Whats up People!
In case you run AKS in manufacturing, you already know the script. A pod can’t attain an exterior service, each dashboard says the cluster is wholesome, and any person is SSHing right into a node with 5 browser tabs open making an attempt to piece the story collectively. This session from the Microsoft Azure Infra Summit 2026 tackles that precise ache.
Shaifali Garg (PM for Azure Container Networking on AKS) sits down with Jonathan Wang, an AKS operator working 30 clusters throughout two areas on Cilium, they usually stroll by way of what an actual networking incident looks like, then introduce the Container Community Insights Agent (CNIA) reside within the cluster.
In Jonathan’s atmosphere, about 40% of incidents find yourself being networking issues. The instruments all exist (kubectl, dashboards, detectors, Hubble), however the time sink is determining which layer the issue lives in and what to test subsequent. CNIA goes after that hole. Here’s what you truly get again:
- A symptom-to-classification leap in seconds, so that you skip the primary half-hour of “is that this DNS, coverage, node, or app?”
- One chat window with one proof desk, one root trigger, and one copy-paste repair command, as an alternative of leaping throughout 5 tabs
- Senior SRE tribal data baked into the workflow, so anybody on the crew can run the identical investigation a principal engineer would
- Learn-only by design, so the agent by no means adjustments something in your cluster. You keep the human within the loop
- Installs as an AKS extension (no Helm chart, no YAML to babysit), and Azure handles the lifecycle
Briefly, CNIA isn’t making an attempt to interchange your SRE crew. It palms them again 20 or half-hour on each networking ticket, which provides up quick throughout a fleet.
Consider CNIA as an AI teammate that lives inside your AKS cluster as a pod. You describe what’s damaged in plain English, the best way you’d ping a senior engineer on Slack, and behind the scenes the agent does 4 issues so as. It classifies the form of downside (DNS, egress, coverage, node, app), it pulls reside proof out of your cluster, it analyzes that proof, and it palms you again a clear report with proof, root trigger, and a copy-paste exec command.
Two architectural selections stand out. First, the agent makes use of your personal Azure OpenAI useful resource (convey your personal), so prompts and diagnostic content material keep in your tenant and your area. Microsoft doesn’t see your diagnostic information, and nothing will get persevered externally. Second, the reply is grounded in proof pulled out of your cluster, not from the web. Your pods, your insurance policies, your CoreDNS, your host-level NIC and kernel counters. If the proof is inconclusive, CNIA says so fairly than fabricating a root trigger. That final bit is what earns belief with senior SREs.
CNIA matches contained in the broader Superior Container Networking Providers (ACNS) story on AKS. ACNS offers you metrics in Azure Managed Prometheus and Grafana, saved and on-demand community logs with Hubble, and FQDN-based filtering with Cilium. CNIA sits on high, automating the triage loop throughout these alerts so that you don’t have to stroll by way of the playbook by hand each time.
The set up is an AKS extension. Roughly 5 to 7 minutes from “az aks extension” to “you have got an SRE buddy in your cluster.” One small pod runs constantly. A second helper solely spins up on the node throughout a deep packet-drop investigation, reads host-level community counters, and is cleaned up proper after. Nothing left behind.
Permissions are intentionally slender:
- Learn-only RBAC on the cluster. The agent seems, it by no means adjustments something
- A workload id tied to your Azure OpenAI useful resource. No shared credentials
- Outbound site visitors is HTTPS to your OpenAI endpoint on port 443, and nothing else. If you wish to log that additional by way of an NSG or firewall, that’s supported
On the security aspect, CNIA layers two protections in opposition to immediate injection. The agent is scope-restricted by design, so off-topic requests get rejected right away. In considered one of Jonathan’s demos, Shefali asks the agent to “delete core-dns” and to “write a script to scrape LinkedIn profiles.” Each are refused on the spot. The second layer is the read-only RBAC on the cluster degree. Even when somebody tricked the immediate into emitting a harmful command, the cluster itself would refuse. The pod’s execution is scoped to particular diagnostic instructions. It’s not an open shell.
Trustworthy tradeoffs, as a result of you’ll ask:
- It’s one cluster at a time. Multi-cluster correlation isn’t in scope but
- It doesn’t auto-remediate. It tells you the repair, you confirm and run it
- It’s AKS solely. EKS and GKE usually are not supported at this time
- Session state lives within the pod in reminiscence. If the pod restarts, you begin a recent chat (previous classes are nonetheless accessible in historical past)
- Heavy packet-drop investigations have been validated as much as round 7 concurrent customers on smaller clusters. The crew is actively scaling that up
The session contains two demos that map on to incidents you have got most likely lived by way of.
Demo 1, egress that silently dies. Pods can’t attain google.com. CoreDNS resolves it high quality, instance.com works from the identical pod, each dashboard says wholesome. CNIA classifies it as an egress connectivity downside (not DNS) and surfaces the precise wrongdoer: a Cilium community coverage named “limit exterior FQDN” with a toFQDN rule that solely permits instance.com. The whole lot else will get silently dropped on the egress gate. DNS was allowed, the TCP connection was not. The repair command (a kubectl patch so as to add google.com to the enable checklist) is true there within the report. Finish-to-end repair in below a minute.
Demo 2, the goal port typo. A service is down with connection refused. Pods working, service exists, endpoints populated, no community insurance policies. The agent goes contained in the pod, seems on the precise listening sockets, and proves the mismatch: goal port 8080, however nginx listens on port 80. One-digit typo in YAML that no kubectl get would floor by itself.
The ROI math is easy. In case your crew handles networking incidents weekly and each prices 20 to half-hour of “the place do I even begin,” that capability provides up throughout the org. And critically, the win is not only pace. When the one engineer who is aware of the place to look goes on go away, the remainder of the crew is now not caught calling them at dwelling.
Three steps. That’s it.
- Learn the general public docs, get an summary, scan the use circumstances, and perceive what CNIA does and doesn’t cowl
- Decide a cluster (dev or staging is a superb place to begin) and set up the AKS extension. Give it 5 to 7 minutes
- Run just a few actual community tickets by way of it. Evaluate your time-to-answer earlier than and after. Hit thumbs-up or thumbs-down within the chat so the product crew sees actual sign
Pricing in preview: no license charge. You pay for the Azure OpenAI tokens it makes use of (your tenant, your useful resource), plus the tiny little bit of cluster compute for the pod. If you have already got Azure OpenAI in your tenant, simply level CNIA at it.
Catch the total Microsoft Azure Infra Summit 2026 session playlist right here: https://www.youtube.com/playlist?checklist=PLjt5SKzX1iI8con7FJDB56G6hHqxGm7ki
Cheers!
Pierre Roman
