Edit

Deploy and manage cluster extensions for Azure Kubernetes Service (AKS)

Cluster extensions provide an Azure Resource Manager driven experience for installation and lifecycle management of services like Azure Machine Learning or Kubernetes applications on an AKS cluster. This feature enables:

  • Azure Resource Manager-based deployment of extensions, including at-scale deployments across AKS clusters.
  • Lifecycle management of the extension (Update, Delete) from Azure Resource Manager.

Categories of cluster extensions

There are two categories of cluster extensions, Core and Standard that can be deployed onto AKS clusters.

Core extensions

Core Kubernetes extensions have broader region availability, a more integrated AKS experience, and release alignment to AKS version releases. Azure Backup and Azure Monitoring for Containers are core extensions.

AKS native experience

Core extensions can be managed using az aks CLI command.

az aks extension create \
  --name <core extension name> \
  --extension-type <type> \
  --cluster-name <name> \
  --resource-group <group>

For more information about the commands, see az aks.

Release policy

Minor and major upgrades of core extensions occur alongside AKS minor and major version updates to avoid introducing breaking changes and provide better reliability.

Add-on to core extension migration

Azure Monitor services, including Container Insights, Managed Prometheus, and Application Insights are transitioning to a cluster extension based backend model. This change updates AKS monitoring add-ons to an extension‑based management model, with no change to functionality or user experience.

  • This backend migration is nondisruptive and doesn't change user experience or require customer action.

  • There's no impact to workloads, data collection, or monitoring functionality.

  • Azure CLI, Azure portal, and all client experiences continue to work as expected.

Note

Refer to the troubleshooting documentation for mitigation details.

Standard extensions

For information about the other cluster extensions, see the table in Currently available extensions and the Kubernetes apps deployed via Azure Marketplace are of the Standard Extension type.

Standard extensions can be managed using the az k8s-extension CLI command. For more information, see Deploy and manage cluster extensions by using Azure CLI.

az k8s-extension create \
  --name <standard extension name> \
  --extension-type <extension-type> \
  --scope cluster \
  --cluster-name <clusterName> \
  --resource-group <resourceGroupName> \
  --cluster-type managedClusters

Cluster extension requirements

The cluster extensions platform is supported in all regions where AKS is deployed. Although the platform is available in all regions, check the region availability for individual extensions.

Important

Ensure that your AKS cluster is created with a managed identity, as cluster extensions don't work with service principal-based clusters.

For new clusters created with az aks create, managed identity is configured by default. For existing service principal-based clusters that need to be switched over to managed identity, it can be enabled by running az aks update with the --enable-managed-identity flag. For more information, see Use managed identity.

Note

If you enabled Microsoft Entra pod-managed identity on your AKS cluster or are considering implementing it, we recommend you first review Workload identity overview to understand our recommendations and options to set up your cluster to use a Microsoft Entra Workload ID (preview). This authentication method replaces pod-managed identity (preview), which integrates with the Kubernetes native capabilities to federate with any external identity providers. The open source Microsoft Entra pod-managed identity (preview) in Azure Kubernetes Service was deprecated as of October 24, 2022.

Currently available extensions

Extension support for security, identity, networking, and deployment readiness capabilities varies by extension. The following table provides the current support status for each capability. Use it to determine whether an extension meets your organization's operational and governance requirements.

  • Federal Information Processing Standard (FIPS) 140-3 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems.
  • Workload Identity is essential for secure identity management and IMDS restriction, to protect against credential theft.
  • Private Link is critical for network isolation, preventing unauthorized access and allowing extensions to function in Network Isolated AKS Clusters.​
  • Deployment Safeguards enforce best practices on an Azure Kubernetes Service (AKS) cluster.​
  • Pod Security Standards (PSS) define three different policies to broadly cover the security spectrum. PSS-Baseline provides a minimally restrictive policy which prevents known privilege escalations.

Legend

Symbol Meaning
✅ Supported
❌ Not Supported
N/R Not Required

Extension capability matrix

Extension Description PSS - Baseline FIPS Deployment Safeguards Workload Identity Private Link
Azure App Configuration Centralized management of application settings and feature flags. ✅ ❌ ✅ ✅ ✅
Azure Machine Learning Train, deploy, and manage machine learning workloads on AKS. ❌ ❌ ❌ ❌ ✅
Dapr Event-driven application runtime for cloud and edge workloads. ✅ ❌ ❌ ✅ ✅
Azure Backup for AKS Backup and restore protection for persistent volumes. (Core Extension) ✅ ❌ ✅ ✅ ✅
Flux (GitOps) GitOps-based configuration and application deployment management. ✅ ❌ ✅ ❌ ✅
Azure Container Storage Persistent storage for AKS workloads. ✅ ❌ ✅ N/R ❌
Service Connector Simplifies secure connectivity between AKS workloads and Azure services. ✅ ❌ ✅ ✅ N/R
Azure Monitor - Container Insights Log collection and monitoring for AKS clusters and containers. (Core Extension) ❌ ❌ ❌ ❌ ✅
Azure Monitor - Prometheus Prometheus-compatible metrics collection for AKS. (Core Extension) ✅ ❌ ✅ N/R ✅
Azure Monitor - App Monitoring Application performance monitoring and telemetry collection. (Core Extension) ❌ ❌ ❌ ❌ ❌
Argo CD GitOps-based continuous delivery for Kubernetes applications. ✅ ❌ ✅ ✅ ❌

You can also select and deploy Kubernetes applications available through Marketplace.

Note

Cluster extensions provide a platform for different extensions to be installed and managed on an AKS cluster. If you're facing issues while using any of these extensions, open a support ticket with the respective service.

Note

Not every capability is relevant to every extension. Extensions marked as Not Required continue to follow applicable AKS security requirements. The status simply indicates the capability isn't needed for the extension's intended functionality.

Next steps

  • Last updated on