[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-aks-network-capture":3,"mdc-bgaokk-key":43,"related-repo-azure-aks-network-capture":1022,"related-org-azure-aks-network-capture":1122},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":38,"sourceUrl":41,"mdContent":42},"aks-network-capture","capture network traffic in AKS clusters","Packet-level network evidence for AKS: run a bounded, distributed packet capture across nodes (filtered by IP, port, or tcpdump\u002FBPF expression), and collect Azure network resources (NSG rules, route tables, firewall, VNET peering) when you need pcap-level proof of where traffic drops. Escalation tool for when logs and read-only checks are inconclusive. WHEN: capture packets on a node, take a pcap, tcpdump on AKS, prove where a packet is dropped, verify an NSG or route is blocking traffic at the wire. DO NOT USE FOR: general DNS \u002F connectivity \u002F ingress troubleshooting — start with aks-troubleshooting (which routes here when a capture is actually needed).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,17,18,21],{"name":14,"slug":15,"type":16},"Observability","observability","tag",{"name":11,"slug":8,"type":16},{"name":19,"slug":20,"type":16},"Networking","networking",{"name":22,"slug":23,"type":16},"Kubernetes","kubernetes",3,"https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills","2026-08-23T04:00:31.384775","MIT",1,[30,31,32,8,33,34,35,23,36,37],"agent-skills","ai-agents","aks","claude","devops","github-copilot","mcp","sre-agent",{"repoUrl":25,"stars":24,"forks":28,"topics":39,"description":40},[30,31,32,8,33,34,35,23,36,37],"Agent skills for operating Azure Kubernetes Service (AKS): troubleshooting, cost, AKS Automatic readiness, GPU\u002Finference, packet capture, and cluster design. The deep Day-2 AKS operator — complements the Azure Skills plugin; works with Claude Code, GitHub Copilot, and Azure SRE Agent.","https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills\u002Ftree\u002FHEAD\u002Fskills\u002Faks-network-capture","---\nname: aks-network-capture\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.0.1\"\n  openclaw:\n    emoji: \"🔍\"\n    requires:\n      anyBins:\n        - kubectl\n        - az\ndescription: \"Packet-level network evidence for AKS: run a bounded, distributed packet capture across nodes (filtered by IP, port, or tcpdump\u002FBPF expression), and collect Azure network resources (NSG rules, route tables, firewall, VNET peering) when you need pcap-level proof of where traffic drops. Escalation tool for when logs and read-only checks are inconclusive. WHEN: capture packets on a node, take a pcap, tcpdump on AKS, prove where a packet is dropped, verify an NSG or route is blocking traffic at the wire. DO NOT USE FOR: general DNS \u002F connectivity \u002F ingress troubleshooting — start with aks-troubleshooting (which routes here when a capture is actually needed).\"\n---\n\n# AKS Network Capture\n\nCapture packet-level evidence on AKS when read-only diagnostics are inconclusive. Use this to prove *where* a packet is dropped — inside the pod, on the node, at an NSG, on a route, or at the Azure load balancer.\n\nThis is an escalation tool. For most networking symptoms (DNS, connectivity, ingress 502s), start with `aks-troubleshooting`; come here when you need a pcap or wire-level proof.\n\n## Safety model\n\nPacket capture requires elevated node access, so these scripts are built to be safe by construction:\n\n- **No shell injection.** User-supplied filters and targets are validated against strict allowlists, passed to `tcpdump` as a single trailing argument (never a shell string), and compile-checked in-pod with `tcpdump -d`. There is no `eval`. A negative regression test (`evals\u002Ftests\u002Faks-network-capture\u002Finjection.test.sh`) proves malicious inputs are rejected.\n- **Scoped access, not `privileged`.** Capture pods use only `NET_ADMIN` + `NET_RAW` with `hostNetwork`. They mount only `\u002Fvar\u002Flog\u002Faks-network-captures` from the node, never the node root, and never enable `hostPID`.\n- **Pinned images.** Capture Jobs use Microsoft Retina's network-tool image from Microsoft Container Registry, pinned by digest; no Docker Hub, no `:latest`.\n\n> The live-cluster smoke test is manual and is not run in CI. Before relying on distributed capture in production, run `evals\u002Ftests\u002Faks-network-capture\u002Fsmoke-live-cluster.sh` against an AKS cluster you control; it uses an isolated namespace, generates bounded same-node DNS traffic, retrieves the exact run, decodes packet records, and verifies Kubernetes plus host-artifact cleanup.\n\n## Capture workflow\n\n| Script | Purpose |\n|--------|---------|\n| `scripts\u002Fsetup-capture-configmap.sh` | Deploy the fixed capture runner to a namespace (run once per namespace) |\n| `scripts\u002Fcreate-capture.sh` | Start a bounded capture Job on the selected nodes\u002Fpods |\n| `scripts\u002Fretrieve-captures.sh` | Pull capture bundles off the nodes and clean up |\n| `scripts\u002Fgenerate-test-traffic.sh` | Drive test traffic from a pod's netns while capturing |\n| `scripts\u002Fcollect-azure-network-info.sh` | Collect the Azure-side network config for the cluster |\n\n```bash\n# Install the fixed capture runner in the namespace\n.\u002Fscripts\u002Fsetup-capture-configmap.sh default\n\n# Capture DNS traffic across all Linux nodes for 2 minutes\n.\u002Fscripts\u002Fcreate-capture.sh --name dns-debug --tcpdump-filter \"udp port 53\" --duration 120s\n\n# Capture for specific pods (resolves each pod to its host node and narrows to the pod IPs)\n.\u002Fscripts\u002Fsetup-capture-configmap.sh production\n.\u002Fscripts\u002Fcreate-capture.sh --name frontend --pod-selector \"app=frontend\" --namespace production\n\n# Retrieve and clean up\n.\u002Fscripts\u002Fretrieve-captures.sh --name dns-debug\n```\n\n`create-capture.sh` targeting flags: `--node-selector`, `--node-names`, `--pod-selector`, `--pod-names` (with `--namespace`). The same namespace contains the ConfigMap and capture Jobs; pass it to `retrieve-captures.sh --namespace` as well. Creation prints the run ID; pass `--run-id` during retrieval when a capture name has multiple runs. Capture flags: `--duration` (max 30m), `--packet-size`, `--tcpdump-filter`. The filter must be a plain BPF expression — no flags, no shell metacharacters.