Open source moves forward when we build in the open, learn from production, and bring those lessons back upstream. That\u2019s why I am excited to be in Atlanta for KubeCon + CloudNativeCon North America 2025 to share what our teams have learned and what we are contributing to next upstream.<\/p>\n\n\n\n
Since my last update at KubeCon + CloudNativeCon Europe 2025<\/a>, we have continued our investments in growing existing CNCF projects, strengthening the foundations of Kubernetes while launching new projects where the community has seen need. From improving reliability and performance to advancing security and AI-native workloads, our goal remains the same: make Kubernetes better for everyone.<\/p>\n\n\n\n We\u2019re also introducing practical improvements across Azure and Azure Kubernetes Service<\/a> (AKS) that make running cloud-native and AI workloads even simpler and more resilient. These updates aren\u2019t just features; they reflect real-world feedback from customers and the community, and they\u2019re designed to help you scale Kubernetes with confidence.<\/p>\n\n\n\n Previously, I have shared why building in the open matters to our teams at Microsoft<\/a>\u2014not just for transparency, but for driving real progress in cloud-native technologies. That commitment continues. We\u2019re proud to work alongside the Cloud Native Computing Foundation (CNCF) and the broader ecosystem to help define the new Kubernetes AI Conformance<\/a> program, aimed at ensuring interoperability and portability for AI workloads. AKS has already met these conformance requirements, reflecting our commitment to open standards. We believe AI conformance will unlock greater choice across open-source tooling and platforms, and we are also contributing to new open-source AI platforms that run on Kubernetes where we see strong community and customers adoption.<\/p>\n\n\n\n Our collaborations span key areas of AI infrastructure. With NVIDIA, we\u2019re scaling multi-node LLM inference with NVIDIA Dynamo.<\/a> We are also collaborating on Ray<\/a> (now part of the PyTorch foundation) as a distributed compute engine with a set of AI libraries that accelerate machine learning workloads. AKS is also now recognized as one of the<\/a>llm-d<\/a> project\u2019s well-lit infrastructure providers<\/a>, ensuring robust support for large-scale AI deployments.<\/p>\n\n\n\n We\u2019re bringing AI to the world of Kubernetes observability with the Inspektor Gadget Model Context Protocol (MCP)<\/a> server, and we\u2019ve open-sourced Wassette<\/a>, a security-oriented runtime for WebAssembly Components via MCP. In the Kubernetes AI Toolchain Operator (KAITO<\/a>), we have added multi-node distributed inference for large models, Gateway API Inference Extension<\/a> (GAIE) integration, and OCI artifact support to vastly reduce model pull time. AIKit<\/a> has also joined the KAITO project, making it easier to fine-tune, build, and deploy open-source LLMs.<\/p>\n\n\n\n Security remains a top priority. We\u2019re addressing community demand for stronger dataplane and software supply chain protections by contributing multicluster support for Istio’s Ambient mode<\/a>, donating the Dalec<\/a> as a sandbox project to the CNCF for secure package and container creation, and enhancing Copa<\/a> with multi-platform support and end-of-life detection for direct image patching. We have also introduced the Headlamp plugin for Karpenter<\/a> to improve scaling and visibility.<\/p>\n\n\n\n In Kubernetes v1.34, Microsoft engineers helped lead the stable feature releases of structured authentication<\/a> and Dynamic Resource Allocation<\/a> (DRA), including DRA\u2019s integration with cluster autoscaler. We also collaborated to bring Headlamp<\/a> under SIG UI and Kube Resource Orchestrator (kro)<\/a> under SIG Cloud Provider, strengthening governance and collaboration.<\/p>\n\n\n\n For the past three years, Azure has been the top cloud provider in CNCF contributions<\/a>, and our focus remains on advancing open source through partnership and shared innovation. These efforts reflect our belief that leadership in cloud-native means listening, contributing, and building together with the community. You can meet many of our contributors in the Azure booth and Project Pavilion at KubeCon!<\/p>\n\n\n\n In addition to our work in the upstream community, I am happy to share several new capabilities in Azure Kubernetes Service<\/a> that reflect where customers are headed: stronger security and governance, improved performance at scale, AI-powered operations, and simplified management.