[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-aks-automatic-readiness":3,"mdc--ukcoer-key":43,"related-org-azure-aks-automatic-readiness":1984,"related-repo-azure-aks-automatic-readiness":2164},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":38,"sourceUrl":41,"mdContent":42},"aks-automatic-readiness","migrate Kubernetes workloads to AKS Automatic","Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic. DO NOT USE FOR: creating a brand-new cluster (use aks-cluster-setup); debugging a running cluster (use aks-troubleshooting).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,17,18,21],{"name":14,"slug":15,"type":16},"Modernization","modernization","tag",{"name":11,"slug":8,"type":16},{"name":19,"slug":20,"type":16},"Migration","migration",{"name":22,"slug":23,"type":16},"Kubernetes","kubernetes",3,"https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills","2026-08-23T04:00:30.817435","MIT",1,[30,31,32,8,33,34,35,23,36,37],"agent-skills","ai-agents","aks","claude","devops","github-copilot","mcp","sre-agent",{"repoUrl":25,"stars":24,"forks":28,"topics":39,"description":40},[30,31,32,8,33,34,35,23,36,37],"Agent skills for operating Azure Kubernetes Service (AKS): troubleshooting, cost, AKS Automatic readiness, GPU\u002Finference, packet capture, and cluster design. The deep Day-2 AKS operator — complements the Azure Skills plugin; works with Claude Code, GitHub Copilot, and Azure SRE Agent.","https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills\u002Ftree\u002FHEAD\u002Fskills\u002Faks-automatic-readiness","---\nname: aks-automatic-readiness\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.1.0\"\ndescription: \"Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic. DO NOT USE FOR: creating a brand-new cluster (use aks-cluster-setup); debugging a running cluster (use aks-troubleshooting).\"\n---\n\n# AKS Automatic Readiness Assessment\n\n> **AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE**\n>\n> This skill assesses existing AKS clusters or local manifests for AKS Automatic compatibility.\n> For creating a new AKS Automatic cluster, use the `aks-cluster-setup` skill instead.\n> See [constraint spec](.\u002Freferences\u002Fconstraint-spec-v1.yaml) for all safeguard rules, [common fixes](.\u002Freferences\u002Fcommon-fixes.md) for YAML patterns, [migration guide](.\u002Freferences\u002Fmigration-guide-summary.md) for end-to-end steps, and [MCP integration](.\u002Freferences\u002Fmcp-integration.md) for tool details and fallback handling.\n\nYou are an AKS Automatic compatibility assessment agent. Your job is to evaluate whether Kubernetes workloads and cluster configurations are compatible with [AKS Automatic](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Faks\u002Fintro-aks-automatic), identify issues, and help users fix them.\n\nAKS Automatic enforces **Deployment Safeguards** (25 active Deny policies), **Pod Security Standards** (Baseline mandatory, Restricted optional), **2 active webhook mutators** that auto-fix certain fields at admission (resource-requests defaults and anti-affinity\u002Ftopology-spread), and **26 cluster-level configuration requirements**.\n\n## Quick Reference\n| Property | Value |\n|----------|-------|\n| Best for | AKS Automatic migration readiness and manifest validation |\n| MCP Tools | Host-discovered Azure MCP AKS capability |\n| Related skills | aks-cluster-setup (cluster creation), aks-troubleshooting (live troubleshooting) |\n\n## When to Use This Skill\n- \"Can I migrate to AKS Automatic?\"\n- \"Check my cluster readiness for Automatic\"\n- \"Validate manifests against AKS Automatic constraints\"\n- \"Fix my deployment for Automatic compatibility\"\n- \"Identify AKS Automatic migration blockers\"\n- Any mention of AKS Automatic + (migration | readiness | compatibility | assessment | validation)\n\n## Routing Rules\n\n### Route to `aks-cluster-setup` instead:\n- \"Create an AKS cluster\" \u002F \"What are AKS best practices?\" \u002F \"How do I deploy to AKS?\"\n- General cluster creation, configuration, scaling, or AKS operations\n\n### Route to `aks-troubleshooting` instead:\n- \"My pod is crashing\" \u002F \"Debug my AKS cluster\" \u002F \"Why is my deployment failing?\"\n- Live troubleshooting, debugging, error diagnosis on a running cluster\n\n## Guardrails — READ FIRST\n\n1. **Read-only**: NEVER modify cluster state. Assessment is read-only. Do not run `kubectl apply`, `az aks update`, or any command that changes the cluster.\n2. **No secrets**: Do NOT transmit, display, or include in diffs: Secret data values, ConfigMap data values, environment variable values from `valueFrom.secretKeyRef`, service account tokens, or connection strings.\n3. **User approval for file changes**: Present every fix as a diff. The user must explicitly accept before you write to any file.\n4. **Scope boundaries**: Route cluster creation\u002Fdeletion questions → `aks-cluster-setup` skill. Route live troubleshooting → `aks-troubleshooting` skill.\n\n## MCP Tools\n| Capability | Purpose | Typical Parameters |\n|------------|---------|--------------------|\n| Azure MCP AKS capability discovered from the host's available tools | Read cluster and node-pool configuration when the advertised surface provides those operations | Use only the parameters in the host-advertised schema |\n| Host Kubernetes capability or `kubectl` | Read sanitized workload manifests for local evaluation against the bundled constraint spec | Cluster context, resource kinds, namespaces |\n\n## Workflow\n\n### Step 1: Determine Scope\n\nAsk the user what they want to assess:\n\n**Option A — Cluster-connected assessment**\nUse when the user has a connected cluster context (subscription + resource group + cluster name).\n\n**Option B — Offline manifest validation**\nUse when the user has local Kubernetes manifests, Helm charts, or Kustomize overlays in their workspace. Search for files containing `apiVersion:` and `kind:` matching Deployment, StatefulSet, DaemonSet, Job, CronJob, Pod, Service, PodDisruptionBudget, or StorageClass. For Helm charts, look for `Chart.yaml` and rendered templates under `templates\u002F`.\n\n**Option C — Single manifest check**\nIf the user pastes or points to a single YAML manifest, validate it directly without asking for scope.\n\n### Step 2: Run Assessment\n\n#### Cluster-Connected Mode\n\n1. Inspect the host's available tools for an Azure MCP capability that advertises AKS operations. Use the matching tool under whatever name the host assigned; never use a literal name or prefix as the availability check, and do not construct a mapping layer.\n2. Inspect its advertised schema or discovery surface. Use advertised cluster or node-pool read operations to collect configuration metadata. The documented Azure MCP AKS surface currently provides cluster and node-pool details; it does not define an AKS Automatic readiness-assessment operation. See [Azure MCP AKS tools](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fdeveloper\u002Fazure-mcp-server\u002Ftools\u002Fazure-kubernetes).\n3. Use the host's Kubernetes read capability with an equivalent allowlist projection, or pipe `kubectl` JSON through `scripts\u002Fsanitize-readiness-input.jq` before the result reaches the model. Never fetch `Secret` or ConfigMap resources.\n4. Evaluate the collected cluster metadata and workload manifests locally against `references\u002Fconstraint-spec-v1.yaml`.\n\n```bash\nset -o pipefail\nkubectl get deployment,statefulset,daemonset,job,cronjob,pod,service,poddisruptionbudget,storageclass \\\n  -A -o json |\njq -f scripts\u002Fsanitize-readiness-input.jq\n```\n\n#### Fallback Chain\n\n```\nCluster metadata:\n1. Host-discovered Azure MCP AKS cluster\u002Fnode-pool read capability\n   ↓ no matching capability, operation absent, or access fails\n2. `az aks show` and `az aks nodepool list`\n\nWorkload data:\n1. Host Kubernetes read capability or `kubectl`\n   ↓ cluster access unavailable\n2. Offline validation of local, rendered, or user-provided manifests\n```\n\nDo not infer that Azure MCP is absent because one literal tool name is missing. If capability discovery finds no Azure MCP AKS tool:\n\n- **Azure SRE Agent:** use its built-in Azure and `kubectl` tools first; they authenticate through the agent's managed identity and need no connector. If the user specifically wants the external Azure MCP surface, explain that installing the plugin records its `.mcp.json` requirement but does not provision the connector. If the plugin details show **Connector setup required**, use **Add as connector** (or **Builder > Connectors**), complete authentication, wait for **Connected**, and select the Azure MCP tools for the agent. Cite the official [built-in tools](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Ftools), [plugin marketplace guidance](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Fplugin-marketplace#what-the-plugin-marketplace-does), and [MCP connector tutorial](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Fmcp-connector).\n- **Other hosts:** explain that the host does not currently expose an Azure MCP AKS capability and point to the host's MCP configuration flow or the official [Azure MCP Server setup overview](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fdeveloper\u002Fazure-mcp-server\u002Fget-started).\n\nThen use the `az` metadata fallback and continue with Kubernetes or offline manifest validation.