\n\n## Azure-side analysis (AKS)\n\nA dropped packet often dies in the Azure network layer, not in Kubernetes. After (or instead of) a capture, run `scripts\u002Fcollect-azure-network-info.sh` and check, in order:\n\n- **NSG** — rules on the node subnet and NICs. Effective rules: `az network nic list-effective-nsg --ids \u003Cnode-nic-id>`.\n- **Routes \u002F UDR** — user-defined routes that redirect or blackhole traffic. Effective: `az network nic show-effective-route-table --ids \u003Cnode-nic-id> -o table`.\n- **Azure Firewall** — if egress is forced through a firewall via UDR.\n- **VNET peering** — for cross-VNET flows.\n- **Load balancer** — backend pools and health-probe path\u002Fport for inbound Services.\n- **Service \u002F private endpoints** — for reaching Azure PaaS (SQL, Storage, Key Vault).\n- **Private DNS** — the script enumerates zones subscription-wide, because a zone linked to the cluster VNET frequently lives in a *different* resource group than the cluster.\n\n### Egress to Azure PaaS fails (Azure SQL, Storage, Key Vault)\n\nWhen pod-to-pod (east-west) traffic works but egress to external Azure services fails, the fault is almost always in the **Azure network layer**, not the cluster CNI. Investigate in order, before concluding it is DNS:\n\n1. **NSG rules on the node subnet (and NIC)** — outbound `Deny` rules blocking the destination port\u002Fservice tag (`Sql`, `Storage`, `AzureCloud`). Most common cause; inspect first.\n2. **Route tables \u002F UDR** — a `0.0.0.0\u002F0` route to a firewall\u002FNVA can black-hole or redirect PaaS-bound traffic. Confirm the effective routes on the subnet.\n3. **Service \u002F private endpoints** — verify the service endpoint is enabled on the subnet, or that the private endpoint's DNS resolves to the private IP and the NSG\u002Froute path to it is open.\n4. **Azure Firewall \u002F NVA** — if egress is forced through the firewall, confirm an application\u002Fnetwork rule allows the destination FQDN or service tag.\n5. **DNS** — only after the above, confirm the FQDN resolves to the intended (public vs. privatelink) endpoint.\n\n`scripts\u002Fcollect-azure-network-info.sh` gathers the NSG rules, route tables, firewall config, and endpoint state to identify which layer blocks the flow.\n\n## Successful vs. broken flow\n\nWhen you have the pcap and the Azure config, map the path and mark where it breaks:\n\n```mermaid\ngraph LR\n    A[Source Pod\u003Cbr\u002F>10.244.1.5] -->|1. veth| B[Node netns]\n    B -->|2. iptables\u002FCNI| C[Routing]\n    C -->|3. NSG \u002F UDR| D[Azure fabric]\n    D -->|4. FORWARD allow| E[Dest Pod\u003Cbr\u002F>10.244.2.8:8443]\n```\n\nHighlight the first hop where the packet is absent in the capture or denied by an NSG\u002Froute rule — that is the failure domain.\n\n## Analysis checklist\n\n1. Extract the retrieved tarballs and open the pcap (`tcpdump -r \u003Cfile>`); confirm whether the traffic was seen at all.\n2. Cross-reference with the Azure network config (`collect-azure-network-info.sh` output).\n3. If the pcap is empty, drive traffic with `generate-test-traffic.sh` during a fresh capture.\n4. Report the failure domain and the evidence (the exact rule, route, or missing hop).\n",{"data":44,"body":54},{"name":4,"license":27,"metadata":45,"description":6},{"author":46,"version":47,"openclaw":48},"Microsoft","1.0.1",{"emoji":49,"requires":50},"🔍",{"anyBins":51},[52,53],"kubectl","az",{"type":55,"children":56},"root",[57,65,79,93,100,105,227,244,250,363,578,666,672,684,778,785,797,888,898,904,909,958,963,969,1016],{"type":58,"tag":59,"props":60,"children":61},"element","h1",{"id":4},[62],{"type":63,"value":64},"text","AKS Network Capture",{"type":58,"tag":66,"props":67,"children":68},"p",{},[69,71,77],{"type":63,"value":70},"Capture packet-level evidence on AKS when read-only diagnostics are inconclusive. Use this to prove ",{"type":58,"tag":72,"props":73,"children":74},"em",{},[75],{"type":63,"value":76},"where",{"type":63,"value":78}," a packet is dropped — inside the pod, on the node, at an NSG, on a route, or at the Azure load balancer.",{"type":58,"tag":66,"props":80,"children":81},{},[82,84,91],{"type":63,"value":83},"This is an escalation tool. For most networking symptoms (DNS, connectivity, ingress 502s), start with ",{"type":58,"tag":85,"props":86,"children":88},"code",{"className":87},[],[89],{"type":63,"value":90},"aks-troubleshooting",{"type":63,"value":92},"; come here when you need a pcap or wire-level proof.",{"type":58,"tag":94,"props":95,"children":97},"h2",{"id":96},"safety-model",[98],{"type":63,"value":99},"Safety model",{"type":58,"tag":66,"props":101,"children":102},{},[103],{"type":63,"value":104},"Packet capture requires elevated node access, so these scripts are built to be safe by construction:",{"type":58,"tag":106,"props":107,"children":108},"ul",{},[109,153,210],{"type":58,"tag":110,"props":111,"children":112},"li",{},[113,119,121,127,129,135,137,143,145,151],{"type":58,"tag":114,"props":115,"children":116},"strong",{},[117],{"type":63,"value":118},"No shell injection.",{"type":63,"value":120}," User-supplied filters and targets are validated against strict allowlists, passed to ",{"type":58,"tag":85,"props":122,"children":124},{"className":123},[],[125],{"type":63,"value":126},"tcpdump",{"type":63,"value":128}," as a single trailing argument (never a shell string), and compile-checked in-pod with ",{"type":58,"tag":85,"props":130,"children":132},{"className":131},[],[133],{"type":63,"value":134},"tcpdump -d",{"type":63,"value":136},". There is no ",{"type":58,"tag":85,"props":138,"children":140},{"className":139},[],[141],{"type":63,"value":142},"eval",{"type":63,"value":144},". A negative regression test (",{"type":58,"tag":85,"props":146,"children":148},{"className":147},[],[149],{"type":63,"value":150},"evals\u002Ftests\u002Faks-network-capture\u002Finjection.test.sh",{"type":63,"value":152},") proves