[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-aks-known-issues":3,"mdc-dd3067-key":43,"related-org-azure-aks-known-issues":1093,"related-repo-azure-aks-known-issues":1273},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":38,"sourceUrl":41,"mdContent":42},"aks-known-issues","diagnose AKS failures using known issue tables","Match an AKS operation failure against a curated, versioned table of documented known issues and error codes — each entry carrying the cause and the Microsoft-documented fix, workaround, or platform limitation. Deterministic error-string → diagnosis lookup for specific, named failures: AKS VM-extension \u002F CSE provisioning errors with a documented nested signature (VMExtensionError_OutboundConnFail \u002F exit 50, VMExtensionError_K8SAPIServerConnFail \u002F exit 51, VMExtensionError_K8SAPIServerDNSLookupFail \u002F exit 52, OrasPullUnauthorizedVMExtensionError \u002F exit 212), SKU and allocation errors (SkuNotAvailable, ZonalAllocationFailed, OverconstrainedAllocationRequest, message-qualified AllocationFailed), VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, node-image \u002F snapshot 'NodeImageVersion is not accepted', and network-isolated-cluster ACR pull failures. ALLOCATION ROUTING: the full messages 'AllocationFailed: The VM allocation failed due to an internal error. Please retry later or try deploying to a different location' and 'AllocationFailed: We do not have sufficient capacity for the requested VM size' are cataloged signatures owned by this skill; they are not bare errors. A prompt that reports only the AllocationFailed code and explicitly has no nested Azure message is not a catalog match — route that bare-code investigation to aks-troubleshooting. WHEN: an AKS create \u002F scale \u002F upgrade \u002F image-pull fails with one of the cataloged signatures; 'what does \u003Cerror> mean on AKS?'; 'is \u003Cerror> a known issue?'; an AKS vmssCSE \u002F VM-extension exit code; or a message-qualified AKS SKU \u002F allocation error. DO NOT USE FOR: a bare VMExtensionProvisioningError wrapper; an unclassified SKU \u002F capacity allocation incident; a numeric exit code without AKS CSE context; a natural-language 'allocation failed' symptom without the Azure error; non-AKS resources; or open-ended incidents with no cataloged signature — pod crashes, NotReady, DNS, ingress, or timeouts (use aks-troubleshooting for AKS incidents). Read-only: it explains and cites the documented fix, and never applies changes without explicit approval.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,15,18,21],{"name":11,"slug":8,"type":14},"tag",{"name":16,"slug":17,"type":14},"Diagnostics","diagnostics",{"name":19,"slug":20,"type":14},"Kubernetes","kubernetes",{"name":22,"slug":23,"type":14},"Debugging","debugging",3,"https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills","2026-08-23T04:00:30.216663","MIT",1,[30,31,32,8,33,34,35,20,36,37],"agent-skills","ai-agents","aks","claude","devops","github-copilot","mcp","sre-agent",{"repoUrl":25,"stars":24,"forks":28,"topics":39,"description":40},[30,31,32,8,33,34,35,20,36,37],"Agent skills for operating Azure Kubernetes Service (AKS): troubleshooting, cost, AKS Automatic readiness, GPU\u002Finference, packet capture, and cluster design. The deep Day-2 AKS operator — complements the Azure Skills plugin; works with Claude Code, GitHub Copilot, and Azure SRE Agent.","https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills\u002Ftree\u002FHEAD\u002Fskills\u002Faks-known-issues","---\nname: aks-known-issues\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"0.1.0\"\n  openclaw:\n    emoji: \"🔖\"\n    requires:\n      anyBins:\n        - az\n        - kubectl\ndescription: \"Match an AKS operation failure against a curated, versioned table of documented known issues and error codes — each entry carrying the cause and the Microsoft-documented fix, workaround, or platform limitation. Deterministic error-string → diagnosis lookup for specific, named failures: AKS VM-extension \u002F CSE provisioning errors with a documented nested signature (VMExtensionError_OutboundConnFail \u002F exit 50, VMExtensionError_K8SAPIServerConnFail \u002F exit 51, VMExtensionError_K8SAPIServerDNSLookupFail \u002F exit 52, OrasPullUnauthorizedVMExtensionError \u002F exit 212), SKU and allocation errors (SkuNotAvailable, ZonalAllocationFailed, OverconstrainedAllocationRequest, message-qualified AllocationFailed), VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, node-image \u002F snapshot 'NodeImageVersion is not accepted', and network-isolated-cluster ACR pull failures. ALLOCATION ROUTING: the full messages 'AllocationFailed: The VM allocation failed due to an internal error. Please retry later or try deploying to a different location' and 'AllocationFailed: We do not have sufficient capacity for the requested VM size' are cataloged signatures owned by this skill; they are not bare errors. A prompt that reports only the AllocationFailed code and explicitly has no nested Azure message is not a catalog match — route that bare-code investigation to aks-troubleshooting. WHEN: an AKS create \u002F scale \u002F upgrade \u002F image-pull fails with one of the cataloged signatures; 'what does \u003Cerror> mean on AKS?'; 'is \u003Cerror> a known issue?'; an AKS vmssCSE \u002F VM-extension exit code; or a message-qualified AKS SKU \u002F allocation error. DO NOT USE FOR: a bare VMExtensionProvisioningError wrapper; an unclassified SKU \u002F capacity allocation incident; a numeric exit code without AKS CSE context; a natural-language 'allocation failed' symptom without the Azure error; non-AKS resources; or open-ended incidents with no cataloged signature — pod crashes, NotReady, DNS, ingress, or timeouts (use aks-troubleshooting for AKS incidents). Read-only: it explains and cites the documented fix, and never applies changes without explicit approval.\"\n---\n\n# AKS Known Issues\n\nTurn a specific AKS **error code or message** into a documented diagnosis: the cause, the Microsoft-documented fix or workaround, and the reference that proves it. This skill is a deterministic string→diagnosis matcher, not an open-ended investigation — it fires when the failure already names itself (an error code, an extension exit code, a rejected value) and you want the known answer fast.\n\n## Operating rules\n\n**Read-only by default.** Do not upgrade, reimage, delete, reconcile, scale, or modify role assignments on the cluster or its Azure resources unless the user explicitly asks. Match the error, explain the cause, cite the documented fix — then apply it only on explicit approval.\n\n**Match on the signature, not the vibe.** Only claim a known issue when the actual error string matches the entry (code, message, and the operation that produced it). Compare error codes as exact values, not substrings: `ZonalAllocationFailed` is not the `AllocationFailed` code. If the symptom is generic and no specific error code is present, this is not the right skill — route to `aks-troubleshooting`.\n\n**Cite the source.