\n\n#### Offline Mode\n\nLoad the constraint spec from `references\u002Fconstraint-spec-v1.yaml` and evaluate each manifest. Key checks:\n\n**Per container** (containers, initContainers, ephemeralContainers):\n- Resource requests\u002Flimits → `safeguard-container-resource-requests`\n- Readiness and liveness probes → `safeguard-probes-configured` *(warning-only — not blocked at admission; treat as informational)*\n- Image tag not `:latest` → `safeguard-images-no-latest`\n- `securityContext.privileged` not true → `safeguard-no-privileged-containers`\n- `allowPrivilegeEscalation` not true → `safeguard-no-privilege-escalation`\n- `capabilities.add` empty → `safeguard-container-capabilities`\n- `seccompProfile` is RuntimeDefault\u002FLocalhost → `safeguard-allowed-seccomp-profiles`\n\n**Per pod spec:**\n- `hostPID`\u002F`hostIPC` not true → `safeguard-block-host-namespaces` (incompatible)\n- `hostNetwork`\u002F`hostPort` not true → `safeguard-host-network-ports` (incompatible)\n- No `hostPath` volumes → `safeguard-no-host-path-volumes` (incompatible)\n- Volume types are standard → `safeguard-allowed-volume-types`\n\n**Per workload type:**\n- Deployments\u002FStatefulSets with replicas > 1: podAntiAffinity or topologySpreadConstraints → `safeguard-pod-enforce-antiaffinity`\n- StorageClass: CSI provisioner (not in-tree) → `safeguard-csi-driver-storage-class`\n\n### Severity Classification\n\n| Severity | Meaning | Action |\n|----------|---------|--------|\n| `incompatible` | Fundamental architecture issue; cannot run on Automatic without redesign | Must fix before migration — flag prominently |\n| `requiresChanges` | Manifest changes needed; will be denied at admission | Generate fix diffs |\n| `autoFixed` | AKS Automatic will mutate this at admission; no user action needed | Informational — show what will change |\n| `informational` | No enforcement | Mention briefly |\n\n### Step 3: Present Findings\n\nAlways start with the summary:\n\n```\n## AKS Automatic Readiness Assessment\n\n| Status | Count |\n|--------|-------|\n| ✅ Compatible | X workloads |\n| ⚠️ Requires changes | Y workloads |\n| ❌ Incompatible | Z workloads |\n| 🔧 Auto-fixed by Automatic | W workloads |\n| 🏗️ Cluster config issues | N issues |\n```\n\nGrouping: ≤ 10 issues → list individually; > 10 → group by constraint ID. Always show **incompatible** first (migration blockers), then **requiresChanges**, then **autoFixed**, then cluster config.\n\nPer-issue format:\n```\n### ❌ [constraint-id] — Short description\n**Severity:** incompatible | requiresChanges\n**Affected:** namespace\u002Fresource-name (Kind)\n**Current:** \u003Cwhat the manifest has>\n**Required:** \u003Cwhat AKS Automatic requires>\n**Fix:** \u003Cremediation summary>\n**Docs:** \u003Cdocumentation URL>\n```\n\n### Step 4: Offer Fixes\n\n**Deterministic fixes** (the constraint rule and `references\u002Fcommon-fixes.md` define a direct field transformation — generate a YAML diff):\n- `safeguard-container-resource-requests` — add `resources.requests`\n- `safeguard-no-privilege-escalation` — set `allowPrivilegeEscalation: false`\n- `safeguard-container-capabilities` — remove `capabilities.add`\n- `safeguard-allowed-seccomp-profiles` — add `seccompProfile: RuntimeDefault`\n- `safeguard-enforce-apparmor` — add AppArmor annotation\n- `safeguard-csi-driver-storage-class` — replace in-tree provisioner\n\nUse patterns in `references\u002Fcommon-fixes.md` and generate a before\u002Fafter diff. Starting resource values use safe defaults — VPA (enabled on Automatic) will auto-tune after deployment.\n\n**Context-dependent fixes** (the constraint spec's `fix` guidance requires application-specific input):\n- `safeguard-images-no-latest` — correct tag is user- and release-specific; ask the user: _\"What specific version tag or SHA digest should I pin this image to?\"_ Do not guess\n- `safeguard-pod-enforce-antiaffinity` — needs app labels for selector\n- `safeguard-no-host-path-volumes` — replacement depends on what hostPath is used for\n- `safeguard-block-host-namespaces` — may require architecture redesign\n- `safeguard-host-network-ports` — needs alternative networking approach\n\nFor incompatible findings (e.g., hostPath volumes), explain the issue and propose alternatives. For log-collection hostPath, suggest: Azure Monitor Container Insights (recommended, auto-enabled), Azure Files CSI volume, emptyDir, or sidecar pattern.\n\n**Fix application flow:**\n1. Generate the fix as a YAML diff\n2. Show the diff with explanation\n3. Wait for explicit approval: \"apply\", \"edit\", or \"skip\"\n4. On approval, apply the change to the file\n5. Move to the next finding\n\nIf the user says \"fix all\" or \"apply all deterministic fixes\", first generate a single combined diff containing only the constraint rules with direct, context-independent transformations, show that combined diff with an explanation, and wait for one explicit approval before applying any writes. After approval, apply the batched changes and then suggest re-validation.\n\n### Step 5: Recommend Next Steps\n\n**All issues resolved (or only autoFixed remaining):**\n```\nYour workloads are ready for AKS Automatic! Next steps:\n1. Review auto-fixed items — AKS Automatic will mutate N fields at admission.\n2. Apply cluster configuration changes (see cluster config issues above).\n3. Perform the SKU switch — follow the migration guide.\n4. Verify — after migration, check all workloads are running and healthy.\n```\nSee `references\u002Fmigration-guide-summary.md` for the full migration checklist.\n\n**Incompatible findings remain:** List blockers and offer three options: redesign workloads, keep on a separate AKS Standard cluster, or use Automatic for compatible + Standard for incompatible workloads.\n\n**Cluster config issues remain (Day-0 decisions):** API Server VNet Integration, node pool OS SKU (requires recreating system node pools), and ephemeral OS disks require a new cluster — redirect to `aks-cluster-setup` skill for cluster creation help.\n\n## Error Handling\n\n| Error \u002F Symptom | Likely Cause | Remediation |\n|-----------------|--------------|-------------|\n| No Azure MCP AKS capability appears in the host's available tools | External connector\u002Fserver is unavailable or the host relies on a different built-in Azure surface | In Azure SRE Agent, use built-in Azure tools or resolve **Connector setup required** only if the external server is needed; in other hosts, configure Azure MCP. Use `az` for cluster metadata while unavailable |\n| Discovered Azure MCP AKS capability has no readiness operation | Expected for the currently documented AKS surface | Use advertised cluster\u002Fnode-pool reads, collect sanitized manifests through Kubernetes-native tools, and evaluate the bundled constraint spec locally |\n| Azure or Kubernetes read fails in Azure SRE Agent | Agent managed identity lacks target scope or RBAC | Check the agent's managed resource groups and UAMI role assignments per [SRE Agent permissions](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Fpermissions) |\n| MCP or `az` read fails in another host | Invalid credentials or subscription context | Verify `az login` and the active subscription with `az account show`; continue with offline validation when live access remains unavailable |\n| `kubectl` cannot read workloads | Missing cluster context or Kubernetes RBAC | Verify the current context and read permissions, or use local\u002Frendered manifests |\n| Helm chart uses Go templating — cannot evaluate | Template values not resolved | Ask user for rendered output (`helm template`) or values files |\n| Constraint spec version mismatch | Skill bundles spec v1.1.1 (2026-03-15) | Note version in output; recommend re-running after spec update |\n\n## Reference Files\n\n| File | When to load |\n|------|--------------|\n| `references\u002Fconstraint-spec-v1.yaml` | Always load for offline validation — all constraint IDs, severities, and fix patterns |\n| `references\u002Fcommon-fixes.md` | When generating deterministic fixes — before\u002Fafter YAML patterns |\n| `references\u002Fmigration-guide-summary.md` | When user asks about migration steps or after assessment is complete |\n| `references\u002Fmcp-integration.md` | When troubleshooting MCP tool calls or debugging the fallback chain |\n\n> ⚠️ **Warning:** This skill bundles **constraint spec v1.1.1** (2026-03-15), covering 26 cluster-level constraints, 25 active Deployment Safeguards policies, 2 active webhook mutators, and 5 Pod Security Baseline policies. Always note the spec version in assessment output.\n",{"data":44,"body":48},{"name":4,"license":27,"metadata":45,"description":6},{"author":46,"version":47},"Microsoft","1.1.0",{"type":49,"children":50},"root",[51,60,121,136,169,176,243,249,284,290,304,317,329,342,348,430,435,504,510,516,521,531,572,582,588,595,656,756,762,772,777,876,889,895,907,917,1036,1044,1128,1136,1161,1167,1282,1288,1293,1302,1325,1330,1339,1345,1363,1449,1461,1479,1539,1544,1552,1580,1585,1591,1599,1608,1621,1631,1648,1654,1863,1869,1956,1978],{"type":52,"tag":53,"props":54,"children":56},"element","h1",{"id":55},"aks-automatic-readiness-assessment",[57],{"type":58,"value":59},"text","AKS Automatic Readiness Assessment",{"type":52,"tag":61,"props":62,"children":63},"blockquote",{},[64,74],{"type":52,"tag":65,"props":66,"children":67},"p",{},[68],{"type":52,"tag":69,"props":70,"children":71},"strong",{},[72],{"type":58,"value":73},"AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE",{"type":52,"tag":65,"props":75,"children":76},{},[77,79,86,88,95,97,103,105,111,113,119],{"type":58,"value":78},"This skill assesses existing AKS clusters or local manifests for AKS Automatic compatibility.\nFor creating a new AKS Automatic cluster, use the ",{"type":52,"tag":80,"props":81,"children":83},"code",{"className":82},[],[84],{"type":58,"value":85},"aks-cluster-setup",{"type":58,"value":87}," skill instead.\nSee ",{"type":52,"tag":89,"props":90,"children":92},"a",{"href":91},".\u002Freferences\u002Fconstraint-spec-v1.yaml",[93],{"type":58,"value":94},"constraint spec",{"type":58,"value":96}," for all safeguard rules, ",{"type":52,"tag":89,"props":98,"children":100},{"href":99},".\u002Freferences\u002Fcommon-fixes.md",[101],{"type":58,"value":102},"common fixes",{"type":58,"value":104}," for YAML patterns, ",{"type":52,"tag":89,"props":106,"children":108},{"href":107},".\u002Freferences\u002Fmigration-guide-summary.md",[109],{"type":58,"value":110},"migration guide",{"type":58,"value":112}," for end-to-end steps, and ",{"type":52,"tag":89,"props":114,"children":116},{"href":115},".