malicious inputs are rejected.",{"type":58,"tag":110,"props":154,"children":155},{},[156,169,171,177,179,185,187,193,195,201,203,209],{"type":58,"tag":114,"props":157,"children":158},{},[159,161,167],{"type":63,"value":160},"Scoped access, not ",{"type":58,"tag":85,"props":162,"children":164},{"className":163},[],[165],{"type":63,"value":166},"privileged",{"type":63,"value":168},".",{"type":63,"value":170}," Capture pods use only ",{"type":58,"tag":85,"props":172,"children":174},{"className":173},[],[175],{"type":63,"value":176},"NET_ADMIN",{"type":63,"value":178}," + ",{"type":58,"tag":85,"props":180,"children":182},{"className":181},[],[183],{"type":63,"value":184},"NET_RAW",{"type":63,"value":186}," with ",{"type":58,"tag":85,"props":188,"children":190},{"className":189},[],[191],{"type":63,"value":192},"hostNetwork",{"type":63,"value":194},". They mount only ",{"type":58,"tag":85,"props":196,"children":198},{"className":197},[],[199],{"type":63,"value":200},"\u002Fvar\u002Flog\u002Faks-network-captures",{"type":63,"value":202}," from the node, never the node root, and never enable ",{"type":58,"tag":85,"props":204,"children":206},{"className":205},[],[207],{"type":63,"value":208},"hostPID",{"type":63,"value":168},{"type":58,"tag":110,"props":211,"children":212},{},[213,218,220,226],{"type":58,"tag":114,"props":214,"children":215},{},[216],{"type":63,"value":217},"Pinned images.",{"type":63,"value":219}," Capture Jobs use Microsoft Retina's network-tool image from Microsoft Container Registry, pinned by digest; no Docker Hub, no ",{"type":58,"tag":85,"props":221,"children":223},{"className":222},[],[224],{"type":63,"value":225},":latest",{"type":63,"value":168},{"type":58,"tag":228,"props":229,"children":230},"blockquote",{},[231],{"type":58,"tag":66,"props":232,"children":233},{},[234,236,242],{"type":63,"value":235},"The live-cluster smoke test is manual and is not run in CI. Before relying on distributed capture in production, run ",{"type":58,"tag":85,"props":237,"children":239},{"className":238},[],[240],{"type":63,"value":241},"evals\u002Ftests\u002Faks-network-capture\u002Fsmoke-live-cluster.sh",{"type":63,"value":243}," against an AKS cluster you control; it uses an isolated namespace, generates bounded same-node DNS traffic, retrieves the exact run, decodes packet records, and verifies Kubernetes plus host-artifact cleanup.",{"type":58,"tag":94,"props":245,"children":247},{"id":246},"capture-workflow",[248],{"type":63,"value":249},"Capture workflow",{"type":58,"tag":251,"props":252,"children":253},"table",{},[254,273],{"type":58,"tag":255,"props":256,"children":257},"thead",{},[258],{"type":58,"tag":259,"props":260,"children":261},"tr",{},[262,268],{"type":58,"tag":263,"props":264,"children":265},"th",{},[266],{"type":63,"value":267},"Script",{"type":58,"tag":263,"props":269,"children":270},{},[271],{"type":63,"value":272},"Purpose",{"type":58,"tag":274,"props":275,"children":276},"tbody",{},[277,295,312,329,346],{"type":58,"tag":259,"props":278,"children":279},{},[280,290],{"type":58,"tag":281,"props":282,"children":283},"td",{},[284],{"type":58,"tag":85,"props":285,"children":287},{"className":286},[],[288],{"type":63,"value":289},"scripts\u002Fsetup-capture-configmap.sh",{"type":58,"tag":281,"props":291,"children":292},{},[293],{"type":63,"value":294},"Deploy the fixed capture runner to a namespace (run once per namespace)",{"type":58,"tag":259,"props":296,"children":297},{},[298,307],{"type":58,"tag":281,"props":299,"children":300},{},[301],{"type":58,"tag":85,"props":302,"children":304},{"className":303},[],[305],{"type":63,"value":306},"scripts\u002Fcreate-capture.sh",{"type":58,"tag":281,"props":308,"children":309},{},[310],{"type":63,"value":311},"Start a bounded capture Job on the selected nodes\u002Fpods",{"type":58,"tag":259,"props":313,"children":314},{},[315,324],{"type":58,"tag":281,"props":316,"children":317},{},[318],{"type":58,"tag":85,"props":319,"children":321},{"className":320},[],[322],{"type":63,"value":323},"scripts\u002Fretrieve-captures.sh",{"type":58,"tag":281,"props":325,"children":326},{},[327],{"type":63,"value":328},"Pull capture bundles off the nodes and clean up",{"type":58,"tag":259,"props":330,"children":331},{},[332,341],{"type":58,"tag":281,"props":333,"children":334},{},[335],{"type":58,"tag":85,"props":336,"children":338},{"className":337},[],[339],{"type":63,"value":340},"scripts\u002Fgenerate-test-traffic.sh",{"type":58,"tag":281,"props":342,"children":343},{},[344],{"type":63,"value":345},"Drive test traffic from a pod's netns while capturing",{"type":58,"tag":259,"props":347,"children":348},{},[349,358],{"type":58,"tag":281,"props":350,"children":351},{},[352],{"type":58,"tag":85,"props":353,"children":355},{"className":354},[],[356],{"type":63,"value":357},"scripts\u002Fcollect-azure-network-info.sh",{"type":58,"tag":281,"props":359,"children":360},{},[361],{"type":63,"value":362},"Collect the Azure-side network config for the cluster",{"type":58,"tag":364,"props":365,"children":370},"pre",{"className":366,"code":367,"language":368,"meta":369,"style":369},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Install the fixed capture runner in the namespace\n.\u002Fscripts\u002Fsetup-capture-configmap.sh default\n\n# Capture DNS traffic across all Linux nodes for 2 minutes\n.\u002Fscripts\u002Fcreate-capture.sh --name dns-debug --tcpdump-filter \"udp port 53\" --duration 120s\n\n# Capture for specific pods (resolves each pod to its host node and narrows to the pod IPs)\n.\u002Fscripts\u002Fsetup-capture-configmap.sh production\n.\u002Fscripts\u002Fcreate-capture.sh --name frontend --pod-selector \"app=frontend\" --namespace production\n\n# Retrieve and clean up\n.\u002Fscripts\u002Fretrieve-captures.sh --name dns-debug\n","bash","",[371],{"type":58,"tag":85,"props":372,"children":373},{"__ignoreMap":369},[374,385,401,410,419,469,477,486,499,543,551,560],{"type":58,"tag":375,"props":376,"children":378},"span",{"class":377,"line":28},"line",[379],{"type":58,"tag":375,"props":380,"children":382},{"style":381},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[383],{"type":63,"value":384},"# Install the fixed capture runner in the namespace\n",{"type":58,"tag":375,"props":386,"children":388},{"class":377,"line":387},2,[389,395],{"type":58,"tag":375,"props":390,"children":392},{"style":391},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[393],{"type":63,"value":394},".