AKS Managed Service for Prometheus GA: Control‑Plane Metrics Collection Now Supported

AKS just gave platform teams a visibility shortcut: Managed Prometheus now supports control-plane metrics collection (GA). In plain terms, Azure will collect API server, kube-controller-manager, scheduler and other control-plane endpoints for AKS and ingest them into Azure Monitor Managed Service for Prometheus without you standing up sidecars or custom scraping jobs.

The control-plane visibility problem everyone ignored

For years the pragmatic approach was: run kube-state-metrics and a few scrape-sidecars, stitch them into your Prometheus or push metrics to a managed backend, and hope you didn't miss a manifest or RBAC quirk. That worked until the control plane itself was the thing misbehaving — then your ad-hoc collectors were the first to fail.

Making control-plane metrics first-class in AKS' Managed Service for Prometheus is the right call. It removes brittle scraping plumbing from tenant clusters, standardizes labels and cardinality controls via Azure Monitor policies, and—critically—makes it straightforward to alert on control-plane SLOs like apiserver_request_latencies, etcd commit durations, or controller reconciliation lag without deploying extra workloads into cluster nodepools.

Operational implications platform teams should care about:

Faster incident triage: a single managed ingestion point means runbooks can assume metrics exist and are queryable even when tenant nodes are impaired.
Capacity planning gets cleaner: central retention and cardinality controls reduce the variability introduced by customer-managed collectors.
Reduced blast radius: fewer privileged scraping sidecars running on nodepools.

If you want the implementation details and upgrade guidance, I covered the same ground when AKS pushed this into GA earlier this month: AKS: Managed Prometheus control-plane metrics reach GA.

Live disk resizing: stateful scale without downtime

Coinciding with observability changes, Azure also declared GA for online resize support for many Premium SSD v2 and Ultra disk configurations. For stateful workloads—think AKS node pools, database VMs, and data services—this is a material improvement: you can change size and, for many configurations, performance characteristics without deallocating VMs. Check disk type, VM SKU compatibility, and any OS-level requirements first, because some combinations or specific performance parameter changes can still require a VM reboot or reattach.

This isn't magical—policy and IO characteristics still matter—but the operational cost of reactive scaling drops, and cost-optimization strategies (smaller baseline, burst when needed) become more practical.

CI/CD creds: finally fewer PATs, but not zero work

Azure DevOps continues to push teams off PATs toward service connections, OAuth flows, and improved integrations that let pipelines use service principals or managed identities where possible. That aligns pipeline integrations with RBAC and centralized auditing, moving secrets out of repos and pipeline variables and into traceable constructs.

This is the correct move. PATs were a credential-sprawl problem waiting for a misconfiguration to happen; service connections centralize control and auditing. Realistically, migration will introduce friction for older tasks and third-party tools that still expect PATs. Platform teams must inventory pipelines, update task definitions, and map legacy scopes to service-connection roles. The payoff is fewer leaked tokens and a better least-privilege posture.

Azure DevOps also announced improvements to remote test orchestration and tighter pull-request annotations on work items—small features that tighten the feedback loop between test runs and tracking systems, which matters for complex Azure deployments.

Agentic warehouses and Foundry guidance: signal, not just docs

Microsoft published expanded guidance on agent selection for Foundry and on patterns for agentic architectures in Fabric and related data services. This isn't merely academic: it's a reference pattern for multi-agent orchestration, data-aware agents, and what Microsoft calls SAFE agent design.

My take: this guidance is overdue and useful, but treat it like a new runtime you must own. Agentic architectures introduce their own observability, lifecycle, and threat models. Teams that treat agents as ephemeral features—hand them to ML folks and walk away—will be surprised when they become first-class production services requiring capacity planning, secrets rotation, and incident playbooks.

What to do tomorrow

Start by enabling AKS managed control-plane metrics in a staging cluster and wire alerts for apiserver and etcd SLO signals. Inventory DevOps pipelines for PAT usage and prioritize converting high-risk integrations to service connections. Treat any agentic projects as platform services: define SLAs, RBAC, and deploy observability before you scale them past one team.

This batch of updates is less about flashy new features and more about reducing low-level operational friction. Azure is consolidating control-plane visibility and CI/CD auth patterns while nudging teams toward agent-first architectures — useful moves, but they require platform teams to finally own the operational lifecycle of agents and the auth flows around them. If you don't, these conveniences will become your next operational debt.

AKS Managed Service for Prometheus GA: Control‑Plane Metrics Collection Now Supported

Sources

AKS v20260807: Node pool rollback GA and automatic AZ placement

AKS: Managed Prometheus GA for control-plane metrics and node-pool rollback

AKS control-plane metrics GA: Azure Monitor Managed Service for Prometheus ingestion