What is Container Network Insights Agent for AKS? (Public Preview)

Container Network Insights Agent is an AI-powered diagnostic assistant that helps you identify and resolve networking issues in your Azure Kubernetes Service (AKS) clusters. Describe a problem in natural language, such as DNS failures, packet drops, unreachable services, or blocked traffic. The agent collects evidence from your cluster and returns a structured report with root cause analysis and remediation guidance.

Unlike tools that operate only at the Kubernetes layer, Container Network Insights Agent can also gather host-level network statistics through its Linux Networking plugin. The agent can inspect NIC ring buffers, kernel packet counters, SoftIRQ distribution, and socket buffer utilization across your cluster nodes. This surfaces low-level issues such as packet drops, network bottlenecks, and hardware-level saturation that are otherwise difficult to diagnose in a Kubernetes environment.

The agent runs as an in-cluster web application deployed as an AKS cluster extension. You access it through your browser. It provides insights, analysis, and recommended actions. You review the findings and apply any suggested changes yourself.

What can you do with Container Network Insights Agent?

Container Network Insights Agent helps you troubleshoot the most common and most time-consuming categories of AKS networking issues:

Each diagnostic produces a structured report that includes what was checked, what's healthy, what failed, the identified root cause, and the exact commands to fix and verify the issue.

When to use Container Network Insights Agent

Use Container Network Insights Agent when you need to

• Describe the problem in plain English: No need to construct CLI commands or know which tool handles each networking layer. The agent determines the right diagnostic steps automatically.
• Trace issues across Kubernetes and host networking in one conversation: Go from network policies and pod scheduling down to NIC ring buffers and kernel counters without switching tools or SSH-ing into nodes.
• Detect active issues, not just stale counters: Delta-based measurements distinguish problems happening right now from historical noise.
• Get automated root cause analysis with ready-to-use fixes: The agent correlates evidence from multiple cluster data sources and delivers a structured report with remediation commands you can copy and run.
• Troubleshoot on any AKS cluster with no additional setup: DNS, packet drop, and Kubernetes networking diagnostics work out of the box. Enable Advanced Container Networking Services (ACNS) for Cilium policy and Hubble flow analysis.

Container Network Insights Agent isn't designed for

• Application code debugging or software development assistance
• Storage, PersistentVolume, or disk troubleshooting
• RBAC configuration, secrets management, or security auditing (except network policies)
• Workload scheduling, resource optimization, or cost management
• Non-Azure cloud environments (AWS, GCP)
• Making changes to your cluster (the agent provides recommendations only; you apply them)

How it works

When you describe a networking issue, Container Network Insights Agent follows a structured diagnostic workflow:

You describe the issue → Agent classifies it → Collects evidence from the cluster → Analyzes findings → Reports results

Container Network Insights Agent runs as a pod inside your AKS cluster. You interact with it through a web browser over HTTPS. Inside the cluster, the agent executes diagnostic commands through the AKS MCP server and connects to five data sources through specialized plugins:

• Kubernetes API Server: Queries pods, services, nodes, network policies, and other cluster resources via kubectl through the AKS MCP server.
• CoreDNS: Collects DNS health status and metrics through the DNS plugin.
• Cilium Agent: Inspects Cilium network policies and endpoint state via the AKS MCP server through the Kubernetes Networking plugin.
• Hubble: Observes live network flows and identifies dropped traffic via the AKS MCP server through the Kubernetes Networking plugin.
• Node Network Stack: Gathers host-level network statistics (RX/TX buffers, ring buffer state, softnet counters) through the Linux Networking plugin.

The agent communicates bidirectionally with Azure OpenAI Service: it sends your natural language query and collected diagnostic evidence for reasoning, and receives structured diagnostic insights in return.

