Support assessment and sources¶
All sources were read on 2026-09-30 (the "access date" for every row below).
Microsoft Learn pages were read from the published page and from the public source
repository MicrosoftDocs/azure-aks-docs (latest commit touching
articles/application-network on 2026-09-16). CLI behaviour was checked with
az 2.86.0 + appnet-preview 1.0.0b4 (--help only) and istioctl 1.30.5
(--help only). No Azure resource was created or modified while writing the lab.
Evidence labels used throughout the lab:
| Label | Meaning |
|---|---|
| DOCUMENTED | Stated in current official Microsoft Learn documentation for the Azure product. |
| UPSTREAM | Stated in official Istio / Kubernetes / Cilium documentation. Describes the open-source mechanism, not Azure-managed support. |
| INFERENCE | Follows from the architecture described in the docs, but is not stated anywhere. |
| RUNTIME | Observed by running the lab. A passing experiment is not proof of Microsoft support. Every runtime item stays NOT RUN until you execute it (see acceptance.md). |
1. Capability and support matrix¶
| Capability | Status | Source (accessed 2026-09-30) | Prerequisites | Limitations / notes |
|---|---|---|---|---|
| Azure CNI Overlay | GA, DOCUMENTED | Azure CNI Overlay concepts, Configure overlay | Pod CIDR must not overlap the node subnet, peered VNets, or AKS-reserved ranges (169.254.0.0/16, 192.0.2.0/24, 172.30.0.0/16, 172.31.0.0/16) |
Pod IPs are not reachable from outside the cluster. Traffic leaving the cluster is SNATed to the node IP. |
| Azure CNI powered by Cilium (overlay mode) | GA, DOCUMENTED | Azure CNI powered by Cilium | --network-plugin azure --network-plugin-mode overlay --network-dataplane cilium |
Linux only. ipBlock cannot select pod or node IPs. No policy for hostNetwork pods. No kube-proxy. Only label exclusion may be changed in the Cilium ConfigMap. |
| Kubernetes NetworkPolicy (L3/L4) enforced by Cilium | GA, DOCUMENTED | Same page, feature table "Kubernetes Network Policies: supported without ACNS" | None (no ACNS) | Cilium L7 policy, FQDN filtering, WireGuard and Cilium mTLS require ACNS; this lab deliberately uses none of them. |
| Azure Kubernetes Application Network | PREVIEW | Overview, Get started | Feature Microsoft.AppLink/PublicPreview + provider Microsoft.AppLink; az ≥ 2.84.0; appnet-preview extension; AKS ≥ 1.30; AKS-managed Entra ID; OIDC issuer; Managed Gateway API; no Istio add-on |
Not for production. Excluded from SLAs, and support is best effort. No private clusters. Linux only. Fixed regions. Location/RG/subscription immutable. Upgrade mode can't be switched. |
| Application Network multi-cluster (east-west gateways, global services) | PREVIEW, DOCUMENTED (with a contradiction, see §4) | Architecture, Traffic management use cases | Both clusters joined to the same Application Network. You provide reachability between east-west gateways (VNet peering, VPN, …) | Ports and NSG rules for east-west gateways are not documented. |
| Automatic mTLS, SPIFFE identities, managed CA | PREVIEW, DOCUMENTED | Security, Architecture | None | Identity is spiffe://cluster.local/ns/<ns>/sa/<sa>, with no cluster component. CA isn't chained to a public CA. Workload certs last 24h and rotate every 12h. Intermediates last 90d/45d, the root 12mo/6mo. |
| Strict mTLS | PREVIEW. The docs say you "can change to strict mode" but show no procedure | Security + UPSTREAM PeerAuthentication | PeerAuthentication CRD (installed by Application Network) |
Lab uses a namespace-scoped PeerAuthentication and doesn't rely on a mesh-root namespace. |
| L4 AuthorizationPolicy (ztunnel) | PREVIEW, DOCUMENTED | Traffic management, Security | Ambient enrollment | |
| Waypoints + L7 AuthorizationPolicy | PREVIEW, DOCUMENTED | Traffic management | istioctl matching the Istio minor |
UPSTREAM: ingress traffic skips a service waypoint by default (waypoints). |
Ingress gateway (Gateway API, class istio) |
PREVIEW, DOCUMENTED (HTTP only) | Traffic management | Managed Gateway API CRDs | HTTPS for ingress is not documented for Application Network. The lab uses the UPSTREAM Gateway API TLS listener (Istio secure ingress) as an experiment. External-client mTLS is out of scope. |
| "Application routing" | See note | — | — | In this lab, "application routing" means Gateway API HTTPRoute rules. The AKS application routing add-on (--enable-app-routing[-istio]) is a different product and is not installed. |