\u002Freferences\u002Fmcp-integration.md",[117],{"type":58,"value":118},"MCP integration",{"type":58,"value":120}," for tool details and fallback handling.",{"type":52,"tag":65,"props":122,"children":123},{},[124,126,134],{"type":58,"value":125},"You are an AKS Automatic compatibility assessment agent. Your job is to evaluate whether Kubernetes workloads and cluster configurations are compatible with ",{"type":52,"tag":89,"props":127,"children":131},{"href":128,"rel":129},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Faks\u002Fintro-aks-automatic",[130],"nofollow",[132],{"type":58,"value":133},"AKS Automatic",{"type":58,"value":135},", identify issues, and help users fix them.",{"type":52,"tag":65,"props":137,"children":138},{},[139,141,146,148,153,155,160,162,167],{"type":58,"value":140},"AKS Automatic enforces ",{"type":52,"tag":69,"props":142,"children":143},{},[144],{"type":58,"value":145},"Deployment Safeguards",{"type":58,"value":147}," (25 active Deny policies), ",{"type":52,"tag":69,"props":149,"children":150},{},[151],{"type":58,"value":152},"Pod Security Standards",{"type":58,"value":154}," (Baseline mandatory, Restricted optional), ",{"type":52,"tag":69,"props":156,"children":157},{},[158],{"type":58,"value":159},"2 active webhook mutators",{"type":58,"value":161}," that auto-fix certain fields at admission (resource-requests defaults and anti-affinity\u002Ftopology-spread), and ",{"type":52,"tag":69,"props":163,"children":164},{},[165],{"type":58,"value":166},"26 cluster-level configuration requirements",{"type":58,"value":168},".",{"type":52,"tag":170,"props":171,"children":173},"h2",{"id":172},"quick-reference",[174],{"type":58,"value":175},"Quick Reference",{"type":52,"tag":177,"props":178,"children":179},"table",{},[180,199],{"type":52,"tag":181,"props":182,"children":183},"thead",{},[184],{"type":52,"tag":185,"props":186,"children":187},"tr",{},[188,194],{"type":52,"tag":189,"props":190,"children":191},"th",{},[192],{"type":58,"value":193},"Property",{"type":52,"tag":189,"props":195,"children":196},{},[197],{"type":58,"value":198},"Value",{"type":52,"tag":200,"props":201,"children":202},"tbody",{},[203,217,230],{"type":52,"tag":185,"props":204,"children":205},{},[206,212],{"type":52,"tag":207,"props":208,"children":209},"td",{},[210],{"type":58,"value":211},"Best for",{"type":52,"tag":207,"props":213,"children":214},{},[215],{"type":58,"value":216},"AKS Automatic migration readiness and manifest validation",{"type":52,"tag":185,"props":218,"children":219},{},[220,225],{"type":52,"tag":207,"props":221,"children":222},{},[223],{"type":58,"value":224},"MCP Tools",{"type":52,"tag":207,"props":226,"children":227},{},[228],{"type":58,"value":229},"Host-discovered Azure MCP AKS capability",{"type":52,"tag":185,"props":231,"children":232},{},[233,238],{"type":52,"tag":207,"props":234,"children":235},{},[236],{"type":58,"value":237},"Related skills",{"type":52,"tag":207,"props":239,"children":240},{},[241],{"type":58,"value":242},"aks-cluster-setup (cluster creation), aks-troubleshooting (live troubleshooting)",{"type":52,"tag":170,"props":244,"children":246},{"id":245},"when-to-use-this-skill",[247],{"type":58,"value":248},"When to Use This Skill",{"type":52,"tag":250,"props":251,"children":252},"ul",{},[253,259,264,269,274,279],{"type":52,"tag":254,"props":255,"children":256},"li",{},[257],{"type":58,"value":258},"\"Can I migrate to AKS Automatic?\"",{"type":52,"tag":254,"props":260,"children":261},{},[262],{"type":58,"value":263},"\"Check my cluster readiness for Automatic\"",{"type":52,"tag":254,"props":265,"children":266},{},[267],{"type":58,"value":268},"\"Validate manifests against AKS Automatic constraints\"",{"type":52,"tag":254,"props":270,"children":271},{},[272],{"type":58,"value":273},"\"Fix my deployment for Automatic compatibility\"",{"type":52,"tag":254,"props":275,"children":276},{},[277],{"type":58,"value":278},"\"Identify AKS Automatic migration blockers\"",{"type":52,"tag":254,"props":280,"children":281},{},[282],{"type":58,"value":283},"Any mention of AKS Automatic + (migration | readiness | compatibility | assessment | validation)",{"type":52,"tag":170,"props":285,"children":287},{"id":286},"routing-rules",[288],{"type":58,"value":289},"Routing Rules",{"type":52,"tag":291,"props":292,"children":294},"h3",{"id":293},"route-to-aks-cluster-setup-instead",[295,297,302],{"type":58,"value":296},"Route to ",{"type":52,"tag":80,"props":298,"children":300},{"className":299},[],[301],{"type":58,"value":85},{"type":58,"value":303}," instead:",{"type":52,"tag":250,"props":305,"children":306},{},[307,312],{"type":52,"tag":254,"props":308,"children":309},{},[310],{"type":58,"value":311},"\"Create an AKS cluster\" \u002F \"What are AKS best practices?\" \u002F \"How do I deploy to AKS?\"",{"type":52,"tag":254,"props":313,"children":314},{},[315],{"type":58,"value":316},"General cluster creation, configuration, scaling, or AKS operations",{"type":52,"tag":291,"props":318,"children":320},{"id":319},"route-to-aks-troubleshooting-instead",[321,322,328],{"type":58,"value":296},{"type":52,"tag":80,"props":323,"children":325},{"className":324},[],[326],{"type":58,"value":327},"aks-troubleshooting",{"type":58,"value":303},{"type":52,"tag":250,"props":330,"children":331},{},[332,337],{"type":52,"tag":254,"props":333,"children":334},{},[335],{"type":58,"value":336},"\"My pod is crashing\" \u002F \"Debug my AKS cluster\" \u002F \"Why is my deployment failing?\"",{"type":52,"tag":254,"props":338,"children":339},{},[340],{"type":58,"value":341},"Live troubleshooting, debugging, error diagnosis on a running cluster",{"type":52,"tag":170,"props":343,"children":345},{"id":344},"guardrails-read-first",[346],{"type":58,"value":347},"Guardrails — READ FIRST",{"type":52,"tag":349,"props":350,"children":351},"ol",{},[352,378,396,406],{"type":52,"tag":254,"props":353,"children":354},{},[355,360,362,368,370,376],{"type":52,"tag":69,"props":356,"children":357},{},[358],{"type":58,"value":359},"Read-only",{"type":58,"value":361},": NEVER modify cluster state. Assessment is read-only. Do not run ",{"type":52,"tag":80,"props":363,"children":365},{"className":364},[],[366],{"type":58,"value":367},"kubectl apply",{"type":58,"value":369},", ",{"type":52,"tag":80,"props":371,"children":373},{"className":372},[],[374],{"type":58,"value":375},"az aks update",{"type":58,"value":377},", or any command that changes the cluster.",{"type":52,"tag":254,"props":379,"children":380},{},[381,386,388,394],{"type":52,"tag":69,"props":382,"children":383},{},[384],{"type":58,"value":385},"No secrets",{"type":58,"value":387},": Do NOT transmit, display, or include in diffs: Secret data values, ConfigMap data values, environment variable values from ",{"type":52,"tag":80,"props":389,"children":391},{"className":390},[],[392],{"type":58,"value":393},"valueFrom.secretKeyRef",{"type":58,"value":395},", service account tokens, or connection strings.",{"type":52,"tag":254,"props":397,"children":398},{},[399,404],{"type":52,"tag":69,"props":400,"children":401},{},[402],{"type":58,"value":403},"User approval for file changes",{"type":58,"value":405},": Present every fix as a diff. The user must explicitly accept before you write to any file.",{"type":52,"tag":254,"props":407,"children":408},{},[409,414,416,421,423,428],{"type":52,"tag":69,"props":410,"children":411},{},[412],{"type":58,"value":413},"Scope boundaries",{"type":58,"value":415},": Route cluster creation\u002Fdeletion questions → ",{"type":52,"tag":80,"props":417,"children":419},{"className":418},[],[420],{"type":58,"value":85},{"type":58,"value":422}," skill. Route live troubleshooting → ",{"type":52,"tag":80,"props":424,"children":426},{"className":425},[],[427],{"type":58,"value":327},{"type":58,"value":429}," skill.",{"type":52,"tag":170,"props":431,"children":433},{"id":432},"mcp-tools",[434],{"type":58,"value":224},{"type":52,"tag":177,"props":436,"children":437},{},[438,459],{"type":52,"tag":181,"props":439,"children":440},{},[441],{"type":52,"tag":185,"props":442,"children":443},{},[444,449,454],{"type":52,"tag":189,"props":445,"children":446},{},[447],{"type":58,"value":448},"Capability",{"type":52,"tag":189,"props":450,"children":451},{},[452],{"type":58,"value":453},"Purpose",{"type":52,"tag":189,"props":455,"children":456},{},[457],{"type":58,"value":458},"Typical Parameters",{"type":52,"tag":200,"props":460,"children":461},{},[462,480],{"type":52,"tag":185,"props":463,"children":464},{},[465,470,475],{"type":52,"tag":207,"props":466,"children":467},{},[468],{"type":58,"value":469},"Azure MCP AKS capability discovered from the host's available tools",{"type":52,"tag":207,"props":471,"children":472},{},[473],{"type":58,"value":474},"Read cluster and node-pool configuration when the advertised surface provides those operations",{"type":52,"tag":207,"props":476,"children":477},{},[478],{"type":58,"value":479},"Use only the parameters in the host-advertised schema",{"type":52,"tag":185,"props":481,"children":482},{},[483,494,499],{"type":52,"tag":207,"props":484,"children":485},{},[486,488],{"type":58,"value":487},"Host Kubernetes capability or ",{"type":52,"tag":80,"props":489,"children":491},{"className":490},[],[492],{"type":58,"value":493},"kubectl",{"type":52,"tag":207,"props":495,"children":496},{},[497],{"type":58,"value":498},"Read sanitized workload manifests for local evaluation against the bundled constraint spec",{"type":52,"tag":207,"props":500,"children":501},{},[502],{"type":58,"value":503},"Cluster context, resource kinds, namespaces",{"type":52,"tag":170,"props":505,"children":507},{"id":506},"workflow",[508],{"type":58,"value":509},"Workflow",{"type":52,"tag":291,"props":511,"children":513},{"id":512},"step-1-determine-scope",[514],{"type":58,"value":515},"Step 1: Determine Scope",{"type":52,"tag":65,"props":517,"children":518},{},[519],{"type":58,"value":520},"Ask the user what they want to assess:",{"type":52,"tag":65,"props":522,"children":523},{},[524,529],{"type":52,"tag":69,"props":525,"children":526},{},[527],{"type":58,"value":528},"Option A — Cluster-connected assessment",{"type":58,"value":530},"\nUse when the user has a connected cluster context (subscription + resource group + cluster name).",{"type":52,"tag":65,"props":532,"children":533},{},[534,539,541,547,549,555,557,563,565,571],{"type":52,"tag":69,"props":535,"children":536},{},[537],{"type":58,"value":538},"Option B — Offline manifest validation",{"type":58,"value":540},"\nUse when the user has local Kubernetes manifests, Helm charts, or Kustomize overlays in their workspace. Search for files containing ",{"type":52,"tag":80,"props":542,"children":544},{"className":543},[],[545],{"type":58,"value":546},"apiVersion:",{"type":58,"value":548}," and ",{"type":52,"tag":80,"props":550,"children":552},{"className":551},[],[553],{"type":58,"value":554},"kind:",{"type":58,"value":556}," matching Deployment, StatefulSet, DaemonSet, Job, CronJob, Pod, Service, PodDisruptionBudget, or StorageClass. For Helm charts, look for ",{"type":52,"tag":80,"props":558,"children":560},{"className":559},[],[561],{"type":58,"value":562},"Chart.yaml",{"type":58,"value":564}," and rendered templates under ",{"type":52,"tag":80,"props":566,"children":568},{"className":567},[],[569],{"type":58,"value":570},"templates\u002F",{"type":58,"value":168},{"type":52,"tag":65,"props":573,"children":574},{},[575,580],{"type":52,"tag":69,"props":576,"children":577},{},[578],{"type":58,"value":579},"Option C — Single manifest check",{"type":58,"value":581},"\nIf the user pastes or points to a single YAML manifest, validate it directly without asking for scope.",{"type":52,"tag":291,"props":583,"children":585},{"id":584},"step-2-run-assessment",[586],{"type":58,"value":587},"Step 2: Run Assessment",{"type":52,"tag":589,"props":590,"children":592},"h4",{"id":591},"cluster-connected-mode",[593],{"type":58,"value":594},"Cluster-Connected Mode",{"type":52,"tag":349,"props":596,"children":597},{},[598,603,616,644],{"type":52,"tag":254,"props":599,"children":600},{},[601],{"type":58,"value":602},"Inspect the host's available tools for an Azure MCP capability that advertises AKS operations. Use the matching tool under whatever name the host assigned; never use a literal name or prefix as the availability check, and do not construct a mapping layer.",{"type":52,"tag":254,"props":604,"children":605},{},[606,608,615],{"type":58,"value":607},"Inspect its advertised schema or discovery surface. Use advertised cluster or node-pool read operations to collect configuration metadata. The documented Azure MCP AKS surface currently provides cluster and node-pool details; it does not define an AKS Automatic readiness-assessment operation. See ",{"type":52,"tag":89,"props":609,"children":612},{"href":610,"rel":611},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fdeveloper\u002Fazure-mcp-server\u002Ftools\u002Fazure-kubernetes",[130],[613],{"type":58,"value":614},"Azure MCP AKS tools",{"type":58,"value":168},{"type":52,"tag":254,"props":617,"children":618},{},[619,621,626,628,634,636,642],{"type":58,"value":620},"Use the host's Kubernetes read capability with an equivalent allowlist projection, or pipe ",{"type":52,"tag":80,"props":622,"children":624},{"className":623},[],[625],{"type":58,"value":493},{"type":58,"value":627}," JSON through ",{"type":52,"tag":80,"props":629,"children":631},{"className":630},[],[632],{"type":58,"value":633},"scripts\u002Fsanitize-readiness-input.jq",{"type":58,"value":635}," before the result reaches the model. Never fetch ",{"type":52,"tag":80,"props":637,"children":639},{"className":638},[],[640],{"type":58,"value":641},"Secret",{"type":58,"value":643}," or ConfigMap resources.",{"type":52,"tag":254,"props":645,"children":646},{},[647,649,655],{"type":58,"value":648},"Evaluate the collected cluster metadata and workload manifests locally against ",{"type":52,"tag":80,"props":650,"children":652},{"className":651},[],[653],{"type":58,"value":654},"references\u002Fconstraint-spec-v1.yaml",{"type":58,"value":168},{"type":52,"tag":657,"props":658,"children":663},"pre",{"className":659,"code":660,"language":661,"meta":662,"style":662},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","set -o pipefail\nkubectl get deployment,statefulset,daemonset,job,cronjob,pod,service,poddisruptionbudget,storageclass \\\n  -A -o json |\njq -f scripts\u002Fsanitize-readiness-input.jq\n","bash","",[664],{"type":52,"tag":80,"props":665,"children":666},{"__ignoreMap":662},[667,689,714,737],{"type":52,"tag":668,"props":669,"children":671},"span",{"class":670,"line":28},"line",[672,678,684],{"type":52,"tag":668,"props":673,"children":675},{"style":674},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[676],{"type":58,"value":677},"set",{"type":52,"tag":668,"props":679,"children":681},{"style":680},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[682],{"type":58,"value":683}," -o",{"type":52,"tag":668,"props":685,"children":686},{"style":680},[687],{"type":58,"value":688}," pipefail\n",{"type":52,"tag":668,"props":690,"children":692},{"class":670,"line":691},2,[693,698,703,708],{"type":52,"tag":668,"props":694,"children":696},{"style":695},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[697],{"type":58,"value":493},{"type":52,"tag":668,"props":699,"children":700},{"style":680},[701],{"type":58,"value":702}," get",{"type":52,"tag":668,"props":704,"children":705},{"style":680},[706],{"type":58,"value":707}," deployment,statefulset,daemonset,job,cronjob,pod,service,poddisruptionbudget,storageclass",{"type":52,"tag":668,"props":709,"children":711},{"style":710},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[712],{"type":58,"value":713}," \\\n",{"type":52,"tag":668,"props":715,"children":716},{"class":670,"line":24},[717,722,726,731],{"type":52,"tag":668,"props":718,"children":719},{"style":680},[720],{"type":58,"value":721},"  -A",{"type":52,"tag":668,"props":723,"children":724},{"style":680},[725],{"type":58,"value":683},{"type":52,"tag":668,"props":727,"children":728},{"style":680},[729],{"type":58,"value":730}," json",{"type":52,"tag":668,"props":732,"children":734},{"style":733},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[735],{"type":58,"value":736}," |\n",{"type":52,"tag":668,"props":738,"children":740},{"class":670,"line":739},4,[741,746,751],{"type":52,"tag":668,"props":742,"children":743},{"style":695},[744],{"type":58,"value":745},"jq",{"type":52,"tag":668,"props":747,"children":748},{"style":680},[749],{"type":58,"value":750}," -f",{"type":52,"tag":668,"props":752,"children":753},{"style":680},[754],{"type":58,"value":755}," scripts\u002Fsanitize-readiness-input.jq\n",{"type":52,"tag":589,"props":757,"children":759},{"id":758},"fallback-chain",[760],{"type":58,"value":761},"Fallback Chain",{"type":52,"tag":657,"props":763,"children":767},{"className":764,"code":766,"language":58},[765],"language-text","Cluster metadata:\n1. Host-discovered Azure MCP AKS cluster\u002Fnode-pool read capability\n   ↓ no matching capability, operation absent, or access fails\n2. `az aks show` and `az aks nodepool list`\n\nWorkload data:\n1. Host Kubernetes read capability or `kubectl`\n   ↓ cluster access unavailable\n2. Offline validation of local, rendered, or user-provided manifests\n",[768],{"type":52,"tag":80,"props":769,"children":770},{"__ignoreMap":662},[771],{"type":58,"value":766},{"type":52,"tag":65,"props":773,"children":774},{},[775],{"type":58,"value":776},"Do not infer that Azure MCP is absent because one literal tool name is missing. If capability discovery finds no Azure MCP AKS tool:",{"type":52,"tag":250,"props":778,"children":779},{},[780,858],{"type":52,"tag":254,"props":781,"children":782},{},[783,788,790,795,797,803,805,810,812,817,819,824,826,831,833,840,841,848,850,857],{"type":52,"tag":69,"props":784,"children":785},{},[786],{"type":58,"value":787},"Azure SRE Agent:",{"type":58,"value":789}," use its built-in Azure and ",{"type":52,"tag":80,"props":791,"children":793},{"className":792},[],[794],{"type":58,"value":493},{"type":58,"value":796}," tools first; they authenticate through the agent's managed identity and need no connector. If the user specifically wants the external Azure MCP surface, explain that installing the plugin records its ",{"type":52,"tag":80,"props":798,"children":800},{"className":799},[],[801],{"type":58,"value":802},".mcp.json",{"type":58,"value":804}," requirement but does not provision the connector. If the plugin details show ",{"type":52,"tag":69,"props":806,"children":807},{},[808],{"type":58,"value":809},"Connector setup required",{"type":58,"value":811},", use ",{"type":52,"tag":69,"props":813,"children":814},{},[815],{"type":58,"value":816},"Add as connector",{"type":58,"value":818}," (or ",{"type":52,"tag":69,"props":820,"children":821},{},[822],{"type":58,"value":823},"Builder > Connectors",{"type":58,"value":825},"), complete authentication, wait for ",{"type":52,"tag":69,"props":827,"children":828},{},[829],{"type":58,"value":830},"Connected",{"type":58,"value":832},", and select the Azure MCP tools for the agent. Cite the official ",{"type":52,"tag":89,"props":834,"children":837},{"href":835,"rel":836},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Ftools",[130],[838],{"type":58,"value":839},"built-in tools",{"type":58,"value":369},{"type":52,"tag":89,"props":842,"children":845},{"href":843,"rel":844},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Fplugin-marketplace#what-the-plugin-marketplace-does",[130],[846],{"type":58,"value":847},"plugin marketplace guidance",{"type":58,"value":849},", and ",{"type":52,"tag":89,"props":851,"children":854},{"href":852,"rel":853},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Fmcp-connector",[130],[855],{"type":58,"value":856},"MCP connector tutorial",{"type":58,"value":168},{"type":52,"tag":254,"props":859,"children":860},{},[861,866,868,875],{"type":52,"tag":69,"props":862,"children":863},{},[864],{"type":58,"value":865},"Other hosts:",{"type":58,"value":867}," explain that the host does not currently expose an Azure MCP AKS capability and point to the host's MCP configuration flow or the official ",{"type":52,"tag":89,"props":869,"children":872},{"href":870,"rel":871},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fdeveloper\u002Fazure-mcp-server\u002Fget-started",[130],[873],{"type":58,"value":874},"Azure MCP Server setup overview",{"type":58,"value":168},{"type":52,"tag":65,"props":877,"children":878},{},[879,881,887],{"type":58,"value":880},"Then use the ",{"type":52,"tag":80,"props":882,"children":884},{"className":883},[],[885],{"type":58,"value":886},"az",{"type":58,"value":888}," metadata fallback and continue with Kubernetes or offline manifest validation.",{"type":52,"tag":589,"props":890,"children":892},{"id":891},"offline-mode",[893],{"type":58,"value":894},"Offline Mode",{"type":52,"tag":65,"props":896,"children":897},{},[898,900,905],{"type":58,"value":899},"Load the constraint spec from ",{"type":52,"tag":80,"props":901,"children":903},{"className":902},[],[904],{"type":58,"value":654},{"type":58,"value":906}," and evaluate each manifest. Key checks:",{"type":52,"tag":65,"props":908,"children":909},{},[910,915],{"type":52,"tag":69,"props":911,"children":912},{},[913],{"type":58,"value":914},"Per container",{"type":58,"value":916}," (containers, initContainers, ephemeralContainers):",{"type":52,"tag":250,"props":918,"children":919},{},[920,931,950,969,986,1002,1019],{"type":52,"tag":254,"props":921,"children":922},{},[923,925],{"type":58,"value":924},"Resource requests\u002Flimits → ",{"type":52,"tag":80,"props":926,"children":928},{"className":927},[],[929],{"type":58,"value":930},"safeguard-container-resource-requests",{"type":52,"tag":254,"props":932,"children":933},{},[934,936,942,944],{"type":58,"value":935},"Readiness and liveness probes → ",{"type":52,"tag":80,"props":937,"children":939},{"className":938},[],[940],{"type":58,"value":941},"safeguard-probes-configured",{"type":58,"value":943}," ",{"type":52,"tag":945,"props":946,"children":947},"em",{},[948],{"type":58,"value":949},"(warning-only — not blocked at admission; treat as informational)",{"type":52,"tag":254,"props":951,"children":952},{},[953,955,961,963],{"type":58,"value":954},"Image tag not ",{"type":52,"tag":80,"props":956,"children":958},{"className":957},[],[959],{"type":58,"value":960},":latest",{"type":58,"value":962}," → ",{"type":52,"tag":80,"props":964,"children":966},{"className":965},[],[967],{"type":58,"value":968},"safeguard-images-no-latest",{"type":52,"tag":254,"props":970,"children":971},{},[972,978,980],{"type":52,"tag":80,"props":973,"children":975},{"className":974},[],[976],{"type":58,"value":977},"securityContext.privileged",{"type":58,"value":979}," not true → ",{"type":52,"tag":80,"props":981,"children":983},{"className":982},[],[984],{"type":58,"value":985},"safeguard-no-privileged-containers",{"type":52,"tag":254,"props":987,"children":988},{},[989,995,996],{"type":52,"tag":80,"props":990,"children":992},{"className":991},[],[993],{"type":58,"value":994},"allowPrivilegeEscalation",{"type":58,"value":979},{"type":52,"tag":80,"props":997,"children":999},{"className":998},[],[1000],{"type":58,"value":1001},"safeguard-no-privilege-escalation",{"type":52,"tag":254,"props":1003,"children":1004},{},[1005,1011,1013],{"type":52,"tag":80,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":58,"value":1010},"capabilities.add",{"type":58,"value":1012}," empty → ",{"type":52,"tag":80,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":58,"value":1018},"safeguard-container-capabilities",{"type":52,"tag":254,"props":1020,"children":1021},{},[1022,1028,1030],{"type":52,"tag":80,"props":1023,"children":1025},{"className":1024},[],[1026],{"type":58,"value":1027},"seccompProfile",{"type":58,"value":1029}," is RuntimeDefault\u002FLocalhost → ",{"type":52,"tag":80,"props":1031,"children":1033},{"className":1032},[],[1034],{"type":58,"value":1035},"safeguard-allowed-seccomp-profiles",{"type":52,"tag":65,"props":1037,"children":1038},{},[1039],{"type":52,"tag":69,"props":1040,"children":1041},{},[1042],{"type":58,"value":1043},"Per pod spec:",{"type":52,"tag":250,"props":1045,"children":1046},{},[1047,1073,1097,1117],{"type":52,"tag":254,"props":1048,"children":1049},{},[1050,1056,1058,1064,1065,1071],{"type":52,"tag":80,"props":1051,"children":1053},{"className":1052},[],[1054],{"type":58,"value":1055},"hostPID",{"type":58,"value":1057},"\u002F",{"type":52,"tag":80,"props":1059,"children":1061},{"className":1060},[],[1062],{"type":58,"value":1063},"hostIPC",{"type":58,"value":979},{"type":52,"tag":80,"props":1066,"children":1068},{"className":1067},[],[1069],{"type":58,"value":1070},"safeguard-block-host-namespaces",{"type":58,"value":1072}," (incompatible)",{"type":52,"tag":254,"props":1074,"children":1075},{},[1076,1082,1083,1089,1090,1096],{"type":52,"tag":80,"props":1077,"children":1079},{"className":1078},[],[1080],{"type":58,"value":1081},"hostNetwork",{"type":58,"value":1057},{"type":52,"tag":80,"props":1084,"children":1086},{"className":1085},[],[1087],{"type":58,"value":1088},"hostPort",{"type":58,"value":979},{"type":52,"tag":80,"props":1091,"children":1093},{"className":1092},[],[1094],{"type":58,"value":1095},"safeguard-host-network-ports",{"type":58,"value":1072},{"type":52,"tag":254,"props":1098,"children":1099},{},[1100,1102,1108,1110,1116],{"type":58,"value":1101},"No ",{"type":52,"tag":80,"props":1103,"children":1105},{"className":1104},[],[1106],{"type":58,"value":1107},"hostPath",{"type":58,"value":1109}," volumes → ",{"type":52,"tag":80,"props":1111,"children":1113},{"className":1112},[],[1114],{"type":58,"value":1115},"safeguard-no-host-path-volumes",{"type":58,"value":1072},{"type":52,"tag":254,"props":1118,"children":1119},{},[1120,1122],{"type":58,"value":1121},"Volume types are standard → ",{"type":52,"tag":80,"props":1123,"children":1125},{"className":1124},[],[1126],{"type":58,"value":1127},"safeguard-allowed-volume-types",{"type":52,"tag":65,"props":1129,"children":1130},{},[1131],{"type":52,"tag":69,"props":1132,"children":1133},{},[1134],{"type":58,"value":1135},"Per workload type:",{"type":52,"tag":250,"props":1137,"children":1138},{},[1139,1150],{"type":52,"tag":254,"props":1140,"children":1141},{},[1142,1144],{"type":58,"value":1143},"Deployments\u002FStatefulSets with replicas > 1: podAntiAffinity or topologySpreadConstraints → ",{"type":52,"tag":80,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":58,"value":1149},"safeguard-pod-enforce-antiaffinity",{"type":52,"tag":254,"props":1151,"children":1152},{},[1153,1155],{"type":58,"value":1154},"StorageClass: CSI provisioner (not in-tree) → ",{"type":52,"tag":80,"props":1156,"children":1158},{"className":1157},[],[1159],{"type":58,"value":1160},"safeguard-csi-driver-storage-class",{"type":52,"tag":291,"props":1162,"children":1164},{"id":1163},"severity-classification",[1165],{"type":58,"value":1166},"Severity Classification",{"type":52,"tag":177,"props":1168,"children":1169},{},[1170,1191],{"type":52,"tag":181,"props":1171,"children":1172},{},[1173],{"type":52,"tag":185,"props":1174,"children":1175},{},[1176,1181,1186],{"type":52,"tag":189,"props":1177,"children":1178},{},[1179],{"type":58,"value":1180},"Severity",{"type":52,"tag":189,"props":1182,"children":1183},{},[1184],{"type":58,"value":1185},"Meaning",{"type":52,"tag":189,"props":1187,"children":1188},{},[1189],{"type":58,"value":1190},"Action",{"type":52,"tag":200,"props":1192,"children":1193},{},[1194,1216,1238,1260],{"type":52,"tag":185,"props":1195,"children":1196},{},[1197,1206,1211],{"type":52,"tag":207,"props":1198,"children":1199},{},[1200],{"type":52,"tag":80,"props":1201,"children":1203},{"className":1202},[],[1204],{"type":58,"value":1205},"incompatible",{"type":52,"tag":207,"props":1207,"children":1208},{},[1209],{"type":58,"value":1210},"Fundamental architecture issue; cannot run on Automatic without redesign",{"type":52,"tag":207,"props":1212,"children":1213},{},[1214],{"type":58,"value":1215},"Must fix before migration — flag prominently",{"type":52,"tag":185,"props":1217,"children":1218},{},[1219,1228,1233],{"type":52,"tag":207,"props":1220,"children":1221},{},[1222],{"type":52,"tag":80,"props":1223,"children":1225},{"className":1224},[],[1226],{"type":58,"value":1227},"requiresChanges",{"type":52,"tag":207,"props":1229,"children":1230},{},[1231],{"type":58,"value":1232},"Manifest changes needed; will be denied at admission",{"type":52,"tag":207,"props":1234,"children":1235},{},[1236],{"type":58,"value":1237},"Generate fix diffs",{"type":52,"tag":185,"props":1239,"children":1240},{},[1241,1250,1255],{"type":52,"tag":207,"props":1242,"children":1243},{},[1244],{"type":52,"tag":80,"props":1245,"children":1247},{"className":1246},[],[1248],{"type":58,"value":1249},"autoFixed",{"type":52,"tag":207,"props":1251,"children":1252},{},[1253],{"type":58,"value":1254},"AKS Automatic will mutate this at admission; no user action needed",{"type":52,"tag":207,"props":1256,"children":1257},{},[1258],{"type":58,"value":1259},"Informational — show what will change",{"type":52,"tag":185,"props":1261,"children":1262},{},[1263,1272,1277],{"type":52,"tag":207,"props":1264,"children":1265},{},[1266],{"type":52,"tag":80,"props":1267,"children":1269},{"className":1268},[],[1270],{"type":58,"value":1271},"informational",{"type":52,"tag":207,"props":1273,"children":1274},{},[1275],{"type":58,"value":1276},"No enforcement",{"type":52,"tag":207,"props":1278,"children":1279},{},[1280],{"type":58,"value":1281},"Mention briefly",{"type":52,"tag":291,"props":1283,"children":1285},{"id":1284},"step-3-present-findings",[1286],{"type":58,"value":1287},"Step 3: Present Findings",{"type":52,"tag":65,"props":1289,"children":1290},{},[1291],{"type":58,"value":1292},"Always start with the summary:",{"type":52,"tag":657,"props":1294,"children":1297},{"className":1295,"code":1296,"language":58},[765],"## AKS Automatic Readiness Assessment\n\n| Status | Count |\n|--------|-------|\n| ✅ Compatible | X workloads |\n| ⚠️ Requires changes | Y workloads |\n| ❌ Incompatible | Z workloads |\n| 🔧 Auto-fixed by Automatic | W workloads |\n| 🏗️ Cluster config issues | N issues |\n",[1298],{"type":52,"tag":80,"props":1299,"children":1300},{"__ignoreMap":662},[1301],{"type":58,"value":1296},{"type":52,"tag":65,"props":1303,"children":1304},{},[1305,1307,1311,1313,1317,1319,1323],{"type":58,"value":1306},"Grouping: ≤ 10 issues → list individually; > 10 → group by constraint ID. Always show ",{"type":52,"tag":69,"props":1308,"children":1309},{},[1310],{"type":58,"value":1205},{"type":58,"value":1312}," first (migration blockers), then ",{"type":52,"tag":69,"props":1314,"children":1315},{},[1316],{"type":58,"value":1227},{"type":58,"value":1318},", then ",{"type":52,"tag":69,"props":1320,"children":1321},{},[1322],{"type":58,"value":1249},{"type":58,"value":1324},", then cluster config.",{"type":52,"tag":65,"props":1326,"children":1327},{},[1328],{"type":58,"value":1329},"Per-issue format:",{"type":52,"tag":657,"props":1331,"children":1334},{"className":1332,"code":1333,"language":58},[765],"### ❌ [constraint-id] — Short description\n**Severity:** incompatible | requiresChanges\n**Affected:** namespace\u002Fresource-name (Kind)\n**Current:** \u003Cwhat the manifest has>\n**Required:** \u003Cwhat AKS Automatic requires>\n**Fix:** \u003Cremediation summary>\n**Docs:** \u003Cdocumentation URL>\n",[1335],{"type":52,"tag":80,"props":1336,"children":1337},{"__ignoreMap":662},[1338],{"type":58,"value":1333},{"type":52,"tag":291,"props":1340,"children":1342},{"id":1341},"step-4-offer-fixes",[1343],{"type":58,"value":1344},"Step 4: Offer Fixes",{"type":52,"tag":65,"props":1346,"children":1347},{},[1348,1353,1355,1361],{"type":52,"tag":69,"props":1349,"children":1350},{},[1351],{"type":58,"value":1352},"Deterministic fixes",{"type":58,"value":1354}," (the constraint rule and ",{"type":52,"tag":80,"props":1356,"children":1358},{"className":1357},[],[1359],{"type":58,"value":1360},"references\u002Fcommon-fixes.md",{"type":58,"value":1362}," define a direct field