My AKS cluster is stuck in the "Updating" state for more than 24 hour, and the operation is not progressing. This happened right after my subscription billing payment was processed.

Hi ,

Thanks for reaching out to Microsoft Q&A.

When an AKS cluster stays in Updating for 24+ hours with ReconcilingDNS/ReconcilingAddons and never completes, it means the control-plane reconciliation loop is stuck. This is almost never caused by your billing payment. It is usually caused by one of the following:

A bad or half-applied AKS extension (aks-preview is the usual culprit).

An internal control-plane operation that failed to update DNS or addon configuration.

A blocked ARM deployment lock or a policy that prevents AKS from modifying resources.

A node pool that is stuck in a failed provisioning state.

You cannot fix this from the client side once the control-plane is stuck. It requires Azure Support to repair the cluster’s control plane state.

If it has been stuck for more than a few hours, the control-plane is wedged and only Azure Support can repair it. They will manually reset the AKS control-plane reconciliation state. You will not lose your workloads or data disks.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

Hello @Yassmine EL JARY ,

Can you steps mentioned below in order and see if you find any anomaly (like provisioning state being stuck in updating or failed state)

Step 1: Check the cluster state- Run the following command to get more detailed status and recent operations:

az aks show --name aks-cLluster --resource-group RG --query "{provisioningState:provisioningState, powerState:powerState, fqdn:fqdn, privateFqdn:privateFqdn, addonProfiles:addonProfiles}" -o json

This will show:

• Current provisioning and power state
• DNS endpoints (FQDN)
• Addon status (e.g., monitoring, httpApplicationRouting, azurepolicy, etc.)

Step 2: Check for DNS or network-related issues: Since ReconcilingDNS is stuck, there might be a problem with:

• Custom DNS configuration (e.g., custom DNS server, private cluster DNS issues)
• Network security groups (NSG) blocking Azure control plane communication
• Private link or private endpoint conflicts Check your cluster’s network profile:

az aks show --name aks-cLluster --resource-group RG --query networkProfile -o json

Step 3: Check addon status:

If ReconcilingAddons is stuck, a specific addon might be failing. List addons and their states:

az aks addon list --name aks-cLluster --resource-group RG -o table

Common problematic addons:

• monitoring (Azure Monitor for containers)
• azurepolicy (Gatekeeper)
• ingressApplicationGateway
• openServiceMesh If an addon is failing, you might try disabling it temporarily to unblock the update:

az aks disable-addons --addons <addon-name> --name aks-cLluster --resource-group RG

Then re-enable it later. Note: these commands are created with the name of the AKS cluster as "aks-cLluster" and resource group name as "RG".

Additionally, I've reached out to you via Private Message requesting few details related to your subscription which can help us collaborate with you more effectively over Team's call and get to know the issue better.