---
title: Cluster extensions for Azure Kubernetes Service (AKS)
description: Learn how to deploy and manage the lifecycle of cluster extensions on Azure Kubernetes Service (AKS).
ms.date: 09/09/2025
ms.topic: overview
ms.subservice: aks-developer
author: davidsmatlak
ms.author: davidsmatlak
ai-usage: ai-assisted

# Customer intent: As a Kubernetes administrator, I want to deploy and manage cluster extensions on Azure Kubernetes Service so that I can enhance my cluster's capabilities and streamline the lifecycle management of related applications and services.
---

# Deploy and manage cluster extensions for Azure Kubernetes Service (AKS)

Cluster extensions provide an Azure Resource Manager driven experience for installation and lifecycle management of services like Azure Machine Learning or Kubernetes applications on an AKS cluster. This feature enables:

- Azure Resource Manager-based deployment of extensions, including at-scale deployments across AKS clusters.
- Lifecycle management of the extension (Update, Delete) from Azure Resource Manager.

## Categories of cluster extensions

There are two categories of cluster extensions, _Core_ and _Standard_ that can be deployed onto AKS clusters.

### Core extensions

Core Kubernetes extensions have broader region availability, a more integrated AKS experience, and release alignment to AKS version releases. Azure Backup is a core extension.

#### AKS native experience

Core extensions can be managed using `az aks` CLI command.

```azurecli
az aks extension create \
  --name <core extension name> \
  --extension-type <type> \
  --cluster-name <name> \
  --resource-group <group>
```

For more information about the commands, see [`az aks`](/cli/azure/aks).

#### Release policy

Minor and major upgrades of core extensions occur alongside AKS minor and major version updates to avoid introducing breaking changes and provide better reliability.

### Add-on to core extension migration

[Azure Monitor](/azure/azure-monitor/containers/kubernetes-monitoring-overview) services, including [Container Insights](/azure/azure-monitor/containers/kubernetes-monitoring-enable?tabs=cli), [Managed Prometheus](/azure/azure-monitor/containers/kubernetes-monitoring-enable?tabs=cli), and [Application Insights](/azure/azure-monitor/containers/kubernetes-codeless?tabs=portal) are transitioning to a cluster extension based backend model. This change updates AKS monitoring [add-ons](/azure/aks/integrations) to an extension‑based management model, with no change to functionality or user experience.

- This backend migration is nondisruptive and doesn't change user experience or require customer action.

- There's no impact to workloads, data collection, or monitoring functionality.

- Azure CLI, Azure portal, and all client experiences continue to work as expected.

> [!NOTE]
> - **Azure policy restrictions:** Custom Azure policies that block creation or updates to the [cluster extensions resource type](/rest/api/kubernetesconfiguration/extensions/extensions/create) must be updated or exempted.
> - **Azure resource locks:** Azure resource locks can block management of [cluster extensions resource type](/rest/api/kubernetesconfiguration/extensions/extensions/create).
>
> Refer to the [troubleshooting](https://aka.ms/k8s-extensions-tsg) documentation for mitigation details.

### Standard extensions

For information about the other cluster extensions, see the table in [Currently available extensions](cluster-extensions.md#currently-available-extensions) and the [Kubernetes apps](deploy-marketplace.md) deployed via Azure Marketplace are of the Standard Extension type.

Standard extensions can be managed using the `az k8s-extension` CLI command. For more information, see [Deploy and manage cluster extensions by using Azure CLI](deploy-extensions-az-cli.md).

```azurecli
az k8s-extension create \
  --name <standard extension name> \
  --extension-type <extension-type> \
  --scope cluster \
  --cluster-name <clusterName> \
  --resource-group <resourceGroupName> \
  --cluster-type managedClusters
```

## Cluster extension requirements

The cluster extensions platform is supported in all regions where AKS is deployed, except Qatar Central and US air gapped clouds. Although the platform is available in all regions, check the region availability for individual extensions.

