docs(azure): decide the managed scope for upgrades, add-ons, identity - #22
Merged
Merged
Conversation
Automatic locks the upgrade channel to stable with no override, which settles the LTS question too: Premium's extra support window is moot on a cluster that's never allowed to age. Storage CSI and policy stay AKS-managed; Velero's node-agent needs an explicit namespace exclusion from the enforced baseline Pod Security Standards to run at all. Crossplane's Azure provider checked out active, not a blocker. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Garinlu
marked this pull request as draft
September 14, 2026 15:21
The stable channel and the LTS refusal survive as deliberate choices instead of Automatic's impositions, backed by AKS's own N-2 support window rather than a lack of alternative. Policy enforcement moves out of this module's scope entirely — the same boundary that already kept Velero out of it — which means nothing here restricts privileged containers or hostPath, so Velero gets both its modes back instead of needing a namespace exclusion to recover one of them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Standard doesn't enable this by itself, but Microsoft documents it as a generic best-practice collection, not an Automatic-only convenience — resource requests, anti-affinity, image-tag hygiene, CSI enforcement, plus baseline Pod Security Standards. This module turns it on at Baseline/Enforce instead of leaving the choice to a later layer. Consequence: Velero's node-agent is blocked again, same as it would have been under Automatic, recovered the same way — an explicit namespace exclusion, set when whatever deploys Velero needs it, not a default this module carries. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Garinlu
marked this pull request as ready for review
September 15, 2026 13:01
8 tasks
UlysseCarpentier
approved these changes
Sep 17, 2026
Garinlu
enabled auto-merge (rebase)
September 17, 2026 09:33
Garinlu
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
stable, hardcoded, chosen deliberately for the same N-2 support-window margin a self-imposed policy would target.stableis never far enough behind to need it.Test plan
docs/aws/anddocs/gcp/.