The diagnostic workflow follows four steps:

1. Classify: The agent determines the issue category (DNS, connectivity, network policy, service routing, or packet drops) based on your description.
2. Collect evidence: The agent runs diagnostic commands against your cluster through the AKS MCP server, using kubectl, cilium, and hubble. Each diagnostic category uses a dedicated evidence collection workflow to gather the right data automatically.
3. Analyze: The agent examines collected evidence to separate healthy signals from anomalies. The agent bases all conclusions on actual command output, never on speculation.
4. Report: You receive a structured report that includes:

• A summary of the issue and its status
• An evidence table showing each check, its result, and whether it passed or failed
• Analysis of what's working and what's broken
• Root cause identification with specific evidence citations
• Exact commands to fix the issue and verify the fix

Integrations

Container Network Insights Agent works with the AKS networking tools you already use:

Safety model and limitations

How the agent interacts with your cluster

Container Network Insights Agent collects diagnostic data from your cluster to generate insights, reports, and recommended actions. It executes cluster operations through the AKS MCP server and uses a dedicated Kubernetes service account (container-networking-agent-reader) with minimal permissions scoped to the data it needs for diagnostics.

Container Network Insights Agent doesn't make changes to your cluster. It provides remediation commands and recommendations, but you review and apply them yourself.

Scope restrictions

The agent responds only to networking and Kubernetes-related questions and doesn't respond to off-topic requests. The system also includes prompt injection defenses to prevent misuse.

Session and conversation limits

Concurrency

Container Network Insights Agent supports 1–7 concurrent users under typical conditions. Packet drop diagnostics on larger clusters (25+ nodes) may require limiting concurrent users to avoid API server load. For details, see Scale guidance.

Example scenarios and sample prompts

DNS troubleshooting

DNS resolution failures are one of the most common networking issues in Kubernetes. When pods can't resolve service names, external domains, or both, Container Network Insights Agent runs a comprehensive DNS diagnostic that checks CoreDNS health, configuration, DNS resolution from multiple paths, and network policies that might block DNS traffic.

Common situations:

• Pods log Name or service not known or NXDOMAIN errors
• Applications time out reaching services by name
• DNS works for some pods but not others
• External domain resolution fails while internal resolution works (or vice versa)

Sample prompts:

What the agent checks:

The DNS diagnostic checks CoreDNS pod health, service endpoints, and CoreDNS configuration, including custom ConfigMaps. It also tests DNS resolution across multiple paths: same-namespace, cross-namespace, FQDN, and external. The agent evaluates CoreDNS Prometheus metrics and network policy rules, including Cilium toFQDN egress policies that might silently restrict external domain resolution.

Example root causes the agent identifies:

• CoreDNS pods not running or not ready
• Custom CoreDNS ConfigMap with misconfigured rewrite or forward rules
• Network policy blocking UDP/TCP port 53 (DNS traffic)
• Cilium toFQDNs policy missing a required domain in its allow list
• NodeLocal DNS DaemonSet deployed without a Cilium LocalRedirectPolicy
• Application configured with the wrong service DNS name

RX / Packet drop troubleshooting

Packet drops are difficult to diagnose because they can occur at multiple layers: NIC hardware, the kernel networking stack, or application socket buffers. Container Network Insights Agent deploys a lightweight debug pod to each node to collect host-level network statistics. It then uses delta measurements to identify where packets are lost.

Common situations:

• Applications report intermittent connection resets or timeouts
• Tools like iperf show packet loss between nodes
• Network latency spikes appear on specific nodes
• High CPU usage correlated with network processing
• ethtool -S shows incrementing RX drop counters

Sample prompts:

What the agent checks:

The packet drop diagnostic examines NIC ring buffer utilization (ethtool), kernel softnet statistics (/proc/net/softnet_stat), per-CPU SoftIRQ distribution, and socket buffer saturation. It also reviews network interface statistics (/proc/net/dev), kernel buffer tunables (tcp_rmem, rmem_max, netdev_max_backlog), RPS/XPS/RFS configuration, and CNI-specific interface analysis. The agent uses delta measurements (before-and-after snapshots) to detect active drops versus historical counters.

Example root causes the agent identifies:

• NIC ring buffer exhaustion: active rx_dropped counters incrementing
• Kernel packet drops: non-zero values in /proc/net/softnet_stat drop column
• Socket buffer overflow: socket receive queue growing beyond buffer limits
• SoftIRQ CPU bottleneck: high %soft on a single CPU with imbalanced interrupt distribution
• All checks passing: agent reports "No issue detected" rather than guessing

Kubernetes networking troubleshooting

When pods can't communicate with services, network policies block expected traffic, or services have no endpoints, Container Network Insights Agent investigates the full networking path. The agent checks pod scheduling and readiness, service endpoint registration, network policy evaluation, and Hubble flow observation.