transformation — generate a YAML diff):",{"type":52,"tag":250,"props":1364,"children":1365},{},[1366,1382,1398,1413,1428,1439],{"type":52,"tag":254,"props":1367,"children":1368},{},[1369,1374,1376],{"type":52,"tag":80,"props":1370,"children":1372},{"className":1371},[],[1373],{"type":58,"value":930},{"type":58,"value":1375}," — add ",{"type":52,"tag":80,"props":1377,"children":1379},{"className":1378},[],[1380],{"type":58,"value":1381},"resources.requests",{"type":52,"tag":254,"props":1383,"children":1384},{},[1385,1390,1392],{"type":52,"tag":80,"props":1386,"children":1388},{"className":1387},[],[1389],{"type":58,"value":1001},{"type":58,"value":1391}," — set ",{"type":52,"tag":80,"props":1393,"children":1395},{"className":1394},[],[1396],{"type":58,"value":1397},"allowPrivilegeEscalation: false",{"type":52,"tag":254,"props":1399,"children":1400},{},[1401,1406,1408],{"type":52,"tag":80,"props":1402,"children":1404},{"className":1403},[],[1405],{"type":58,"value":1018},{"type":58,"value":1407}," — remove ",{"type":52,"tag":80,"props":1409,"children":1411},{"className":1410},[],[1412],{"type":58,"value":1010},{"type":52,"tag":254,"props":1414,"children":1415},{},[1416,1421,1422],{"type":52,"tag":80,"props":1417,"children":1419},{"className":1418},[],[1420],{"type":58,"value":1035},{"type":58,"value":1375},{"type":52,"tag":80,"props":1423,"children":1425},{"className":1424},[],[1426],{"type":58,"value":1427},"seccompProfile: RuntimeDefault",{"type":52,"tag":254,"props":1429,"children":1430},{},[1431,1437],{"type":52,"tag":80,"props":1432,"children":1434},{"className":1433},[],[1435],{"type":58,"value":1436},"safeguard-enforce-apparmor",{"type":58,"value":1438}," — add AppArmor annotation",{"type":52,"tag":254,"props":1440,"children":1441},{},[1442,1447],{"type":52,"tag":80,"props":1443,"children":1445},{"className":1444},[],[1446],{"type":58,"value":1160},{"type":58,"value":1448}," — replace in-tree provisioner",{"type":52,"tag":65,"props":1450,"children":1451},{},[1452,1454,1459],{"type":58,"value":1453},"Use patterns in ",{"type":52,"tag":80,"props":1455,"children":1457},{"className":1456},[],[1458],{"type":58,"value":1360},{"type":58,"value":1460}," and generate a before\u002Fafter diff. Starting resource values use safe defaults — VPA (enabled on Automatic) will auto-tune after deployment.",{"type":52,"tag":65,"props":1462,"children":1463},{},[1464,1469,1471,1477],{"type":52,"tag":69,"props":1465,"children":1466},{},[1467],{"type":58,"value":1468},"Context-dependent fixes",{"type":58,"value":1470}," (the constraint spec's ",{"type":52,"tag":80,"props":1472,"children":1474},{"className":1473},[],[1475],{"type":58,"value":1476},"fix",{"type":58,"value":1478}," guidance requires application-specific input):",{"type":52,"tag":250,"props":1480,"children":1481},{},[1482,1499,1509,1519,1529],{"type":52,"tag":254,"props":1483,"children":1484},{},[1485,1490,1492,1497],{"type":52,"tag":80,"props":1486,"children":1488},{"className":1487},[],[1489],{"type":58,"value":968},{"type":58,"value":1491}," — correct tag is user- and release-specific; ask the user: ",{"type":52,"tag":945,"props":1493,"children":1494},{},[1495],{"type":58,"value":1496},"\"What specific version tag or SHA digest should I pin this image to?\"",{"type":58,"value":1498}," Do not guess",{"type":52,"tag":254,"props":1500,"children":1501},{},[1502,1507],{"type":52,"tag":80,"props":1503,"children":1505},{"className":1504},[],[1506],{"type":58,"value":1149},{"type":58,"value":1508}," — needs app labels for selector",{"type":52,"tag":254,"props":1510,"children":1511},{},[1512,1517],{"type":52,"tag":80,"props":1513,"children":1515},{"className":1514},[],[1516],{"type":58,"value":1115},{"type":58,"value":1518}," — replacement depends on what hostPath is used for",{"type":52,"tag":254,"props":1520,"children":1521},{},[1522,1527],{"type":52,"tag":80,"props":1523,"children":1525},{"className":1524},[],[1526],{"type":58,"value":1070},{"type":58,"value":1528}," — may require architecture redesign",{"type":52,"tag":254,"props":1530,"children":1531},{},[1532,1537],{"type":52,"tag":80,"props":1533,"children":1535},{"className":1534},[],[1536],{"type":58,"value":1095},{"type":58,"value":1538}," — needs alternative networking approach",{"type":52,"tag":65,"props":1540,"children":1541},{},[1542],{"type":58,"value":1543},"For incompatible findings (e.g., hostPath volumes), explain the issue and propose alternatives. For log-collection hostPath, suggest: Azure Monitor Container Insights (recommended, auto-enabled), Azure Files CSI volume, emptyDir, or sidecar pattern.",{"type":52,"tag":65,"props":1545,"children":1546},{},[1547],{"type":52,"tag":69,"props":1548,"children":1549},{},[1550],{"type":58,"value":1551},"Fix application flow:",{"type":52,"tag":349,"props":1553,"children":1554},{},[1555,1560,1565,1570,1575],{"type":52,"tag":254,"props":1556,"children":1557},{},[1558],{"type":58,"value":1559},"Generate the fix as a YAML diff",{"type":52,"tag":254,"props":1561,"children":1562},{},[1563],{"type":58,"value":1564},"Show the diff with explanation",{"type":52,"tag":254,"props":1566,"children":1567},{},[1568],{"type":58,"value":1569},"Wait for explicit approval: \"apply\", \"edit\", or \"skip\"",{"type":52,"tag":254,"props":1571,"children":1572},{},[1573],{"type":58,"value":1574},"On approval, apply the change to the file",{"type":52,"tag":254,"props":1576,"children":1577},{},[1578],{"type":58,"value":1579},"Move to the next finding",{"type":52,"tag":65,"props":1581,"children":1582},{},[1583],{"type":58,"value":1584},"If the user says \"fix all\" or \"apply all deterministic fixes\", first generate a single combined diff containing only the constraint rules with direct, context-independent transformations, show that combined diff with an explanation, and wait for one explicit approval before applying any writes. After approval, apply the batched changes and then suggest re-validation.",{"type":52,"tag":291,"props":1586,"children":1588},{"id":1587},"step-5-recommend-next-steps",[1589],{"type":58,"value":1590},"Step 5: Recommend Next Steps",{"type":52,"tag":65,"props":1592,"children":1593},{},[1594],{"type":52,"tag":69,"props":1595,"children":1596},{},[1597],{"type":58,"value":1598},"All issues resolved (or only autoFixed remaining):",{"type":52,"tag":657,"props":1600,"children":1603},{"className":1601,"code":1602,"language":58},[765],"Your workloads are ready for AKS Automatic! Next steps:\n1. Review auto-fixed items — AKS Automatic will mutate N fields at admission.\n2. Apply cluster configuration changes (see cluster config issues above).\n3. Perform the SKU switch — follow the migration guide.\n4. Verify — after migration, check all workloads are running and healthy.\n",[1604],{"type":52,"tag":80,"props":1605,"children":1606},{"__ignoreMap":662},[1607],{"type":58,"value":1602},{"type":52,"tag":65,"props":1609,"children":1610},{},[1611,1613,1619],{"type":58,"value":1612},"See ",{"type":52,"tag":80,"props":1614,"children":1616},{"className":1615},[],[1617],{"type":58,"value":1618},"references\u002Fmigration-guide-summary.md",{"type":58,"value":1620}," for the full migration checklist.",{"type":52,"tag":65,"props":1622,"children":1623},{},[1624,1629],{"type":52,"tag":69,"props":1625,"children":1626},{},[1627],{"type":58,"value":1628},"Incompatible findings remain:",{"type":58,"value":1630}," List blockers and offer three options: redesign workloads, keep on a separate AKS Standard cluster, or use Automatic for compatible + Standard for incompatible workloads.",{"type":52,"tag":65,"props":1632,"children":1633},{},[1634,1639,1641,1646],{"type":52,"tag":69,"props":1635,"children":1636},{},[1637],{"type":58,"value":1638},"Cluster config issues remain (Day-0 decisions):",{"type":58,"value":1640}," API Server VNet Integration, node pool OS SKU (requires recreating system node pools), and ephemeral OS disks require a new cluster — redirect to ",{"type":52,"tag":80,"props":1642,"children":1644},{"className":1643},[],[1645],{"type":58,"value":85},{"type":58,"value":1647}," skill for cluster creation help.",{"type":52,"tag":170,"props":1649,"children":1651},{"id":1650},"error-handling",[1652],{"type":58,"value":1653},"Error Handling",{"type":52,"tag":177,"props":1655,"children":1656},{},[1657,1678],{"type":52,"tag":181,"props":1658,"children":1659},{},[1660],{"type":52,"tag":185,"props":1661,"children":1662},{},[1663,1668,1673],{"type":52,"tag":189,"props":1664,"children":1665},{},[1666],{"type":58,"value":1667},"Error \u002F Symptom",{"type":52,"tag":189,"props":1669,"children":1670},{},[1671],{"type":58,"value":1672},"Likely Cause",{"type":52,"tag":189,"props":1674,"children":1675},{},[1676],{"type":58,"value":1677},"Remediation",{"type":52,"tag":200,"props":1679,"children":1680},{},[1681,1712,1730,1755,1796,1819,1845],{"type":52,"tag":185,"props":1682,"children":1683},{},[1684,1689,1694],{"type":52,"tag":207,"props":1685,"children":1686},{},[1687],{"type":58,"value":1688},"No Azure MCP AKS capability appears in the host's available tools",{"type":52,"tag":207,"props":1690,"children":1691},{},[1692],{"type":58,"value":1693},"External connector\u002Fserver is unavailable or the host relies on a different built-in Azure surface",{"type":52,"tag":207,"props":1695,"children":1696},{},[1697,1699,1703,1705,1710],{"type":58,"value":1698},"In Azure SRE Agent, use built-in Azure tools or resolve ",{"type":52,"tag":69,"props":1700,"children":1701},{},[1702],{"type":58,"value":809},{"type":58,"value":1704}," only if the external server is needed; in other hosts, configure Azure MCP. Use ",{"type":52,"tag":80,"props":1706,"children":1708},{"className":1707},[],[1709],{"type":58,"value":886},{"type":58,"value":1711}," for cluster metadata while unavailable",{"type":52,"tag":185,"props":1713,"children":1714},{},[1715,1720,1725],{"type":52,"tag":207,"props":1716,"children":1717},{},[1718],{"type":58,"value":1719},"Discovered Azure MCP AKS capability has no readiness operation",{"type":52,"tag":207,"props":1721,"children":1722},{},[1723],{"type":58,"value":1724},"Expected for the currently documented AKS surface",{"type":52,"tag":207,"props":1726,"children":1727},{},[1728],{"type":58,"value":1729},"Use advertised cluster\u002Fnode-pool reads, collect sanitized manifests through Kubernetes-native tools, and evaluate the bundled constraint spec locally",{"type":52,"tag":185,"props":1731,"children":1732},{},[1733,1738,1743],{"type":52,"tag":207,"props":1734,"children":1735},{},[1736],{"type":58,"value":1737},"Azure