Promote security gating to GA in stable version 2026-05-01

specification/containerservice/resource-manager/Microsoft.ContainerService/aks/AgentPool.tsp

@@ -97,7 +97,7 @@ interface AgentPools {
    * Completes the upgrade operation for the specified agent pool.
    */
   #suppress "@azure-tools/typespec-azure-resource-manager/arm-post-operation-response-codes" "Keeping both 202 and 204 responses for passing the lintdiff validator. See https://github.com/Azure/azure-openapi-validator/issues/809"
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   @summary("Completes the upgrade of an agent pool.")
   completeUpgrade is ArmResourceActionAsync<
     AgentPool,
@@ -143,7 +143,7 @@ interface AgentPools {
    */
   @get
   @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ContainerService/managedClusters/{resourceName}/agentPools/{agentPoolName}/operations/{operationId}")
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   getByAgentPool is AgentPoolsOps.ActionSync<
     AgentPool,
     void,

specification/containerservice/resource-manager/Microsoft.ContainerService/aks/AgentPoolModels.tsp

@@ -171,28 +171,28 @@ model ManagedClusterAgentPoolProfileProperties {
   /**
    * The version of node image
    */
-  @renamedFrom(Versions.v2026_03_02_preview, "nodeImageVersion")
-  @removed(Versions.v2026_03_02_preview)
+  @renamedFrom(Versions.v2026_05_02_preview, "nodeImageVersion")
+  @removed(Versions.v2026_05_02_preview)
   @visibility(Lifecycle.Read)
   readOnlyNodeImageVersion?: string;
 
   /**
    * The version of node image
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   nodeImageVersion?: string;
 
   /**
    * Defines the upgrade strategy for the agent pool. The default is Rolling.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   upgradeStrategy?: UpgradeStrategy;
 
   /**
    * Whether to enable the full-cache ephemeral OS disk feature. When this feature is enabled, the entire operating system will be locally cached on the ephemeral OS disk, preventing E17 events caused by network failures.
    */
   #suppress "@azure-tools/typespec-azure-core/casing-style" "Property name maintained for backward compatibility with existing API versions"
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   enableOSDiskFullCaching?: boolean;
 
   /**
@@ -203,7 +203,7 @@ model ManagedClusterAgentPoolProfileProperties {
   /**
    * Settings for Blue-Green upgrade on the agentpool. Applies when upgrade strategy is set to BlueGreen.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   upgradeSettingsBlueGreen?: AgentPoolBlueGreenUpgradeSettings;
 
   /**
@@ -274,7 +274,7 @@ model ManagedClusterAgentPoolProfileProperties {
   /**
    * Taints added on the nodes during creation that will not be reconciled by AKS. These taints will not be reconciled by AKS and can be removed with a kubectl call. This field can be modified after node pool is created, but nodes will not be recreated with new taints until another operation that requires recreation (e.g. node image upgrade) happens. These taints allow for required configuration to run before the node is ready to accept workloads, for example 'key1=value1:NoSchedule' that then can be removed with `kubectl taint nodes node1 key1=value1:NoSchedule-`
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   nodeInitializationTaints?: string[];
 
   /**
@@ -401,7 +401,7 @@ model ManagedClusterAgentPoolProfileProperties {
   /**
    * Settings to determine the prepared image specification used to provision nodes in a pool.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   preparedImageSpecificationProfile?: PreparedImageSpecificationProfile;
 }
 
@@ -422,7 +422,7 @@ model AgentPoolUpgradeSettings {
   /**
    * The maximum number or percentage of extra nodes that are allowed to be blocked in the agent pool during an upgrade when undrainable node behavior is Cordon. This can either be set to an integer (e.g. '5') or a percentage (e.g. '50%'). If a percentage is specified, it is the percentage of the total agent pool size at the time of the upgrade. For percentages, fractional nodes are rounded up. If not specified, the default is maxSurge. This must always be greater than or equal to maxSurge. For more information, including best practices, see: https://learn.microsoft.com/en-us/azure/aks/upgrade-cluster
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   maxBlockedNodes?: string;
 
