[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-aks-cluster-setup":3,"mdc--wriccp-key":43,"related-org-azure-aks-cluster-setup":1127,"related-repo-azure-aks-cluster-setup":1307},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":38,"sourceUrl":41,"mdContent":42},"aks-cluster-setup","design and configure Azure Kubernetes Service clusters","Make the AKS-specific design decisions for a new production Azure Kubernetes Service (AKS) cluster — SKU (Automatic vs Standard), pod IP model (Azure CNI Overlay vs kubenet), API-server access, egress, identity, upgrades, node pools, and reliability — then delegate the actual provisioning to the Azure Skills deployment engine. WHEN: create AKS cluster, provision AKS environment, design AKS networking, choose AKS SKU, Day-0 AKS checklist, plan a production AKS cluster. DO NOT USE FOR: debugging a running cluster (use aks-troubleshooting); assessing an existing cluster for AKS Automatic (use aks-automatic-readiness); GPU \u002F model-serving setup (see azure-skills airunway-aks-setup); generic non-AKS Azure resource deployment (use azure-skills azure-deploy directly).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,15,18,21],{"name":11,"slug":8,"type":14},"tag",{"name":16,"slug":17,"type":14},"Architecture","architecture",{"name":19,"slug":20,"type":14},"Deployment","deployment",{"name":22,"slug":23,"type":14},"Kubernetes","kubernetes",3,"https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills","2026-08-23T04:00:29.49469","MIT",1,[30,31,32,8,33,34,35,23,36,37],"agent-skills","ai-agents","aks","claude","devops","github-copilot","mcp","sre-agent",{"repoUrl":25,"stars":24,"forks":28,"topics":39,"description":40},[30,31,32,8,33,34,35,23,36,37],"Agent skills for operating Azure Kubernetes Service (AKS): troubleshooting, cost, AKS Automatic readiness, GPU\u002Finference, packet capture, and cluster design. The deep Day-2 AKS operator — complements the Azure Skills plugin; works with Claude Code, GitHub Copilot, and Azure SRE Agent.","https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills\u002Ftree\u002FHEAD\u002Fskills\u002Faks-cluster-setup","---\nname: aks-cluster-setup\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.0.0\"\ndescription: \"Make the AKS-specific design decisions for a new production Azure Kubernetes Service (AKS) cluster — SKU (Automatic vs Standard), pod IP model (Azure CNI Overlay vs kubenet), API-server access, egress, identity, upgrades, node pools, and reliability — then delegate the actual provisioning to the Azure Skills deployment engine. WHEN: create AKS cluster, provision AKS environment, design AKS networking, choose AKS SKU, Day-0 AKS checklist, plan a production AKS cluster. DO NOT USE FOR: debugging a running cluster (use aks-troubleshooting); assessing an existing cluster for AKS Automatic (use aks-automatic-readiness); GPU \u002F model-serving setup (see azure-skills airunway-aks-setup); generic non-AKS Azure resource deployment (use azure-skills azure-deploy directly).\"\n---\n\n# AKS Cluster Setup\n\nThis skill owns the **AKS-specific design decisions** for standing up a production cluster and then hands the **provisioning execution** to the [Azure Skills](https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills) deployment engine. It distinguishes **Day-0 decisions** (networking, API-server access — hard to change later) from **Day-1 features** (can be enabled post-creation). See [references\u002Fcli-reference.md](references\u002Fcli-reference.md) for the commands.\n\n## How this works with Azure Skills\n\nThis is a **thin facade over provisioning** — it owns the AKS design and delegates the generic provisioning execution to Azure Skills; it does not run `azd` or `az deployment` itself. It enriches the request with AKS-specific design decisions, then delegates the generic provisioning workflow to Azure Skills.\n\n```text\nUser: \"Create a production AKS cluster\"\n  │\n  ▼\naks-cluster-setup (this skill)\n  │  Decides the AKS-specific design:\n  │   - AKS Automatic vs Standard\n  │   - Pod IP model (Azure CNI Overlay vs VNet-routable vs kubenet)\n  │   - API-server access (public \u002F private \u002F authorized ranges)\n  │   - Egress model, identity, node pools, upgrade strategy, zones\n  │\n  ▼\nHands off to Azure Skills (install alongside):\n  ├─ azure-prepare   → analyzes requirements, generates the infra plan\n  ├─ azure-validate  → validates the plan, provisions a preview\n  └─ azure-deploy    → runs azd up \u002F az deployment to create the cluster\n```\n\nInstall **both**: `aks-cluster-setup` for the AKS design brain, Azure Skills as the deployment engine underneath. If Azure Skills is not present, this skill still produces the full design and the exact `az aks create` command in [references\u002Fcli-reference.md](references\u002Fcli-reference.md) so the user can provision manually. This skill never provisions non-AKS resources — for those, use Azure Skills directly.\n\n## Rules\n\n1. Start from the user's requirements for compute, networking, security, and scale.\n2. Inspect the host's available tools for an Azure MCP capability that advertises AKS operations. Use the matching capability under whatever name the host assigned, inspect its advertised schema or discovery surface, and choose the smallest operation that fits. Do not gate on or construct a mapping for a literal tool name. Fall back to `az aks` only when the host exposes no matching capability or its AKS surface lacks the needed operation.\n3. Default to **AKS Automatic** unless the user needs control not supported by Node Auto Provisioning. Standard is for full configurability at higher operational overhead.\n4. Record the rationale for every Day-0 decision (networking, API-server access) — these are expensive or impossible to change after creation.\n\n## Required inputs (ask only what is needed)\n\nIf the user is unsure, use the safe defaults below.\n\n- Environment type: dev\u002Ftest or production\n- Region(s), availability zones, preferred node VM sizes\n- Expected scale (node\u002Fcluster count, workload size)\n- Networking requirements (API-server access, pod IP model, ingress\u002Fegress control)\n- Security and identity requirements, including image registry\n- Upgrade and observability preferences\n- Cost constraints\n\n## Design workflow\n\n### 1. Cluster type\n\n- **AKS Automatic** (default): a curated experience with pre-configured best practices for security, reliability, and performance. Use unless you need custom networking, autoscaling, or node-pool configuration not supported by Node Auto Provisioning (NAP).\n- **AKS Standard**: full control over configuration, at additional setup and management overhead.