Who provides OS-level support for Ubuntu worker nodes in AKS (Microsoft vs Canonical)?

Question

Who provides OS-level support for Ubuntu worker nodes in AKS (Microsoft vs Canonical)?

Ryan Smith 20

What we’re trying to confirm:

Does Microsoft provide full support for the Ubuntu OS layer on AKS nodes, including:

-Kernel issues

-OS-level vulnerabilities

-FIPS-enabled node images

Is Canonical ever a required support path for AKS environments, or is Microsoft always the single support provider when using:

Default AKS Ubuntu images

No custom OS modifications

From a compliance / audit perspective, is the following statement accurate:

“Microsoft provides end-to-end support for AKS, including the Ubuntu node OS, and customers do not require a separate Canonical support agreement when using AKS-managed node images.”

Thanks for your help!

0 comments

Answer accepted by question author

Manish Deshpande 8,215 Microsoft External Staff Moderator

Hello @Ryan Smith

Great set of questions these come up often in compliance and audit discussions, so let me walk through each one clearly.

Does Microsoft provide full support for the Ubuntu OS layer on AKS nodes?

Yes for standard AKS-managed node images, Microsoft is your primary support contact and covers the Ubuntu OS layer. Here's how the support chain works behind the scenes:

Canonical supplies Microsoft with Ubuntu OS builds that include all available security updates. Microsoft then customizes these images for AKS (via an open-source tool called AgentBaker), tests them internally, and bundles them into weekly node image releases. So when it comes to kernel issues, OS-level CVEs, and security patches,

Microsoft handles this through the node image upgrade process you don't go to Canonical directly.

As the Microsoft docs explicitly state, Ubuntu node images are "fully validated by AKS and supported by Microsoft, Canonical, and the Ubuntu community." Canonical is a behind-the-scenes partner here; the customer-facing support relationship is entirely with Microsoft.

Vulnerability Management for AKS
https://learn.microsoft.com/en-us/azure/aks/concepts-vulnerability-management

AKS Node Images
https://learn.microsoft.com/en-us/azure/aks/node-images

What about FIPS-enabled node images?

Microsoft provides and manages FIPS 140-3-enabled node images for AKS as well. These are distinct images from the standard Ubuntu ones (different OS version / kernel in some cases), and they're still fully managed by Microsoft no separate agreement with Canonical is needed here either. FIPS-enabled node pools are natively supported via the --enable-fips-image flag during node pool creation.

Enable FIPS for AKS Node Pools
https://learn.microsoft.com/en-us/azure/aks/enable-fips-nodes

Is Canonical ever a required support path for AKS?

Not for standard AKS-managed Ubuntu images with no custom OS modifications. Microsoft is your single point of contact. Canonical's involvement is upstream and transparent to you as a customer.

The only scenario where this changes is if you make direct, unsupported modifications to the node OS outside of the AKS API (e.g., SSHing into nodes and manually running apt upgrade, modifying node settings via IaaS APIs). In those cases, any changes don't persist across upgrades or reboots, and Microsoft's support becomes best-effort. The recommendation is always to use the AKS node image upgrade mechanism for OS-level changes — that's the only supported and persistent path.

AKS Support Policies
https://learn.microsoft.com/en-us/azure/aks/support-policies

On your compliance / audit statement:

The statement "Microsoft provides end-to-end support for AKS, including the Ubuntu node OS, and customers do not require a separate Canonical support agreement when using AKS-managed node images" is accurate for compliance purposes, with one nuance worth noting for precision:

Canonical is involved in supplying the upstream OS builds to Microsoft, but this is a backend partnership between Microsoft and Canonical. From a customer and audit perspective, Microsoft is the responsible party and single support contact. You are not required to have, nor would you be expected to have, a Canonical support agreement to receive OS-level support on AKS nodes.

For audit documentation, the AKS Support Policies and Vulnerability Management pages linked above are the right Microsoft sources to cite.

AKS Day-2 Patch and Upgrade Guidance
https://learn.microsoft.com/en-us/azure/architecture/operator-guides/aks/aks-upgrade-practices

Thanks,
Manish.

Manish Deshpande 8,215 Reputation points Microsoft External Staff Moderator

2026-06-29T11:07:11.07+00:00

Hello @Ryan Smith

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

2 additional answers

Your answer

Manish Deshpande 8,215 Reputation points Microsoft External Staff Moderator

2026-06-29T11:07:11.07+00:00

Hello @Ryan Smith

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Answer 1

Microsoft is the support provider for AKS clusters and their managed node images, including Ubuntu-based node pools.

For Ubuntu worker nodes in AKS:

Ubuntu node images are “fully validated by AKS and supported by Microsoft, Canonical, and the Ubuntu community.”
Microsoft manages security vulnerabilities and missing security updates for “Ubuntu operating system 18.04 and 22.04 worker nodes,” receiving OS builds from Canonical “that have all available security updates applied.”

This means:

Kernel issues and OS-level vulnerabilities on AKS-managed Ubuntu node images are handled through Microsoft’s AKS support process. Canonical provides the underlying OS builds and security updates to Microsoft, but customers consume this via AKS images and AKS support.
FIPS-enabled Ubuntu node images are explicitly listed as an AKS-supported Ubuntu variant (“Ubuntu with containerd and FIPS”), with documented limitations (for example, “Not yet supported for Ubuntu 22.04+” and incompatibility with Arm64, Trusted Launch, or CVM). These are part of the AKS-supported image matrix.

Nothing in the provided material indicates that customers must open support cases directly with Canonical when they are using:

Default AKS Ubuntu images, and
No custom OS modifications.

From a compliance/audit perspective, the following statement is consistent with the documentation provided:

“Microsoft provides end-to-end support for AKS, including the Ubuntu node OS, and customers do not require a separate Canonical support agreement when using AKS-managed node images.”

Canonical’s role is to supply and maintain the Ubuntu OS builds and security updates that Microsoft then validates and ships as AKS node images; customer-facing support is through Microsoft.

References:

Answer 2

Hello @Ryan Smith,

Thank you for reaching out Q&A forum.

Ubuntu images for AKS worker nodes are provided by Canonical and customized by Microsoft to ensure enhanced compatibility within the AKS environment. Canonical closely collaborates with the Azure AKS team to ensure that the Ubuntu images are appropriately configured for optimal performance. Ubuntu

The security patch pipeline specifically works like this:

For Ubuntu 18.04 and 22.04 worker nodes, Canonical provides Microsoft with OS builds that have all available security updates applied. Microsoft Learn

For Linux nodes, Canonical Ubuntu makes OS security patches available once a day. Microsoft then tests and bundles these patches in the weekly updates to node images.

"customers do not require a separate Canonical support agreement"✅ TrueNo direct Canonical contract needed for standard managed AKS nodes

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.