Common situations:

• Pod-to-pod or pod-to-service communication fails
• Services are unreachable from certain namespaces
• Network policies unexpectedly block traffic
• Service endpoints exist but connections still time out
• Hubble shows DROPPED verdict on flows between pods

Sample prompts:

What the agent checks:

The Kubernetes networking diagnostic examines pod status and scheduling, service configuration and endpoint registration, and network policies (both Kubernetes NetworkPolicy and CiliumNetworkPolicy). It also analyzes Hubble flows, including dropped traffic, and service-to-pod port mapping. A common misconfiguration the agent catches is a service targetPort that doesn't match the pod containerPort. This mismatch causes connection timeouts even though endpoints appear healthy.

Example root causes the agent identifies:

• Network policy (or CiliumNetworkPolicy) blocking ingress or egress traffic
• Service targetPort doesn't match the pod's containerPort
• Service selector labels don't match any pod labels (empty endpoints)
• Pod stuck in Pending due to unschedulable resource requests
• Readiness probe failing, causing pods to be excluded from service endpoints
• Cilium agent pods not healthy

Known issues and product limitations

Scale guidance

The first query from a new user might take longer if all agents in the pre-warmed pool (default: three agents) are in use. Subsequent queries from the same session use the already-initialized agent.

Known issues

Extension availability

The microsoft.containernetworkingagent AKS extension is available in all Azure public regions where AKS is supported. It isn't available in Azure Government, Microsoft Azure operated by 21Vianet, or other sovereign clouds.

Pricing

Container Network Insights Agent runs as a pod in your AKS cluster. Direct costs include:

• Azure OpenAI usage: Token consumption depends on conversation length and diagnostic complexity. See Azure OpenAI pricing for current rates.
• AKS node compute: The Container Network Insights Agent pod and (for packet drop diagnostics) the debug DaemonSet consume cluster compute resources.

Container Network Insights Agent itself has no separate licensing fee during public preview.

Access and use Container Network Insights Agent

Container Network Insights Agent is a browser-based chatbot that runs inside your AKS cluster. After deployment, open the application URL in any modern browser to start a conversation. You don't need a CLI tool on your workstation or a portal blade to navigate. It's a standalone chat interface designed for network diagnostics.

Sign up

When you first open the Container Network Insights Agent URL, the application prompts you to sign in. Depending on how your administrator configured the deployment, you sign in with either a simple username (development environments) or your Microsoft Entra ID credentials (production environments).

Grant permissions

After signing in, the application might prompt you to grant permissions. Review the requested permissions and select Accept to continue.

Chat interface

After you authenticate, you land on the chat interface. The server maintains your session, so you can close and reopen the browser tab within the session timeout window without losing your conversation.

The chat interface is where you:

• Ask questions in natural language: Type prompts like "Why can't my pod resolve DNS?" or "Check packet drops on node aks-nodepool1-vmss000000". No special syntax is required.
• Receive structured diagnostic reports: Responses include evidence tables, root cause analysis, and remediation commands you can copy and run.
• Start new conversations: Each conversation maintains its own context. Switch topics by starting a new conversation.
• Submit feedback: After each diagnostic response, use the built-in feedback controls (thumbs-up and thumbs-down) to rate the quality of the diagnosis. Your feedback helps improve future diagnostic accuracy.

Report issues

If you encounter a problem with Container Network Insights Agent:

1. Note the session ID and timestamp of the issue (visible in the chat interface)
2. Check the health endpoints: /health, /ready, /live
3. Review pod logs: kubectl logs -l app=container-networking-agent -n kube-system
4. File an issue through your standard Azure support channel

Next steps

• Quickstart: Deploy Container Network Insights Agent
• Troubleshoot Container Network Insights Agent on AKS
• Advanced Container Networking Services overview
• Azure CNI powered by Cilium