| JWT validation + claim-based routing | PREVIEW, DOCUMENTED | Traffic management | OIDC issuer | The doc's "missing token → 404" is a route miss, not auth enforcement. "Require a token" (requestPrincipals) is UPSTREAM. |
| Cross-cluster traffic shifting | PREVIEW, DOCUMENTED | Traffic management | Global services + waypoints | Ratios are approximate: HBONE connection reuse can pin streams (the doc notes this too). |
| Fault injection (delay/abort) | PREVIEW, DOCUMENTED | Traffic management | Waypoint | One doc sample is broken (see §5). |
| Metrics (data plane) | PREVIEW, DOCUMENTED | Observability, Metrics | Azure Monitor workspace, managed Prometheus, ConfigMap | No control-plane metrics, no tracing. |
| Logs (data plane + istiod) | PREVIEW, DOCUMENTED | Logs | Log Analytics, Container Insights, diagnostic setting (istiod) |
Logging is disabled by default. MeshControlPlane is the table for control-plane logs. |
| Upgrades (SelfManaged / FullyManaged) | PREVIEW, DOCUMENTED | Upgrades, Supported versions | — | SelfManaged: N→N+1 only, roll back once to N-1. Default version is N-1. Patches are always automatic. Application Network never upgrades AKS. |
| Planned maintenance | PREVIEW, DOCUMENTED | Planned maintenance | aksManagedNodeOSUpgradeSchedule |
Best effort only. Urgent fixes may ignore the window. |
| VNet peering | GA, DOCUMENTED | Peering overview | Non-overlapping VNet address spaces | Peering routes VNet address spaces, never overlay pod CIDRs. |
| Managed Gateway API CRDs | DOCUMENTED | Managed Gateway API | az ≥ 2.86.0, --enable-gateway-api |
Standard channel only. The bundle version follows the Kubernetes minor (1.35 → v1.4.1). |
| Private clusters | Not supported with Application Network | Overview | — | The API server stays public. The lab doesn't set authorized IP ranges, because the IPs the managed control plane uses to reach the API server are undocumented (INFERENCE). |
| Istio add-on, self-managed Istio, second Cilium, ACNS, Cilium mTLS/L7, Cluster Mesh | Deliberately not used | — | — | The Istio add-on is explicitly unsupported alongside Application Network. |
2. Compatibility of the exact combination¶
Azure CNI Overlay + Cilium dataplane + Kubernetes NetworkPolicy + Application Network ambient
| Question | Answer | Evidence class |
|---|---|---|
| Do the Application Network docs list a required or supported CNI? | No. The overview, get-started, architecture, security and traffic-management pages never mention Azure CNI, overlay, or Cilium. | DOCUMENTED (absence) |
| Do the docs say NetworkPolicy works with Application Network? | Only generically: "Combine AuthorizationPolicies with Kubernetes NetworkPolicies" (security page). No guidance on HBONE port 15008, probes, or east-west sources. | DOCUMENTED (partial) |
| Does upstream Istio ambient work on Cilium? | Yes, with conditions. Cilium needs cni.exclusive=false, must not use BPF masquerading, and needs socketLB.hostNamespaceOnly=true when kube-proxy is replaced (Istio platform prerequisites, Cilium Istio integration). |
UPSTREAM |
| Can a learner set those Cilium values on AKS? | No. AKS allows only label-exclusion changes to the Cilium ConfigMap. 07-verify-clusters.sh reads the values and records them as evidence. |
DOCUMENTED + RUNTIME |
| Does default-deny NetworkPolicy break ambient health probes on Cilium? | UPSTREAM says yes. Ambient SNATs kubelet probes to 169.254.7.127, which Cilium doesn't exempt. Exercise 10 tests this at runtime. |
UPSTREAM → RUNTIME |
| Is AKS Automatic (which defaults to CNI Overlay + Cilium) documented as compatible with Application Network? | Not stated. The fact that the default AKS Automatic network is Overlay + Cilium suggests the combination is expected to work, but that is inference, not a support statement. | INFERENCE |
| Conclusion | The exact combination is undocumented. The lab therefore gates onboarding behind G4_EXPERIMENTAL: you must explicitly accept running it as an experiment. Application Network is not silently replaced by another mesh. | — |
3. Live checks (2026-09-30, read-only, lab author's subscription)¶
| Check | Result |
|---|---|
Microsoft.AppLink/PublicPreview feature |
NotRegistered (registration is gate G1_PREVIEW) |
az appnet list-versions |