\u002Fscripts\u002Fsetup-capture-configmap.sh",{"type":58,"tag":375,"props":396,"children":398},{"style":397},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[399],{"type":63,"value":400}," default\n",{"type":58,"tag":375,"props":402,"children":403},{"class":377,"line":24},[404],{"type":58,"tag":375,"props":405,"children":407},{"emptyLinePlaceholder":406},true,[408],{"type":63,"value":409},"\n",{"type":58,"tag":375,"props":411,"children":413},{"class":377,"line":412},4,[414],{"type":58,"tag":375,"props":415,"children":416},{"style":381},[417],{"type":63,"value":418},"# Capture DNS traffic across all Linux nodes for 2 minutes\n",{"type":58,"tag":375,"props":420,"children":422},{"class":377,"line":421},5,[423,428,433,438,443,449,454,459,464],{"type":58,"tag":375,"props":424,"children":425},{"style":391},[426],{"type":63,"value":427},".\u002Fscripts\u002Fcreate-capture.sh",{"type":58,"tag":375,"props":429,"children":430},{"style":397},[431],{"type":63,"value":432}," --name",{"type":58,"tag":375,"props":434,"children":435},{"style":397},[436],{"type":63,"value":437}," dns-debug",{"type":58,"tag":375,"props":439,"children":440},{"style":397},[441],{"type":63,"value":442}," --tcpdump-filter",{"type":58,"tag":375,"props":444,"children":446},{"style":445},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[447],{"type":63,"value":448}," \"",{"type":58,"tag":375,"props":450,"children":451},{"style":397},[452],{"type":63,"value":453},"udp port 53",{"type":58,"tag":375,"props":455,"children":456},{"style":445},[457],{"type":63,"value":458},"\"",{"type":58,"tag":375,"props":460,"children":461},{"style":397},[462],{"type":63,"value":463}," --duration",{"type":58,"tag":375,"props":465,"children":466},{"style":397},[467],{"type":63,"value":468}," 120s\n",{"type":58,"tag":375,"props":470,"children":472},{"class":377,"line":471},6,[473],{"type":58,"tag":375,"props":474,"children":475},{"emptyLinePlaceholder":406},[476],{"type":63,"value":409},{"type":58,"tag":375,"props":478,"children":480},{"class":377,"line":479},7,[481],{"type":58,"tag":375,"props":482,"children":483},{"style":381},[484],{"type":63,"value":485},"# Capture for specific pods (resolves each pod to its host node and narrows to the pod IPs)\n",{"type":58,"tag":375,"props":487,"children":489},{"class":377,"line":488},8,[490,494],{"type":58,"tag":375,"props":491,"children":492},{"style":391},[493],{"type":63,"value":394},{"type":58,"tag":375,"props":495,"children":496},{"style":397},[497],{"type":63,"value":498}," production\n",{"type":58,"tag":375,"props":500,"children":502},{"class":377,"line":501},9,[503,507,511,516,521,525,530,534,539],{"type":58,"tag":375,"props":504,"children":505},{"style":391},[506],{"type":63,"value":427},{"type":58,"tag":375,"props":508,"children":509},{"style":397},[510],{"type":63,"value":432},{"type":58,"tag":375,"props":512,"children":513},{"style":397},[514],{"type":63,"value":515}," frontend",{"type":58,"tag":375,"props":517,"children":518},{"style":397},[519],{"type":63,"value":520}," --pod-selector",{"type":58,"tag":375,"props":522,"children":523},{"style":445},[524],{"type":63,"value":448},{"type":58,"tag":375,"props":526,"children":527},{"style":397},[528],{"type":63,"value":529},"app=frontend",{"type":58,"tag":375,"props":531,"children":532},{"style":445},[533],{"type":63,"value":458},{"type":58,"tag":375,"props":535,"children":536},{"style":397},[537],{"type":63,"value":538}," --namespace",{"type":58,"tag":375,"props":540,"children":541},{"style":397},[542],{"type":63,"value":498},{"type":58,"tag":375,"props":544,"children":546},{"class":377,"line":545},10,[547],{"type":58,"tag":375,"props":548,"children":549},{"emptyLinePlaceholder":406},[550],{"type":63,"value":409},{"type":58,"tag":375,"props":552,"children":554},{"class":377,"line":553},11,[555],{"type":58,"tag":375,"props":556,"children":557},{"style":381},[558],{"type":63,"value":559},"# Retrieve and clean up\n",{"type":58,"tag":375,"props":561,"children":563},{"class":377,"line":562},12,[564,569,573],{"type":58,"tag":375,"props":565,"children":566},{"style":391},[567],{"type":63,"value":568},".\u002Fscripts\u002Fretrieve-captures.sh",{"type":58,"tag":375,"props":570,"children":571},{"style":397},[572],{"type":63,"value":432},{"type":58,"tag":375,"props":574,"children":575},{"style":397},[576],{"type":63,"value":577}," dns-debug\n",{"type":58,"tag":66,"props":579,"children":580},{},[581,587,589,595,597,603,604,610,611,617,619,625,627,633,635,641,643,649,651,657,658,664],{"type":58,"tag":85,"props":582,"children":584},{"className":583},[],[585],{"type":63,"value":586},"create-capture.sh",{"type":63,"value":588}," targeting flags: ",{"type":58,"tag":85,"props":590,"children":592},{"className":591},[],[593],{"type":63,"value":594},"--node-selector",{"type":63,"value":596},", ",{"type":58,"tag":85,"props":598,"children":600},{"className":599},[],[601],{"type":63,"value":602},"--node-names",{"type":63,"value":596},{"type":58,"tag":85,"props":605,"children":607},{"className":606},[],[608],{"type":63,"value":609},"--pod-selector",{"type":63,"value":596},{"type":58,"tag":85,"props":612,"children":614},{"className":613},[],[615],{"type":63,"value":616},"--pod-names",{"type":63,"value":618}," (with ",{"type":58,"tag":85,"props":620,"children":622},{"className":621},[],[623],{"type":63,"value":624},"--namespace",{"type":63,"value":626},"). The same namespace contains the ConfigMap and capture Jobs; pass it to ",{"type":58,"tag":85,"props":628,"children":630},{"className":629},[],[631],{"type":63,"value":632},"retrieve-captures.sh --namespace",{"type":63,"value":634}," as well. Creation prints the run ID; pass ",{"type":58,"tag":85,"props":636,"children":638},{"className":637},[],[639],{"type":63,"value":640},"--run-id",{"type":63,"value":642}," during