Microsoft's November 10, 2026 AKS networking update introduces configurable dimensions for Advanced Container Networking Services observability in public preview. The announcement describes more control over selected traffic and retained investigation detail. Microsoft networking update.
The blog previously covered container network logs reaching GA. This follow-up focuses on the newly announced preview controls; the base logging capability and the additional preview have separate release statuses.
My proposed evaluation would start with an incident question. Define what an engineer must establish from the records, then measure whether the chosen collection and grouping settings preserve that evidence at an acceptable volume.
Write the Investigation Question First
The announcement describes retaining details such as DNS queries and source or destination IP addresses for selected workloads, including selection by Cilium security identity. These capabilities belong to the observability preview within the broader networking update. Preview scope.
For a hypothetical service with unexpected outbound communication, I would write a concrete acceptance question: can the on-call engineer connect the observed destination to the relevant workload during the selected time window?
Record the expected evidence, authorized investigator, and retention requirement. Ask the application owner to review whether the proposed record is sufficient to distinguish normal activity from the controlled test case.
Treat Selection and Grouping as Separate Decisions
Microsoft Learn distinguishes traffic filters from aggregation grouping fields. Narrower filters can reduce collection, while additional grouping fields can produce more records. Container network log controls.
My pilot would change one decision at a time. First establish which traffic belongs in the experiment. Then assess which distinctions must survive aggregation so the investigator can answer the acceptance question.
Preserve both configuration and observation times. A lower record count needs an explanation that relates it to the test traffic and the retained investigative detail. Ask the reviewer to demonstrate the conclusion from the stored evidence.
Verify the Complete Retention Path
The documentation says ACNS writes matching flow logs to rotating node-local files. Long-term investigation requires forwarding; Azure Monitor provides the integrated path through Container Insights and Log Analytics, while an existing compatible pipeline is another documented option. Storage and collection behavior.
I would trace one approved synthetic observation from generation to the location the on-call team actually queries. Record where it arrived, the delay, the identifying fields, and the access used to retrieve it.
Include a controlled interruption of the test collection path in the rehearsal. Establish how the team detects missing evidence, identifies the affected interval, and explains that gap in an incident record. Give the investigation owner a documented escalation route.
Compare Volume Against Useful Evidence
My measurement sheet would pair the observed record volume with the acceptance result. Use the same representative traffic pattern and observation window when comparing candidate configurations.
Include the engineer time needed to answer the question. A configuration that produces a manageable stream still needs to preserve enough context for an operator to explain the relevant communication without guessing.
Agree on the collection boundary with the people who operate the destination workspace or logging service. Record the applicable ingestion, retention, and access decisions for this environment before extending the pilot to additional workloads.
Give Temporary Investigation Settings an Owner
I would separate the proposed everyday collection profile from a temporary investigation profile. For each, record the purpose, workload scope, approving owner, expected duration, and review date.
Rehearse ending the investigation. The operator should be able to identify which settings were introduced for the case, restore the agreed profile, and confirm that required everyday observations remain available.
Before adoption, verify current preview availability, prerequisites, supported configuration, and the team's existing networking setup against Microsoft's documentation. Keep the prior configuration recoverable and make the pilot's acceptance evidence available to the change reviewer.
Practical Cloud Engineer Takeaway
Define the incident question and required evidence before choosing fields.
Evaluate traffic selection separately from aggregation detail.
Trace a synthetic observation into the retained query destination.
Compare data volume with investigation usefulness and operator effort.
Assign an owner and expiry review to temporary collection changes.
Who Should Care?
AKS platform engineers, SREs, security investigators, and observability owners evaluating targeted network telemetry for selected workloads.
Bottom Line
The preview gives teams more control over network investigation detail. A useful pilot shows that the chosen scope, grouping, and retention path preserve the evidence the on-call engineer needs within the team's operating constraints.
No AKS cluster, ACNS setting, collection resource, workspace, logging pipeline, or Azure networking configuration was changed for this article.
Sources
Stay radical, stay curious, and keep pushing the boundaries of what is possible in the cloud.
Chriz
Beyond Cloud with Chriz
Comments