Azure just moved the networking chess pieces. The AKS release tracker shows multiple patch releases across supported minors — but the real operational shift is that Azure CNI Overlay is now GA, and L7 (application-layer) network policy controls are generally available. Those two items change how you reason about IP allocation, ingress compatibility, and policy enforcement in AKS.
Azure CNI Overlay GA is overdue and the right call. For years, teams hit IP exhaustion or had to carve huge VNets to give pods routable IPs. Overlay mode decouples pod addressing from VNet IP consumption and is explicitly listed as compatible with Application Gateway and the Application Gateway Ingress Controller (AGIC). That compatibility is the crucial bit: you can run an overlay topology without sacrificing gateway-backed ingress features.
Why this matters in practice
- IP model changes: Overlay changes how you consume VNet addresses and how you debug connectivity. Tools and runbooks that assume pod IP == VNet-routable IP will break. Expect surprises in service-mesh sidecars, external IP whitelisting, and any security tooling tied to host-networking assumptions.
- Ingress and L7 behavior: AGIC compatibility removes a big blocker for teams that wanted cloud-native ingress features without reverting to host-network plumbing. But the GA of L7 policy controls means more of your traffic control can move into Azure's networking stack rather than into sidecar or mutating-webhook solutions.
- Observability and metrics: Container Insights and platform metrics coming from the CNI and kubelet may expose different labels, counters, or cardinality under overlay. Don’t assume previous dashboards will map cleanly.
Other platform changes worth watching
AKS also added a small security/operational trio that changes baseline node behavior:
- SSH on Windows node pools is disabled by default for new node pools: this reduces attack surface and image drift for Windows workloads. It will break any runbook that SSHs into Windows nodes for debugging. Invest in remote debugging tooling and automation instead of ad-hoc node access.
- The default node image baseline has been moved forward for newer Kubernetes minors: expect differences in kernel versions, containerd, and packaged tooling. If you pin images or rely on legacy packages, plan a compatibility test pass.
- A deployment safeguards feature in the Microsoft.ContainerService resource provider lets platform owners gate or enforce upgrade behaviors for managed clusters — useful for platform-managed upgrade policies.
These platform-level changes combined with the patch releases make the upcoming maintenance window non-trivial.
What to change in your upgrade playbook (say it plainly)
Test Azure CNI Overlay in a staging cluster with the exact ingress, service mesh, and NetworkPolicy controllers you run in prod. Validate egress and SNAT behavior, node autoscaling, and any firewall rules that rely on pod-IP mapping. Rework any incident runbooks that open SSH into nodes — Windows SSH removal is the new default for new node pools. Finally, treat the newer default node image baseline as a breaking change for anything that relies on node-local packages or kernel quirks.
If you want a primer on the Ubuntu default and Azure CNI Overlay implications, I covered the practical checklist here: AKS defaults Ubuntu 24.04 CVM for Kubernetes 1.34–1.38; Azure CNI Overlay GA — what platform teams must do.
Opinion: Azure is finally aligning product ergonomics with real platform needs. Moving overlay to GA and promoting L7 policy controls shows they’re solving the right problems — IP exhaustion, ingress compatibility, and centralized policy enforcement. But the release also raises the bar for testing discipline. If your team treats cluster upgrades as “apply and pray,” this change will bite you. Treat the next maintenance window like a systems migration: validate networking semantics, observability, and node baseline behavior first.
AKS’s recent release activity is not cosmetic; it nudges architectural choices. If your CI/CD and runbooks aren’t ready for overlay networking and stricter node hardening, schedule time now. This is one of those platform moments where the vendor made the right technical call — your ops practices need to catch up.