connectivity)
- AzureCharts – Latest Azure Updates for Kubernetes Service
- AzureCharts – Azure Updates in August 2026
- Azure DevOps Blog – Recent August 2026 posts
- Azure DevOps – Released Features Timeline
- Azure/AKS August 2026 release notes (Azure File CSI driver update)