[BUG] Cannot update cluster from kubenet to Azure CNI Overlay

[benjaminxie02]

Describe the bug
I am following the docs at
https://learn.microsoft.com/en-us/azure/aks/update-azure-cni?tabs=kubenet
which gives the a command to migrate an existing cluster from kubenet to Azure CNI Overlay. When I run it, I get an error.

To Reproduce
Steps to reproduce the behavior:

1. Run

az aks update \
  --name $CLUSTER_NAME \
  --resource-group $RESOURCE_GROUP \
  --pod-cidr 10.250.0.0/16 \
  --network-plugin azure \
  --network-plugin-mode overlay

2. See error

(UnsupportedNetworkpluginModeWithNetworkplugin) NetworkpluginMode overlay is not supported with Networkplugin kubenet.
Code: UnsupportedNetworkPluginModeWithNetworkPlugin
Message: NetworkPluginMode overlay is not supported with NetworkPLugin kubenet.
Target: networkProfile.networkpluginMode

Expected behavior
I expect my cluster's network configuration to become Azure CNI Overlay and the pod CIDR to be what I set it to.

Environment:

• CLI Version [e.g. 2.84]
• Kubernetes version [e.g. 1.33.5]

Additional context
Network policy engine: none

Using custom VNet

Did not create a user-assigned managed identity on the cluster to detach the route table from the VNet however, this error does not seem related to that.

[PixelRobots]

Do you have network policies enabled on your cluster?

[sf-msft]

The route table should automatically detach if managed and shouldn't cause the migration to fail.

What az cli version is this via az version?

{
  "azure-cli": "2.84.0",
  "azure-cli-core": "2.84.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "aks-preview": "19.0.0b25",
    "alb": "2.0.1",
    "amg": "2.8.1",
    "ssh": "2.0.6"
  }
}

Could you post the output of az aks show -g $RESOURCE_GROUP -n $CLUSTER_NAME as well? e.g.

    "networkDataplane": null,
    "networkMode": null,
    "networkPlugin": "kubenet",
    "networkPluginMode": null,
    "networkPolicy": "none",
    "outboundType": "loadBalancer",
    "podCidr": "10.244.0.0/16",
    "podCidrs": [
      "10.244.0.0/16"
    ],
    "podLinkLocalAccess": "IMDS",
    "serviceCidr": "10.0.0.0/16",
    "serviceCidrs": [
      "10.0.0.0/16"
    ],

[benjaminxie02]

@PixelRobots, thanks for assisting! I don't have a network policy engine so doesn't that mean no network polices?

@sf-msft, thank you for assisting as well! Here's what you asked for.
{
"azure-cli": "2.72.0",
"azure-cli-core": "2.72.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {}
}

"networkDataplane": "azure",
"networkMode": null,
"networkPlugin": "azure",
"networkPluginMode": "overlay",
"networkPolicy": "none",
"outboundType": "loadBalancer",
"podCidr": "10.244.0.0/16",
"podCidrs": [
"10.244.0.0/16"
],
"serviceCidr": "10.0.0.0/16",
"serviceCidrs": [
"10.0.0.0/16"
]

[PixelRobots]

Looking at that output yes you are not using network policies.

Also looking at it you are not on kubenet. Your nwtworkplugin is Azure.

If you were on kubenet it would say kubenet.

[sf-msft]

Worth sanity checking it is in fact the same cluster as the one originally described in this issue as it appears this network profile shows the cluster is on Azure CNI Overlay already. I'll leave this issue open, but feel free to open a support ticket if this requires deeper investigation.

[sf-msft]

@benjaminxie02 Any updates?

[chasewilson]

No update here I will close but @benjaminxie02 please reopen if you feel this is in error and is still an issue