\n\n### 2. Networking (pod IP, egress, ingress, dataplane)\n\n**Pod IP model** (key Day-0 decision):\n\n- **Azure CNI Overlay** (recommended): pod IPs from a private overlay range, not VNet-routable; scales to large environments and suits most workloads.\n- **Azure CNI (VNet-routable)**: pod IPs directly from the VNet (pod subnet or node subnet); use when pods must be addressable from the VNet or on-premises. Docs: https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Faks\u002Fazure-cni-overlay\n\n**Dataplane & network policy**:\n\n- **Azure CNI powered by Cilium** (recommended): eBPF-based, for high-performance packet processing, network policy, and observability.\n\n**Egress**:\n\n- **Static Egress Gateway** for stable, predictable outbound IPs.\n- For restricted egress: UDR + Azure Firewall or an NVA.\n\n**Ingress**:\n\n- **App Routing add-on with Gateway API** — recommended default for HTTP\u002FHTTPS workloads.\n- **Istio service mesh with Gateway API** — advanced traffic management, mTLS, canary releases.\n- **Application Gateway for Containers** — L7 load balancing with WAF integration.\n\n**DNS**:\n\n- Enable **LocalDNS** on all node pools for reliable, performant resolution.\n\n### 3. Security\n\n- Use **Microsoft Entra ID** everywhere (control plane, Workload Identity for pods, node access). Avoid static credentials.\n- Azure Key Vault via the **Secrets Store CSI Driver** for secrets.\n- Enable **Azure Policy** + **Deployment Safeguards**.\n- Enable **encryption at rest** for etcd\u002FAPI server and **in-transit** for node-to-node.\n- Allow only signed, policy-approved images (Azure Policy + Ratify); prefer **Azure Container Registry**.\n- **Isolation**: namespaces, network policies, scoped logging.\n\n### 4. Observability\n\n- Use **Managed Prometheus** and **Container Insights** with **Grafana** for logs and metrics.\n- Enable **Diagnostic Settings** to collect control-plane and audit logs into a Log Analytics workspace.\n- Complement with Application Insights, Resource Health, and AppLens detectors for troubleshooting.\n\n### 5. Upgrades & patching\n\n- Configure **Maintenance Windows** for controlled upgrade timing.\n- Enable **auto-upgrade** for the control plane and node OS to stay current on security patches and Kubernetes versions.\n- Consider **LTS versions** (2-year support, Premium tier) for enterprise stability.\n- **Fleet upgrades**: use **AKS Fleet Manager** for staged rollout from test to production.\n\n### 6. Performance\n\n- Use **Ephemeral OS disks** (`--node-osdisk-type Ephemeral`) for faster node startup.\n- Select **Azure Linux** as the node OS (smaller footprint, faster boot).\n- Enable **KEDA** for event-driven autoscaling beyond HPA.\n\n### 7. Node pools & compute\n\n- **Dedicated system node pool**: at least 2 nodes, tainted `CriticalAddonsOnly` for system workloads.\n- Enable **Node Auto Provisioning (NAP)** for cost savings and responsive scaling.\n- Use **latest-generation SKUs (v5\u002Fv6)** for host-level optimizations.\n- **Avoid B-series (burstable) VMs** — they cause performance and reliability issues.\n- Use SKUs with **at least 4 vCPUs** for production.\n- Set **topology spread constraints** to distribute pods across hosts\u002Fzones per SLO.\n\n### 8. Reliability\n\n- Deploy across **3 availability zones** (`--zones 1 2 3`).\n- Use the **Standard tier** for a zone-redundant control plane and the 99.95% API-server SLA.\n- Enable **Microsoft Defender for Containers** for runtime protection.\n- Configure **PodDisruptionBudgets** for all production workloads.\n\n### 9. Cost controls\n\n- Use **Spot node pools** for batch\u002Finterruptible workloads (up to 90% savings). For ongoing spend reduction on a running cluster, use `aks-cost-optimization`.\n- **Stop\u002FStart** dev\u002Ftest clusters: `az aks stop` \u002F `az aks start`.\n- Consider **Reserved Instances** or **Savings Plans** for steady-state workloads.\n\n## Guardrails\n\n- Do not request or output secrets (tokens, keys).\n- Do not ask the user to paste subscription IDs. Resolve subscription and resource scope via MCP tools or `az account show` \u002F `az account list`.\n- For ambiguous Day-0 decisions, ask clarifying questions. For Day-1 features, propose 2–3 safe options with trade-offs and choose a conservative default.\n- Do not promise zero downtime; advise workload safeguards (PDBs, probes, replicas) and staged upgrades.\n\n## Error handling\n\n| Error \u002F symptom | Likely cause | Remediation |\n|-----------------|--------------|-------------|\n| MCP tool call fails or times out | Invalid credentials, subscription, or AKS context | Verify `az login`, confirm the active subscription with `az account show`, check the target resource group without echoing identifiers back |\n| Quota exceeded | Regional vCPU or resource limits | Request a quota increase or select a different region \u002F VM SKU |\n| Networking conflict (IP exhaustion) | Pod subnet too small for the CNI\u002Foverlay model | Re-plan IP ranges; may require cluster recreation (Day-0) |\n| Workload Identity not working | Missing OIDC issuer or federated credential | Enable `--enable-oidc-issuer --enable-workload-identity`, configure the federated identity |\n",{"data":44,"body":48},{"name":4,"license":27,"metadata":45,"description":6},{"author":46,"version":47},"Microsoft","1.0.0",{"type":49,"children":50},"root",[51,59,112,119,148,160,193,199,239,245,250,289,295,302,324,330,340,369,379,392,401,419,428,461,470,485,491,575,581,625,631,686,692,737,743,820,826,882,888,951,957,994,1000],{"type":52,"tag":53,"props":54,"children":55},"element","h1",{"id":4},[56],{"type":57,"value":58},"text","AKS Cluster Setup",{"type":52,"tag":60,"props":61,"children":62},"p",{},[63,65,71,73,78,80,89,91,96,98,103,105,110],{"type":57,"value":64},"This skill owns the ",{"type":52,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":57,"value":70},"AKS-specific design decisions",{"type":57,"value":72}," for standing up a production cluster and then hands the ",{"type":52,"tag":66,"props":74,"children":75},{},[76],{"type":57,"value":77},"provisioning execution",{"type":57,"value":79}," to the ",{"type":52,"tag":81,"props":82,"children":86},"a",{"href":83,"rel":84},"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fazure-skills",[85],"nofollow",[87],{"type":57,"value":88},"Azure Skills",{"type":57,"value":90}," deployment engine. It distinguishes ",{"type":52,"tag":66,"props":92,"children":93},{},[94],{"type":57,"value":95},"Day-0 decisions",{"type":57,"value":97}," (networking, API-server access — hard to change later) from ",{"type":52,"tag":66,"props":99,"children":100},{},[101],{"type":57,"value":102},"Day-1 features",{"type":57,"value":104}," (can be enabled post-creation). See ",{"type":52,"tag":81,"props":106,"children":108},{"href":107},"references\u002Fcli-reference.md",[109],{"type":57,"value":107},{"type":57,"value":111}," for the commands.",{"type":52,"tag":113,"props":114,"children":116},"h2",{"id":115},"how-this-works-with-azure-skills",[117],{"type":57,"value":118},"How this works with Azure Skills",{"type":52,"tag":60,"props":120,"children":121},{},[122,124,129,131,138,140,146],{"type":57,"value":123},"This is a ",{"type":52,"tag":66,"props":125,"children":126},{},[127],{"type":57,"value":128},"thin facade over provisioning",{"type":57,"value":130}," — it owns the AKS design and delegates the generic provisioning execution to Azure Skills; it does not run ",{"type":52,"tag":132,"props":133,"children":135},"code",{"className":134},[],[136],{"type":57,"value":137},"azd",{"type":57,"value":139}," or ",{"type":52,"tag":132,"props":141,"children":143},{"className":142},[],[144],{"type":57,"value":145},"az deployment",{"type":57,"value":147}," itself. It enriches the request with AKS-specific design decisions, then delegates the generic provisioning workflow to Azure Skills.",{"type":52,"tag":149,"props":150,"children":155},"pre",{"className":151,"code":153,"language":57,"meta":154},[152],"language-text","User: \"Create a production AKS cluster\"\n  │\n  ▼\naks-cluster-setup (this skill)\n  │  Decides the AKS-specific design:\n  │   - AKS Automatic vs Standard\n  │   - Pod IP model (Azure CNI Overlay vs VNet-routable vs kubenet)\n  │   - API-server access (public \u002F private \u002F authorized ranges)\n  │   - Egress model, identity, node pools, upgrade strategy, zones\n  │\n  ▼\nHands off to Azure Skills (install alongside):\n  ├─ azure-prepare   → analyzes requirements, generates the infra plan\n  ├─ azure-validate  → validates the plan, provisions a preview\n  └─ azure-deploy    → runs azd up \u002F az deployment to create the cluster\n","",[156],{"type":52,"tag":132,"props":157,"children":158},{"__ignoreMap":154},[159],{"type":57,"value":153},{"type":52,"tag":60,"props":161,"children":162},{},[163,165,170,172,177,179,185,187,191],{"type":57,"value":164},"Install ",{"type":52,"tag":66,"props":166,"children":167},{},[168],{"type":57,"value":169},"both",{"type":57,"value":171},": ",{"type":52,"tag":132,"props":173,"children":175},{"className":174},[],[176],{"type":57,"value":4},{"type":57,"value":178}," for the AKS design brain, Azure Skills as the deployment engine underneath. If Azure Skills is not present, this skill still produces the full design and the exact ",{"type":52,"tag":132,"props":180,"children":182},{"className":181},[],[183],{"type":57,"value":184},"az aks create",{"type":57,"value":186}," command in ",{"type":52,"tag":81,"props":188,"children":189},{"href":107},[190],{"type":57,"value":107},{"type":57,"value":192}," so the user can provision manually. This skill never provisions non-AKS resources — for those, use Azure Skills directly.",{"type":52,"tag":113,"props":194,"children":196},{"id":195},"rules",[197],{"type":57,"value":198},"Rules",{"type":52,"tag":200,"props":201,"children":202},"ol",{},[203,209,222,234],{"type":52,"tag":204,"props":205,"children":206},"li",{},[207],{"type":57,"value":208},"Start from the user's requirements for compute, networking, security, and scale.",{"type":52,"tag":204,"props":210,"children":211},{},[212,214,220],{"type":57,"value":213},"Inspect the host's available tools for an Azure MCP capability that advertises AKS operations. Use the matching capability under whatever name the host assigned, inspect its advertised schema or discovery surface, and choose the smallest operation that fits. Do not gate on or construct a mapping for a literal tool name. Fall back to ",{"type":52,"tag":132,"props":215,"children":217},{"className":216},[],[218],{"type":57,"value":219},"az aks",{"type":57,"value":221}," only when the host exposes no matching capability or its AKS surface lacks the needed operation.",{"type":52,"tag":204,"props":223,"children":224},{},[225,227,232],{"type":57,"value":226},"Default to ",{"type":52,"tag":66,"props":228,"children":229},{},[230],{"type":57,"value":231},"AKS Automatic",{"type":57,"value":233}," unless the user needs control not supported by Node Auto Provisioning. Standard is for full configurability at higher operational overhead.",{"type":52,"tag":204,"props":235,"children":236},{},[237],{"type":57,"value":238},"Record the rationale for every Day-0 decision (networking, API-server access) — these are expensive or impossible to change after creation.",{"type":52,"tag":113,"props":240,"children":242},{"id":241},"required-inputs-ask-only-what-is-needed",[243],{"type":57,"value":244},"Required inputs (ask only what is needed)",{"type":52,"tag":60,"props":246,"children":247},{},[248],{"type":57,"value":249},"If the user is unsure, use the safe defaults below.",{"type":52,"tag":251,"props":252,"children":253},"ul",{},[254,259,264,269,274,279,284],{"type":52,"tag":204,"props":255,"children":256},{},[257],{"type":57,"value":258},"Environment type: dev\u002Ftest or production",{"type":52,"tag":204,"props":260,"children":261},{},[262],{"type":57,"value":263},"Region(s), availability zones, preferred node VM sizes",{"type":52,"tag":204,"props":265,"children":266},{},[267],{"type":57,"value":268},"Expected scale (node\u002Fcluster count, workload size)",{"type":52,"tag":204,"props":270,"children":271},{},[272],{"type":57,"value":273},"Networking requirements (API-server access, pod IP model, ingress\u002Fegress control)",{"type":52,"tag":204,"props":275,"children":276},{},[277],{"type":57,"value":278},"Security and identity requirements, including image registry",{"type":52,"tag":204,"props":280,"children":281},{},[282],{"type":57,"value":283},"Upgrade and observability preferences",{"type":52,"tag":204,"props":285,"children":286},{},[287],{"type":57,"value":288},"Cost constraints",{"type":52,"tag":113,"props":290,"children":292},{"id":291},"design-workflow",[293],{"type":57,"value":294},"Design workflow",{"type":52,"tag":296,"props":297,"children":299},"h3",{"id":298},"_1-cluster-type",[300],{"type":57,"value":301},"1. Cluster type",{"type":52,"tag":251,"props":303,"children":304},{},[305,314],{"type":52,"tag":204,"props":306,"children":307},{},[308,312],{"type":52,"tag":66,"props":309,"children":310},{},[311],{"type":57,"value":231},{"type":57,"value":313}," (default): a curated experience with pre-configured best practices for security, reliability, and performance. Use unless you need custom networking, autoscaling, or