[Feature] Native AKS Preflight Validation for Upgrade Readiness

Summary

AKS upgrades currently rely heavily on runtime validation during upgrade execution. While AKS already performs some validation internally, there is still no comprehensive native “preflight validation” feature that customers can proactively run before starting production upgrades.

This becomes especially important for clusters serving live production traffic during upgrades.

I would like to request a native AKS preflight validation capability that can be executed before:

control plane upgrades
node pool upgrades

The goal would be to proactively identify upgrade blockers and operational risks before the upgrade starts.

Proposed Capability

Example:

az aks preflight-check \
--resource-group rg-shared-001-prod \
--name aks-shared-001-prod \
--target-version 1.30.0

or:

az aks upgrade validate ...
Requested Control Plane / Infrastructure Preflight Checks

These checks would focus on AKS infrastructure readiness and upgrade feasibility.

1. PodDisruptionBudget Drainability Validation

Detect workloads where:

current replicas == minAvailable
disruptionsAllowed = 0
maxUnavailable = 0

These configurations commonly block node drain operations during AKS upgrades.

Example:

replicas: 2
pdb:
minAvailable: 2

or workloads where:

one pod is already unhealthy
leaving no available disruption budget

The preflight should identify:

workloads likely to block drain
workloads with zero disruption allowance
workloads with insufficient redundancy during rolling node upgrades
2. Surge Node IP Capacity Validation

Validate whether AKS subnet(s) have enough free IP capacity for:

surge node creation
pod IP allocation during upgrade

Especially important for:

Azure CNI
multi-nodepool clusters
production clusters using max surge

Suggested validation:

calculate required IPs after surge
compare against subnet usable IPs
fail before upgrade if insufficient

This is currently a common production upgrade failure scenario.

3. VM Quota Validation

Validate whether:

regional vCPU quota
VM-family-specific quota

are sufficient for:

configured max surge
upgrading node pools

Currently, upgrade failures can occur after the upgrade has already started because Azure quota is exhausted.

The preflight should proactively fail before upgrade execution begins.

4. Node Pool / AKS Resource Health Validation

Validate:

AKS provisioning state
node pool provisioning state
unhealthy node pools
upgrade-blocking cluster states

Example:

node pools in Failed state
partially upgraded pools
invalid upgrade paths