   /**
@@ -448,7 +448,7 @@ model AgentPoolUpgradeSettings {
 /**
  * Settings for blue-green upgrade on an agentpool
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model AgentPoolBlueGreenUpgradeSettings {
   /**
    * The number or percentage of nodes to drain in batch during blue-green upgrade. Must be a non-zero number. This can either be set to an integer (e.g. '5') or a percentage (e.g. '50%'). If a percentage is specified, it is the percentage of the total number of blue nodes of the initial upgrade operation. For percentages, fractional nodes are rounded up. If not specified, the default is 10%. For more information, including best practices, see: https://learn.microsoft.com/en-us/azure/aks/upgrade-cluster
@@ -541,26 +541,26 @@ model KubeletConfig {
   /**
    * Specifies the default seccomp profile applied to all workloads. If not specified, 'Unconfined' will be used by default.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   seccompDefault?: SeccompDefault;
 
   /**
    * Kube-reserved values for kubelet. When a value is not set, the system-computed default based on VM size is used. See [AKS node resource reservations](https://aka.ms/aks/nodereservations) for details on computed defaults. Only applicable for Linux nodepools.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   kubeReserved?: KubeReserved;
 
   /**
    * Hard eviction thresholds for kubelet. When a threshold is not set, the system default is used. See [AKS node resource reservations](https://aka.ms/aks/nodereservations) for details on computed defaults. Only applicable for Linux nodepools.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   hardEvictionThreshold?: HardEvictionThreshold;
 }
 
 /**
  * Kube-reserved values for kubelet. When a value is not set, the system-computed default based on VM size is used. See [AKS node resource reservations](https://aka.ms/aks/nodereservations) for details on computed defaults. Only applicable for Linux nodepools.
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model KubeReserved {
   /**
    * The amount of CPU reserved for Kubernetes system daemons, in millicores. Must be greater than or equal to 140. For example, a value of 200 means 200m (0.2 CPU cores).
@@ -577,7 +577,7 @@ model KubeReserved {
 /**
  * Hard eviction thresholds for kubelet. These thresholds trigger pod eviction when node resources drop below the specified values. Values must be greater than or equal to the documented minimums for each signal. Supported formats are Ki, Mi, Gi, or percentages using %.
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model HardEvictionThreshold {
   /**
    * The threshold for available memory below which pod eviction is triggered. Accepts absolute values (e.g. '500Mi') or percentage values (e.g. '5%'). Absolute values must be greater than or equal to 100Mi. Percentage values must be greater than or equal to 2%.
@@ -797,7 +797,7 @@ model AgentPoolNetworkProfile {
    * The resource IDs of public IP prefixes for node public IPs. At most one IPv4 and one IPv6 prefix may be specified. Order does not matter; the RP determines IP version from the referenced resource's publicIPAddressVersion. Requires enableNodePublicIP to be true on the agent pool. Mutually exclusive with the top-level nodePublicIPPrefixID property. Immutable after node pool creation. To change prefixes, delete and recreate the node pool. For more information, see https://aka.ms/aks/ipv6-ilpip
    */
   #suppress "@azure-tools/typespec-azure-core/casing-style" "Property name maintained for backward compatibility with existing API versions"
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   @maxItems(2)
   nodePublicIPPrefixIDs?: Azure.Core.armResourceIdentifier<[
     {
@@ -821,13 +821,13 @@ model AgentPoolNetworkProfile {
   ]>[];
 