node-pool configuration not supported by Node Auto Provisioning (NAP).",{"type":52,"tag":204,"props":315,"children":316},{},[317,322],{"type":52,"tag":66,"props":318,"children":319},{},[320],{"type":57,"value":321},"AKS Standard",{"type":57,"value":323},": full control over configuration, at additional setup and management overhead.",{"type":52,"tag":296,"props":325,"children":327},{"id":326},"_2-networking-pod-ip-egress-ingress-dataplane",[328],{"type":57,"value":329},"2. Networking (pod IP, egress, ingress, dataplane)",{"type":52,"tag":60,"props":331,"children":332},{},[333,338],{"type":52,"tag":66,"props":334,"children":335},{},[336],{"type":57,"value":337},"Pod IP model",{"type":57,"value":339}," (key Day-0 decision):",{"type":52,"tag":251,"props":341,"children":342},{},[343,353],{"type":52,"tag":204,"props":344,"children":345},{},[346,351],{"type":52,"tag":66,"props":347,"children":348},{},[349],{"type":57,"value":350},"Azure CNI Overlay",{"type":57,"value":352}," (recommended): pod IPs from a private overlay range, not VNet-routable; scales to large environments and suits most workloads.",{"type":52,"tag":204,"props":354,"children":355},{},[356,361,363],{"type":52,"tag":66,"props":357,"children":358},{},[359],{"type":57,"value":360},"Azure CNI (VNet-routable)",{"type":57,"value":362},": pod IPs directly from the VNet (pod subnet or node subnet); use when pods must be addressable from the VNet or on-premises. Docs: ",{"type":52,"tag":81,"props":364,"children":367},{"href":365,"rel":366},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Faks\u002Fazure-cni-overlay",[85],[368],{"type":57,"value":365},{"type":52,"tag":60,"props":370,"children":371},{},[372,377],{"type":52,"tag":66,"props":373,"children":374},{},[375],{"type":57,"value":376},"Dataplane & network policy",{"type":57,"value":378},":",{"type":52,"tag":251,"props":380,"children":381},{},[382],{"type":52,"tag":204,"props":383,"children":384},{},[385,390],{"type":52,"tag":66,"props":386,"children":387},{},[388],{"type":57,"value":389},"Azure CNI powered by Cilium",{"type":57,"value":391}," (recommended): eBPF-based, for high-performance packet processing, network policy, and observability.",{"type":52,"tag":60,"props":393,"children":394},{},[395,400],{"type":52,"tag":66,"props":396,"children":397},{},[398],{"type":57,"value":399},"Egress",{"type":57,"value":378},{"type":52,"tag":251,"props":402,"children":403},{},[404,414],{"type":52,"tag":204,"props":405,"children":406},{},[407,412],{"type":52,"tag":66,"props":408,"children":409},{},[410],{"type":57,"value":411},"Static Egress Gateway",{"type":57,"value":413}," for stable, predictable outbound IPs.",{"type":52,"tag":204,"props":415,"children":416},{},[417],{"type":57,"value":418},"For restricted egress: UDR + Azure Firewall or an NVA.",{"type":52,"tag":60,"props":420,"children":421},{},[422,427],{"type":52,"tag":66,"props":423,"children":424},{},[425],{"type":57,"value":426},"Ingress",{"type":57,"value":378},{"type":52,"tag":251,"props":429,"children":430},{},[431,441,451],{"type":52,"tag":204,"props":432,"children":433},{},[434,439],{"type":52,"tag":66,"props":435,"children":436},{},[437],{"type":57,"value":438},"App Routing add-on with Gateway API",{"type":57,"value":440}," — recommended default for HTTP\u002FHTTPS workloads.",{"type":52,"tag":204,"props":442,"children":443},{},[444,449],{"type":52,"tag":66,"props":445,"children":446},{},[447],{"type":57,"value":448},"Istio service mesh with Gateway API",{"type":57,"value":450}," — advanced traffic management, mTLS, canary releases.",{"type":52,"tag":204,"props":452,"children":453},{},[454,459],{"type":52,"tag":66,"props":455,"children":456},{},[457],{"type":57,"value":458},"Application Gateway for Containers",{"type":57,"value":460}," — L7 load balancing with WAF integration.",{"type":52,"tag":60,"props":462,"children":463},{},[464,469],{"type":52,"tag":66,"props":465,"children":466},{},[467],{"type":57,"value":468},"DNS",{"type":57,"value":378},{"type":52,"tag":251,"props":471,"children":472},{},[473],{"type":52,"tag":204,"props":474,"children":475},{},[476,478,483],{"type":57,"value":477},"Enable ",{"type":52,"tag":66,"props":479,"children":480},{},[481],{"type":57,"value":482},"LocalDNS",{"type":57,"value":484}," on all node pools for reliable, performant resolution.",{"type":52,"tag":296,"props":486,"children":488},{"id":487},"_3-security",[489],{"type":57,"value":490},"3. Security",{"type":52,"tag":251,"props":492,"children":493},{},[494,506,518,536,554,565],{"type":52,"tag":204,"props":495,"children":496},{},[497,499,504],{"type":57,"value":498},"Use ",{"type":52,"tag":66,"props":500,"children":501},{},[502],{"type":57,"value":503},"Microsoft Entra ID",{"type":57,"value":505}," everywhere (control plane, Workload Identity for pods, node access). Avoid static credentials.",{"type":52,"tag":204,"props":507,"children":508},{},[509,511,516],{"type":57,"value":510},"Azure Key Vault via the ",{"type":52,"tag":66,"props":512,"children":513},{},[514],{"type":57,"value":515},"Secrets Store CSI Driver",{"type":57,"value":517}," for secrets.",{"type":52,"tag":204,"props":519,"children":520},{},[521,522,527,529,534],{"type":57,"value":477},{"type":52,"tag":66,"props":523,"children":524},{},[525],{"type":57,"value":526},"Azure Policy",{"type":57,"value":528}," + ",{"type":52,"tag":66,"props":530,"children":531},{},[532],{"type":57,"value":533},"Deployment Safeguards",{"type":57,"value":535},".",{"type":52,"tag":204,"props":537,"children":538},{},[539,540,545,547,552],{"type":57,"value":477},{"type":52,"tag":66,"props":541,"children":542},{},[543],{"type":57,"value":544},"encryption at rest",{"type":57,"value":546}," for etcd\u002FAPI server and ",{"type":52,"tag":66,"props":548,"children":549},{},[550],{"type":57,"value":551},"in-transit",{"type":57,"value":553}," for node-to-node.",{"type":52,"tag":204,"props":555,"children":556},{},[557,559,564],{"type":57,"value":558},"Allow only signed, policy-approved images (Azure Policy + Ratify); prefer ",{"type":52,"tag":66,"props":560,"children":561},{},[562],{"type":57,"value":563},"Azure Container Registry",{"type":57,"value":535},{"type":52,"tag":204,"props":566,"children":567},{},[568,573],{"type":52,"tag":66,"props":569,"children":570},{},[571],{"type":57,"value":572},"Isolation",{"type":57,"value":574},": namespaces, network policies, scoped logging.",{"type":52,"tag":296,"props":576,"children":578},{"id":577},"_4-observability",[579],{"type":57,"value":580},"4. Observability",{"type":52,"tag":251,"props":582,"children":583},{},[584,609,620],{"type":52,"tag":204,"props":585,"children":586},{},[587,588,593,595,600,602,607],{"type":57,"value":498},{"type":52,"tag":66,"props":589,"children":590},{},[591],{"type":57,"value":592},"Managed