How to fix AKS Defender error in Kubernetes

# Register the feature (requires Owner role on subscription)
az feature register --namespace Microsoft.ContainerService --name AKS-AzureDefender

# Wait for it to show as "Registered"
az feature list --output table --query "[?contains(name, 'AKS-AzureDefender')]"

# Once Registered, refresh provider
az provider register --namespace Microsoft.ContainerService

# Update cluster with Defender enabled
az aks update \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --enable-defender

# Verify it was applied
az aks show \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --query "securityProfile.defender"

# Get kubeconfig
az aks get-credentials \
  --resource-group <resource-group-name> \
  --name <cluster-name>

# Check Defender pods
kubectl get pods -n kube-system | grep microsoft-defender
kubectl get pods -n kube-system | grep defender

# All pods should be in Running state
kubectl get pods -n kube-system -l app=microsoft-defender-publisher
kubectl get pods -n kube-system -l k8s-app=microsoft-defender

kubectl logs -n kube-system -l app=microsoft-defender-publisher --tail=100
kubectl describe pod -n kube-system <pod-name>  # Check events

# Check cgroup version on cluster nodes
kubectl debug node/<node-name> -it --image=ubuntu
# Inside container:
ls /sys/fs/cgroup/memory/memory.usage_in_bytes
# If not found, you're on cgroup v2

az aks upgrade \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --kubernetes-version <latest-version>

# From a pod in the cluster, test connectivity:
kubectl run -it debug --image=curlimages/curl --restart=Never -- /bin/sh

# Test required endpoints
curl -I https://dc.services.visualstudio.com  # Application Insights
curl -I https://scadvisorcontent.blob.core.windows.net  # Container images
curl -I https://prod.oms.opinsights.azure.com  # Log Analytics
kubectl delete pod debug

# Create NAT Gateway (if not already created)
az network public-ip create \
  --resource-group <resource-group-name> \
  --name <pip-name>

az network nat gateway create \
  --resource-group <resource-group-name> \
  --name <nat-gateway-name> \
  --public-ip-address-ids <pip-id>

# Associate with subnet
az network vnet subnet update \
  --resource-group <resource-group-name> \
  --vnet-name <vnet-name> \
  --name <subnet-name> \
  --nat-gateway <nat-gateway-name>

# Check Defender pod logs
kubectl logs -n kube-system -l app=microsoft-defender-publisher | grep -i certificate

# Verify DNS resolution from cluster
kubectl run -it debug --image=ubuntu --restart=Never -- /bin/bash
apt-get update && apt-get install -y dnsutils
nslookup dc.services.visualstudio.com
exit
kubectl delete pod debug

az aks update \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --dns-service-ip <custom-dns-ip>

# Get cluster's workspace ID
az aks show \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --query "addonProfiles.omsagent.config.logAnalyticsWorkspaceResourceId"

# Verify workspace exists and has permissions
az monitor log-analytics workspace show \
  --resource-id <workspace-resource-id>

# Check if workspace was deleted
az monitor log-analytics workspace list \
  --resource-group <resource-group-name>

az aks enable-addons \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --addons monitoring

# Disable Defender
az aks update \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --disable-defender

# Wait 2-3 minutes for cleanup
sleep 180

# Re-enable Defender
az aks update \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --enable-defender

# Verify
kubectl get pods -n kube-system | grep defender