Fails with SubscriptionNotRegistered until registration, so live AppNet versions could not be checked. Re-run 01-preflight-azure.sh after gate G1. |
Provider Microsoft.AppLink location list |
West Central US, East US, East US 2, West US 2, West US 3, Central US, UK South, North Europe, Southeast Asia |
| AKS versions in eastus2 | 1.31–1.36 GA, 1.37 preview. 1.35 chosen: in the docs it's compatible with AppNet 1.2–1.5 (AppNet 1.3/1.4 have reached or are near end of life). |
| VM SKUs | This subscription restricts D-series v3–v6 (NotAvailableForSubscription). Standard_D4as_v7 is available in eastus2 (zones 1, 2). |
| Quota | StandardDasv7Family 0/100, regional cores 0/100 (the lab needs about 24 vCPUs, including surge) |
| Retail prices (eastus2, Linux, pay-as-you-go) | D4as_v7 $0.182/h. P6 disk $9.28/month. Standard static public IP $0.005/h. AKS Standard tier $0.10/h (Free tier $0). Peering intra-region $0.01/GB. Log Analytics ingestion $2.76/GB. Application Network: no published price found. |
4. Contradictions and how the lab resolves them¶
| # | Contradiction | Resolution |
|---|---|---|
| C1 | The overview says "Application Network supports single-cluster AKS deployments". The architecture page describes multi-cluster service discovery, and the traffic-management walkthrough uses two clusters. | Both are current Learn pages. The lab treats multi-cluster as documented preview functionality with an inconsistent scope statement, and says so in Module 5. If this matters to you, ask Microsoft which statement is authoritative. |
| C2 | The overview's region list includes japaneast, southindia and northcentralus but not uksouth. The provider's live location list includes uksouth and omits those three. | Preflight requires the region to be in both lists. |
| C3 | Metrics page: "data plane … appnet-system namespace". Every other page and the CLI output use applink-system. |
The lab uses applink-system (and checks it exists at runtime). |
| C4 | The docs call --version an "Application Network version". az appnet member join --help says "Istio version". |
The lab passes whatever az appnet list-versions reports and never invents a value. |
| C5 | az appnet member join in the upgrades doc includes --member-location. Get-started omits it. |
CLI help: optional, defaults to the cluster's location. Omitted. |
| C6 | The CLI exposes --east-west-gateway Internal/External, --network-name and --private-connect-subnet, none of which appear in the docs. |
Not used. The documented default (Internal, shown in the get-started sample output) is verified at runtime. |
| C7 | Delete: the get-started doc was corrected on 2026-09-16 to say deleting the Application Network cascades to members. Members must still be un-enrolled from ambient before removal. | Cleanup un-enrolls first, then removes members explicitly, then deletes. That's safe under either reading. |
5. Sample typos corrected (with evidence)¶
| Doc location | Problem | Correction | Evidence |
|---|---|---|---|
| Traffic mgmt, traffic shifting and fault sections | $CLUSTER_NAME1, $CLUSTER_NAME2 (variables defined as CLUSTER_NAME_1/2) |
Explicit --context values from config/lab.env |
Variable definitions at the top of the same page |
| Traffic mgmt, shift script | $BOOKINFO_GTW_IP vs $BOOK_INFO_GTW_IP |
The script reads the Gateway address directly | Same page |
| Traffic mgmt, "Reduce HTTP delay" (1s) | YAML indentation is broken (metadata:/name: at the same level, etc.) and it uses subset: v1 with no DestinationRule defining that subset |
70-ratings-delay-jason.yaml: valid structure, no subset | VirtualService schema (kubeconform); Istio subset semantics require a DestinationRule |
| Logs page | az aks enable-addons --addon monitoring |
--addons monitoring |
az aks enable-addons --help (2.86.0) |
| Get-started, delete | az appnet delete --appnet-name vs az appnet create --name |
Both are valid aliases | az appnet delete --help lists --appnet-name --name -n |
| Traffic mgmt, JWT | Doc sends a bearer token to the gateway's public IP over HTTP | JWT gateway uses an internal LB. Tests call the in-cluster Service name. Tokens are 10-minute kubectl create token tokens piped over stdin |
Your requirement; the AKS internal-LB annotation is DOCUMENTED |
6. Unresolved support gaps (read before approving gate G4)¶
- G-1: No documentation that Application Network is supported or validated on Azure CNI Overlay with the Cilium dataplane.