> [!IMPORTANT]
> Ensure that your AKS cluster is created with a managed identity, as cluster extensions don't work with service principal-based clusters.
>
> For new clusters created with `az aks create`, managed identity is configured by default. For existing service principal-based clusters that need to be switched over to managed identity, it can be enabled by running `az aks update` with the `--enable-managed-identity` flag. For more information, see [Use managed identity][use-managed-identity].

> [!NOTE]
> If you enabled [Microsoft Entra pod-managed identity][use-azure-ad-pod-identity] on your AKS cluster or are considering implementing it,
> we recommend you first review [Workload identity overview][workload-identity-overview] to understand our
> recommendations and options to set up your cluster to use a Microsoft Entra Workload ID (preview).
> This authentication method replaces pod-managed identity (preview), which integrates with the Kubernetes native capabilities
> to federate with any external identity providers.
> The open source Microsoft Entra pod-managed identity (preview) in Azure Kubernetes Service was deprecated as of October 24, 2022.

## Currently available extensions

| Extension | Description |
| --------- | ----------- |
| [Dapr][dapr-overview] | `Dapr` is a portable, event-driven runtime that makes it easy for any developer to build resilient, stateless, and stateful applications that run on cloud and edge. |
| [Azure App Configuration][app-config-overview] | Use Azure App Configuration to centrally manage application settings and feature flags. |
| [Azure Machine Learning][azure-ml-overview] | Use Azure Kubernetes Service clusters to train, inference, and manage machine learning models in Azure Machine Learning. |
| [Flux (GitOps)][gitops-overview] | Use GitOps with Flux to manage cluster configuration and application deployment. See also [supported versions of Flux (GitOps)][gitops-support] and [Tutorial: Deploy applications using GitOps with Flux v2][gitops-tutorial].|
| [Azure Container Storage](/azure/storage/container-storage/container-storage-introduction) | Use Azure Container Storage to manage block storage on AKS clusters to store data in persistent volumes. |
| [Azure Backup for AKS](/azure/backup/azure-kubernetes-service-backup-overview) | Use Azure Backup for AKS to protect your containerized applications and data stored in Persistent Volumes deployed in the AKS clusters. |
| [Container Network Insights Agent][container-network-insights-agent-overview] | Use the Container Network Insights Agent—an AI-powered, evidence-based AKS cluster extension—to diagnose and troubleshoot networking issues in your AKS cluster. |

You can also [select and deploy Kubernetes applications available through Marketplace](deploy-marketplace.md).

> [!NOTE]
> Cluster extensions provide a platform for different extensions to be installed and managed on an AKS cluster. If you're facing issues while using any of these extensions, open a support ticket with the respective service.

## Next steps

- Learn how to [deploy cluster extensions by using Azure CLI](deploy-extensions-az-cli.md).
- Read about [cluster extensions][arc-k8s-extensions].


<!-- INTERNAL LINKS -->
[arc-k8s-extensions]: /azure/azure-arc/kubernetes/conceptual-extensions
[app-config-overview]: ./azure-app-configuration-quickstart.md
[azure-ml-overview]: /azure/machine-learning/how-to-attach-kubernetes-anywhere
[dapr-overview]: ./dapr.md
[gitops-overview]: /azure/azure-arc/kubernetes/conceptual-gitops-flux2
[gitops-support]: /azure/azure-arc/kubernetes/extensions-release#flux-gitops
[gitops-tutorial]: /azure/azure-arc/kubernetes/tutorial-use-gitops-flux2
[k8s-extension-reference]: /cli/azure/k8s-extension
[use-managed-identity]: ./use-managed-identity.md
[workload-identity-overview]: workload-identity-overview.md
[use-azure-ad-pod-identity]: use-azure-ad-pod-identity.md
[container-network-insights-agent-overview]: ./container-network-insights-agent-overview.md

<!-- EXTERNAL LINKS -->
[arc-k8s-regions]: https://azure.microsoft.com/global-infrastructure/services/?products=azure-arc&regions=all