<\/p>\n\n\n\n Security isn\u2019t an afterthought in AKS, it\u2019s foundational. We\u2019ve focused on making clusters resilient by design, starting with the node layer. Flatcar Container Linux<\/a> introduces an immutable filesystem that prevents configuration drift and simplifies recovery from incidents. For organizations operating across clouds, Flatcar\u2019s CNCF roots ensure consistency and portability.<\/p>\n\n\n\n Building on that principle, Azure Linux with OS Guard<\/a> takes host security even further. This next-generation container host enforces immutability and code integrity using technologies like SELinux and Integrity Policy Enforcement (IPE), upstreamed in Linux kernel 6.12. With Trusted Launch enabled by default, OS Guard locks down the boot process and user space, ensuring only trusted binaries run. It\u2019s the same hardened foundation that powers Microsoft\u2019s own fleet, now available for your workloads.<\/p>\n\n\n\n Governance also matters. Azure Kubernetes Fleet Manager\u2019s new Managed Namespaces<\/a> feature gives platform teams a way to enforce resource quotas, networking policies, and RBAC across clusters without manual intervention. Immutable configurations mean tenants can\u2019t override security baselines, helping organizations maintain compliance and control at scale.<\/p>\n\n\n\n Networking is central to Kubernetes performance, and AKS is evolving to keep clusters fast and reliable. LocalDNS<\/a> speeds up DNS resolution by handling queries locally on each node, eliminating bottlenecks and insulating workloads from upstream outages.<\/p>\n\n\n\n For high-scale and latency-sensitive applications, eBPF host routing<\/a> moves routing logic into the kernel for fewer hops and higher throughput, while local redirect policy<\/a> ensures traffic stays node-local whenever possible. We\u2019ve also strengthened traffic control and observability in Azure Container Networking Services (ACNS) with Layer 7 policy<\/a> for fine-grained application-level enforcement and container network metrics filtering<\/a> to cut data noise and costs. These improvements, combined with new options like Pod CIDR expansion<\/a> and cluster-wide Cilium policies<\/a>, give operators the tools to scale without compromise.<\/p>\n\n\n\n AI workloads need more than GPU capacity\u2014they need operational intelligence. We\u2019re bringing agentic reasoning directly into the CLI<\/a> with az aks agent, so operators can describe an issue in natural language and get targeted diagnostics and actionable fixes without hopping across tools. We\u2019ve also streamlined model serving with integrated Model Context Protocol<\/a> to connect models with external tools<\/a> and data in real time. For teams running GPU fleets, built\u2011in GPU metrics<\/a> and a managed device plugin<\/a> reduce the toil of provisioning and monitoring, while scheduler profile configuration<\/a> helps place the right workload on the right node for performance and cost.<\/p>\n\n\n\n To give customers more choice in how they run distributed AI, we also recently announced a partnership with Anyscale<\/a> to deliver a managed Ray service on Azure, bringing a Python\u2011native engine for training, tuning, and inference to AKS\u2011backed clusters without the burden of control\u2011plane management.<\/p>\n\n\n\n In addition to our work in the upstream community, I am happy to share several new capabilities in Azure Kubernetes Service<\/a> that reflect where customers are headed: stronger security and governance, improved performance at scale, AI-powered operations, and simplified management.<\/p>\n\n\n\n Security isn\u2019t an afterthought in AKS, it\u2019s foundational. We\u2019ve focused on making clusters resilient by design, starting with the node layer. Flatcar Container Linux<\/a> introduces an immutable filesystem that prevents configuration drift and simplifies recovery from incidents. For organizations operating across clouds, Flatcar\u2019s CNCF roots ensure consistency and portability.<\/p>\n\n\n\n Building on that principle, Azure Linux with OS Guard<\/a> takes host security even further. This next-generation container host enforces immutability and code integrity using technologies like SELinux and Integrity Policy Enforcement (IPE), upstreamed in Linux kernel 6.12. With Trusted Launch enabled by default, OS Guard locks down the boot process and user space, ensuring only trusted binaries run. It\u2019s the same hardened foundation that powers Microsoft\u2019s own fleet, now available for your workloads.