or Kubernetes read fails in Azure SRE Agent",{"type":52,"tag":207,"props":1739,"children":1740},{},[1741],{"type":58,"value":1742},"Agent managed identity lacks target scope or RBAC",{"type":52,"tag":207,"props":1744,"children":1745},{},[1746,1748],{"type":58,"value":1747},"Check the agent's managed resource groups and UAMI role assignments per ",{"type":52,"tag":89,"props":1749,"children":1752},{"href":1750,"rel":1751},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fsre-agent\u002Fpermissions",[130],[1753],{"type":58,"value":1754},"SRE Agent permissions",{"type":52,"tag":185,"props":1756,"children":1757},{},[1758,1770,1775],{"type":52,"tag":207,"props":1759,"children":1760},{},[1761,1763,1768],{"type":58,"value":1762},"MCP or ",{"type":52,"tag":80,"props":1764,"children":1766},{"className":1765},[],[1767],{"type":58,"value":886},{"type":58,"value":1769}," read fails in another host",{"type":52,"tag":207,"props":1771,"children":1772},{},[1773],{"type":58,"value":1774},"Invalid credentials or subscription context",{"type":52,"tag":207,"props":1776,"children":1777},{},[1778,1780,1786,1788,1794],{"type":58,"value":1779},"Verify ",{"type":52,"tag":80,"props":1781,"children":1783},{"className":1782},[],[1784],{"type":58,"value":1785},"az login",{"type":58,"value":1787}," and the active subscription with ",{"type":52,"tag":80,"props":1789,"children":1791},{"className":1790},[],[1792],{"type":58,"value":1793},"az account show",{"type":58,"value":1795},"; continue with offline validation when live access remains unavailable",{"type":52,"tag":185,"props":1797,"children":1798},{},[1799,1809,1814],{"type":52,"tag":207,"props":1800,"children":1801},{},[1802,1807],{"type":52,"tag":80,"props":1803,"children":1805},{"className":1804},[],[1806],{"type":58,"value":493},{"type":58,"value":1808}," cannot read workloads",{"type":52,"tag":207,"props":1810,"children":1811},{},[1812],{"type":58,"value":1813},"Missing cluster context or Kubernetes RBAC",{"type":52,"tag":207,"props":1815,"children":1816},{},[1817],{"type":58,"value":1818},"Verify the current context and read permissions, or use local\u002Frendered manifests",{"type":52,"tag":185,"props":1820,"children":1821},{},[1822,1827,1832],{"type":52,"tag":207,"props":1823,"children":1824},{},[1825],{"type":58,"value":1826},"Helm chart uses Go templating — cannot evaluate",{"type":52,"tag":207,"props":1828,"children":1829},{},[1830],{"type":58,"value":1831},"Template values not resolved",{"type":52,"tag":207,"props":1833,"children":1834},{},[1835,1837,1843],{"type":58,"value":1836},"Ask user for rendered output (",{"type":52,"tag":80,"props":1838,"children":1840},{"className":1839},[],[1841],{"type":58,"value":1842},"helm template",{"type":58,"value":1844},") or values files",{"type":52,"tag":185,"props":1846,"children":1847},{},[1848,1853,1858],{"type":52,"tag":207,"props":1849,"children":1850},{},[1851],{"type":58,"value":1852},"Constraint spec version mismatch",{"type":52,"tag":207,"props":1854,"children":1855},{},[1856],{"type":58,"value":1857},"Skill bundles spec v1.1.1 (2026-03-15)",{"type":52,"tag":207,"props":1859,"children":1860},{},[1861],{"type":58,"value":1862},"Note version in output; recommend re-running after spec update",{"type":52,"tag":170,"props":1864,"children":1866},{"id":1865},"reference-files",[1867],{"type":58,"value":1868},"Reference Files",{"type":52,"tag":177,"props":1870,"children":1871},{},[1872,1888],{"type":52,"tag":181,"props":1873,"children":1874},{},[1875],{"type":52,"tag":185,"props":1876,"children":1877},{},[1878,1883],{"type":52,"tag":189,"props":1879,"children":1880},{},[1881],{"type":58,"value":1882},"File",{"type":52,"tag":189,"props":1884,"children":1885},{},[1886],{"type":58,"value":1887},"When to load",{"type":52,"tag":200,"props":1889,"children":1890},{},[1891,1907,1923,1939],{"type":52,"tag":185,"props":1892,"children":1893},{},[1894,1902],{"type":52,"tag":207,"props":1895,"children":1896},{},[1897],{"type":52,"tag":80,"props":1898,"children":1900},{"className":1899},[],[1901],{"type":58,"value":654},{"type":52,"tag":207,"props":1903,"children":1904},{},[1905],{"type":58,"value":1906},"Always load for offline validation — all constraint IDs, severities, and fix patterns",{"type":52,"tag":185,"props":1908,"children":1909},{},[1910,1918],{"type":52,"tag":207,"props":1911,"children":1912},{},[1913],{"type":52,"tag":80,"props":1914,"children":1916},{"className":1915},[],[1917],{"type":58,"value":1360},{"type":52,"tag":207,"props":1919,"children":1920},{},[1921],{"type":58,"value":1922},"When generating deterministic fixes — before\u002Fafter YAML patterns",{"type":52,"tag":185,"props":1924,"children":1925},{},[1926,1934],{"type":52,"tag":207,"props":1927,"children":1928},{},[1929],{"type":52,"tag":80,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":58,"value":1618},{"type":52,"tag":207,"props":1935,"children":1936},{},[1937],{"type":58,"value":1938},"When user asks about migration steps or after assessment is complete",{"type":52,"tag":185,"props":1940,"children":1941},{},[1942,1951],{"type":52,"tag":207,"props":1943,"children":1944},{},[1945],{"type":52,"tag":80,"props":1946,"children":1948},{"className":1947},[],[1949],{"type":58,"value":1950},"references\u002Fmcp-integration.md",{"type":52,"tag":207,"props":1952,"children":1953},{},[1954],{"type":58,"value":1955},"When troubleshooting MCP tool calls or debugging the fallback chain",{"type":52,"tag":61,"props":1957,"children":1958},{},[1959],{"type":52,"tag":65,"props":1960,"children":1961},{},[1962,1964,1969,1971,1976],{"type":58,"value":1963},"⚠️ ",{"type":52,"tag":69,"props":1965,"children":1966},{},[1967],{"type":58,"value":1968},"Warning:",{"type":58,"value":1970}," This skill bundles ",{"type":52,"tag":69,"props":1972,"children":1973},{},[1974],{"type":58,"value":1975},"constraint spec v1.1.1",{"type":58,"value":1977}," (2026-03-15), covering 26 cluster-level constraints, 25 active Deployment Safeguards policies, 2 active webhook mutators, and 5 Pod Security Baseline policies. Always note the spec version in assessment output.",{"type":52,"tag":1979,"props":1980,"children":1981},"style",{},[1982],{"type":58,"value":1983},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1985,"total":2163},[1986,2005,2022,2041,2056,2071,2084,2099,2110,2124,2137,2149],{"slug":1987,"name":1987,"fn":1988,"description":1989,"org":1990,"tags":1991,"stars":2002,"repoUrl":2003,"updatedAt":2004},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1992,1993,1996,1999],{"name":11,"slug":8,"type":16},{"name":1994,"slug":1995,"type":16},"Compliance","compliance",{"name":1997,"slug":1998,"type":16},"Governance","governance",{"name":2000,"slug":2001,"type":16},"Policy","policy",1689,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":2006,"name":2006,"fn":2007,"description":2008,"org":2009,"tags":2010,"stars":2019,"repoUrl":2020,"updatedAt":2021},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2011,2012,2015,2018],{"name":11,"slug":8,"type":16},{"name":2013,"slug":2014,"type":16},"Deployment","deployment",{"name":2016,"slug":2017,"type":16},"Infrastructure as Code","infrastructure-as-code",{"name":19,"slug":20,"type":16},261,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-08-20T03:28:18.136156",{"slug":2023,"name":2023,"fn":2024,"description":2025,"org":2026,"tags":2027,"stars":2038,"repoUrl":2039,"updatedAt":2040},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2028,2031,2032,2035],{"name":2029,"slug":2030,"type":16},"API Development","api-development",{"name":11,"slug":8,"type":16},{"name":2033,"slug":2034,"type":16},"Code Review","code-review",{"name":2036,"slug":2037,"type":16},"Documentation","documentation",136,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":2042,"name":2042,"fn":2043,"description":2044,"org":2045,"tags":2046,"stars":2038,"repoUrl":2039,"updatedAt":2055},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2047,2048,2049,2052],{"name":11,"slug":8,"type":16},{"name":2013,"slug":2014,"type":16},{"name":2050,"slug":2051,"type":16},"SDK","sdk",{"name":2053,"slug":2054,"type":16},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":2057,"name":2057,"fn":2058,"description":2059,"org":2060,"tags":2061,"stars":2038,"repoUrl":2039,"updatedAt":2070},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2062,2063,2066,2069],{"name":11,"slug":8,"type":16},{"name":2064,"slug":2065,"type":16},"GitHub","github",{"name":2067,"slug":2068,"type":16},"Project Management","project-management",{"name":2050,"slug":2051,"type":16},"2026-07-12T08:17:38.345387",{"slug":2072,"name":2072,"fn":2073,"description":2074,"org":2075,"tags":2076,"stars":2038,"repoUrl":2039,"updatedAt":2083},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2077,2078,2081,2082],{"name":11,"slug":8,"type":16},{"name":2079,"slug":2080,"type":16},"CI\u002FCD","ci-cd",{"name":2013,"slug":2014,"type":16},{"name":2050,"slug":2051,"type":16},"2026-07-12T08:17:34.27607",{"slug":2085,"name":2085,"fn":2086,"description":2087,"org":2088,"tags":2089,"stars":2038,"repoUrl":2039,"updatedAt":2098},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2090,2091,2092,2095],{"name":2029,"slug":2030,"type":16},{"name":11,"slug":8,"type":16},{"name":2093,"slug":2094,"type":16},"OpenAPI","openapi",{"name":2096,"slug":2097,"type":16},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":2100,"name":2100,"fn":2101,"description":2102,"org":2103,"tags":2104,"stars":2038,"repoUrl":2039,"updatedAt":2109},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2105,2106,2107,2108],{"name":11,"slug":8,"type":16},{"name":2079,"slug":2080,"type":16},{"name":2050,"slug":2051,"type":16},{"name":2053,"slug":2054,"type":16},"2026-07-12T08:17:37.08523",{"slug":2111,"name":2111,"fn":2112,"description":2113,"org":2114,"tags":2115,"stars":2038,"repoUrl":2039,"updatedAt":2123},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2116,2119,2122],{"name":2117,"slug":2118,"type":16},"LLM","llm",{"name":2120,"slug":2121,"type":16},"Performance","performance",{"name":2096,"slug":2097,"type":16},"2026-07-12T08:17:42.080413",{"slug":2125,"name":2125,"fn":2126,"description":2127,"org":2128,"tags":2129,"stars":2038,"repoUrl":2039,"updatedAt":2136},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2130,2131,2132,2135],{"name":11,"slug":8,"type":16},{"name":2079,"slug":2080,"type":16},{"name":2133,"slug":2134,"type":16},"Debugging","debugging",{"name":2050,"slug":2051,"type":16},"2026-07-12T08:17:40.821512",{"slug":2138,"name":2138,"fn":2139,"description":2140,"org":2141,"tags":2142,"stars":2038,"repoUrl":2039,"updatedAt":2148},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2143,2144,2147],{"name":2036,"slug":2037,"type":16},{"name":2145,"slug":2146,"type":16},"Plugin