AI changed what teams ask of Kubernetes. Workloads today are more than a stateless web tier, they are an inference service with an expensive GPU behind it, an agent that behaves unpredictably, and a data path that shifts from dataset throughput to checkpoint durability to serving latency as the application matures. Today at the Reactor event, we are showing demos and announcing new capabilities to support your AI workloads.
This wave of AKS releases answers three of those pressures directly: isolating AI workloads, assembling the componentry that agentic applications need, and making capacity work harder than it did last quarter.
Workload and AI isolation
Agents are unpredictable by design. Consider an agent installing packages, making unexpected network calls, or attempting to escape its pod into the node — with a shared kernel, one compromise becomes a node-wide problem. The AKS answer is layered: secure by default, verify the workload, then raise the boundary when the data demands it.
- GA: Pod sandboxing support in node auto-provisioning (NAP). Every pod runs inside its own lightweight VM with an isolated guest kernel, built on the open-source Kata Containers project, so a compromise of one kernel instance is contained to one workload. With NAP support, that isolated compute is provisioned efficiently instead of hand-sized.
- GA: Confidential GPU support. AMD SEV-SNP confidential VMs with NVIDIA H100 Tensor Core GPUs, linking CPU and GPU trusted execution environments. Memory stays hardware-encrypted, which helps prevent data access by cloud providers, administrators, and privileged users — the control that makes sovereign, regulated, and privacy-sensitive AI workloads viable.
- GA: Trusted Launch support in NAP. Secure boot, virtual TPM, and boot integrity monitoring on Generation 2 VMs, applied automatically whenever NAP selects a Gen 2 SKU. No touch, no configuration, hardened nodes.
- GA: Identity Bindings. Removes the 20 federated identity credential ceiling on a user-assigned managed identity. Multiple clusters now share one managed identity through a single credential, with access governed by granular Kubernetes RBAC and AKS-managed token exchange — the difference between a platform that stops at 20 clusters and one that doesn't.
- GA: NFS encryption in transit and workload identity for Azure Files CSI. Protects traffic on the shared-file path and lets pods authenticate with identity instead of storage account keys, for the models, artifacts, and configuration many replicas read at once.
- GA: Argo CD extension for AKS. Automate application deployment and continuous reconciliation from Git with trusted access and security controls built in: see application health, sync state, and the deployed revision at a glance, get improved security through automatic updates of the Argo CD components, sign in to the Argo CD UI with Azure identities, and authenticate to ACR and Azure DevOps with workload identity.
Agent componentry
Agentic applications need a path from code to a verified deployment, a runtime that absorbs bursts, and enough observability to find out why a GPU ran out of memory at 2am.
- GA: Argo CD extension for AKS. Managed GitOps with application health, sync state, and deployed revision visible in one place, automatic updates for Argo CD components, single sign-on with Azure identities, and workload identity authentication to ACR and Azure DevOps. The Flux extension for AKS remains available for Flux-based workflows.
- Public Preview: Virtual Nodes v2 as a cluster extension. Burst into Azure Container Instances in seconds without waiting for node provisioning, pay only while pods run, and get Hyper-V isolated microVMs with confidential container support. Inference spikes and agent fan-out stop requiring permanently overprovisioned nodes.
- Public Preview: GPU memory profiling. See which functions allocate GPU memory, with no app code changes and no sidecar, and go from "memory is under pressure" to the exact call path as a flame graph. Profile, fix, re-profile.
- GA: NFS encryption in transit and workload identity for Azure Files CSI. Secures the shared-file path that many replicas read at once, protecting traffic on the wire and letting pods authenticate with identity instead of storage account keys. Best fit for models, artifacts, configuration, and shared application data reached through a Kubernetes-native interface.
- GA: Azure Container Storage v2.2.1. Improves local NVMe provisioning and expansion, reduces resource consumption at scale, and adds Elastic SAN support on tainted nodes, strengthening the production foundation for databases, data pipelines, and model-serving workloads that need container-native volume orchestration.
- GA: Azure CSI driver security hardening (AKS release v20260904). Stronger input and mount validation, credential isolation and refresh, protection against resource-exhaustion paths, and better diagnostics. The storage integration is part of the workload trust boundary, and this release treats it that way.
Around these, the developer surfaces stay where teams already work: the AKS extension for VS Code, AKS Skills in GitHub Copilot and your preferred CLI, AKS desktop, and Azure Kubernetes Fleet Manager resource placement for declaring one release intent across many clusters and regions.
Efficiency
Getting the most out of expensive compute is key, and we want to ensure your training, inference, fine-tuning and batch jobs spend with purpose and scale with demand. We’re introducing the following capabilities to help support.
- GA: Improved Spot VM handling in NAP. Proactive replacement of evicted spot nodes via Node Problem Detector, extended eviction notification, and an in-VM rebalancing signal, so spot capacity becomes usable for real workloads.
- GA: Provisioning Request support in Cluster Autoscaler. Immediate cleanup of partially provisioned compute when capacity constraints prevent full allocation, reducing wasted spend and capacity fragmentation for AI and batch job orchestrators.
- GA: Ultra SSD and GPU Operator/BYO driver support in NAP. Sub-millisecond, high-IOPS storage for stateful and AI workloads, and your choice of AKS-managed GPU driver, NVIDIA GPU Operator, or a self-managed custom driver.
- Public Preview: AKS Hyperscale Configuration. Pre-provisioned control planes in H2, H4, and H8 tiers, reaching 7,000 API server executing seats, 400 pods per second scheduling, and six etcd partitions. For AI training, HPC, batch, and surge events, the control plane is ready before demand arrives.
- Public Preview: Automatic zonal placement. Zones auto lets AKS pick SKU-supported zones, cap any single zone at 50% of the pool, and re-evaluate capacity during scale-out instead of failing against a fixed zone list.
- GA: Managed system components uptime SLA. A 99.9% guarantee for system components running on managed system node pools in AKS Automatic clusters, including CoreDNS, KEDA, Eraser, Konnectivity, VPA, and workload identity.
- Private Preview: Azure Chaos Studio extension. Blue/green node pool upgrades, node pool rollback up to seven days, maxUnavailable fallback, capacity reservation groups for existing node pools, pod eviction on freeze, on-demand node health checks
- Public Preview: Flex Nodes for AKS. A deployment option that lets application and platform teams use hybrid and edge infrastructure as connected worker nodes attached to an AKS control plane in Azure.
With Flex Nodes for AKS, we’ve seen three forces pull workloads outside a single Azure region: data residency, constrained capacity, and latency. The traditional answer is another cluster at the edge, and with it another control plane, another upgrade cycle, another policy surface. Flex Nodes offers an alternative architecture. The Kubernetes control plane stays in Azure while only worker nodes run at the edge or on customer infrastructure, giving one cluster and one operating model across cloud and edge.
Flex Nodes fits applications that require local execution but not local operations: AI inference, data processing, industrial applications, content delivery, branch office services, and latency-sensitive business workloads. Flex nodes can specifically detect NVIDIA hardware and configure the runtime, while customers supply the driver and Kubernetes GPU components today. Azure Linux, Ubuntu, and RHEL are supported. Learn more at: aka.ms/aks/flexnodeforaks.
Where local autonomy is the requirement instead, we also have the Public Preview for AKS on bare metal Ubuntu runs a full local cluster on your own CPU and GPU hardware with no virtualization layer.
AKS is more than where your AI application runs. Your Kubernetes environments now operate the contract between the workload and its state, its isolation boundary, its capacity, and its location, so your teams can spend their attention on building new AI apps, deploying agents, and supporting development teams with the open-source frameworks they need.
Microsoft