<\/p>\n\n\n\n Governance also matters. Azure Kubernetes Fleet Manager\u2019s new Managed Namespaces<\/a> feature gives platform teams a way to enforce resource quotas, networking policies, and RBAC across clusters without manual intervention. Immutable configurations mean tenants can\u2019t override security baselines, helping organizations maintain compliance and control at scale.<\/p>\n\n\n\n Networking is central to Kubernetes performance, and AKS is evolving to keep clusters fast and reliable. LocalDNS<\/a> speeds up DNS resolution by handling queries locally on each node, eliminating bottlenecks and insulating workloads from upstream outages.<\/p>\n\n\n\n For high-scale and latency-sensitive applications, eBPF host routing<\/a> moves routing logic into the kernel for fewer hops and higher throughput, while local redirect policy<\/a> ensures traffic stays node-local whenever possible. We\u2019ve also strengthened traffic control and observability in Azure Container Networking Services (ACNS) with Layer 7 policy<\/a> for fine-grained application-level enforcement and container network metrics filtering<\/a> to cut data noise and costs. These improvements, combined with new options like Pod CIDR expansion<\/a> and cluster-wide Cilium policies<\/a>, give operators the tools to scale without compromise.<\/p>\n\n\n\n AI workloads need more than GPU capacity\u2014they need operational intelligence. We\u2019re bringing agentic reasoning directly into the CLI<\/a> with az aks agent, so operators can describe an issue in natural language and get targeted diagnostics and actionable fixes without hopping across tools. We\u2019ve also streamlined model serving with integrated Model Context Protocol<\/a> to connect models with external tools<\/a> and data in real time. For teams running GPU fleets, built\u2011in GPU metrics<\/a> and a managed device plugin<\/a> reduce the toil of provisioning and monitoring, while scheduler profile configuration<\/a> helps place the right workload on the right node for performance and cost.<\/p>\n\n\n\n To give customers more choice in how they run distributed AI, we also recently announced a partnership with Anyscale<\/a> to deliver a managed Ray service on Azure, bringing a Python\u2011native engine for training, tuning, and inference to AKS\u2011backed clusters without the burden of control\u2011plane management.<\/p>\n\n\n\n Running Kubernetes shouldn\u2019t feel like a maze. We\u2019re streamlining operations with features like one-click Cloud Shell in a VNet for private clusters<\/a>, removing the need for custom VM setups, and enhancing scheduling flexibility with profile configuration for advanced workload placement.<\/p>\n\n\n\n We\u2019re also continuing to invest in making AKS Automatic<\/a> the easiest Kubernetes experience for developers and operators. Expect more updates at Microsoft Ignite next week, where we\u2019ll share enhancements that make it even easier to get started with AKS.<\/p>\n\n\n\n I\u2019m looking forward to connecting in Atlanta and hearing what\u2019s top of mind for you. Here\u2019s where you can find us:<\/p>\n\n\n\n If you\u2019re at the event, come say hello! We\u2019d love to hear what you\u2019re building and where Kubernetes needs to go next.<\/p>\n","protected":false},"excerpt":{"rendered":" From improving reliability and performance to advancing security and AI-native workloads, our goal remains the same: make Kubernetes better for everyone.<\/p>\n","protected":false},"author":6153,"featured_media":98288,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"msxcm_post_with_no_image":false,"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","footnotes":""},"post_tag":[308],"content-type":[346],"topic":[],"programming-languages":[],"coauthors":[600],"class_list":["post-98286","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-azure-kubernetes-service","content-type-news","review-flag-1593580415-931","review-flag-1593580419-521","review-flag-2-1593580437-411","review-flag-6-1593580457-852","review-flag-7-1593580463-151","review-flag-9-1593580473-997","review-flag-exclu-1593580297-613","review-flag-machi-1680214156-53","review-flag-micro-1680215167-604","review-flag-new-1593580248-669","review-flag-partn-1593580279-545","review-flag-vm-1593580807-312"],"yoast_head":"\nOur ongoing commitment to building in the open<\/h2>\n\n\n\n
Advancing AKS for what\u2019s next<\/h2>\n\n\n\n
Secure by design<\/h3>\n\n\n\n
Performance at scale<\/h3>\n\n\n\n
AI-powered operations<\/h3>\n\n\n\n
Advancing AKS for what\u2019s next<\/h3>\n\n\n\nSecure by design<\/h3>\n\n\n\n
Performance at scale<\/h3>\n\n\n\n
AI-powered operations<\/h3>\n\n\n\n
Simplifying the Kubernetes experience<\/h3>\n\n\n\n
See you at KubeCon + CloudNativeCon<\/h2>\n\n\n\n
\n
\n
\n
\n