** Every match names its Microsoft Learn reference so the user (or a support engineer) can verify the fix before acting. If you cannot cite a documented source, say so and hand off — do not invent a \"known issue.\"\n\n## How to use\n\n1. **Capture the exact failure** — the error code, the full message, and the operation (`az aks nodepool show` on a `provisioningState=Failed` pool surfaces the code; VM-extension failures surface `vmssCSE` exit codes; ARM\u002FCLI returns the error verbatim).\n2. **Match** it against the table below (common set) or [references\u002Ferror-code-map.md](references\u002Ferror-code-map.md) (full catalog).\n3. **Confirm the signature** matches — same code, same operation class.\n4. **Present** the cause + the documented fix + the reference URL. Flag whether the fix is read-only (a config check) or a change that needs approval.\n5. **Route out** if there is no exact match: generic AKS incidents → `aks-troubleshooting`; non-AKS failures → no AKS skill. A bare `VMExtensionProvisioningError` or `AllocationFailed` is not enough to diagnose. A numeric exit code also requires AKS `vmssCSE` \u002F CSE context. Request the nested error, complete message, operation, and AKS resource context.\n\n## Common known issues\n\n| Error \u002F signature | What it means | Documented fix | Microsoft Learn |\n|---|---|---|---|\n| Node pool `provisioningState=Failed` | The backing VMSS hit an error during provision\u002Fscale\u002Fupdate — capacity, quota, network, policy, or a resource lock | Read the exact code from `az aks nodepool show`, then `az vmss show`; resolve the underlying cause (quota\u002Fcapacity\u002Fpolicy\u002Flock) and reconcile with `az aks nodepool update` | [Node\u002FVM failed state](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Favailability-performance\u002Fcluster-node-virtual-machine-failed-state#scenario-3-node-pool-is-in-a-failed-state) |\n| AKS `vmssCSE` \u002F `VMExtensionProvisioningError` containing `VMExtensionError_OutboundConnFail`, `OutboundConnFailVMExtensionError`, `ERR_OUTBOUND_CONN_FAIL`, or exit **50** | The CSE couldn't establish the outbound connection needed to obtain node-provisioning packages | Test `mcr.microsoft.com:443`; inspect the firewall, proxy, NSG, UDR, and required AKS FQDN\u002Fport rules. For private clusters with custom DNS, verify Azure DNS `168.63.129.16` is an upstream resolver | [VMExtensionError_OutboundConnFail](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-outboundconnfail) |\n| AKS `vmssCSE` \u002F `VMExtensionProvisioningError` containing `VMExtensionError_K8SAPIServerConnFail`, `K8SAPIServerConnFailVMExtensionError`, `ERR_K8S_API_SERVER_CONN_FAIL`, or exit **51** | The node couldn't connect to the AKS API-server endpoint on TCP 443 | Test `\u003Capi-server-fqdn>:443`; inspect NSG, UDR, firewall\u002Fproxy, authorized IP ranges, private-endpoint status, and TLS inspection | [VMExtensionError_K8SAPIServerConnFail](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-k8sapiserverconnfail) |\n| AKS `vmssCSE` \u002F `VMExtensionProvisioningError` containing `VMExtensionError_K8SAPIServerDNSLookupFail`, `K8SAPIServerDNSLookupFailVMExtensionError`, `ERR_K8S_API_SERVER_DNS_LOOKUP_FAIL`, or exit **52** | The node couldn't resolve the cluster API-server FQDN | Resolve the cluster FQDN with `nslookup` or `dig` and verify DNS reachability on port 53 and forwarders. For private clusters, also verify the private-zone VNet link and A record | [VMExtensionError_K8SAPIServerDNSLookupFail](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-k8sapiserverdnslookupfail) |\n| `VMCannotFitEphemeralOSDisk` | The requested OS disk doesn't fit the VM SKU's cache\u002Ftemp storage, but ephemeral was requested (or defaulted) | Use a VM SKU with a large enough cache\u002Ftemp, reduce `--node-osdisk-size`, or set `--node-osdisk-type Managed`. OS disk type\u002Fsize can't change in place — create a new node pool and migrate | [Ephemeral OS disks](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Faks\u002Fconcepts-storage#ephemeral-os-disks-in-aks) |\n| AKS node-pool `SkuNotAvailable` with the requested size, location, and zone in the message | The VM SKU is unavailable for this subscription in that placement; Spot capacity can also cause this code | Inspect restrictions with `az vm list-skus --location \u003Cregion> --size \u003Cpartial-size> --all --output table`; select another size, zone, or region, or request the required SKU. Do not label it quota exhaustion | [SkuNotAvailable](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Ftroubleshooting\u002Ferror-sku-not-available) |\n| AKS `ZonalAllocationFailed`: `Allocation failed. We do not have sufficient capacity for the requested VM size in this zone` | Azure lacks capacity for the requested VM size in that availability zone; an associated proximity placement group can also constrain placement | Use another SKU, zone, region, or node pool. Check for a proximity placement group before attributing the constraint to one. During upgrades only, set `maxUnavailable > 0` together with `maxSurge=0` to avoid requesting surge capacity | [AKS allocation errors](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fzonalallocation-allocationfailed-error) |\n| AKS node-pool `OverconstrainedAllocationRequest` with the listed constraints | The requested combination of SKU, networking, zone, ephemeral disk, proximity placement group, or other listed constraints can't be allocated | Read the listed constraints, then relax the named constraint or use another SKU, zone, region, or node pool. Remove a proximity placement group only when it is actually listed or configured | [AKS allocation errors](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fzonalallocation-allocationfailed-error) |\n| AKS create \u002F scale \u002F upgrade `AllocationFailed` with its full nested message | The documented internal-error form requires a later retry or another location; a message that explicitly says insufficient capacity is a placement-capacity failure | Follow the nested message: retry later or use another location for the internal-error form; for an explicit capacity form, use another SKU, zone, region, or node pool. During upgrades only, set `maxUnavailable > 0` together with `maxSurge=0` to avoid requesting surge capacity | [AKS allocation errors](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fzonalallocation-allocationfailed-error) |\n| `LinkedAuthorizationFailed` | The cluster identity (managed identity or SP) lacks a role assignment on a **linked** resource named in the error (e.g. a subnet, DDoS plan, or route table) | Grant the identity the action shown in the error at the **linked** resource scope; verify role-assignment propagation and that the linked resource still exists | [LinkedAuthorizationFailed](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Flinkedauthorizationfailed-error) |\n| `OrasPullUnauthorizedVMExtensionError` \u002F `vmssCSE` exit **212** | On a network-isolated cluster (outbound `none`\u002F`block`), the kubelet