AKS control-plane metrics GA: Azure Monitor Managed Service for Prometheus ingestion

AKS just turned control-plane telemetry from a zoo of sidecars and forked exporters into a supported managed product. The new GA feature ships control-plane metrics (api-server, controller-manager, scheduler, etcd-related signals) through Azure Monitor Managed Service for Prometheus — no more rolling your own Prometheus scrape jobs or hosting fragile sidecars on management nodes.

This is overdue and the right call. Platform teams have been stitching together control-plane visibility for years with unsupported hacks: kube-state-metrics on control plane nodes, cluster-scoped DaemonSets that you hoped wouldn’t break upgrades, or forwarding to tenant Prometheus instances. Azure’s managed approach standardizes collection, retention, and query tooling and reduces operational toil for teams running AKS at scale.

What you get, concretely

First-class, managed ingestion of apiserver and controller metrics via Azure Monitor Managed Prometheus (GA).
Less reliance on ad-hoc sidecars and node-scrape configurations that often escape upgrade testing.
Integration with the Azure monitoring stack for alerting, dashboards, and role-based access controls.

There are non-trivial trade-offs

Managed collection is convenient, but it's not free policy. Control-plane metrics are both sensitive and high-cardinality: they can reveal auditable operational heartbeats, workload counts, and request patterns that may map back to users. Expect three immediate operational tasks:

Rework alerting and runbooks. Your SRE playbooks tuned to node-exporter and cAdvisor signals need revalidation against the metric names, label sets, and any aggregation or sampling the managed service applies.
Budget for cardinality. Managed Prometheus pricing and ingestion considerations will change how you tag metrics; high-cardinality controller metrics that were cheap on a self-hosted Prometheus can become costly in a managed ingestion model.
Lock down access. Ensure RBAC and workspace-level controls are applied so CI systems, contractors, or external partners don’t get broad read access to control-plane telemetry.

Azure didn’t stop at observability. Recent AKS CLI and platform updates add tighter security and operational posture options — Trusted Launch and vTPM/secure-boot variants, API server VNet integration, and finer-grained autoscaler controls are becoming easier to enable from cluster templates. These changes push AKS toward more secure defaults; platform teams should bake them into bootstrap templates now to avoid accumulating technical debt.

Azure’s DevOps and AI moves matter too

Azure DevOps and related CI/CD tooling are moving away from long-lived PATs toward federated and managed identities (workload identities and short-lived tokens) for service connections; teams should migrate where possible to reduce credential risk. Separately, DevOps products are integrating AI-assisted features that let agents access repository and work-item context — these can speed planning and code generation but are also a new attack surface. Treat agent access like any production service account: least privilege, scoped credentials, and detailed audit trails.

Networking and security performance upgrades are practical wins: Azure Firewall Premium and edge services have been improved to support higher TLS-inspection throughput and better IDPS performance, and edge rule management features now reduce deployment drift in complex rule sets. These kinds of throughput and operational improvements lower the bar for adopting inline security at scale.

Cloud AI platform work is accelerating agent-first workflows: providers are offering larger-model runtimes on newer GPU instances and adding platform features that let apps expose structured context to agents. That trend changes how teams think about secrets, context exposure, and runtime isolation.

If you run AKS, stop treating control-plane telemetry as an optional nicety. Ingest it centrally, but redesign alerting and RBAC around the managed metric schema today. If you still rely on PATs in CI/CD, move to federated or managed identities immediately — that migration will pay security dividends. And if you let AI assistants interact with your DevOps systems, apply the same operational rigor as you would for a new microservice.

This week’s stack of changes is not incremental housekeeping — it’s a platform pivot toward managed observability, identity-first DevOps, and agent-friendly infrastructure. Platform teams who act fast will reduce toil and risk; those who treat these as mere opt-ins will be rewriting runbooks during the next outage.

AKS control-plane metrics GA: Azure Monitor Managed Service for Prometheus ingestion

Sources

AKS confidential VMs for Linux node pools, ACR artifact streaming, Windows node updates, and security posture improvements

AKS GA: Windows Server 2025 node pools, ACR Artifact Streaming, and confidential Linux node pools

Astra agentic LLMs on Microsoft Foundry: AKS egress, image, and observability controls (limited access)