   /** Secondary network interface configurations for each VM in the agent pool. Each entry is a template: one physical NIC per entry is provisioned on every VM instance. These interfaces are created at agent pool creation time and are immutable. The length of the list must be less than the NIC capacity minus 1 for the VM size of the agent pool (AKS manages the primary NIC). For example, a Standard_D8a_v4 VM supports up to 4 NICs, so the maximum number of secondary interfaces allowed is 3. For mixed-SKU VM pools the effective capacity is the minimum across all SKUs: count(secondaryNetworkInterfaces) + 1 <= min(maxNICs). For more information, see https://aka.ms/aks/multi-nic */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   @identifiers(#[])
   secondaryNetworkInterfaces?: AgentPoolNetworkInterface[];
 }
 
 /** Type of network interface to be provisioned on each virtual machine instance. For more information, see https://aka.ms/aks/multi-nic */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 union AgentPoolNetworkInterfaceType {
   string,
 
@@ -839,7 +839,7 @@ union AgentPoolNetworkInterfaceType {
 }
 
 /** Configuration of a secondary network interface provisioned on each VM instance in the agent pool. For more information, see https://aka.ms/aks/multi-nic */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model AgentPoolNetworkInterface {
   /**
    * Type of NIC to be provisioned on the VM.
@@ -939,20 +939,20 @@ model GPUProfile {
   /**
    * Specify the type of GPU driver to install when creating Windows agent pools. If not provided, AKS selects the driver based on system compatibility. This cannot be changed once the AgentPool has been created. This cannot be set on Linux AgentPools. For Linux AgentPools, the driver is selected based on system compatibility.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   driverType?: DriverType;
 
   /**
    * NVIDIA-specific GPU settings.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   nvidia?: NvidiaGPUProfile;
 }
 
 /**
  * NVIDIA-specific GPU settings
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model NvidiaGPUProfile {
   /**
    * The Managed GPU experience installs additional components, such as the Data Center GPU Manager (DCGM) metrics for monitoring, on top of the GPU driver for you. For more details of what is installed, check out aka.ms/aks/managed-gpu.
@@ -1013,7 +1013,7 @@ model ScaleProfile {
    * Scaling decisions across profiles are governed by the cluster autoscaler expander,
    * configurable via `ManagedCluster.properties.autoScalerProfile.expander`.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   @identifiers(#[])
   autoscale?: AutoScaleProfile[];
 }
@@ -1036,7 +1036,7 @@ model ManualScaleProfile {
 /**
  * Specifications on auto-scaling.
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model AutoScaleProfile {
   /**
    * VM size that AKS will use when creating and scaling e.g. 'Standard_E4s_v3', 'Standard_E16s_v3' or 'Standard_D16s_v5'.
@@ -1160,7 +1160,7 @@ model LocalDNSOverride {
 /**
  * Settings to determine the prepared image specification used to provision nodes in a pool.
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model PreparedImageSpecificationProfile {
   /**
    * The resource ID of the prepared image specification resource to use. This can include a version. Omitting the version will use the latest version of the prepared image specification.

specification/containerservice/resource-manager/Microsoft.ContainerService/aks/AgentPoolUpgradeProfile.tsp

@@ -76,14 +76,14 @@ model AgentPoolUpgradeProfileProperties {
   /**
    * List of components grouped by kubernetes major.minor version.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   @identifiers(#[])
   componentsByReleases?: ComponentsByRelease[];
 
   /**
    * List of historical good versions for rollback operations.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   @visibility(Lifecycle.Read)
   @identifiers(#[])
   recentlyUsedVersions?: AgentPoolRecentlyUsedVersion[];
@@ -109,14 +109,14 @@ model AgentPoolUpgradeProfilePropertiesUpgradesItem {
   /**
    * Whether the Kubernetes version is out of support.
    */
-  @added(Versions.v2026_03_02_preview)
+  @added(Versions.v2026_05_02_preview)
   isOutOfSupport?: boolean;
 }
 
 /**
  * A historical version that can be used for rollback operations.
  */
-@added(Versions.v2026_03_02_preview)
+@added(Versions.v2026_05_02_preview)
 model AgentPoolRecentlyUsedVersion {
   /**
    * The Kubernetes version (major.minor.patch) available for rollback.