ACNS observability-only configuration deploys crash-looping acns-security-agent when security is disabled

Question

ACNS observability-only configuration deploys crash-looping acns-security-agent when security is disabled

Preston Rodriguez 0

An AKS cluster configured with Advanced Container Networking Services observability enabled and security disabled deploys the AKS-managed acns-security-agent DaemonSet.

The agent starts the standalone Cilium DNS proxy with an invalid combination of generated settings:

--enable-l7-proxy='false'
--enable-standalone-dns-proxy='true'

The container immediately terminates with:

standalone DNS proxy requires L7 proxy and standalone DNS proxy to be enabled in the configuration

The ARM resource confirms that ACNS security is disabled:

"advancedNetworking": {
  "enabled": true,
  "observability": {
    "enabled": true
  },
  "security": {
    "enabled": false
  }
}

Despite this, AKS deploys the security-specific acns-security-agent DaemonSet and configures the standalone DNS proxy as enabled while disabling its required L7 proxy dependency.

AKS Kubernetes version: 1.36.2
Region: centralus
Network plugin: Azure CNI

Network plugin mode: Overlay

Network dataplane: Cilium

Network policy: Cilium

ACNS observability: Enabled

ACNS security: Disabled

Node OS: Azure Linux

Node image: AKSAzureLinux-V3gen2-202607.09.0

Security-agent image: mcr.microsoft.com/containernetworking/cilium/dns-proxy:v1.19.3-260520

SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator

2026-08-04T15:07:04.17+00:00

Hello @Preston Rodriguez,

Thank you for using Q & A forum.

Based on the information provided, this appears to be a regression in AKS ACNS component deployment/configuration where an observability-only cluster incorrectly deploys the acns-security-agent and generates a Cilium configuration that enables standalone DNS proxy while disabling its mandatory L7 proxy dependency. The resulting CrashLoopBackOff is expected behavior from the DNS proxy, but the invalid configuration originates from AKS-managed resources.

Example Custom Configuration Override

If you choose to apply a custom configuration, you can create a patch to disable the acns-security-agent DaemonSet when security is disabled. Here’s an example using kubectl:

Create a patch file disable-acns-security-agent.yaml

cat > disable-acns-security-agent.yaml <

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

2 answers

Your answer

SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator

2026-08-04T15:07:04.17+00:00

Hello @Preston Rodriguez,

Thank you for using Q & A forum.

Based on the information provided, this appears to be a regression in AKS ACNS component deployment/configuration where an observability-only cluster incorrectly deploys the acns-security-agent and generates a Cilium configuration that enables standalone DNS proxy while disabling its mandatory L7 proxy dependency. The resulting CrashLoopBackOff is expected behavior from the DNS proxy, but the invalid configuration originates from AKS-managed resources.

Example Custom Configuration Override

If you choose to apply a custom configuration, you can create a patch to disable the acns-security-agent DaemonSet when security is disabled. Here’s an example using kubectl:

Create a patch file disable-acns-security-agent.yaml

cat > disable-acns-security-agent.yaml <

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Answer 1

Hi Preston Rodriguez,

Thank you for providing the detailed configuration information and error output.

Based on the details shared, the observed behavior appears inconsistent with the configured ACNS state. The ARM resource indicates that ACNS Observability is enabled while ACNS Security is disabled, yet the AKS-managed acns-security-agent DaemonSet is still being deployed and configured with:

--enable-standalone-dns-proxy=true

--enable-l7-proxy=false

The reported error:

standalone DNS proxy requires L7 proxy and standalone DNS proxy to be enabled in the configuration.

suggests that the generated configuration contains conflicting settings, as the standalone DNS proxy depends on L7 proxy functionality.

To help determine whether this is an AKS-managed configuration issue, could you please confirm the following:

Does the same behavior occur on a newly created AKS cluster using the same ACNS configuration?
Does the issue persist after upgrading to the latest supported AKS patch version?
Can you verify whether the generated configuration associated with the acns-security-agent contains the same conflicting values across all affected nodes?

Based on the information provided so far, this does not appear to be caused by a user configuration error. If the behavior is consistently reproducible, further investigation by the AKS Networking/ACNS engineering team may be required to determine whether the managed service is generating an invalid configuration under this specific scenario.

Please share any additional findings, and we'll be happy to review them further.

Answer 2

Hello @Preston Rodriguez

Thanks for sharing the detailed configuration and error output.

Based on your findings, this looks less like a configuration mistake and more like an AKS-managed deployment issue. Since the ARM resource clearly shows ACNS Observability = Enabled and ACNS Security = Disabled, the acns-security-agent DaemonSet shouldn't be deployed with a configuration that requires L7 proxy functionality.

The crash message:

standalone DNS proxy requires L7 proxy and standalone DNS proxy to be enabled in the configuration

suggests the generated Cilium configuration is internally inconsistent. Specifically, enable-standalone-dns-proxy=true is being set while enable-l7-proxy=false, which violates the dependency expected by the agent.

As a few troubleshooting steps, it would be useful to confirm:

Whether this behavior is reproducible on a newly created AKS cluster with the same ACNS settings.
If the issue persists after upgrading to the latest supported AKS patch version, in case it's already been addressed.
Whether the generated ConfigMap for the security agent contains the same conflicting values, which would further indicate an AKS-managed configuration generation bug.

If reproducible, this appears to warrant review by the AKS networking/ACNS engineering team, as the managed service is generating an invalid Cilium configuration despite the ARM resource reflecting the intended state.

Please let us know if you've already tested this on another cluster or AKS version, as that could help determine whether this is a regional regression or a broader product issue.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Allan Solomon Mejia 7,915 Reputation points

2026-08-08T00:33:22.6666667+00:00

Hello @Preston Rodriguez

Let us know if you still need further assistance, otherwise, please "Accept the Answer". Thank you.

ACNS observability-only configuration deploys crash-looping acns-security-agent when security is disabled

Create a patch file disable-acns-security-agent.yaml

2 answers

Your answer