- G-2: No documented interaction between Cilium-enforced NetworkPolicy and ambient: HBONE port 15008, probe SNAT
169.254.7.127, east-west gateway sources. - G-3: East-west gateway ports, protocols and NSG requirements aren't documented. The lab discovers them from the live Service and tests TCP reachability.
- G-4: No HTTPS or external-client mTLS guidance for Application Network ingress.
- G-5: No documentation of whether ingress traffic can be routed through waypoints (
ENABLE_INGRESS_WAYPOINT_ROUTINGis istiod configuration managed by Azure). - G-6: Contradictory single- vs multi-cluster scope (C1).
- G-7: No published preview pricing, and it's undocumented where the management-plane Key Vault lives.
- G-8: Not documented whether
--disable-local-accountsor API-server authorized IP ranges are compatible with the managed control plane. The lab leaves both at their defaults. - G-9: Ingress routing to a global service whose endpoints are only remote isn't documented. Exercise 7 marks it as an experiment.
7. Approval gates¶
| Gate | Script / step | What it does | Billable? |
|---|---|---|---|
| G1_PREVIEW | 02-register-preview.sh |
Registers the preview feature + provider (subscription-wide, never undone by cleanup) | No |
| G2_FOUNDATION | 03-create-network.sh, 04-create-identities.sh |
Resource groups, VNets, peering, identities, subnet-scoped role assignments | Peering per GB |
| G3_CLUSTERS | 05-create-clusters.sh |
Two AKS clusters + your AKS RBAC roles | Yes |
| G4_EXPERIMENTAL | ex04 acknowledge |
Accepts the undocumented combination as an experiment | No |
| G5_APPNET | ex04 create, ex04 join |
Application Network + 2 members | Unknown (no published price) |
| G6_INGRESS | ex07 deploy |
Public LB frontend + public IP, restricted to your IP | Yes |
| G7_MONITORING | ex12 enable-metrics / enable-logs / monitoring-disable |
Azure Monitor workspace, Log Analytics, Container Insights, diagnostic settings | Yes |
| G8_LIFECYCLE | ex12 maintenance-window / upgrade-member |
Maintenance config, member minor upgrade (disruptive) | No |
| G9_* | cleanup scripts | Deletion (typed confirmation) | Stops charges |
8. Reference list¶
Microsoft Learn (accessed 2026-09-30):
- Azure CNI powered by Cilium: https://learn.microsoft.com/azure/aks/azure-cni-powered-by-cilium
- Azure CNI Overlay concepts: https://learn.microsoft.com/azure/aks/concepts-network-azure-cni-overlay
- AKS CNI prerequisites/reserved ranges: https://learn.microsoft.com/azure/aks/concepts-network-cni-overview
- Managed Gateway API: https://learn.microsoft.com/azure/aks/managed-gateway-api
- AKS private clusters: https://learn.microsoft.com/azure/aks/private-clusters
- Standard LB annotations (azure-allowed-ip-ranges, internal LB): https://learn.microsoft.com/azure/aks/configure-load-balancer-standard
- Application Network: overview, architecture, get-started, security, traffic-management-use-cases, supported-versions, observability, metrics, logs, upgrades, planned-maintenance: https://learn.microsoft.com/azure/application-network/
- VNet peering: https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview
- AKS pricing: https://azure.microsoft.com/pricing/details/kubernetes-service/ · Retail Prices API: https://prices.azure.com/api/retail/prices
Upstream (concepts only; not Azure support statements):
- Istio ambient + NetworkPolicy: https://istio.io/latest/docs/ambient/usage/networkpolicy/
- Istio ambient platform prerequisites (Cilium): https://istio.io/latest/docs/ambient/install/platform-prerequisites/
- Istio waypoints (ingress behaviour, bypass): https://istio.io/latest/docs/ambient/usage/waypoint/
- Istio verify mTLS in ambient: https://istio.io/latest/docs/ambient/usage/verify-mtls-enabled/
- Istio Gateway API task (<gateway>-<class> naming, infrastructure): https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/
- Istio secure ingress (Gateway API TLS): https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
- Cilium + Istio: https://docs.cilium.io/en/stable/network/servicemesh/istio/
- Kubernetes NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/