retrieval when a capture name has multiple runs. Capture flags: ",{"type":58,"tag":85,"props":644,"children":646},{"className":645},[],[647],{"type":63,"value":648},"--duration",{"type":63,"value":650}," (max 30m), ",{"type":58,"tag":85,"props":652,"children":654},{"className":653},[],[655],{"type":63,"value":656},"--packet-size",{"type":63,"value":596},{"type":58,"tag":85,"props":659,"children":661},{"className":660},[],[662],{"type":63,"value":663},"--tcpdump-filter",{"type":63,"value":665},". The filter must be a plain BPF expression — no flags, no shell metacharacters.",{"type":58,"tag":94,"props":667,"children":669},{"id":668},"azure-side-analysis-aks",[670],{"type":63,"value":671},"Azure-side analysis (AKS)",{"type":58,"tag":66,"props":673,"children":674},{},[675,677,682],{"type":63,"value":676},"A dropped packet often dies in the Azure network layer, not in Kubernetes. After (or instead of) a capture, run ",{"type":58,"tag":85,"props":678,"children":680},{"className":679},[],[681],{"type":63,"value":357},{"type":63,"value":683}," and check, in order:",{"type":58,"tag":106,"props":685,"children":686},{},[687,704,721,731,741,751,761],{"type":58,"tag":110,"props":688,"children":689},{},[690,695,697,703],{"type":58,"tag":114,"props":691,"children":692},{},[693],{"type":63,"value":694},"NSG",{"type":63,"value":696}," — rules on the node subnet and NICs. Effective rules: ",{"type":58,"tag":85,"props":698,"children":700},{"className":699},[],[701],{"type":63,"value":702},"az network nic list-effective-nsg --ids \u003Cnode-nic-id>",{"type":63,"value":168},{"type":58,"tag":110,"props":705,"children":706},{},[707,712,714,720],{"type":58,"tag":114,"props":708,"children":709},{},[710],{"type":63,"value":711},"Routes \u002F UDR",{"type":63,"value":713}," — user-defined routes that redirect or blackhole traffic. Effective: ",{"type":58,"tag":85,"props":715,"children":717},{"className":716},[],[718],{"type":63,"value":719},"az network nic show-effective-route-table --ids \u003Cnode-nic-id> -o table",{"type":63,"value":168},{"type":58,"tag":110,"props":722,"children":723},{},[724,729],{"type":58,"tag":114,"props":725,"children":726},{},[727],{"type":63,"value":728},"Azure Firewall",{"type":63,"value":730}," — if egress is forced through a firewall via UDR.",{"type":58,"tag":110,"props":732,"children":733},{},[734,739],{"type":58,"tag":114,"props":735,"children":736},{},[737],{"type":63,"value":738},"VNET peering",{"type":63,"value":740}," — for cross-VNET flows.",{"type":58,"tag":110,"props":742,"children":743},{},[744,749],{"type":58,"tag":114,"props":745,"children":746},{},[747],{"type":63,"value":748},"Load balancer",{"type":63,"value":750}," — backend pools and health-probe path\u002Fport for inbound Services.",{"type":58,"tag":110,"props":752,"children":753},{},[754,759],{"type":58,"tag":114,"props":755,"children":756},{},[757],{"type":63,"value":758},"Service \u002F private endpoints",{"type":63,"value":760}," — for reaching Azure PaaS (SQL, Storage, Key Vault).",{"type":58,"tag":110,"props":762,"children":763},{},[764,769,771,776],{"type":58,"tag":114,"props":765,"children":766},{},[767],{"type":63,"value":768},"Private DNS",{"type":63,"value":770}," — the script enumerates zones subscription-wide, because a zone linked to the cluster VNET frequently lives in a ",{"type":58,"tag":72,"props":772,"children":773},{},[774],{"type":63,"value":775},"different",{"type":63,"value":777}," resource group than the cluster.",{"type":58,"tag":779,"props":780,"children":782},"h3",{"id":781},"egress-to-azure-paas-fails-azure-sql-storage-key-vault",[783],{"type":63,"value":784},"Egress to Azure PaaS fails (Azure SQL, Storage, Key Vault)",{"type":58,"tag":66,"props":786,"children":787},{},[788,790,795],{"type":63,"value":789},"When pod-to-pod (east-west) traffic works but egress to external Azure services fails, the fault is almost always in the ",{"type":58,"tag":114,"props":791,"children":792},{},[793],{"type":63,"value":794},"Azure network layer",{"type":63,"value":796},", not the cluster CNI. Investigate in order, before concluding it is DNS:",{"type":58,"tag":798,"props":799,"children":800},"ol",{},[801,841,859,868,878],{"type":58,"tag":110,"props":802,"children":803},{},[804,809,811,817,819,825,826,832,833,839],{"type":58,"tag":114,"props":805,"children":806},{},[807],{"type":63,"value":808},"NSG rules on the node subnet (and NIC)",{"type":63,"value":810}," — outbound ",{"type":58,"tag":85,"props":812,"children":814},{"className":813},[],[815],{"type":63,"value":816},"Deny",{"type":63,"value":818}," rules blocking the destination port\u002Fservice tag (",{"type":58,"tag":85,"props":820,"children":822},{"className":821},[],[823],{"type":63,"value":824},"Sql",{"type":63,"value":596},{"type":58,"tag":85,"props":827,"children":829},{"className":828},[],[830],{"type":63,"value":831},"Storage",{"type":63,"value":596},{"type":58,"tag":85,"props":834,"children":836},{"className":835},[],[837],{"type":63,"value":838},"AzureCloud",{"type":63,"value":840},"). Most common cause; inspect first.",{"type":58,"tag":110,"props":842,"children":843},{},[844,849,851,857],{"type":58,"tag":114,"props":845,"children":846},{},[847],{"type":63,"value":848},"Route tables \u002F UDR",{"type":63,"value":850}," — a ",{"type":58,"tag":85,"props":852,"children":854},{"className":853},[],[855],{"type":63,"value":856},"0.0.0.0\u002F0",{"type":63,"value":858}," route to a firewall\u002FNVA can black-hole or redirect PaaS-bound traffic. Confirm the effective routes on the subnet.",{"type":58,"tag":110,"props":860,"children":861},{},[862,866],{"type":58,"tag":114,"props":863,"children":864},{},[865],{"type":63,"value":758},{"type":63,"value":867}," — verify the service endpoint is enabled on the subnet, or that the private endpoint's DNS resolves to the private IP and the NSG\u002Froute path to it is open.",{"type":58,"tag":110,"props":869,"children":870},{},[871,876],{"type":58,"tag":114,"props":872,"children":873},{},[874],{"type":63,"value":875},"Azure Firewall \u002F NVA",{"type":63,"value":877}," — if egress is forced through the firewall, confirm an application\u002Fnetwork