[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-aks-troubleshooting":3,"mdc--ibqods-key":46,"related-org-azure-aks-troubleshooting":911,"related-repo-azure-aks-troubleshooting":1091},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":41,"sourceUrl":44,"mdContent":45},"aks-troubleshooting","debug and troubleshoot Azure Kubernetes Service incidents","Debug and root-cause live Azure Kubernetes Service (AKS) cluster incidents: pod crashes, node failures, DNS\u002Fnetworking, ingress\u002Fload-balancer errors, network policy, upgrade failures, and spot\u002Fzone disruptions. Runs a read-only, evidence-first investigation using the AKS MCP tools, az, and kubectl, and produces a structured incident report. WHEN: CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, pod Pending, DNS resolution failure, 502\u002F503 from ingress, connectivity timeout, upgrade stuck, cordon\u002Fdrain failure, spot eviction, SNAT exhaustion, expired certificate, 'investigate my AKS cluster'. DO NOT USE FOR: packet-level capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); creating or provisioning a cluster (use aks-cluster-setup); cost\u002Frightsizing (use aks-cost-optimization); a named, documented AKS error code or message with a known signature — e.g. VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, a vmssCSE exit code (use aks-known-issues).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,15,18,21,24],{"name":11,"slug":8,"type":14},"tag",{"name":16,"slug":17,"type":14},"Networking","networking",{"name":19,"slug":20,"type":14},"Incident Response","incident-response",{"name":22,"slug":23,"type":14},"Kubernetes","kubernetes",{"name":25,"slug":26,"type":14},"Debugging","debugging",3,"https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills","2026-08-23T04:00:21.674812","MIT",1,[33,34,35,8,36,37,38,23,39,40],"agent-skills","ai-agents","aks","claude","devops","github-copilot","mcp","sre-agent",{"repoUrl":28,"stars":27,"forks":31,"topics":42,"description":43},[33,34,35,8,36,37,38,23,39,40],"Agent skills for operating Azure Kubernetes Service (AKS): troubleshooting, cost, AKS Automatic readiness, GPU\u002Finference, packet capture, and cluster design. The deep Day-2 AKS operator — complements the Azure Skills plugin; works with Claude Code, GitHub Copilot, and Azure SRE Agent.","https:\u002F\u002Fgithub.com\u002FAzure\u002FAKS-Skills\u002Ftree\u002FHEAD\u002Fskills\u002Faks-troubleshooting","---\nname: aks-troubleshooting\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.0.1\"\n  openclaw:\n    emoji: \"☸️\"\n    requires:\n      anyBins:\n        - kubectl\n        - az\ndescription: \"Debug and root-cause live Azure Kubernetes Service (AKS) cluster incidents: pod crashes, node failures, DNS\u002Fnetworking, ingress\u002Fload-balancer errors, network policy, upgrade failures, and spot\u002Fzone disruptions. Runs a read-only, evidence-first investigation using the AKS MCP tools, az, and kubectl, and produces a structured incident report. WHEN: CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, pod Pending, DNS resolution failure, 502\u002F503 from ingress, connectivity timeout, upgrade stuck, cordon\u002Fdrain failure, spot eviction, SNAT exhaustion, expired certificate, 'investigate my AKS cluster'. DO NOT USE FOR: packet-level capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); creating or provisioning a cluster (use aks-cluster-setup); cost\u002Frightsizing (use aks-cost-optimization); a named, documented AKS error code or message with a known signature — e.g. VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, a vmssCSE exit code (use aks-known-issues).\"\n---\n\n# AKS Troubleshooting\n\nRoot-cause live AKS incidents with a read-only, evidence-first investigation. This skill covers the full Day-2 troubleshooting surface — workloads, nodes, networking, ingress, upgrades, and spot\u002Fzone disruptions — and produces a structured incident report.\n\n## Operating rules\n\n**Read-only by default.** Do not restart, delete, cordon, drain, scale, upgrade, or reconfigure any resource unless the user explicitly asks for remediation. Gather evidence, name the root cause, and propose the fix — but do not apply it uninvited.