Prometheus",{"type":57,"value":594}," and ",{"type":52,"tag":66,"props":596,"children":597},{},[598],{"type":57,"value":599},"Container Insights",{"type":57,"value":601}," with ",{"type":52,"tag":66,"props":603,"children":604},{},[605],{"type":57,"value":606},"Grafana",{"type":57,"value":608}," for logs and metrics.",{"type":52,"tag":204,"props":610,"children":611},{},[612,613,618],{"type":57,"value":477},{"type":52,"tag":66,"props":614,"children":615},{},[616],{"type":57,"value":617},"Diagnostic Settings",{"type":57,"value":619}," to collect control-plane and audit logs into a Log Analytics workspace.",{"type":52,"tag":204,"props":621,"children":622},{},[623],{"type":57,"value":624},"Complement with Application Insights, Resource Health, and AppLens detectors for troubleshooting.",{"type":52,"tag":296,"props":626,"children":628},{"id":627},"_5-upgrades-patching",[629],{"type":57,"value":630},"5. Upgrades & patching",{"type":52,"tag":251,"props":632,"children":633},{},[634,646,657,669],{"type":52,"tag":204,"props":635,"children":636},{},[637,639,644],{"type":57,"value":638},"Configure ",{"type":52,"tag":66,"props":640,"children":641},{},[642],{"type":57,"value":643},"Maintenance Windows",{"type":57,"value":645}," for controlled upgrade timing.",{"type":52,"tag":204,"props":647,"children":648},{},[649,650,655],{"type":57,"value":477},{"type":52,"tag":66,"props":651,"children":652},{},[653],{"type":57,"value":654},"auto-upgrade",{"type":57,"value":656}," for the control plane and node OS to stay current on security patches and Kubernetes versions.",{"type":52,"tag":204,"props":658,"children":659},{},[660,662,667],{"type":57,"value":661},"Consider ",{"type":52,"tag":66,"props":663,"children":664},{},[665],{"type":57,"value":666},"LTS versions",{"type":57,"value":668}," (2-year support, Premium tier) for enterprise stability.",{"type":52,"tag":204,"props":670,"children":671},{},[672,677,679,684],{"type":52,"tag":66,"props":673,"children":674},{},[675],{"type":57,"value":676},"Fleet upgrades",{"type":57,"value":678},": use ",{"type":52,"tag":66,"props":680,"children":681},{},[682],{"type":57,"value":683},"AKS Fleet Manager",{"type":57,"value":685}," for staged rollout from test to production.",{"type":52,"tag":296,"props":687,"children":689},{"id":688},"_6-performance",[690],{"type":57,"value":691},"6. Performance",{"type":52,"tag":251,"props":693,"children":694},{},[695,714,726],{"type":52,"tag":204,"props":696,"children":697},{},[698,699,704,706,712],{"type":57,"value":498},{"type":52,"tag":66,"props":700,"children":701},{},[702],{"type":57,"value":703},"Ephemeral OS disks",{"type":57,"value":705}," (",{"type":52,"tag":132,"props":707,"children":709},{"className":708},[],[710],{"type":57,"value":711},"--node-osdisk-type Ephemeral",{"type":57,"value":713},") for faster node startup.",{"type":52,"tag":204,"props":715,"children":716},{},[717,719,724],{"type":57,"value":718},"Select ",{"type":52,"tag":66,"props":720,"children":721},{},[722],{"type":57,"value":723},"Azure Linux",{"type":57,"value":725}," as the node OS (smaller footprint, faster boot).",{"type":52,"tag":204,"props":727,"children":728},{},[729,730,735],{"type":57,"value":477},{"type":52,"tag":66,"props":731,"children":732},{},[733],{"type":57,"value":734},"KEDA",{"type":57,"value":736}," for event-driven autoscaling beyond HPA.",{"type":52,"tag":296,"props":738,"children":740},{"id":739},"_7-node-pools-compute",[741],{"type":57,"value":742},"7. Node pools & compute",{"type":52,"tag":251,"props":744,"children":745},{},[746,764,775,786,796,808],{"type":52,"tag":204,"props":747,"children":748},{},[749,754,756,762],{"type":52,"tag":66,"props":750,"children":751},{},[752],{"type":57,"value":753},"Dedicated system node pool",{"type":57,"value":755},": at least 2 nodes, tainted ",{"type":52,"tag":132,"props":757,"children":759},{"className":758},[],[760],{"type":57,"value":761},"CriticalAddonsOnly",{"type":57,"value":763}," for system workloads.",{"type":52,"tag":204,"props":765,"children":766},{},[767,768,773],{"type":57,"value":477},{"type":52,"tag":66,"props":769,"children":770},{},[771],{"type":57,"value":772},"Node Auto Provisioning (NAP)",{"type":57,"value":774}," for cost savings and responsive scaling.",{"type":52,"tag":204,"props":776,"children":777},{},[778,779,784],{"type":57,"value":498},{"type":52,"tag":66,"props":780,"children":781},{},[782],{"type":57,"value":783},"latest-generation SKUs (v5\u002Fv6)",{"type":57,"value":785}," for host-level optimizations.",{"type":52,"tag":204,"props":787,"children":788},{},[789,794],{"type":52,"tag":66,"props":790,"children":791},{},[792],{"type":57,"value":793},"Avoid B-series (burstable) VMs",{"type":57,"value":795}," — they cause performance and reliability issues.",{"type":52,"tag":204,"props":797,"children":798},{},[799,801,806],{"type":57,"value":800},"Use SKUs with ",{"type":52,"tag":66,"props":802,"children":803},{},[804],{"type":57,"value":805},"at least 4 vCPUs",{"type":57,"value":807}," for production.",{"type":52,"tag":204,"props":809,"children":810},{},[811,813,818],{"type":57,"value":812},"Set ",{"type":52,"tag":66,"props":814,"children":815},{},[816],{"type":57,"value":817},"topology spread constraints",{"type":57,"value":819}," to distribute pods across hosts\u002Fzones per SLO.",{"type":52,"tag":296,"props":821,"children":823},{"id":822},"_8-reliability",[824],{"type":57,"value":825},"8. Reliability",{"type":52,"tag":251,"props":827,"children":828},{},[829,848,860,871],{"type":52,"tag":204,"props":830,"children":831},{},[832,834,839,840,846],{"type":57,"value":833},"Deploy across ",{"type":52,"tag":66,"props":835,"children":836},{},[837],{"type":57,"value":838},"3 availability zones",{"type":57,"value":705},{"type":52,"tag":132,"props":841,"children":843},{"className":842},[],[844],{"type":57,"value":845},"--zones 1 2 3",{"type":57,"value":847},").",{"type":52,"tag":204,"props":849,"children":850},{},[851,853,858],{"type":57,"value":852},"Use the ",{"type":52,"tag":66,"props":854,"children":855},{},[856],{"type":57,"value":857},"Standard tier",{"type":57,"value":859}," for a zone-redundant control plane and the 99.95% API-server SLA.",{"type":52,"tag":204,"props":861,"children":862},{},[863,864,869],{"type":57,"value":477},{"type":52,"tag":66,"props":865,"children":866},{},[867],{"type":57,"value":868},"Microsoft Defender for Containers",{"type":57,"value":870}," for runtime protection.",{"type":52,"tag":204,"props":872,"children":873},{},[874,875,880],{"type":57,"value":638},{"type":52,"tag":66,"props":876,"children":877},{},[878],{"type":57,"value":879},"PodDisruptionBudgets",{"type":57,"value":881}," for