Somebody, somewhere, put a preview OS SKU into production because it had “hardened” in the datasheet. That person now has a deadline. Azure published the retirement notice for Azure Linux with OS Guard — the preview security SKU for AKS node pools — and the support end date is fixed. This is a planned deprecation, not an incident. It becomes an incident the day your node pool stops receiving fixes and someone asks why.
December 10, 2026
That is the hard stop. After that date the Azure Linux with OS Guard SKU is retired in AKS and Microsoft stops shipping node image updates, CVE patches, and support for it. The replacement, Azure Container Linux, is generally available now — so unlike a lot of “migrate off the preview” notices, you are not being asked to move to another beta. You are moving from an unsupported preview to a GA image. That part is genuinely fine.
89 days
From today’s date, that is what’s left. It sounds like a quarter. It is not. For any cluster that carries real traffic you need a test pass in a non-prod cluster, a validation window for whatever runs on those nodes, and a change window per environment. Burn a week on approvals, a week on staging, and you’re out of runway by mid-November. Start the audit this week, not in November.
2 commands to find the blast radius
You cannot fix what you cannot see, and the affected SKU only lives at the node pool level — a cluster can look clean while one node pool underneath it does not. List every cluster across a subscription, then interrogate each cluster’s node pools for their OS SKU:
Check the osSku value against the OS Guard SKU string named in the official retirement notice before you assume you’re clear — don’t guess the identifier, read it. Run it across every subscription you own, not the two you remember. To sweep a tenant, loop az account list into the commands above rather than clicking through the portal thirty times.
1 node pool at a time
There is no in-place OS SKU swap and no automated migration. AKS does not flip an existing node pool from one OS image family to another. The pattern is node pool replacement: stand up a new node pool on Azure Container Linux, cordon and drain the old one so workloads reschedule, validate, then delete the retiring pool. Do it one pool at a time so you keep capacity and a rollback path. Follow the current step-by-step in Microsoft’s retirement notice and the linked AKS docs for the exact --os-sku value and flags — the SKU name is new enough that copying a command from a blog (including a paraphrase of this one) will bite you. Get the string from the docs.
0 patches after the cutoff
This is the part that turns a maintenance ticket into a risk finding. After December 10 an OS Guard node pool keeps running — nothing force-terminates it — but it stops getting node image updates. That means kernel and userland CVEs land and stay open, no support case will be honoured for the retired SKU, and any auditor who greps your fleet for unsupported OS versions will find it. A hardened image that no longer receives security patches is neither hardened nor an asset. It’s a liability with good marketing.
The migration is mechanical and the target is GA. The only way this hurts is by being ignored until week twelve. Query your subscriptions today, and treat any pool you find as a change you schedule now, not a fire you fight in December.
