Windows Server 2022 — AKS hybrid worker nodes remain NotReady after patch cycle — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Windows worker nodes stay NotReady, reducing cluster capacity and causing scheduling failures.

Environment & Reproduction

Seen after host OS patching, CNI changes, or kubelet/runtime version skew.

Root Cause Analysis

CNI misconfiguration, runtime health degradation, and cert/token rotation issues are common drivers.

Quick Triage

Check node conditions, kubelet logs, and network plugin status.

Step-by-Step Diagnosis

Correlate control-plane events with host networking/runtime changes.

Solution — Primary Fix

Repair CNI state, restart kubelet/runtime, and reconcile version compatibility.

Solution — Alternative Approaches

Drain and recycle impacted nodes while preserving workload availability.

Verification & Acceptance Criteria

Nodes remain Ready for 24h and workloads schedule without backoff.

Rollback Plan

Revert node image/runtime package to previous validated build.

Prevention & Hardening

Use canary node pools and enforce version skew policies pre-upgrade.

Related Errors & Cross-Refs

Related to container registry auth issues and host networking policy conflicts.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

AKS hybrid and Windows node operations guidance.