AKS control-plane metrics GA with Azure Monitor Managed Service for Prometheus

Azure just solved two of the most irritating operational problems for private AKS clusters: blind control-plane telemetry and awkward access for on-call engineers.

AKS now ships GA support for control-plane metrics collection via Azure Monitor Managed Service for Prometheus. Thats not marketing fluff you can now ingest metrics from the API server, etcd, kube-scheduler, kube-controller-manager, cluster-autoscaler and node auto-provisioning directly into the managed Prometheus service. In plain terms: you no longer need bespoke Prometheus jobs, fragile scrape configs or side-channel exporters to get the signals that matter when the control plane is misbehaving.

Microsoft also rolled out Azure Bastion client tunneling for private AKS API servers. Engineers can establish an encrypted tunnel from their laptop to a private API server via Bastion, with authentication tied to Microsoft Entra identities and authorization enforced through Azure RBAC. That removes the common choices of (a) standing up jump hosts you have to harden and patch, or (b) gifting long-lived kubeconfigs and VPN access to teams.

This is the right call. Control-plane telemetry without reliable, auditable remote access is half a fix. Combine Managed Service for Prometheus for the control plane with Bastion-based client tunnels and you get a consistent observability+access story: control-plane incidents become detectable, triageable, and attributable without building bespoke plumbing.

Network and datapath improvements arrived alongside. AKS has added eBPF host routing support to reduce overlay overhead and improve data-path performance for container traffic; if youre still running overlay-heavy stacks for east-west traffic in AKS, eBPF host routing is the nudge you need to reconsider your data path. Azure also added a first-class New Relic integration surfaced in the portal for AKS monitoring, letting teams pair existing New Relic tooling with Azure-native collection.

On the CI/CD side, Azure DevOps continues to expand hosted agent and identity capabilities and is rolling service connections backed by Microsoft Entra workload identities. Practically, that means pipeline service identities can be workload identities (no injected secrets) and those identities are visible in audit trails streamed to Azure Monitor Logs. Other pipeline niceties include improved code coverage reporting and broader platform support for hosted agents.

Why that matters: agentic features (Copilot, hosted agent endpoints) are useful only if you can trust identity and audit. Entra-backed service connections plus audit streaming close the loop agents that act on your CI/CD systems now have centralized identity and an auditable trail rather than scattered secrets and blind side effects. If youre designing agent-based automation and still relying on classic service principals with ad-hoc secrets, youre designing future incident postmortems.

On the AI and analytics front, Databricks has promoted its conversational/workspace APIs and improved export of visualizations from interactive sessions. Azure's AI offerings continue expanding multi-model access under unified governance and publishing guidance that ties agent workflows to centralized identity, observability, and routing.

Taken together: Azure is stitching observability, identity, and agent surfaces into a coherent platform story. Thats not accidental. The platform-level primitives (Managed Service for Prometheus for control plane, Bastion client tunnels, Entra-backed service connections, hosted agent endpoints) are precisely the pieces teams were forced to assemble themselves until now.

If you run AKS privately, stop papering over control-plane visibility with ad-hoc exporters and VPN gymnastics. Adopt the Managed Service for Prometheus control-plane collection and Bastion native tunneling they reduce maintenance, tighten auditability, and make incident response faster. If youre building agentic CI/CD or Copilot workflows, treat Entra-backed service connections and audit-streaming as non-negotiable infrastructure: agents without identity and logs are tech debt waiting to produce unexplainable changes.

Azures short play here is to remove friction; the long play is to make Azure the place where observability, access, and agent automation are the same fabric. Thats good for platform teams and it raises the bar for every on-prem or multi-cloud strategy that still treats these domains as separate problems.

Related: see our deeper coverage of the networking and Bastion work in AKS Advanced Networking: eBPF Host Routing GA and Azure Bastion Access for Private Clusters and the implications for hosted agent MCPs in Azure DevOps Remote MCP Server GA Hosted MCP endpoint for Copilot and AI agents.

AKS control-plane metrics GA with Azure Monitor Managed Service for Prometheus

Sources

AKS Advanced Networking: eBPF Host Routing GA and Azure Bastion Access for Private Clusters

Azure Bastion AKS integration GA and IPv6 dual‑stack preview (with Entra‑backed DevOps and MCP updates)

Azure DevOps Remote MCP Server GA — Hosted MCP endpoint for Copilot and AI agents