all production workloads.",{"type":52,"tag":296,"props":883,"children":885},{"id":884},"_9-cost-controls",[886],{"type":57,"value":887},"9. Cost controls",{"type":52,"tag":251,"props":889,"children":890},{},[891,909,934],{"type":52,"tag":204,"props":892,"children":893},{},[894,895,900,902,908],{"type":57,"value":498},{"type":52,"tag":66,"props":896,"children":897},{},[898],{"type":57,"value":899},"Spot node pools",{"type":57,"value":901}," for batch\u002Finterruptible workloads (up to 90% savings). For ongoing spend reduction on a running cluster, use ",{"type":52,"tag":132,"props":903,"children":905},{"className":904},[],[906],{"type":57,"value":907},"aks-cost-optimization",{"type":57,"value":535},{"type":52,"tag":204,"props":910,"children":911},{},[912,917,919,925,927,933],{"type":52,"tag":66,"props":913,"children":914},{},[915],{"type":57,"value":916},"Stop\u002FStart",{"type":57,"value":918}," dev\u002Ftest clusters: ",{"type":52,"tag":132,"props":920,"children":922},{"className":921},[],[923],{"type":57,"value":924},"az aks stop",{"type":57,"value":926}," \u002F ",{"type":52,"tag":132,"props":928,"children":930},{"className":929},[],[931],{"type":57,"value":932},"az aks start",{"type":57,"value":535},{"type":52,"tag":204,"props":935,"children":936},{},[937,938,943,944,949],{"type":57,"value":661},{"type":52,"tag":66,"props":939,"children":940},{},[941],{"type":57,"value":942},"Reserved Instances",{"type":57,"value":139},{"type":52,"tag":66,"props":945,"children":946},{},[947],{"type":57,"value":948},"Savings Plans",{"type":57,"value":950}," for steady-state workloads.",{"type":52,"tag":113,"props":952,"children":954},{"id":953},"guardrails",[955],{"type":57,"value":956},"Guardrails",{"type":52,"tag":251,"props":958,"children":959},{},[960,965,984,989],{"type":52,"tag":204,"props":961,"children":962},{},[963],{"type":57,"value":964},"Do not request or output secrets (tokens, keys).",{"type":52,"tag":204,"props":966,"children":967},{},[968,970,976,977,983],{"type":57,"value":969},"Do not ask the user to paste subscription IDs. Resolve subscription and resource scope via MCP tools or ",{"type":52,"tag":132,"props":971,"children":973},{"className":972},[],[974],{"type":57,"value":975},"az account show",{"type":57,"value":926},{"type":52,"tag":132,"props":978,"children":980},{"className":979},[],[981],{"type":57,"value":982},"az account list",{"type":57,"value":535},{"type":52,"tag":204,"props":985,"children":986},{},[987],{"type":57,"value":988},"For ambiguous Day-0 decisions, ask clarifying questions. For Day-1 features, propose 2–3 safe options with trade-offs and choose a conservative default.",{"type":52,"tag":204,"props":990,"children":991},{},[992],{"type":57,"value":993},"Do not promise zero downtime; advise workload safeguards (PDBs, probes, replicas) and staged upgrades.",{"type":52,"tag":113,"props":995,"children":997},{"id":996},"error-handling",[998],{"type":57,"value":999},"Error handling",{"type":52,"tag":1001,"props":1002,"children":1003},"table",{},[1004,1028],{"type":52,"tag":1005,"props":1006,"children":1007},"thead",{},[1008],{"type":52,"tag":1009,"props":1010,"children":1011},"tr",{},[1012,1018,1023],{"type":52,"tag":1013,"props":1014,"children":1015},"th",{},[1016],{"type":57,"value":1017},"Error \u002F symptom",{"type":52,"tag":1013,"props":1019,"children":1020},{},[1021],{"type":57,"value":1022},"Likely cause",{"type":52,"tag":1013,"props":1024,"children":1025},{},[1026],{"type":57,"value":1027},"Remediation",{"type":52,"tag":1029,"props":1030,"children":1031},"tbody",{},[1032,1066,1084,1102],{"type":52,"tag":1009,"props":1033,"children":1034},{},[1035,1041,1046],{"type":52,"tag":1036,"props":1037,"children":1038},"td",{},[1039],{"type":57,"value":1040},"MCP tool call fails or times out",{"type":52,"tag":1036,"props":1042,"children":1043},{},[1044],{"type":57,"value":1045},"Invalid credentials, subscription, or AKS context",{"type":52,"tag":1036,"props":1047,"children":1048},{},[1049,1051,1057,1059,1064],{"type":57,"value":1050},"Verify ",{"type":52,"tag":132,"props":1052,"children":1054},{"className":1053},[],[1055],{"type":57,"value":1056},"az login",{"type":57,"value":1058},", confirm the active subscription with ",{"type":52,"tag":132,"props":1060,"children":1062},{"className":1061},[],[1063],{"type":57,"value":975},{"type":57,"value":1065},", check the target resource group without echoing identifiers back",{"type":52,"tag":1009,"props":1067,"children":1068},{},[1069,1074,1079],{"type":52,"tag":1036,"props":1070,"children":1071},{},[1072],{"type":57,"value":1073},"Quota exceeded",{"type":52,"tag":1036,"props":1075,"children":1076},{},[1077],{"type":57,"value":1078},"Regional vCPU or resource limits",{"type":52,"tag":1036,"props":1080,"children":1081},{},[1082],{"type":57,"value":1083},"Request a quota increase or select a different region \u002F VM SKU",{"type":52,"tag":1009,"props":1085,"children":1086},{},[1087,1092,1097],{"type":52,"tag":1036,"props":1088,"children":1089},{},[1090],{"type":57,"value":1091},"Networking conflict (IP exhaustion)",{"type":52,"tag":1036,"props":1093,"children":1094},{},[1095],{"type":57,"value":1096},"Pod subnet too small for the CNI\u002Foverlay model",{"type":52,"tag":1036,"props":1098,"children":1099},{},[1100],{"type":57,"value":1101},"Re-plan IP ranges; may require cluster recreation (Day-0)",{"type":52,"tag":1009,"props":1103,"children":1104},{},[1105,1110,1115],{"type":52,"tag":1036,"props":1106,"children":1107},{},[1108],{"type":57,"value":1109},"Workload Identity not working",{"type":52,"tag":1036,"props":1111,"children":1112},{},[1113],{"type":57,"value":1114},"Missing OIDC issuer or federated credential",{"type":52,"tag":1036,"props":1116,"children":1117},{},[1118,1119,1125],{"type":57,"value":477},{"type":52,"tag":132,"props":1120,"children":1122},{"className":1121},[],[1123],{"type":57,"value":1124},"--enable-oidc-issuer --enable-workload-identity",{"type":57,"value":1126},", configure the federated identity",{"items":1128,"total":1306},[1129,1148,1165,1184,1199,1214,1227,1242,1253,1267,1280,1292],{"slug":1130,"name":1130,"fn":1131,"description":1132,"org":1133,"tags":1134,"stars":1145,"repoUrl":1146,"updatedAt":1147},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1135,1136,1139,1142],{"name":11,"slug":8,"type":14},{"name":1137,"slug":1138,"type":14},"Compliance","compliance",{"name":1140,"slug":1141,"type":14},"Governance","governance",{"name":1143,"slug":1144,"type":14},"Policy","policy",1689,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":1149,"name":1149,"fn":1150,"description":1151,"org":1152,"tags":1153,"stars":1162,"repoUrl":1163,"updatedAt":1164},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1154,1155,1156,1159],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":1157,"slug":1158,"type":14},"Infrastructure