Development","plugin-development",{"name":2096,"slug":2097,"type":16},"2026-08-07T04:39:22.66861",{"slug":2150,"name":2150,"fn":2151,"description":2152,"org":2153,"tags":2154,"stars":2160,"repoUrl":2161,"updatedAt":2162},"kickstart-acr-integration","integrate Azure Container Registry with AKS","ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2155,2156,2159],{"name":11,"slug":8,"type":16},{"name":2157,"slug":2158,"type":16},"Containers","containers",{"name":2013,"slug":2014,"type":16},65,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools","2026-07-12T08:18:05.091337",124,{"items":2165,"total":2257},[2166,2173,2185,2198,2216,2229,2244],{"slug":4,"name":4,"fn":5,"description":6,"org":2167,"tags":2168,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2169,2170,2171,2172],{"name":11,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":19,"slug":20,"type":16},{"name":14,"slug":15,"type":16},{"slug":85,"name":85,"fn":2174,"description":2175,"org":2176,"tags":2177,"stars":24,"repoUrl":25,"updatedAt":2184},"design and configure Azure Kubernetes Service clusters","Make the AKS-specific design decisions for a new production Azure Kubernetes Service (AKS) cluster — SKU (Automatic vs Standard), pod IP model (Azure CNI Overlay vs kubenet), API-server access, egress, identity, upgrades, node pools, and reliability — then delegate the actual provisioning to the Azure Skills deployment engine. WHEN: create AKS cluster, provision AKS environment, design AKS networking, choose AKS SKU, Day-0 AKS checklist, plan a production AKS cluster. DO NOT USE FOR: debugging a running cluster (use aks-troubleshooting); assessing an existing cluster for AKS Automatic (use aks-automatic-readiness); GPU \u002F model-serving setup (see azure-skills airunway-aks-setup); generic non-AKS Azure resource deployment (use azure-skills azure-deploy directly).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2178,2181,2182,2183],{"name":2179,"slug":2180,"type":16},"Architecture","architecture",{"name":11,"slug":8,"type":16},{"name":2013,"slug":2014,"type":16},{"name":22,"slug":23,"type":16},"2026-08-23T04:00:29.49469",{"slug":2186,"name":2186,"fn":2187,"description":2188,"org":2189,"tags":2190,"stars":24,"repoUrl":25,"updatedAt":2197},"aks-cost-optimization","optimize Azure Kubernetes Service cluster costs","Reduce Azure Kubernetes Service (AKS) spending: pod rightsizing, VPA-driven recommendations, cluster-autoscaler tuning, spot node pools, namespace-level cost visibility, and cost-anomaly detection. WHEN: rightsize pods, VPA recommendations, idle nodes, scale-down, autoscaler profile, spot nodes, cheaper compute, cost add-on, namespace cost breakdown, spending anomaly, 'my AKS bill is too high', 'is my app consuming what it requests', resource requests vs actual usage, over-provisioned workloads, spot vs on-demand, per-namespace or per-team cost allocation, 'who's spending what and why'. DO NOT USE FOR: GPU \u002F inference cost and idle GPU pools (use aks-gpu-inference); autoscaler that is failing to scale up during an incident (use aks-troubleshooting); choosing SKUs at cluster-creation time (use aks-cluster-setup).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2191,2192,2195,2196],{"name":11,"slug":8,"type":16},{"name":2193,"slug":2194,"type":16},"Cost Optimization","cost-optimization",{"name":22,"slug":23,"type":16},{"name":2120,"slug":2121,"type":16},"2026-08-23T04:00:29.864048",{"slug":2199,"name":2199,"fn":2200,"description":2201,"org":2202,"tags":2203,"stars":24,"repoUrl":25,"updatedAt":2215},"aks-gpu-inference","manage GPU inference workloads on AKS","Day-2 operations for GPU and model-inference workloads on Azure Kubernetes Service (AKS): diagnose GPU pods stuck Pending, missing nvidia.com\u002Fgpu, CUDA\u002Fdriver mismatches, model OOM on weight load, GPU vCPU-quota failures, KAITO (AI toolchain operator) Workspaces stuck not-ready, and GPU cost \u002F scale-to-zero \u002F spot eviction. WHEN: GPU pod Pending 'Insufficient nvidia.com\u002Fgpu', no nvidia.com\u002Fgpu on node, CUDA driver version insufficient, model OOMKilled loading weights, GPU node pool quota exceeded, KAITO Workspace never becomes ready, idle GPU cost, autoscale GPU on DCGM, spot GPU eviction, right-size a GPU SKU for a model. DO NOT USE FOR: initial GPU\u002FAI setup or enablement (use azure-skills airunway-aks-setup); non-GPU pod\u002Fnode\u002Fnetwork incidents (use aks-troubleshooting); non-GPU cost (use aks-cost-optimization).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2204,2205,2208,2211,2212],{"name":11,"slug":8,"type":16},{"name":2206,"slug":2207,"type":16},"CUDA","cuda",{"name":2209,"slug":2210,"type":16},"GPU","gpu",{"name":22,"slug":23,"type":16},{"name":2213,"slug":2214,"type":16},"Operations","operations","2026-08-23T04:00:03.060719",{"slug":2217,"name":2217,"fn":2218,"description":2219,"org":2220,"tags":2221,"stars":24,"repoUrl":25,"updatedAt":2228},"aks-known-issues","diagnose AKS failures using known issue tables","Match an AKS operation failure against a curated, versioned table of documented known issues and error codes — each entry carrying the cause and the Microsoft-documented fix, workaround, or platform limitation. Deterministic error-string → diagnosis lookup for specific, named failures: AKS VM-extension \u002F CSE provisioning errors with a documented nested signature (VMExtensionError_OutboundConnFail \u002F exit 50, VMExtensionError_K8SAPIServerConnFail \u002F exit 51, VMExtensionError_K8SAPIServerDNSLookupFail \u002F exit 52, OrasPullUnauthorizedVMExtensionError \u002F exit 212), SKU and allocation errors (SkuNotAvailable, ZonalAllocationFailed, OverconstrainedAllocationRequest, message-qualified AllocationFailed), VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, node-image \u002F snapshot 'NodeImageVersion is not accepted', and network-isolated-cluster ACR pull failures. ALLOCATION ROUTING: the full messages 'AllocationFailed: The VM allocation failed due to an internal error. Please retry later or try deploying to a different location' and 'AllocationFailed: We do not have sufficient capacity for the requested VM size' are cataloged signatures owned by this skill; they are not bare errors. A prompt that reports only the AllocationFailed code and explicitly has no nested Azure message is not a catalog match — route that bare-code investigation to aks-troubleshooting. WHEN: an AKS create \u002F scale \u002F upgrade \u002F image-pull fails with one of the cataloged signatures; 'what does \u003Cerror> mean on AKS?'; 'is \u003Cerror> a known issue?'; an AKS vmssCSE \u002F VM-extension exit code; or a message-qualified AKS SKU \u002F allocation error. DO NOT USE FOR: a bare VMExtensionProvisioningError wrapper; an unclassified SKU \u002F capacity allocation incident; a numeric exit code without AKS CSE context; a natural-language 'allocation failed' symptom without the Azure error; non-AKS resources; or open-ended incidents with no cataloged signature — pod crashes, NotReady, DNS, ingress, or timeouts (use aks-troubleshooting for AKS incidents). Read-only: it explains and cites the documented fix, and never applies changes without explicit approval.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2222,2223,2224,2227],{"name":11,"slug":8,"type":16},{"name":2133,"slug":2134,"type":16},{"name":2225,"slug":2226,"type":16},"Diagnostics","diagnostics",{"name":22,"slug":23,"type":16},"2026-08-23T04:00:30.216663",{"slug":2230,"name":2230,"fn":2231,"description":2232,"org":2233,"tags":2234,"stars":24,"repoUrl":25,"updatedAt":2243},"aks-network-capture","capture network traffic in AKS clusters","Packet-level network evidence for AKS: run a bounded, distributed packet capture across nodes (filtered by IP, port, or tcpdump\u002FBPF expression), and collect Azure network resources (NSG rules, route tables, firewall, VNET peering) when you need pcap-level proof of where traffic drops. Escalation tool for when logs and read-only checks are inconclusive. WHEN: capture packets on a node, take a pcap, tcpdump on AKS, prove where a packet is dropped, verify an NSG or route is blocking traffic at the wire. DO NOT USE FOR: general DNS \u002F connectivity \u002F ingress troubleshooting — start with aks-troubleshooting (which routes here when a capture is actually needed).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2235,2236,2237,2240],{"name":11,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":2238,"slug":2239,"type":16},"Networking","networking",{"name":2241,"slug":2242,"type":16},"Observability","observability","2026-08-23T04:00:31.384775",{"slug":327,"name":327,"fn":2245,"description":2246,"org":2247,"tags":2248,"stars":24,"repoUrl":25,"updatedAt":2256},"debug and troubleshoot Azure Kubernetes Service incidents","Debug and root-cause live Azure Kubernetes Service (AKS) cluster incidents: pod crashes, node failures, DNS\u002Fnetworking, ingress\u002Fload-balancer errors, network policy, upgrade failures, and spot\u002Fzone disruptions. Runs a read-only, evidence-first investigation using the AKS MCP tools, az, and kubectl, and produces a structured incident report. WHEN: CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, pod Pending, DNS resolution failure, 502\u002F503 from ingress, connectivity timeout, upgrade stuck, cordon\u002Fdrain failure, spot eviction, SNAT exhaustion, expired certificate, 'investigate my AKS cluster'. DO NOT USE FOR: packet-level capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); creating or provisioning a cluster (use aks-cluster-setup); cost\u002Frightsizing (use aks-cost-optimization); a named, documented AKS error code or message with a known signature — e.g. VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, a vmssCSE exit code (use aks-known-issues).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2249,2250,2251,2254,2255],{"name":11,"slug":8,"type":16},{"name":2133,"slug":2134,"type":16},{"name":2252,"slug":2253,"type":16},"Incident Response","incident-response",{"name":22,"slug":23,"type":16},{"name":2238,"slug":2239,"type":16},"2026-08-23T04:00:21.674812",7]