identity can't pull bootstrap images from the private ACR cache | Ensure the kubelet identity has `AcrPull` (or the ABAC repository-reader role) on the bootstrap ACR and is bound to the VM | [OrasPullUnauthorized](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-oraspullunauthorized) |\n| `NodePoolMcVersionIncompatible` | A node pool is (or would become) more than 3 minor versions behind the control plane | Upgrade the node pool to a version ≤ the control-plane version; don't skip minor versions | [NodePoolMcVersionIncompatible](https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fnodepoolmcversionincompatible-error) |\n| `NodeImageVersion ... is not accepted` | A snapshot- or rollback-pinned node pool is being set to a node-image version that isn't its current version or `latest` | Use `az aks nodepool upgrade --node-image-only` (no `--snapshot-id`) to move to the latest supported image, respecting the OS SKU | [Node pool snapshots](https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Faks\u002Fnode-pool-snapshot#upgrading-a-node-pool-to-a-snapshot) |\n\nThe full catalog — with every error string, the mechanism, and the exact reference — is in [references\u002Ferror-code-map.md](references\u002Ferror-code-map.md). Keep that file the single source of truth and add new entries there as documented issues are confirmed.\n\n## Boundary\n\nThis skill owns **named, documented AKS** failures. The outer `VMExtensionProvisioningError` wrapper, a bare `AllocationFailed`, or an exit number outside AKS `vmssCSE` \u002F CSE output doesn't identify one cause: require the documented nested signature and operation context before matching. Anything without a specific error signature — a pod crashing, a node going NotReady, DNS or ingress misbehaving, intermittent timeouts, or Kubernetes `FailedScheduling` — is a live investigation and belongs to `aks-troubleshooting`, which will route to a packet capture (`aks-network-capture`) or another skill as the evidence dictates. Errors for non-AKS VMs or VM scale sets do not route to an AKS skill.\n",{"data":44,"body":54},{"name":4,"license":27,"metadata":45,"description":6},{"author":46,"version":47,"openclaw":48},"Microsoft","0.1.0",{"emoji":49,"requires":50},"🔖",{"anyBins":51},[52,53],"az","kubectl",{"type":55,"children":56},"root",[57,65,79,86,96,131,141,147,263,269,1020,1031,1037],{"type":58,"tag":59,"props":60,"children":61},"element","h1",{"id":4},[62],{"type":63,"value":64},"text","AKS Known Issues",{"type":58,"tag":66,"props":67,"children":68},"p",{},[69,71,77],{"type":63,"value":70},"Turn a specific AKS ",{"type":58,"tag":72,"props":73,"children":74},"strong",{},[75],{"type":63,"value":76},"error code or message",{"type":63,"value":78}," into a documented diagnosis: the cause, the Microsoft-documented fix or workaround, and the reference that proves it. This skill is a deterministic string→diagnosis matcher, not an open-ended investigation — it fires when the failure already names itself (an error code, an extension exit code, a rejected value) and you want the known answer fast.",{"type":58,"tag":80,"props":81,"children":83},"h2",{"id":82},"operating-rules",[84],{"type":63,"value":85},"Operating rules",{"type":58,"tag":66,"props":87,"children":88},{},[89,94],{"type":58,"tag":72,"props":90,"children":91},{},[92],{"type":63,"value":93},"Read-only by default.",{"type":63,"value":95}," Do not upgrade, reimage, delete, reconcile, scale, or modify role assignments on the cluster or its Azure resources unless the user explicitly asks. Match the error, explain the cause, cite the documented fix — then apply it only on explicit approval.",{"type":58,"tag":66,"props":97,"children":98},{},[99,104,106,113,115,121,123,129],{"type":58,"tag":72,"props":100,"children":101},{},[102],{"type":63,"value":103},"Match on the signature, not the vibe.",{"type":63,"value":105}," Only claim a known issue when the actual error string matches the entry (code, message, and the operation that produced it). Compare error codes as exact values, not substrings: ",{"type":58,"tag":107,"props":108,"children":110},"code",{"className":109},[],[111],{"type":63,"value":112},"ZonalAllocationFailed",{"type":63,"value":114}," is not the ",{"type":58,"tag":107,"props":116,"children":118},{"className":117},[],[119],{"type":63,"value":120},"AllocationFailed",{"type":63,"value":122}," code. If the symptom is generic and no specific error code is present, this is not the right skill — route to ",{"type":58,"tag":107,"props":124,"children":126},{"className":125},[],[127],{"type":63,"value":128},"aks-troubleshooting",{"type":63,"value":130},".",{"type":58,"tag":66,"props":132,"children":133},{},[134,139],{"type":58,"tag":72,"props":135,"children":136},{},[137],{"type":63,"value":138},"Cite the source.",{"type":63,"value":140}," Every match names its Microsoft Learn reference so the user (or a support engineer) can verify the fix before acting. If you cannot cite a documented source, say so and hand off — do not invent a \"known issue.\"",{"type":58,"tag":80,"props":142,"children":144},{"id":143},"how-to-use",[145],{"type":63,"value":146},"How to use",{"type":58,"tag":148,"props":149,"children":150},"ol",{},[151,186,204,214,224],{"type":58,"tag":152,"props":153,"children":154},"li",{},[155,160,162,168,170,176,178,184],{"type":58,"tag":72,"props":156,"children":157},{},[158],{"type":63,"value":159},"Capture the exact failure",{"type":63,"value":161}," — the error code, the full message, and the operation (",{"type":58,"tag":107,"props":163,"children":165},{"className":164},[],[166],{"type":63,"value":167},"az aks nodepool show",{"type":63,"value":169}," on a ",{"type":58,"tag":107,"props":171,"children":173},{"className":172},[],[174],{"type":63,"value":175},"provisioningState=Failed",{"type":63,"value":177}," pool surfaces the code; VM-extension failures surface ",{"type":58,"tag":107,"props":179,"children":181},{"className":180},[],[182],{"type":63,"value":183},"vmssCSE",{"type":63,"value":185}," exit codes; ARM\u002FCLI returns the error verbatim).",{"type":58,"tag":152,"props":187,"children":188},{},[189,194,196,202],{"type":58,"tag":72,"props":190,"children":191},{},[192],{"type":63,"value":193},"Match",{"type":63,"value":195}," it against the table below (common set) or ",{"type":58,"tag":197,"props":198,"children":200},"a",{"href":199},"references\u002Ferror-code-map.md",[201],{"type":63,"value":199},{"type":63,"value":203}," (full catalog).",{"type":58,"tag":152,"props":205,"children":206},{},[207,212],{"type":58,"tag":72,"props":208,"children":209},{},[210],{"type":63,"value":211},"Confirm the signature",{"type":63,"value":213}," matches — same code, same operation class.",{"type":58,"tag":152,"props":215,"children":216},{},[217,222],{"type":58,"tag":72,"props":218,"children":219},{},[220],{"type":63,"value":221},"Present",{"type":63,"value":223}," the cause + the documented fix + the reference URL. Flag whether the fix is read-only (a config check) or a change that needs