From b6f032a82ba35035b14e419bb634f95b84187bcf Mon Sep 17 00:00:00 2001 From: Rahul Rai Date: Fri, 19 Jun 2026 17:35:58 +1000 Subject: [PATCH 1/4] Add validation for AGIC subnet configuration Added validation for Ingress Application Gateway configurations to prevent use of the reserved 'aks-appgateway' subnet, ensuring compliance with subnet delegation constraints. --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 437013792..6d5b5c2df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -52,6 +52,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. +* Validation has been added to the [Ingress Application Gateway (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on to block configurations that specify the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and cannot be used by AGIC due to subnet delegation constraints. Requests using this configuration will now fail with a validation error. Customers should use a dedicated subnet via `--appgw-subnet-cidr` or specify a different subnet ID. #### Bug fixes From 00fb06ca50e52b8f0d1beff0fdbe15652176134f Mon Sep 17 00:00:00 2001 From: Rahul Rai Date: Fri, 19 Jun 2026 18:44:01 +1000 Subject: [PATCH 2/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6d5b5c2df..ef6175615 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -52,7 +52,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* Validation has been added to the [Ingress Application Gateway (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on to block configurations that specify the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and cannot be used by AGIC due to subnet delegation constraints. Requests using this configuration will now fail with a validation error. Customers should use a dedicated subnet via `--appgw-subnet-cidr` or specify a different subnet ID. +* AKS now blocks the [Ingress Application Gateway (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on from using the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and can't be used by AGIC due to subnet delegation constraints. Requests using this configuration now fail validation. Use a dedicated subnet with `--appgw-subnet-id` or `--appgw-subnet-cidr`. #### Bug fixes From 1f7afec8bcb2a9f9cea3ef847f5163c297796652 Mon Sep 17 00:00:00 2001 From: Rahul Rai Date: Mon, 22 Jun 2026 11:46:09 +1000 Subject: [PATCH 3/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ef6175615..1179d1fc1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -52,7 +52,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* AKS now blocks the [Ingress Application Gateway (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on from using the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and can't be used by AGIC due to subnet delegation constraints. Requests using this configuration now fail validation. Use a dedicated subnet with `--appgw-subnet-id` or `--appgw-subnet-cidr`. +* AKS now blocks the [Application Gateway Ingress Controller (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on from using the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and can't be used by AGIC due to subnet delegation constraints. Requests using this configuration now fail validation. Use a dedicated subnet by specifying `--appgw-subnet-id` (or `--appgw-subnet-cidr` during cluster create). #### Bug fixes From e240845be466cd1ce01d5154ad260e17076122fc Mon Sep 17 00:00:00 2001 From: Rahul Rai Date: Mon, 22 Jun 2026 12:03:08 +1000 Subject: [PATCH 4/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1179d1fc1..abeaf95fe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -52,7 +52,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases. * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked. * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites). * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected. -* AKS now blocks the [Application Gateway Ingress Controller (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on from using the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and can't be used by AGIC due to subnet delegation constraints. Requests using this configuration now fail validation. Use a dedicated subnet by specifying `--appgw-subnet-id` (or `--appgw-subnet-cidr` during cluster create). +* AKS now blocks the [Application Gateway Ingress Controller (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on from using the AKS-managed `aks-appgateway` subnet. This subnet is reserved for [Application Gateway for Containers (AGC)](https://learn.microsoft.com/azure/application-gateway/for-containers) and can't be used by AGIC due to subnet delegation constraints. Requests using this configuration now fail validation. Use a dedicated subnet by specifying `--appgw-subnet-id` (or `--appgw-subnet-cidr` during cluster create). #### Bug fixes