as Code","infrastructure-as-code",{"name":1160,"slug":1161,"type":14},"Migration","migration",261,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-08-20T03:28:18.136156",{"slug":1166,"name":1166,"fn":1167,"description":1168,"org":1169,"tags":1170,"stars":1181,"repoUrl":1182,"updatedAt":1183},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1171,1174,1175,1178],{"name":1172,"slug":1173,"type":14},"API Development","api-development",{"name":11,"slug":8,"type":14},{"name":1176,"slug":1177,"type":14},"Code Review","code-review",{"name":1179,"slug":1180,"type":14},"Documentation","documentation",136,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":1185,"name":1185,"fn":1186,"description":1187,"org":1188,"tags":1189,"stars":1181,"repoUrl":1182,"updatedAt":1198},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1190,1191,1192,1195],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":1193,"slug":1194,"type":14},"SDK","sdk",{"name":1196,"slug":1197,"type":14},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":1200,"name":1200,"fn":1201,"description":1202,"org":1203,"tags":1204,"stars":1181,"repoUrl":1182,"updatedAt":1213},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1205,1206,1209,1212],{"name":11,"slug":8,"type":14},{"name":1207,"slug":1208,"type":14},"GitHub","github",{"name":1210,"slug":1211,"type":14},"Project Management","project-management",{"name":1193,"slug":1194,"type":14},"2026-07-12T08:17:38.345387",{"slug":1215,"name":1215,"fn":1216,"description":1217,"org":1218,"tags":1219,"stars":1181,"repoUrl":1182,"updatedAt":1226},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1220,1221,1224,1225],{"name":11,"slug":8,"type":14},{"name":1222,"slug":1223,"type":14},"CI\u002FCD","ci-cd",{"name":19,"slug":20,"type":14},{"name":1193,"slug":1194,"type":14},"2026-07-12T08:17:34.27607",{"slug":1228,"name":1228,"fn":1229,"description":1230,"org":1231,"tags":1232,"stars":1181,"repoUrl":1182,"updatedAt":1241},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1233,1234,1235,1238],{"name":1172,"slug":1173,"type":14},{"name":11,"slug":8,"type":14},{"name":1236,"slug":1237,"type":14},"OpenAPI","openapi",{"name":1239,"slug":1240,"type":14},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":1243,"name":1243,"fn":1244,"description":1245,"org":1246,"tags":1247,"stars":1181,"repoUrl":1182,"updatedAt":1252},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1248,1249,1250,1251],{"name":11,"slug":8,"type":14},{"name":1222,"slug":1223,"type":14},{"name":1193,"slug":1194,"type":14},{"name":1196,"slug":1197,"type":14},"2026-07-12T08:17:37.08523",{"slug":1254,"name":1254,"fn":1255,"description":1256,"org":1257,"tags":1258,"stars":1181,"repoUrl":1182,"updatedAt":1266},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1259,1262,1265],{"name":1260,"slug":1261,"type":14},"LLM","llm",{"name":1263,"slug":1264,"type":14},"Performance","performance",{"name":1239,"slug":1240,"type":14},"2026-07-12T08:17:42.080413",{"slug":1268,"name":1268,"fn":1269,"description":1270,"org":1271,"tags":1272,"stars":1181,"repoUrl":1182,"updatedAt":1279},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1273,1274,1275,1278],{"name":11,"slug":8,"type":14},{"name":1222,"slug":1223,"type":14},{"name":1276,"slug":1277,"type":14},"Debugging","debugging",{"name":1193,"slug":1194,"type":14},"2026-07-12T08:17:40.821512",{"slug":1281,"name":1281,"fn":1282,"description":1283,"org":1284,"tags":1285,"stars":1181,"repoUrl":1182,"updatedAt":1291},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1286,1287,1290],{"name":1179,"slug":1180,"type":14},{"name":1288,"slug":1289,"type":14},"Plugin Development","plugin-development",{"name":1239,"slug":1240,"type":14},"2026-08-07T04:39:22.66861",{"slug":1293,"name":1293,"fn":1294,"description":1295,"org":1296,"tags":1297,"stars":1303,"repoUrl":1304,"updatedAt":1305},"kickstart-acr-integration","integrate Azure Container Registry with AKS","ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1298,1299,1302],{"name":11,"slug":8,"type":14},{"name":1300,"slug":1301,"type":14},"Containers","containers",{"name":19,"slug":20,"type":14},65,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools","2026-07-12T08:18:05.091337",124,{"items":1308,"total":1401},[1309,1322,1329,1341,1359,1372,1387],{"slug":1310,"name":1310,"fn":1311,"description":1312,"org":1313,"tags":1314,"stars":24,"repoUrl":25,"updatedAt":1321},"aks-automatic-readiness","migrate Kubernetes workloads to AKS Automatic","Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic. DO NOT USE FOR: creating a brand-new cluster (use aks-cluster-setup); debugging a running cluster (use aks-troubleshooting).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1315,1316,1317,1318],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":1160,"slug":1161,"type":14},{"name":1319,"slug":1320,"type":14},"Modernization","modernization","2026-08-23T04:00:30.817435",{"slug":4,"name":4,"fn":5,"description":6,"org":1323,"tags":1324,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1325,1326,1327,1328],{"name":16,"slug":17,"type":14},{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":22,"slug":23,"type":14},{"slug":907,"name":907,"fn":1330,"description":1331,"org":1332,"tags":1333,"stars":24,"repoUrl":25,"updatedAt":1340},"optimize Azure Kubernetes Service cluster costs","Reduce Azure Kubernetes Service (AKS) spending: pod rightsizing, VPA-driven recommendations, cluster-autoscaler tuning, spot node pools, namespace-level cost visibility, and cost-anomaly detection. WHEN: rightsize pods, VPA recommendations, idle nodes, scale-down, autoscaler profile, spot nodes, cheaper compute, cost add-on, namespace cost breakdown, spending anomaly, 'my AKS bill is too high', 'is my app consuming what it requests', resource requests vs actual usage, over-provisioned workloads, spot vs on-demand, per-namespace or per-team cost allocation, 'who's spending what and why'. DO NOT USE FOR: GPU \u002F inference cost and idle GPU pools (use aks-gpu-inference); autoscaler that is failing to scale up during an incident (use aks-troubleshooting); choosing SKUs at cluster-creation time (use aks-cluster-setup).