AKS just closed a practical gap that has been biting large clusters for years: Azure CNI Overlay is GA and is explicitly compatible with Application Gateway for Containers (and the Application Gateway Ingress Controller). If you ever hit IP exhaustion on an Azure CNI cluster while using AGIC for L7 ingress, this is the fix you were waiting for.
Why this matters
Azure CNI's original “routed” model assigns host-local IPs to pods, which is great for predictable networking but terrible for scale when every pod consumes an IP. Application Gateway-based ingress (AGIC) is attractive for its managed WAF, TLS offload and Azure-native integration — but pairing it with host-IP CNI left many teams forced into awkward workarounds: excessive VNet peering, huge subnets, or moving ingress off-cluster. Overlay networking removes that IP-per-pod constraint by encapsulating pod traffic, so you get AGIC’s L7 features without blowing your IP pool.
The practical outcome: you can run AGIC at real scale without painful IP planning gymnastics. That changes cluster sizing and cost trade-offs in favor of simpler, native ingress architectures.
Layer 7 Policies hit GA
AKS also promoted Layer 7 Policies to GA. These let you express application-level routing and controls that are enforced by the network plane and that complement, not replace, Kubernetes NetworkPolicies. For multi-tenant or zero-trust designs where you want network-level ACLs tied to application semantics, Layer 7 Policies give operators a native lever — faster, auditable, and easier to integrate with policy tooling than ad-hoc sidecars or opaque ingress rules.
This is the right move. Relying on NetworkPolicy + Ingress alone has left a gap where app-aware controls either live in the mesh or in custom controllers. Having them in the network plane reduces complexity and gives platform teams a single place to reason about east-west L7 behavior.
Security posture and node hardening
AKS updated its CIS Kubernetes benchmark alignment to a newer CIS v1.27 baseline for supported AKS versions. Expect tighter guidance around RBAC defaults, API server flags, and node-level hardening. If you track compliance as code, update your CIS checks to the new baseline; this affects what Azure will flag in Security Center and what auditors expect.
More quietly but more importantly for regulated workloads: kubelet serving certificate rotation has completed rollout for currently supported AKS Kubernetes versions. Long-lived kubelet certs have been a common audit failure; automatic rotation reduces blast radius and makes short-lived identity the default. If you haven't validated kubelet cert rotation in your node bootstrap and monitoring pipelines, prioritize it — broken metrics, log forwarding, or admission webhooks are common friction points during rotation.
Upgrades and operational guidance
Azure refreshed AKS upgrade docs to emphasize clear workflows: control-plane-only upgrades, full cluster upgrades, and the use of auto-upgrade channels. If you use az aks upgrade, the docs now explicitly recommend flows for --auto-upgrade-channel patch and show how to use Get-AzAksVersion to inspect available versions. This is one of those incremental improvements that actually reduces outages: better docs + prescriptive CLI examples equals fewer mis-ordered upgrades.
One practical note: the updated CIS coverage and kubelet rotation apply to currently supported AKS Kubernetes versions. If you're running earlier versions, treat this as a prompt to plan upgrades; AKS LTS timing still matters for teams on longer support horizons (AKS: Kubernetes v1.31 and v1.32 LTS).
What to change now
- If you use AGIC and hit IP limits or complex VNet designs, test Azure CNI Overlay in staging and benchmark ephemeral scale.
- Add Layer 7 Policies to your policy catalog for multi-tenant clusters; they belong in platform-managed policy bundles rather than ad-hoc ingress tweaks.
- Update CIS checks to the new baseline and validate kubelet certificate rotation in your observability and bootstrap paths.
- Revisit your auto-upgrade channel choices;
--auto-upgrade-channel patchreduces blast radius for control-plane churn.
Final take
These changes feel less like flashy features and more like plumbing that should have been sane years ago. GA for Azure CNI Overlay + AGIC removes a real operational cliff for teams that want Azure-native L7 services at scale; Layer 7 Policies and kubelet cert rotation harden the platform where it actually gets audited. If you treat networking and upgrade channels as afterthoughts, this release should change your sprint priorities. Expect to revisit IP planning, ingress topology, and upgrade automation in the next quarter — this is where AKS is pushing teams to get serious about platform hygiene.