approval.",{"type":58,"tag":152,"props":225,"children":226},{},[227,232,234,239,241,247,249,254,256,261],{"type":58,"tag":72,"props":228,"children":229},{},[230],{"type":63,"value":231},"Route out",{"type":63,"value":233}," if there is no exact match: generic AKS incidents → ",{"type":58,"tag":107,"props":235,"children":237},{"className":236},[],[238],{"type":63,"value":128},{"type":63,"value":240},"; non-AKS failures → no AKS skill. A bare ",{"type":58,"tag":107,"props":242,"children":244},{"className":243},[],[245],{"type":63,"value":246},"VMExtensionProvisioningError",{"type":63,"value":248}," or ",{"type":58,"tag":107,"props":250,"children":252},{"className":251},[],[253],{"type":63,"value":120},{"type":63,"value":255}," is not enough to diagnose. A numeric exit code also requires AKS ",{"type":58,"tag":107,"props":257,"children":259},{"className":258},[],[260],{"type":63,"value":183},{"type":63,"value":262}," \u002F CSE context. Request the nested error, complete message, operation, and AKS resource context.",{"type":58,"tag":80,"props":264,"children":266},{"id":265},"common-known-issues",[267],{"type":63,"value":268},"Common known issues",{"type":58,"tag":270,"props":271,"children":272},"table",{},[273,302],{"type":58,"tag":274,"props":275,"children":276},"thead",{},[277],{"type":58,"tag":278,"props":279,"children":280},"tr",{},[281,287,292,297],{"type":58,"tag":282,"props":283,"children":284},"th",{},[285],{"type":63,"value":286},"Error \u002F signature",{"type":58,"tag":282,"props":288,"children":289},{},[290],{"type":63,"value":291},"What it means",{"type":58,"tag":282,"props":293,"children":294},{},[295],{"type":63,"value":296},"Documented fix",{"type":58,"tag":282,"props":298,"children":299},{},[300],{"type":63,"value":301},"Microsoft Learn",{"type":58,"tag":303,"props":304,"children":305},"tbody",{},[306,362,447,518,597,645,688,744,777,822,866,935,966],{"type":58,"tag":278,"props":307,"children":308},{},[309,320,325,351],{"type":58,"tag":310,"props":311,"children":312},"td",{},[313,315],{"type":63,"value":314},"Node pool ",{"type":58,"tag":107,"props":316,"children":318},{"className":317},[],[319],{"type":63,"value":175},{"type":58,"tag":310,"props":321,"children":322},{},[323],{"type":63,"value":324},"The backing VMSS hit an error during provision\u002Fscale\u002Fupdate — capacity, quota, network, policy, or a resource lock",{"type":58,"tag":310,"props":326,"children":327},{},[328,330,335,337,343,345],{"type":63,"value":329},"Read the exact code from ",{"type":58,"tag":107,"props":331,"children":333},{"className":332},[],[334],{"type":63,"value":167},{"type":63,"value":336},", then ",{"type":58,"tag":107,"props":338,"children":340},{"className":339},[],[341],{"type":63,"value":342},"az vmss show",{"type":63,"value":344},"; resolve the underlying cause (quota\u002Fcapacity\u002Fpolicy\u002Flock) and reconcile with ",{"type":58,"tag":107,"props":346,"children":348},{"className":347},[],[349],{"type":63,"value":350},"az aks nodepool update",{"type":58,"tag":310,"props":352,"children":353},{},[354],{"type":58,"tag":197,"props":355,"children":359},{"href":356,"rel":357},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Favailability-performance\u002Fcluster-node-virtual-machine-failed-state#scenario-3-node-pool-is-in-a-failed-state",[358],"nofollow",[360],{"type":63,"value":361},"Node\u002FVM failed state",{"type":58,"tag":278,"props":363,"children":364},{},[365,412,417,438],{"type":58,"tag":310,"props":366,"children":367},{},[368,370,375,377,382,384,390,392,398,399,405,407],{"type":63,"value":369},"AKS ",{"type":58,"tag":107,"props":371,"children":373},{"className":372},[],[374],{"type":63,"value":183},{"type":63,"value":376}," \u002F ",{"type":58,"tag":107,"props":378,"children":380},{"className":379},[],[381],{"type":63,"value":246},{"type":63,"value":383}," containing ",{"type":58,"tag":107,"props":385,"children":387},{"className":386},[],[388],{"type":63,"value":389},"VMExtensionError_OutboundConnFail",{"type":63,"value":391},", ",{"type":58,"tag":107,"props":393,"children":395},{"className":394},[],[396],{"type":63,"value":397},"OutboundConnFailVMExtensionError",{"type":63,"value":391},{"type":58,"tag":107,"props":400,"children":402},{"className":401},[],[403],{"type":63,"value":404},"ERR_OUTBOUND_CONN_FAIL",{"type":63,"value":406},", or exit ",{"type":58,"tag":72,"props":408,"children":409},{},[410],{"type":63,"value":411},"50",{"type":58,"tag":310,"props":413,"children":414},{},[415],{"type":63,"value":416},"The CSE couldn't establish the outbound connection needed to obtain node-provisioning packages",{"type":58,"tag":310,"props":418,"children":419},{},[420,422,428,430,436],{"type":63,"value":421},"Test ",{"type":58,"tag":107,"props":423,"children":425},{"className":424},[],[426],{"type":63,"value":427},"mcr.microsoft.com:443",{"type":63,"value":429},"; inspect the firewall, proxy, NSG, UDR, and required AKS FQDN\u002Fport rules. For private clusters with custom DNS, verify Azure DNS ",{"type":58,"tag":107,"props":431,"children":433},{"className":432},[],[434],{"type":63,"value":435},"168.63.129.16",{"type":63,"value":437}," is an upstream resolver",{"type":58,"tag":310,"props":439,"children":440},{},[441],{"type":58,"tag":197,"props":442,"children":445},{"href":443,"rel":444},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-outboundconnfail",[358],[446],{"type":63,"value":389},{"type":58,"tag":278,"props":448,"children":449},{},[450,492,497,509],{"type":58,"tag":310,"props":451,"children":452},{},[453,454,459,460,465,466,472,473,479,480,486,487],{"type":63,"value":369},{"type":58,"tag":107,"props":455,"children":457},{"className":456},[],[458],{"type":63,"value":183},{"type":63,"value":376},{"type":58,"tag":107,"props":461,"children":463},{"className":462},[],[464],{"type":63,"value":246},{"type":63,"value":383},{"type":58,"tag":107,"props":467,"children":469},{"className":468},[],[470],{"type":63,"value":471},"VMExtensionError_K8SAPIServerConnFail",{"type":63,"value":391},{"type":58,"tag":107,"props":474,"children":476},{"className":475},[],[477],{"type":63,"value":478},"K8SAPIServerConnFailVMExtensionError",{"type":63,"value":391},{"type":58,"tag":107,"props":481,"children":483},{"className":482},[],[484],{"type":63,"value":485},"ERR_K8S_API_SERVER_CONN_FAIL",{"type":63,"value":406},{"type":58,"tag":72,"props":488,"children":489},{},[490],{"type":63,"value":491},"51",{"type":58,"tag":310,"props":493,"children":494},{},[495],{"type":63,"value":496},"The node couldn't connect to the AKS API-server endpoint on TCP 443",{"type":58,"tag":310,"props":498,"children":499},{},[500,501,507],{"type":63,"value":421},{"type":58,"tag":107,"props":502,"children":504},{"className":503},[],[505],{"type":63,"value":506},"\u003Capi-server-fqdn>:443",{"type":63,"value":508},"; inspect NSG, UDR, firewall\u002Fproxy, authorized IP ranges, private-endpoint status, and TLS