rule allows the destination FQDN or service tag.",{"type":58,"tag":110,"props":879,"children":880},{},[881,886],{"type":58,"tag":114,"props":882,"children":883},{},[884],{"type":63,"value":885},"DNS",{"type":63,"value":887}," — only after the above, confirm the FQDN resolves to the intended (public vs. privatelink) endpoint.",{"type":58,"tag":66,"props":889,"children":890},{},[891,896],{"type":58,"tag":85,"props":892,"children":894},{"className":893},[],[895],{"type":63,"value":357},{"type":63,"value":897}," gathers the NSG rules, route tables, firewall config, and endpoint state to identify which layer blocks the flow.",{"type":58,"tag":94,"props":899,"children":901},{"id":900},"successful-vs-broken-flow",[902],{"type":63,"value":903},"Successful vs. broken flow",{"type":58,"tag":66,"props":905,"children":906},{},[907],{"type":63,"value":908},"When you have the pcap and the Azure config, map the path and mark where it breaks:",{"type":58,"tag":364,"props":910,"children":914},{"className":911,"code":912,"language":913,"meta":369,"style":369},"language-mermaid shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","graph LR\n    A[Source Pod\u003Cbr\u002F>10.244.1.5] -->|1. veth| B[Node netns]\n    B -->|2. iptables\u002FCNI| C[Routing]\n    C -->|3. NSG \u002F UDR| D[Azure fabric]\n    D -->|4. FORWARD allow| E[Dest Pod\u003Cbr\u002F>10.244.2.8:8443]\n","mermaid",[915],{"type":58,"tag":85,"props":916,"children":917},{"__ignoreMap":369},[918,926,934,942,950],{"type":58,"tag":375,"props":919,"children":920},{"class":377,"line":28},[921],{"type":58,"tag":375,"props":922,"children":923},{},[924],{"type":63,"value":925},"graph LR\n",{"type":58,"tag":375,"props":927,"children":928},{"class":377,"line":387},[929],{"type":58,"tag":375,"props":930,"children":931},{},[932],{"type":63,"value":933},"    A[Source Pod\u003Cbr\u002F>10.244.1.5] -->|1. veth| B[Node netns]\n",{"type":58,"tag":375,"props":935,"children":936},{"class":377,"line":24},[937],{"type":58,"tag":375,"props":938,"children":939},{},[940],{"type":63,"value":941},"    B -->|2. iptables\u002FCNI| C[Routing]\n",{"type":58,"tag":375,"props":943,"children":944},{"class":377,"line":412},[945],{"type":58,"tag":375,"props":946,"children":947},{},[948],{"type":63,"value":949},"    C -->|3. NSG \u002F UDR| D[Azure fabric]\n",{"type":58,"tag":375,"props":951,"children":952},{"class":377,"line":421},[953],{"type":58,"tag":375,"props":954,"children":955},{},[956],{"type":63,"value":957},"    D -->|4. FORWARD allow| E[Dest Pod\u003Cbr\u002F>10.244.2.8:8443]\n",{"type":58,"tag":66,"props":959,"children":960},{},[961],{"type":63,"value":962},"Highlight the first hop where the packet is absent in the capture or denied by an NSG\u002Froute rule — that is the failure domain.",{"type":58,"tag":94,"props":964,"children":966},{"id":965},"analysis-checklist",[967],{"type":63,"value":968},"Analysis checklist",{"type":58,"tag":798,"props":970,"children":971},{},[972,985,998,1011],{"type":58,"tag":110,"props":973,"children":974},{},[975,977,983],{"type":63,"value":976},"Extract the retrieved tarballs and open the pcap (",{"type":58,"tag":85,"props":978,"children":980},{"className":979},[],[981],{"type":63,"value":982},"tcpdump -r \u003Cfile>",{"type":63,"value":984},"); confirm whether the traffic was seen at all.",{"type":58,"tag":110,"props":986,"children":987},{},[988,990,996],{"type":63,"value":989},"Cross-reference with the Azure network config (",{"type":58,"tag":85,"props":991,"children":993},{"className":992},[],[994],{"type":63,"value":995},"collect-azure-network-info.sh",{"type":63,"value":997}," output).",{"type":58,"tag":110,"props":999,"children":1000},{},[1001,1003,1009],{"type":63,"value":1002},"If the pcap is empty, drive traffic with ",{"type":58,"tag":85,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":63,"value":1008},"generate-test-traffic.sh",{"type":63,"value":1010}," during a fresh capture.",{"type":58,"tag":110,"props":1012,"children":1013},{},[1014],{"type":63,"value":1015},"Report the failure domain and the evidence (the exact rule, route, or missing hop).",{"type":58,"tag":1017,"props":1018,"children":1019},"style",{},[1020],{"type":63,"value":1021},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1023,"total":479},[1024,1039,1054,1069,1087,1102,1109],{"slug":1025,"name":1025,"fn":1026,"description":1027,"org":1028,"tags":1029,"stars":24,"repoUrl":25,"updatedAt":1038},"aks-automatic-readiness","migrate Kubernetes workloads to AKS Automatic","Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic. DO NOT USE FOR: creating a brand-new cluster (use aks-cluster-setup); debugging a running cluster (use aks-troubleshooting).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1030,1031,1032,1035],{"name":11,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":1033,"slug":1034,"type":16},"Migration","migration",{"name":1036,"slug":1037,"type":16},"Modernization","modernization","2026-08-23T04:00:30.817435",{"slug":1040,"name":1040,"fn":1041,"description":1042,"org":1043,"tags":1044,"stars":24,"repoUrl":25,"updatedAt":1053},"aks-cluster-setup","design and configure Azure Kubernetes Service clusters","Make the AKS-specific design decisions for a new production Azure Kubernetes Service (AKS) cluster — SKU (Automatic vs Standard), pod IP model (Azure CNI Overlay vs kubenet), API-server access, egress, identity, upgrades, node pools, and reliability — then delegate the actual provisioning to the Azure Skills deployment engine. WHEN: create AKS cluster, provision AKS environment, design AKS networking, choose AKS SKU, Day-0 AKS checklist, plan a production AKS cluster. DO NOT USE FOR: debugging a running cluster (use aks-troubleshooting); assessing an existing cluster for AKS Automatic (use aks-automatic-readiness); GPU \u002F model-serving setup (see azure-skills airunway-aks-setup); generic non-AKS Azure resource deployment (use azure-skills azure-deploy directly).