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1334,1335,1338,1339],{"name":11,"slug":8,"type":14},{"name":1336,"slug":1337,"type":14},"Cost Optimization","cost-optimization",{"name":22,"slug":23,"type":14},{"name":1263,"slug":1264,"type":14},"2026-08-23T04:00:29.864048",{"slug":1342,"name":1342,"fn":1343,"description":1344,"org":1345,"tags":1346,"stars":24,"repoUrl":25,"updatedAt":1358},"aks-gpu-inference","manage GPU inference workloads on AKS","Day-2 operations for GPU and model-inference workloads on Azure Kubernetes Service (AKS): diagnose GPU pods stuck Pending, missing nvidia.com\u002Fgpu, CUDA\u002Fdriver mismatches, model OOM on weight load, GPU vCPU-quota failures, KAITO (AI toolchain operator) Workspaces stuck not-ready, and GPU cost \u002F scale-to-zero \u002F spot eviction. WHEN: GPU pod Pending 'Insufficient nvidia.com\u002Fgpu', no nvidia.com\u002Fgpu on node, CUDA driver version insufficient, model OOMKilled loading weights, GPU node pool quota exceeded, KAITO Workspace never becomes ready, idle GPU cost, autoscale GPU on DCGM, spot GPU eviction, right-size a GPU SKU for a model. DO NOT USE FOR: initial GPU\u002FAI setup or enablement (use azure-skills airunway-aks-setup); non-GPU pod\u002Fnode\u002Fnetwork incidents (use aks-troubleshooting); non-GPU cost (use aks-cost-optimization).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1347,1348,1351,1354,1355],{"name":11,"slug":8,"type":14},{"name":1349,"slug":1350,"type":14},"CUDA","cuda",{"name":1352,"slug":1353,"type":14},"GPU","gpu",{"name":22,"slug":23,"type":14},{"name":1356,"slug":1357,"type":14},"Operations","operations","2026-08-23T04:00:03.060719",{"slug":1360,"name":1360,"fn":1361,"description":1362,"org":1363,"tags":1364,"stars":24,"repoUrl":25,"updatedAt":1371},"aks-known-issues","diagnose AKS failures using known issue tables","Match an AKS operation failure against a curated, versioned table of documented known issues and error codes — each entry carrying the cause and the Microsoft-documented fix, workaround, or platform limitation. Deterministic error-string → diagnosis lookup for specific, named failures: AKS VM-extension \u002F CSE provisioning errors with a documented nested signature (VMExtensionError_OutboundConnFail \u002F exit 50, VMExtensionError_K8SAPIServerConnFail \u002F exit 51, VMExtensionError_K8SAPIServerDNSLookupFail \u002F exit 52, OrasPullUnauthorizedVMExtensionError \u002F exit 212), SKU and allocation errors (SkuNotAvailable, ZonalAllocationFailed, OverconstrainedAllocationRequest, message-qualified AllocationFailed), VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, node-image \u002F snapshot 'NodeImageVersion is not accepted', and network-isolated-cluster ACR pull failures. ALLOCATION ROUTING: the full messages 'AllocationFailed: The VM allocation failed due to an internal error. Please retry later or try deploying to a different location' and 'AllocationFailed: We do not have sufficient capacity for the requested VM size' are cataloged signatures owned by this skill; they are not bare errors. A prompt that reports only the AllocationFailed code and explicitly has no nested Azure message is not a catalog match — route that bare-code investigation to aks-troubleshooting. WHEN: an AKS create \u002F scale \u002F upgrade \u002F image-pull fails with one of the cataloged signatures; 'what does \u003Cerror> mean on AKS?'; 'is \u003Cerror> a known issue?'; an AKS vmssCSE \u002F VM-extension exit code; or a message-qualified AKS SKU \u002F allocation error. DO NOT USE FOR: a bare VMExtensionProvisioningError wrapper; an unclassified SKU \u002F capacity allocation incident; a numeric exit code without AKS CSE context; a natural-language 'allocation failed' symptom without the Azure error; non-AKS resources; or open-ended incidents with no cataloged signature — pod crashes, NotReady, DNS, ingress, or timeouts (use aks-troubleshooting for AKS incidents). Read-only: it explains and cites the documented fix, and never applies changes without explicit approval.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1365,1366,1367,1370],{"name":11,"slug":8,"type":14},{"name":1276,"slug":1277,"type":14},{"name":1368,"slug":1369,"type":14},"Diagnostics","diagnostics",{"name":22,"slug":23,"type":14},"2026-08-23T04:00:30.216663",{"slug":1373,"name":1373,"fn":1374,"description":1375,"org":1376,"tags":1377,"stars":24,"repoUrl":25,"updatedAt":1386},"aks-network-capture","capture network traffic in AKS clusters","Packet-level network evidence for AKS: run a bounded, distributed packet capture across nodes (filtered by IP, port, or tcpdump\u002FBPF expression), and collect Azure network resources (NSG rules, route tables, firewall, VNET peering) when you need pcap-level proof of where traffic drops. Escalation tool for when logs and read-only checks are inconclusive. WHEN: capture packets on a node, take a pcap, tcpdump on AKS, prove where a packet is dropped, verify an NSG or route is blocking traffic at the wire. DO NOT USE FOR: general DNS \u002F connectivity \u002F ingress troubleshooting — start with aks-troubleshooting (which routes here when a capture is actually needed).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1378,1379,1380,1383],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":1381,"slug":1382,"type":14},"Networking","networking",{"name":1384,"slug":1385,"type":14},"Observability","observability","2026-08-23T04:00:31.384775",{"slug":1388,"name":1388,"fn":1389,"description":1390,"org":1391,"tags":1392,"stars":24,"repoUrl":25,"updatedAt":1400},"aks-troubleshooting","debug and troubleshoot Azure Kubernetes Service incidents","Debug and root-cause live Azure Kubernetes Service (AKS) cluster incidents: pod crashes, node failures, DNS\u002Fnetworking, ingress\u002Fload-balancer errors, network policy, upgrade failures, and spot\u002Fzone disruptions. Runs a read-only, evidence-first investigation using the AKS MCP tools, az, and kubectl, and produces a structured incident report. WHEN: CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, pod Pending, DNS resolution failure, 502\u002F503 from ingress, connectivity timeout, upgrade stuck, cordon\u002Fdrain failure, spot eviction, SNAT exhaustion, expired certificate, 'investigate my AKS cluster'. DO NOT USE FOR: packet-level capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); creating or provisioning a cluster (use aks-cluster-setup); cost\u002Frightsizing (use aks-cost-optimization); a named, documented AKS error code or message with a known signature — e.g. VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, a vmssCSE exit code (use aks-known-issues).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1393,1394,1395,1398,1399],{"name":11,"slug":8,"type":14},{"name":1276,"slug":1277,"type":14},{"name":1396,"slug":1397,"type":14},"Incident Response","incident-response",{"name":22,"slug":23,"type":14},{"name":1381,"slug":1382,"type":14},"2026-08-23T04:00:21.674812",7]