inspection",{"type":58,"tag":310,"props":510,"children":511},{},[512],{"type":58,"tag":197,"props":513,"children":516},{"href":514,"rel":515},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-k8sapiserverconnfail",[358],[517],{"type":63,"value":471},{"type":58,"tag":278,"props":519,"children":520},{},[521,563,568,588],{"type":58,"tag":310,"props":522,"children":523},{},[524,525,530,531,536,537,543,544,550,551,557,558],{"type":63,"value":369},{"type":58,"tag":107,"props":526,"children":528},{"className":527},[],[529],{"type":63,"value":183},{"type":63,"value":376},{"type":58,"tag":107,"props":532,"children":534},{"className":533},[],[535],{"type":63,"value":246},{"type":63,"value":383},{"type":58,"tag":107,"props":538,"children":540},{"className":539},[],[541],{"type":63,"value":542},"VMExtensionError_K8SAPIServerDNSLookupFail",{"type":63,"value":391},{"type":58,"tag":107,"props":545,"children":547},{"className":546},[],[548],{"type":63,"value":549},"K8SAPIServerDNSLookupFailVMExtensionError",{"type":63,"value":391},{"type":58,"tag":107,"props":552,"children":554},{"className":553},[],[555],{"type":63,"value":556},"ERR_K8S_API_SERVER_DNS_LOOKUP_FAIL",{"type":63,"value":406},{"type":58,"tag":72,"props":559,"children":560},{},[561],{"type":63,"value":562},"52",{"type":58,"tag":310,"props":564,"children":565},{},[566],{"type":63,"value":567},"The node couldn't resolve the cluster API-server FQDN",{"type":58,"tag":310,"props":569,"children":570},{},[571,573,579,580,586],{"type":63,"value":572},"Resolve the cluster FQDN with ",{"type":58,"tag":107,"props":574,"children":576},{"className":575},[],[577],{"type":63,"value":578},"nslookup",{"type":63,"value":248},{"type":58,"tag":107,"props":581,"children":583},{"className":582},[],[584],{"type":63,"value":585},"dig",{"type":63,"value":587}," and verify DNS reachability on port 53 and forwarders. For private clusters, also verify the private-zone VNet link and A record",{"type":58,"tag":310,"props":589,"children":590},{},[591],{"type":58,"tag":197,"props":592,"children":595},{"href":593,"rel":594},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-k8sapiserverdnslookupfail",[358],[596],{"type":63,"value":542},{"type":58,"tag":278,"props":598,"children":599},{},[600,609,614,635],{"type":58,"tag":310,"props":601,"children":602},{},[603],{"type":58,"tag":107,"props":604,"children":606},{"className":605},[],[607],{"type":63,"value":608},"VMCannotFitEphemeralOSDisk",{"type":58,"tag":310,"props":610,"children":611},{},[612],{"type":63,"value":613},"The requested OS disk doesn't fit the VM SKU's cache\u002Ftemp storage, but ephemeral was requested (or defaulted)",{"type":58,"tag":310,"props":615,"children":616},{},[617,619,625,627,633],{"type":63,"value":618},"Use a VM SKU with a large enough cache\u002Ftemp, reduce ",{"type":58,"tag":107,"props":620,"children":622},{"className":621},[],[623],{"type":63,"value":624},"--node-osdisk-size",{"type":63,"value":626},", or set ",{"type":58,"tag":107,"props":628,"children":630},{"className":629},[],[631],{"type":63,"value":632},"--node-osdisk-type Managed",{"type":63,"value":634},". OS disk type\u002Fsize can't change in place — create a new node pool and migrate",{"type":58,"tag":310,"props":636,"children":637},{},[638],{"type":58,"tag":197,"props":639,"children":642},{"href":640,"rel":641},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Faks\u002Fconcepts-storage#ephemeral-os-disks-in-aks",[358],[643],{"type":63,"value":644},"Ephemeral OS disks",{"type":58,"tag":278,"props":646,"children":647},{},[648,661,666,679],{"type":58,"tag":310,"props":649,"children":650},{},[651,653,659],{"type":63,"value":652},"AKS node-pool ",{"type":58,"tag":107,"props":654,"children":656},{"className":655},[],[657],{"type":63,"value":658},"SkuNotAvailable",{"type":63,"value":660}," with the requested size, location, and zone in the message",{"type":58,"tag":310,"props":662,"children":663},{},[664],{"type":63,"value":665},"The VM SKU is unavailable for this subscription in that placement; Spot capacity can also cause this code",{"type":58,"tag":310,"props":667,"children":668},{},[669,671,677],{"type":63,"value":670},"Inspect restrictions with ",{"type":58,"tag":107,"props":672,"children":674},{"className":673},[],[675],{"type":63,"value":676},"az vm list-skus --location \u003Cregion> --size \u003Cpartial-size> --all --output table",{"type":63,"value":678},"; select another size, zone, or region, or request the required SKU. Do not label it quota exhaustion",{"type":58,"tag":310,"props":680,"children":681},{},[682],{"type":58,"tag":197,"props":683,"children":686},{"href":684,"rel":685},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Ftroubleshooting\u002Ferror-sku-not-available",[358],[687],{"type":63,"value":658},{"type":58,"tag":278,"props":689,"children":690},{},[691,708,713,734],{"type":58,"tag":310,"props":692,"children":693},{},[694,695,700,702],{"type":63,"value":369},{"type":58,"tag":107,"props":696,"children":698},{"className":697},[],[699],{"type":63,"value":112},{"type":63,"value":701},": ",{"type":58,"tag":107,"props":703,"children":705},{"className":704},[],[706],{"type":63,"value":707},"Allocation failed. We do not have sufficient capacity for the requested VM size in this zone",{"type":58,"tag":310,"props":709,"children":710},{},[711],{"type":63,"value":712},"Azure lacks capacity for the requested VM size in that availability zone; an associated proximity placement group can also constrain placement",{"type":58,"tag":310,"props":714,"children":715},{},[716,718,724,726,732],{"type":63,"value":717},"Use another SKU, zone, region, or node pool. Check for a proximity placement group before attributing the constraint to one. During upgrades only, set ",{"type":58,"tag":107,"props":719,"children":721},{"className":720},[],[722],{"type":63,"value":723},"maxUnavailable > 0",{"type":63,"value":725}," together with ",{"type":58,"tag":107,"props":727,"children":729},{"className":728},[],[730],{"type":63,"value":731},"maxSurge=0",{"type":63,"value":733}," to avoid requesting surge capacity",{"type":58,"tag":310,"props":735,"children":736},{},[737],{"type":58,"tag":197,"props":738,"children":741},{"href":739,"rel":740},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fzonalallocation-allocationfailed-error",[358],[742],{"type":63,"value":743},"AKS allocation errors",{"type":58,"tag":278,"props":745,"children":746},{},[747,759,764,769],{"type":58,"tag":310,"props":748,"children":749},{},[750,751,757],{"type":63,"value":652},{"type":58,"tag":107,"props":752,"children":754},{"className":753},[],[755],{"type":63,"value":756},"OverconstrainedAllocationRequest",{"type":63,"value":758}," with the listed constraints",{"type":58,"tag":310,"props":760,"children":761},{},[762],{"type":63,"value":763},"The requested combination of SKU, networking, zone, ephemeral disk, proximity placement group, or other listed constraints can't be allocated",{"type":58,"tag":310,"props":765,"children":766},{},[767],{"type":63,"value":768},"Read the listed constraints, then relax the named constraint or use another SKU, zone, region, or node pool. Remove a proximity placement group only when it is actually listed or