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1045,1048,1049,1052],{"name":1046,"slug":1047,"type":16},"Architecture","architecture",{"name":11,"slug":8,"type":16},{"name":1050,"slug":1051,"type":16},"Deployment","deployment",{"name":22,"slug":23,"type":16},"2026-08-23T04:00:29.49469",{"slug":1055,"name":1055,"fn":1056,"description":1057,"org":1058,"tags":1059,"stars":24,"repoUrl":25,"updatedAt":1068},"aks-cost-optimization","optimize Azure Kubernetes Service cluster costs","Reduce Azure Kubernetes Service (AKS) spending: pod rightsizing, VPA-driven recommendations, cluster-autoscaler tuning, spot node pools, namespace-level cost visibility, and cost-anomaly detection. WHEN: rightsize pods, VPA recommendations, idle nodes, scale-down, autoscaler profile, spot nodes, cheaper compute, cost add-on, namespace cost breakdown, spending anomaly, 'my AKS bill is too high', 'is my app consuming what it requests', resource requests vs actual usage, over-provisioned workloads, spot vs on-demand, per-namespace or per-team cost allocation, 'who's spending what and why'. DO NOT USE FOR: GPU \u002F inference cost and idle GPU pools (use aks-gpu-inference); autoscaler that is failing to scale up during an incident (use aks-troubleshooting); choosing SKUs at cluster-creation time (use aks-cluster-setup).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1060,1061,1064,1065],{"name":11,"slug":8,"type":16},{"name":1062,"slug":1063,"type":16},"Cost Optimization","cost-optimization",{"name":22,"slug":23,"type":16},{"name":1066,"slug":1067,"type":16},"Performance","performance","2026-08-23T04:00:29.864048",{"slug":1070,"name":1070,"fn":1071,"description":1072,"org":1073,"tags":1074,"stars":24,"repoUrl":25,"updatedAt":1086},"aks-gpu-inference","manage GPU inference workloads on AKS","Day-2 operations for GPU and model-inference workloads on Azure Kubernetes Service (AKS): diagnose GPU pods stuck Pending, missing nvidia.com\u002Fgpu, CUDA\u002Fdriver mismatches, model OOM on weight load, GPU vCPU-quota failures, KAITO (AI toolchain operator) Workspaces stuck not-ready, and GPU cost \u002F scale-to-zero \u002F spot eviction. WHEN: GPU pod Pending 'Insufficient nvidia.com\u002Fgpu', no nvidia.com\u002Fgpu on node, CUDA driver version insufficient, model OOMKilled loading weights, GPU node pool quota exceeded, KAITO Workspace never becomes ready, idle GPU cost, autoscale GPU on DCGM, spot GPU eviction, right-size a GPU SKU for a model. DO NOT USE FOR: initial GPU\u002FAI setup or enablement (use azure-skills airunway-aks-setup); non-GPU pod\u002Fnode\u002Fnetwork incidents (use aks-troubleshooting); non-GPU cost (use aks-cost-optimization).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1075,1076,1079,1082,1083],{"name":11,"slug":8,"type":16},{"name":1077,"slug":1078,"type":16},"CUDA","cuda",{"name":1080,"slug":1081,"type":16},"GPU","gpu",{"name":22,"slug":23,"type":16},{"name":1084,"slug":1085,"type":16},"Operations","operations","2026-08-23T04:00:03.060719",{"slug":1088,"name":1088,"fn":1089,"description":1090,"org":1091,"tags":1092,"stars":24,"repoUrl":25,"updatedAt":1101},"aks-known-issues","diagnose AKS failures using known issue tables","Match an AKS operation failure against a curated, versioned table of documented known issues and error codes — each entry carrying the cause and the Microsoft-documented fix, workaround, or platform limitation. Deterministic error-string → diagnosis lookup for specific, named failures: AKS VM-extension \u002F CSE provisioning errors with a documented nested signature (VMExtensionError_OutboundConnFail \u002F exit 50, VMExtensionError_K8SAPIServerConnFail \u002F exit 51, VMExtensionError_K8SAPIServerDNSLookupFail \u002F exit 52, OrasPullUnauthorizedVMExtensionError \u002F exit 212), SKU and allocation errors (SkuNotAvailable, ZonalAllocationFailed, OverconstrainedAllocationRequest, message-qualified AllocationFailed), VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, node-image \u002F snapshot 'NodeImageVersion is not accepted', and network-isolated-cluster ACR pull failures. ALLOCATION ROUTING: the full messages 'AllocationFailed: The VM allocation failed due to an internal error. Please retry later or try deploying to a different location' and 'AllocationFailed: We do not have sufficient capacity for the requested VM size' are cataloged signatures owned by this skill; they are not bare errors. A prompt that reports only the AllocationFailed code and explicitly has no nested Azure message is not a catalog match — route that bare-code investigation to aks-troubleshooting. WHEN: an AKS create \u002F scale \u002F upgrade \u002F image-pull fails with one of the cataloged signatures; 'what does \u003Cerror> mean on AKS?'; 'is \u003Cerror> a known issue?'; an AKS vmssCSE \u002F VM-extension exit code; or a message-qualified AKS SKU \u002F allocation error. DO NOT USE FOR: a bare VMExtensionProvisioningError wrapper; an unclassified SKU \u002F capacity allocation incident; a numeric exit code without AKS CSE context; a natural-language 'allocation failed' symptom without the Azure error; non-AKS resources; or open-ended incidents with no cataloged signature — pod crashes, NotReady, DNS, ingress, or timeouts (use aks-troubleshooting for AKS incidents). Read-only: it explains and cites the documented fix, and never applies changes without explicit approval.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1093,1094,1097,1100],{"name":11,"slug":8,"type":16},{"name":1095,"slug":1096,"type":16},"Debugging","debugging",{"name":1098,"slug":1099,"type":16},"Diagnostics","diagnostics",{"name":22,"slug":23,"type":16},"2026-08-23T04:00:30.216663",{"slug":4,"name":4,"fn":5,"description":6,"org":1103,"tags":1104,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1105,1106,1107,1108],{"name":11,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":19,"slug":20,"type":16},{"name":14,"slug":15,"type":16},{"slug":90,"name":90,"fn":1110,"description":1111,"org":1112,"tags":1113,"stars":24,"repoUrl":25,"updatedAt":1121},"debug and troubleshoot Azure Kubernetes Service incidents","Debug and root-cause live Azure Kubernetes Service (AKS) cluster incidents: pod crashes, node failures, DNS\u002Fnetworking, ingress\u002Fload-balancer errors, network policy, upgrade failures, and spot\u002Fzone disruptions. Runs a read-only, evidence-first investigation using the AKS MCP tools, az, and kubectl, and produces a structured incident report. WHEN: CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, pod Pending, DNS resolution failure, 502\u002F503 from ingress, connectivity timeout, upgrade stuck, cordon\u002Fdrain failure, spot eviction, SNAT exhaustion, expired certificate, 'investigate my AKS cluster'. DO NOT USE FOR: packet-level capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); creating or provisioning a cluster (use aks-cluster-setup); cost\u002Frightsizing (use aks-cost-optimization); a named, documented AKS error code or message with a known signature — e.g. VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, a vmssCSE exit code (use aks-known-issues).