Kubernetes works best when you tell it what you want running and let controllers keep at it until the cluster matches. At KubeCon + CloudNativeCon North America 2026, most of what we’re extending is that model to work that has traditionally lived outside this declarative style of management. <\/p>\n\n\n\n
\n That work often ends up in scripts, runbooks, or with someone watching a dashboard. Device plugins let Kubernetes count GPUs but not describe them. Across a fleet, it’s hard to know which clusters have drifted, and the call on whether to continue an upgrade often comes down to whoever is watching. Agents add their own needs: runs that can pause and pick up again later, strong isolation for the code they execute, and no dependency on one framework or cloud.\n<\/p>\n\n\n\n
Since my last update<\/a> at KubeCon + CloudNativeCon Europe 2026, much of our work upstream and in Microsoft Azure has gone into these problems.<\/p>\n\n\n\n This cycle’s upstream work spans secure workload isolation, portable agent infrastructure, inference, and capacity across sites:<\/p>\n\n\n\n Open source communities also depend on people willing to step up and lead, and I’m proud of the Microsoft engineers who did this year across the CNCF:<\/p>\n\n\n\n In addition to our upstream work, I’m happy to share new capabilities in Azure Kubernetes Service<\/a> (AKS) and Azure Kubernetes Fleet Manager<\/a> across AI infrastructure, multi-cluster operations, upgrades, and security. <\/p>\n\n\n\n \n AI and HPC workloads often need specific kinds of GPUs and networking, but device plugins only let them ask for a number of devices. Teams running remote direct memory access (RDMA) over InfiniBand also have managed drivers and device plugins. With this release, those teams can schedule GPUs and high-performance networking through upstream Kubernetes APIs, and AKS runs the drivers.\n<\/p>\n\n\n\n Dynamic resource allocation (DRA) replaces fixed device counts with a model where a workload describes the hardware it needs and Kubernetes assigns a match. AKS now offers managed support for DRANET<\/a>, the DRA-network driver maintained in Kubernetes-sigs, on RDMA-capable node pools for distributed training and HPC jobs, and managed DRA for GPU node pools<\/a> brings the same model to GPUs. DRANET also powers multiple network interface card (multi-NIC) support<\/a>, which attaches dedicated interfaces on separate subnets directly to pods.<\/p>\n\n\n\n Fleet placement works like the rest of Kubernetes; the hub holds the desired state, and member clusters are kept in line with it. In practice, people edit member clusters directly, new clusters join with workloads already running, and resources sometimes have to come off a cluster without disrupting the applications that use them.<\/p>\n\n\n\n Azure Kubernetes Fleet Manager, built on the CNCF Sandbox project KubeFleet, gives platform teams a single control plane for placing Kubernetes resources across clusters. Lessons from COSMIC<\/a>, the internal platform Microsoft 365 engineering teams run on AKS, have helped shape Fleet and how we think about running clusters at scale.<\/p>\n\n\n\n \n Three placement controls for those situations are now generally available: \n<\/p>\n\n\n\n \n For simpler cases, annotation-based placement<\/a> declares target clusters with annotations on a standard Kubernetes resource instead of a separate placement object.\n<\/p>\n\n\n\n Upgrade blockers often surface only after an upgrade has started, and stopping a bad one usually depends on someone watching dashboards. Two new capabilities address both: <\/p>\n\n\n\n Security teams need to know that code on their nodes, including inside container images, comes from trusted sources and hasn’t been altered. Azure Container Linux<\/a>, the immutable, container-optimized host operating system for AKS, now supports Integrity Policy Enforcement (IPE), generally available in audit mode.<\/p>\n\n\n\n IPE is a Linux security module, merged upstream in kernel 6.12, that validates executable code against signed dm-verity volumes. In audit mode it logs untrusted or tampered code without blocking it, so teams can fix problems before turning on enforcement. Node auto-provisioning now supports Azure Container Linux too<\/a>, so nodes provisioned on demand for pending pods run on the same hardened host.<\/p>\n\n\n\n Flow-log aggregation in container network observability keeps storage costs predictable, but it drops the fields that security and connectivity investigations rely on. With configurable dimensions for container network observability<\/a>, teams choose which fields aggregation keeps, such as domain names, per-pod IP addresses, and HTTP URLs, and filter logs and metrics by Cilium identity.<\/p>\n\n\n\n The thread running through all of this is the one we started with. Kubernetes is at its best when the system, rather than a person, keeps what\u2019s running matched to what you asked for. Each time a decision moves out of a runbook and into a controller, platform teams get some of their attention back. GPUs, fleets, upgrades, and agents are where that\u2019s happening next, and most of the work is in the open where you can shape it.<\/p>\n\n\n\n Stay connected with the AKS community, explore the latest developments, and share your feedback. Here are a few ways to get involved:<\/p>\n\n\n\nBuilding in the open<\/h2>\n\n\n\n
\n
New leadership roles<\/h3>\n\n\n\n
\n
What’s new in Azure Kubernetes Service<\/h2>\n\n\n\n
AI infrastructure on upstream Kubernetes APIs<\/h3>\n\n\n\n
Simpler multi-cluster operations<\/h3>\n\n\n\n
\n
Safer upgrades<\/h3>\n\n\n\n
\n
Security and network visibility<\/h3>\n\n\n\n
Get involved<\/h2>\n\n\n\n
\n