configured",{"type":58,"tag":310,"props":770,"children":771},{},[772],{"type":58,"tag":197,"props":773,"children":775},{"href":739,"rel":774},[358],[776],{"type":63,"value":743},{"type":58,"tag":278,"props":778,"children":779},{},[780,792,797,814],{"type":58,"tag":310,"props":781,"children":782},{},[783,785,790],{"type":63,"value":784},"AKS create \u002F scale \u002F upgrade ",{"type":58,"tag":107,"props":786,"children":788},{"className":787},[],[789],{"type":63,"value":120},{"type":63,"value":791}," with its full nested message",{"type":58,"tag":310,"props":793,"children":794},{},[795],{"type":63,"value":796},"The documented internal-error form requires a later retry or another location; a message that explicitly says insufficient capacity is a placement-capacity failure",{"type":58,"tag":310,"props":798,"children":799},{},[800,802,807,808,813],{"type":63,"value":801},"Follow the nested message: retry later or use another location for the internal-error form; for an explicit capacity form, use another SKU, zone, region, or node pool. During upgrades only, set ",{"type":58,"tag":107,"props":803,"children":805},{"className":804},[],[806],{"type":63,"value":723},{"type":63,"value":725},{"type":58,"tag":107,"props":809,"children":811},{"className":810},[],[812],{"type":63,"value":731},{"type":63,"value":733},{"type":58,"tag":310,"props":815,"children":816},{},[817],{"type":58,"tag":197,"props":818,"children":820},{"href":739,"rel":819},[358],[821],{"type":63,"value":743},{"type":58,"tag":278,"props":823,"children":824},{},[825,834,846,857],{"type":58,"tag":310,"props":826,"children":827},{},[828],{"type":58,"tag":107,"props":829,"children":831},{"className":830},[],[832],{"type":63,"value":833},"LinkedAuthorizationFailed",{"type":58,"tag":310,"props":835,"children":836},{},[837,839,844],{"type":63,"value":838},"The cluster identity (managed identity or SP) lacks a role assignment on a ",{"type":58,"tag":72,"props":840,"children":841},{},[842],{"type":63,"value":843},"linked",{"type":63,"value":845}," resource named in the error (e.g. a subnet, DDoS plan, or route table)",{"type":58,"tag":310,"props":847,"children":848},{},[849,851,855],{"type":63,"value":850},"Grant the identity the action shown in the error at the ",{"type":58,"tag":72,"props":852,"children":853},{},[854],{"type":63,"value":843},{"type":63,"value":856}," resource scope; verify role-assignment propagation and that the linked resource still exists",{"type":58,"tag":310,"props":858,"children":859},{},[860],{"type":58,"tag":197,"props":861,"children":864},{"href":862,"rel":863},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Flinkedauthorizationfailed-error",[358],[865],{"type":63,"value":833},{"type":58,"tag":278,"props":867,"children":868},{},[869,891,912,925],{"type":58,"tag":310,"props":870,"children":871},{},[872,878,879,884,886],{"type":58,"tag":107,"props":873,"children":875},{"className":874},[],[876],{"type":63,"value":877},"OrasPullUnauthorizedVMExtensionError",{"type":63,"value":376},{"type":58,"tag":107,"props":880,"children":882},{"className":881},[],[883],{"type":63,"value":183},{"type":63,"value":885}," exit ",{"type":58,"tag":72,"props":887,"children":888},{},[889],{"type":63,"value":890},"212",{"type":58,"tag":310,"props":892,"children":893},{},[894,896,902,904,910],{"type":63,"value":895},"On a network-isolated cluster (outbound ",{"type":58,"tag":107,"props":897,"children":899},{"className":898},[],[900],{"type":63,"value":901},"none",{"type":63,"value":903},"\u002F",{"type":58,"tag":107,"props":905,"children":907},{"className":906},[],[908],{"type":63,"value":909},"block",{"type":63,"value":911},"), the kubelet identity can't pull bootstrap images from the private ACR cache",{"type":58,"tag":310,"props":913,"children":914},{},[915,917,923],{"type":63,"value":916},"Ensure the kubelet identity has ",{"type":58,"tag":107,"props":918,"children":920},{"className":919},[],[921],{"type":63,"value":922},"AcrPull",{"type":63,"value":924}," (or the ABAC repository-reader role) on the bootstrap ACR and is bound to the VM",{"type":58,"tag":310,"props":926,"children":927},{},[928],{"type":58,"tag":197,"props":929,"children":932},{"href":930,"rel":931},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fvmextensionerror-oraspullunauthorized",[358],[933],{"type":63,"value":934},"OrasPullUnauthorized",{"type":58,"tag":278,"props":936,"children":937},{},[938,947,952,957],{"type":58,"tag":310,"props":939,"children":940},{},[941],{"type":58,"tag":107,"props":942,"children":944},{"className":943},[],[945],{"type":63,"value":946},"NodePoolMcVersionIncompatible",{"type":58,"tag":310,"props":948,"children":949},{},[950],{"type":63,"value":951},"A node pool is (or would become) more than 3 minor versions behind the control plane",{"type":58,"tag":310,"props":953,"children":954},{},[955],{"type":63,"value":956},"Upgrade the node pool to a version ≤ the control-plane version; don't skip minor versions",{"type":58,"tag":310,"props":958,"children":959},{},[960],{"type":58,"tag":197,"props":961,"children":964},{"href":962,"rel":963},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Ferror-codes\u002Fnodepoolmcversionincompatible-error",[358],[965],{"type":63,"value":946},{"type":58,"tag":278,"props":967,"children":968},{},[969,978,989,1010],{"type":58,"tag":310,"props":970,"children":971},{},[972],{"type":58,"tag":107,"props":973,"children":975},{"className":974},[],[976],{"type":63,"value":977},"NodeImageVersion ... is not accepted",{"type":58,"tag":310,"props":979,"children":980},{},[981,983],{"type":63,"value":982},"A snapshot- or rollback-pinned node pool is being set to a node-image version that isn't its current version or ",{"type":58,"tag":107,"props":984,"children":986},{"className":985},[],[987],{"type":63,"value":988},"latest",{"type":58,"tag":310,"props":990,"children":991},{},[992,994,1000,1002,1008],{"type":63,"value":993},"Use ",{"type":58,"tag":107,"props":995,"children":997},{"className":996},[],[998],{"type":63,"value":999},"az aks nodepool upgrade --node-image-only",{"type":63,"value":1001}," (no ",{"type":58,"tag":107,"props":1003,"children":1005},{"className":1004},[],[1006],{"type":63,"value":1007},"--snapshot-id",{"type":63,"value":1009},") to move to the latest supported image, respecting the OS SKU",{"type":58,"tag":310,"props":1011,"children":1012},{},[1013],{"type":58,"tag":197,"props":1014,"children":1017},{"href":1015,"rel":1016},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Faks\u002Fnode-pool-snapshot#upgrading-a-node-pool-to-a-snapshot",[358],[1018],{"type":63,"value":1019},"Node pool snapshots",{"type":58,"tag":66,"props":1021,"children":1022},{},[1023,1025,1029],{"type":63,"value":1024},"The full catalog — with every error string, the mechanism, and the exact reference — is in ",{"type":58,"tag":197,"props":1026,"children":1027},{"href":199},[1028],{"type":63,"value":199},{"type":63,"value":1030},". Keep that file the single source of truth and add new entries there as documented issues are confirmed.",{"type":58,"tag":80,"props":1032,"children":1034},{"id":1033},"boundary",[1035],{"type":63,"value":1036},"Boundary",{"type":58,"tag":66,"props":1038,"children":1039},{},[1040,1042,1047,1049,1054,1056,1061,1063,1068,1070,1076,1078,1083,1085,1091],{"type":63,"value":1041},"This