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1114,1115,1116,1119,1120],{"name":11,"slug":8,"type":16},{"name":1095,"slug":1096,"type":16},{"name":1117,"slug":1118,"type":16},"Incident Response","incident-response",{"name":22,"slug":23,"type":16},{"name":19,"slug":20,"type":16},"2026-08-23T04:00:21.674812",{"items":1123,"total":1295},[1124,1143,1158,1177,1192,1207,1220,1235,1246,1258,1269,1281],{"slug":1125,"name":1125,"fn":1126,"description":1127,"org":1128,"tags":1129,"stars":1140,"repoUrl":1141,"updatedAt":1142},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1130,1131,1134,1137],{"name":11,"slug":8,"type":16},{"name":1132,"slug":1133,"type":16},"Compliance","compliance",{"name":1135,"slug":1136,"type":16},"Governance","governance",{"name":1138,"slug":1139,"type":16},"Policy","policy",1689,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":1144,"name":1144,"fn":1145,"description":1146,"org":1147,"tags":1148,"stars":1155,"repoUrl":1156,"updatedAt":1157},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1149,1150,1151,1154],{"name":11,"slug":8,"type":16},{"name":1050,"slug":1051,"type":16},{"name":1152,"slug":1153,"type":16},"Infrastructure as Code","infrastructure-as-code",{"name":1033,"slug":1034,"type":16},261,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-08-20T03:28:18.136156",{"slug":1159,"name":1159,"fn":1160,"description":1161,"org":1162,"tags":1163,"stars":1174,"repoUrl":1175,"updatedAt":1176},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1164,1167,1168,1171],{"name":1165,"slug":1166,"type":16},"API Development","api-development",{"name":11,"slug":8,"type":16},{"name":1169,"slug":1170,"type":16},"Code Review","code-review",{"name":1172,"slug":1173,"type":16},"Documentation","documentation",136,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":1178,"name":1178,"fn":1179,"description":1180,"org":1181,"tags":1182,"stars":1174,"repoUrl":1175,"updatedAt":1191},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1183,1184,1185,1188],{"name":11,"slug":8,"type":16},{"name":1050,"slug":1051,"type":16},{"name":1186,"slug":1187,"type":16},"SDK","sdk",{"name":1189,"slug":1190,"type":16},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":1193,"name":1193,"fn":1194,"description":1195,"org":1196,"tags":1197,"stars":1174,"repoUrl":1175,"updatedAt":1206},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1198,1199,1202,1205],{"name":11,"slug":8,"type":16},{"name":1200,"slug":1201,"type":16},"GitHub","github",{"name":1203,"slug":1204,"type":16},"Project Management","project-management",{"name":1186,"slug":1187,"type":16},"2026-07-12T08:17:38.345387",{"slug":1208,"name":1208,"fn":1209,"description":1210,"org":1211,"tags":1212,"stars":1174,"repoUrl":1175,"updatedAt":1219},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1213,1214,1217,1218],{"name":11,"slug":8,"type":16},{"name":1215,"slug":1216,"type":16},"CI\u002FCD","ci-cd",{"name":1050,"slug":1051,"type":16},{"name":1186,"slug":1187,"type":16},"2026-07-12T08:17:34.27607",{"slug":1221,"name":1221,"fn":1222,"description":1223,"org":1224,"tags":1225,"stars":1174,"repoUrl":1175,"updatedAt":1234},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1226,1227,1228,1231],{"name":1165,"slug":1166,"type":16},{"name":11,"slug":8,"type":16},{"name":1229,"slug":1230,"type":16},"OpenAPI","openapi",{"name":1232,"slug":1233,"type":16},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":1236,"name":1236,"fn":1237,"description":1238,"org":1239,"tags":1240,"stars":1174,"repoUrl":1175,"updatedAt":1245},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1241,1242,1243,1244],{"name":11,"slug":8,"type":16},{"name":1215,"slug":1216,"type":16},{"name":1186,"slug":1187,"type":16},{"name":1189,"slug":1190,"type":16},"2026-07-12T08:17:37.08523",{"slug":1247,"name":1247,"fn":1248,"description":1249,"org":1250,"tags":1251,"stars":1174,"repoUrl":1175,"updatedAt":1257},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1252,1255,1256],{"name":1253,"slug":1254,"type":16},"LLM","llm",{"name":1066,"slug":1067,"type":16},{"name":1232,"slug":1233,"type":16},"2026-07-12T08:17:42.080413",{"slug":1259,"name":1259,"fn":1260,"description":1261,"org":1262,"tags":1263,"stars":1174,"repoUrl":1175,"updatedAt":1268},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1264,1265,1266,1267],{"name":11,"slug":8,"type":16},{"name":1215,"slug":1216,"type":16},{"name":1095,"slug":1096,"type":16},{"name":1186,"slug":1187,"type":16},"2026-07-12T08:17:40.821512",{"slug":1270,"name":1270,"fn":1271,"description":1272,"org":1273,"tags":1274,"stars":1174,"repoUrl":1175,"updatedAt":1280},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1275,1276,1279],{"name":1172,"slug":1173,"type":16},{"name":1277,"slug":1278,"type":16},"Plugin Development","plugin-development",{"name":1232,"slug":1233,"type":16},"2026-08-07T04:39:22.66861",{"slug":1282,"name":1282,"fn":1283,"description":1284,"org":1285,"tags":1286,"stars":1292,"repoUrl":1293,"updatedAt":1294},"kickstart-acr-integration","integrate Azure Container Registry with AKS","ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1287,1288,1291],{"name":11,"slug":8,"type":16},{"name":1289,"slug":1290,"type":16},"Containers","containers",{"name":1050,"slug":1051,"type":16},65,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools","2026-07-12T08:18:05.091337",124]