skill owns ",{"type":58,"tag":72,"props":1043,"children":1044},{},[1045],{"type":63,"value":1046},"named, documented AKS",{"type":63,"value":1048}," failures. The outer ",{"type":58,"tag":107,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":63,"value":246},{"type":63,"value":1055}," wrapper, a bare ",{"type":58,"tag":107,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":63,"value":120},{"type":63,"value":1062},", or an exit number outside AKS ",{"type":58,"tag":107,"props":1064,"children":1066},{"className":1065},[],[1067],{"type":63,"value":183},{"type":63,"value":1069}," \u002F CSE output doesn't identify one cause: require the documented nested signature and operation context before matching. Anything without a specific error signature — a pod crashing, a node going NotReady, DNS or ingress misbehaving, intermittent timeouts, or Kubernetes ",{"type":58,"tag":107,"props":1071,"children":1073},{"className":1072},[],[1074],{"type":63,"value":1075},"FailedScheduling",{"type":63,"value":1077}," — is a live investigation and belongs to ",{"type":58,"tag":107,"props":1079,"children":1081},{"className":1080},[],[1082],{"type":63,"value":128},{"type":63,"value":1084},", which will route to a packet capture (",{"type":58,"tag":107,"props":1086,"children":1088},{"className":1087},[],[1089],{"type":63,"value":1090},"aks-network-capture",{"type":63,"value":1092},") or another skill as the evidence dictates. Errors for non-AKS VMs or VM scale sets do not route to an AKS skill.",{"items":1094,"total":1272},[1095,1114,1133,1152,1167,1182,1195,1210,1221,1235,1246,1258],{"slug":1096,"name":1096,"fn":1097,"description":1098,"org":1099,"tags":1100,"stars":1111,"repoUrl":1112,"updatedAt":1113},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1101,1102,1105,1108],{"name":11,"slug":8,"type":14},{"name":1103,"slug":1104,"type":14},"Compliance","compliance",{"name":1106,"slug":1107,"type":14},"Governance","governance",{"name":1109,"slug":1110,"type":14},"Policy","policy",1689,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":1115,"name":1115,"fn":1116,"description":1117,"org":1118,"tags":1119,"stars":1130,"repoUrl":1131,"updatedAt":1132},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1120,1121,1124,1127],{"name":11,"slug":8,"type":14},{"name":1122,"slug":1123,"type":14},"Deployment","deployment",{"name":1125,"slug":1126,"type":14},"Infrastructure as Code","infrastructure-as-code",{"name":1128,"slug":1129,"type":14},"Migration","migration",261,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-08-20T03:28:18.136156",{"slug":1134,"name":1134,"fn":1135,"description":1136,"org":1137,"tags":1138,"stars":1149,"repoUrl":1150,"updatedAt":1151},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1139,1142,1143,1146],{"name":1140,"slug":1141,"type":14},"API Development","api-development",{"name":11,"slug":8,"type":14},{"name":1144,"slug":1145,"type":14},"Code Review","code-review",{"name":1147,"slug":1148,"type":14},"Documentation","documentation",136,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":1153,"name":1153,"fn":1154,"description":1155,"org":1156,"tags":1157,"stars":1149,"repoUrl":1150,"updatedAt":1166},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1158,1159,1160,1163],{"name":11,"slug":8,"type":14},{"name":1122,"slug":1123,"type":14},{"name":1161,"slug":1162,"type":14},"SDK","sdk",{"name":1164,"slug":1165,"type":14},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":1168,"name":1168,"fn":1169,"description":1170,"org":1171,"tags":1172,"stars":1149,"repoUrl":1150,"updatedAt":1181},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1173,1174,1177,1180],{"name":11,"slug":8,"type":14},{"name":1175,"slug":1176,"type":14},"GitHub","github",{"name":1178,"slug":1179,"type":14},"Project Management","project-management",{"name":1161,"slug":1162,"type":14},"2026-07-12T08:17:38.345387",{"slug":1183,"name":1183,"fn":1184,"description":1185,"org":1186,"tags":1187,"stars":1149,"repoUrl":1150,"updatedAt":1194},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1188,1189,1192,1193],{"name":11,"slug":8,"type":14},{"name":1190,"slug":1191,"type":14},"CI\u002FCD","ci-cd",{"name":1122,"slug":1123,"type":14},{"name":1161,"slug":1162,"type":14},"2026-07-12T08:17:34.27607",{"slug":1196,"name":1196,"fn":1197,"description":1198,"org":1199,"tags":1200,"stars":1149,"repoUrl":1150,"updatedAt":1209},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1201,1202,1203,1206],{"name":1140,"slug":1141,"type":14},{"name":11,"slug":8,"type":14},{"name":1204,"slug":1205,"type":14},"OpenAPI","openapi",{"name":1207,"slug":1208,"type":14},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":1211,"name":1211,"fn":1212,"description":1213,"org":1214,"tags":1215,"stars":1149,"repoUrl":1150,"updatedAt":1220},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1216,1217,1218,1219],{"name":11,"slug":8,"type":14},{"name":1190,"slug":1191,"type":14},{"name":1161,"slug":1162,"type":14},{"name":1164,"slug":1165,"type":14},"2026-07-12T08:17:37.08523",{"slug":1222,"name":1222,"fn":1223,"description":1224,"org":1225,"tags":1226,"stars":1149,"repoUrl":1150,"updatedAt":1234},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1227,1230,1233],{"name":1228,"slug":1229,"type":14},"LLM","llm",{"name":1231,"slug":1232,"type":14},"Performance","performance",{"name":1207,"slug":1208,"type":14},"2026-07-12T08:17:42.080413",{"slug":1236,"name":1236,"fn":1237,"description":1238,"org":1239,"tags":1240,"stars":1149,"repoUrl":1150,"updatedAt":1245},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1241,1242,1243,1244],{"name":11,"slug":8,"type":14},{"name":1190,"slug":1191,"type":14},{"name":22,"slug":23,"type":14},{"name":1161,"slug":1162,"type":14},"2026-07-12T08:17:40.821512",{"slug":1247,"name":1247,"fn":1248,"description":1249,"org":1250,"tags":1251,"stars":1149,"repoUrl":1150,"updatedAt":1257},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1252,1253,1256],{"name":1147,"slug":1148,"type":14},{"name":1254,"slug":1255,"type":14},"Plugin Development","plugin-development",{"name":1207,"slug":1208,"type":14},"2026-08-07T04:39:22.66861",{"slug":1259,"name":1259,"fn":1260,"description":1261,"org":1262,"tags":1263,"stars":1269,"repoUrl":1270,"updatedAt":1271},"kickstart-acr-integration","integrate Azure Container Registry with AKS","ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1264,1265,1268],{"name":11,"slug":8,"type":14},{"name":1266,"slug":1267,"type":14},"Containers","containers",{"name":1122,"slug":1123,"type":14},65,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools","2026-07-12T08:18:05.091337",124,{"items":1274,"total":1366},[1275,1288,1301,1314,1332,1339,1353],{"slug":1276,"name":1276,"fn":1277,"description":1278,"org":1279,"tags":1280,"stars":24,"repoUrl":25,"updatedAt":1287},"aks-automatic-readiness","migrate Kubernetes workloads to AKS Automatic","Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic. DO NOT USE FOR: creating a brand-new cluster (use aks-cluster-setup); debugging a running cluster (use aks-troubleshooting).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1281,1282,1283,1284],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":1128,"slug":1129,"type":14},{"name":1285,"slug":1286,"type":14},"Modernization","modernization","2026-08-23T04:00:30.817435",{"slug":1289,"name":1289,"fn":1290,"description":1291,"org":1292,"tags":1293,"stars":24,"repoUrl":25,"updatedAt":1300},"aks-cluster-setup","design and configure Azure Kubernetes Service clusters","Make the AKS-specific design decisions for a new production Azure Kubernetes Service (AKS) cluster — SKU (Automatic vs Standard), pod IP model (Azure CNI Overlay vs kubenet), API-server access, egress, identity, upgrades, node pools, and reliability — then delegate the actual provisioning to the Azure Skills deployment engine. WHEN: create AKS cluster, provision AKS environment, design AKS networking, choose AKS SKU, Day-0 AKS checklist, plan a production AKS cluster. DO NOT USE FOR: debugging a running cluster (use aks-troubleshooting); assessing an existing cluster for AKS Automatic (use aks-automatic-readiness); GPU \u002F model-serving setup (see azure-skills airunway-aks-setup); generic non-AKS Azure resource deployment (use azure-skills azure-deploy directly).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1294,1297,1298,1299],{"name":1295,"slug":1296,"type":14},"Architecture","architecture",{"name":11,"slug":8,"type":14},{"name":1122,"slug":1123,"type":14},{"name":19,"slug":20,"type":14},"2026-08-23T04:00:29.49469",{"slug":1302,"name":1302,"fn":1303,"description":1304,"org":1305,"tags":1306,"stars":24,"repoUrl":25,"updatedAt":1313},"aks-cost-optimization","optimize Azure Kubernetes Service cluster costs","Reduce Azure Kubernetes Service (AKS) spending: pod rightsizing, VPA-driven recommendations, cluster-autoscaler tuning, spot node pools, namespace-level cost visibility, and cost-anomaly detection. WHEN: rightsize pods, VPA recommendations, idle nodes, scale-down, autoscaler profile, spot nodes, cheaper compute, cost add-on, namespace cost breakdown, spending anomaly, 'my AKS bill is too high', 'is my app consuming what it requests', resource requests vs actual usage, over-provisioned workloads, spot vs on-demand, per-namespace or per-team cost allocation, 'who's spending what and why'. DO NOT USE FOR: GPU \u002F inference cost and idle GPU pools (use aks-gpu-inference); autoscaler that is failing to scale up during an incident (use aks-troubleshooting); choosing SKUs at cluster-creation time (use aks-cluster-setup).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1307,1308,1311,1312],{"name":11,"slug":8,"type":14},{"name":1309,"slug":1310,"type":14},"Cost Optimization","cost-optimization",{"name":19,"slug":20,"type":14},{"name":1231,"slug":1232,"type":14},"2026-08-23T04:00:29.864048",{"slug":1315,"name":1315,"fn":1316,"description":1317,"org":1318,"tags":1319,"stars":24,"repoUrl":25,"updatedAt":1331},"aks-gpu-inference","manage GPU inference workloads on AKS","Day-2 operations for GPU and model-inference workloads on Azure Kubernetes Service (AKS): diagnose GPU pods stuck Pending, missing nvidia.com\u002Fgpu, CUDA\u002Fdriver mismatches, model OOM on weight load, GPU vCPU-quota failures, KAITO (AI toolchain operator) Workspaces stuck not-ready, and GPU cost \u002F scale-to-zero \u002F spot eviction. WHEN: GPU pod Pending 'Insufficient nvidia.com\u002Fgpu', no nvidia.com\u002Fgpu on node, CUDA driver version insufficient, model OOMKilled loading weights, GPU node pool quota exceeded, KAITO Workspace never becomes ready, idle GPU cost, autoscale GPU on DCGM, spot GPU eviction, right-size a GPU SKU for a model. DO NOT USE FOR: initial GPU\u002FAI setup or enablement (use azure-skills airunway-aks-setup); non-GPU pod\u002Fnode\u002Fnetwork incidents (use aks-troubleshooting); non-GPU cost (use aks-cost-optimization).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1320,1321,1324,1327,1328],{"name":11,"slug":8,"type":14},{"name":1322,"slug":1323,"type":14},"CUDA","cuda",{"name":1325,"slug":1326,"type":14},"GPU","gpu",{"name":19,"slug":20,"type":14},{"name":1329,"slug":1330,"type":14},"Operations","operations","2026-08-23T04:00:03.060719",{"slug":4,"name":4,"fn":5,"description":6,"org":1333,"tags":1334,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1335,1336,1337,1338],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":16,"slug":17,"type":14},{"name":19,"slug":20,"type":14},{"slug":1090,"name":1090,"fn":1340,"description":1341,"org":1342,"tags":1343,"stars":24,"repoUrl":25,"updatedAt":1352},"capture network traffic in AKS clusters","Packet-level network evidence for AKS: run a bounded, distributed packet capture across nodes (filtered by IP, port, or tcpdump\u002FBPF expression), and collect Azure network resources (NSG rules, route tables, firewall, VNET peering) when you need pcap-level proof of where traffic drops. Escalation tool for when logs and read-only checks are inconclusive. WHEN: capture packets on a node, take a pcap, tcpdump on AKS, prove where a packet is dropped, verify an NSG or route is blocking traffic at the wire. DO NOT USE FOR: general DNS \u002F connectivity \u002F ingress troubleshooting — start with aks-troubleshooting (which routes here when a capture is actually needed).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1344,1345,1346,1349],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":1347,"slug":1348,"type":14},"Networking","networking",{"name":1350,"slug":1351,"type":14},"Observability","observability","2026-08-23T04:00:31.384775",{"slug":128,"name":128,"fn":1354,"description":1355,"org":1356,"tags":1357,"stars":24,"repoUrl":25,"updatedAt":1365},"debug and troubleshoot Azure Kubernetes Service incidents","Debug and root-cause live Azure Kubernetes Service (AKS) cluster incidents: pod crashes, node failures, DNS\u002Fnetworking, ingress\u002Fload-balancer errors, network policy, upgrade failures, and spot\u002Fzone disruptions. Runs a read-only, evidence-first investigation using the AKS MCP tools, az, and kubectl, and produces a structured incident report. WHEN: CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, pod Pending, DNS resolution failure, 502\u002F503 from ingress, connectivity timeout, upgrade stuck, cordon\u002Fdrain failure, spot eviction, SNAT exhaustion, expired certificate, 'investigate my AKS cluster'. DO NOT USE FOR: packet-level capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); creating or provisioning a cluster (use aks-cluster-setup); cost\u002Frightsizing (use aks-cost-optimization); a named, documented AKS error code or message with a known signature — e.g. VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, a vmssCSE exit code (use aks-known-issues).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1358,1359,1360,1363,1364],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":1361,"slug":1362,"type":14},"Incident Response","incident-response",{"name":19,"slug":20,"type":14},{"name":1347,"slug":1348,"type":14},"2026-08-23T04:00:21.674812",7]