\n\n**Evidence before conclusion.** Do not state a root cause without quoting the evidence that supports it. \"Pod is Pending\" and \"node is NotReady\" are symptoms, not causes — trace them to the specific selector, taint, exhausted resource, or Azure-side condition.\n\n**Tool preference.** Inspect the host's available tools for Azure MCP capabilities that advertise AKS, AppLens, Azure Monitor, or Resource Health operations. Use each matching capability under its host-assigned name, preferring the smallest operation that fits the read. Never treat a specific prefix or spelling as an availability check, and do not invent a name-mapping layer. Fall back to raw `az aks` and `kubectl` only when the host exposes no matching capability or the discovered MCP surface cannot perform the check. Default the MCP access mode to `readonly`. See [references\u002Faks-mcp.md](references\u002Faks-mcp.md).\n\n**Evidence order.** Gather Azure-side state first (cluster state, resource health, recent operations, node-pool state, detector\u002Fmonitoring output), then Kubernetes-side state (reachability, nodes, `kube-system`, events, the affected namespace, pod detail, logs). This ordering catches platform-level causes — a failed upgrade operation, a stopped cluster, a quota block — before you spend time inside the cluster.\n\n## Route by symptom\n\n| Symptom | Reference |\n|---------|-----------|\n| Broad investigation, unknown root cause | [general-diagnostics.md](general-diagnostics.md) |\n| Pod crash, OOMKilled, ImagePullBackOff, Pending, readiness probe | [pod-failures.md](pod-failures.md) |\n| Node NotReady, node pressure, node scaling \u002F autoscaler not triggering | [node-issues.md](node-issues.md) |\n| Service connectivity, DNS, pod-to-pod networking | [networking.md](networking.md) |\n| Ingress 502\u002F503, load-balancer health probe, external access | [load-balancer-and-ingress.md](load-balancer-and-ingress.md) |\n| Network policy blocking traffic | [network-policy.md](network-policy.md) |\n| Upgrade stuck, cordon\u002Fdrain failure | [upgrade-operations.md](upgrade-operations.md) |\n| Spot eviction, zone rebalance failure | [spot-and-zone-issues.md](spot-and-zone-issues.md) |\n| Any symptom → exact commands, in order | [references\u002Fsymptom-map.md](references\u002Fsymptom-map.md) |\n\n`references\u002Fsymptom-map.md` is the fastest path: 16 symptom sections, each a self-contained block of the exact `kubectl`\u002F`az` commands to run plus the common causes. Start there when the symptom is clear; use the topic files above for deeper investigation.\n\n## Scripts\n\nBoth are POSIX `sh`, read-only, and safe to run at the start of any investigation. Invoke with `sh \u003Cscript>` or `.\u002F\u003Cscript>`.\n\n- `scripts\u002Fcluster-snapshot.sh` — quick cluster-health overview (nodes, system pods, recent events, node-pool state).\n- `scripts\u002Fpod-deep-dive.sh \u003Cnamespace> \u003Cpod>` — full diagnostic dump for one pod: describe, events, current and previous logs across all containers, resource usage.\n\n## AKS-specific gotchas\n\nThe highest-signal failure patterns that are specific to AKS — a frontier model will not reliably know these. Review before investigating.\n\n- **Azure CNI vs kubenet is a fork in every networking fix.** Check `az aks show -o json --query networkProfile.networkPlugin` **first** — the plugin (kubenet, Azure CNI, CNI Overlay, Cilium) changes how pod IPs, routes, and network policy behave.\n- **Managed-identity RBAC is behind a large share of AKS failures.** ACR pull, disk attach, private DNS, and Key Vault access all depend on the cluster or kubelet identity having a role assignment. Check `az aks show --query identityProfile` and the relevant role assignments early.\n- **Node NotReady is not always a VM problem.** It can be kubelet, containerd, the CNI plugin, Azure host maintenance, or an expired kubelet\u002FAPI-server certificate. Correlate `kubectl describe node` conditions with `az vm get-instance-view`, and check `kubectl get csr` for pending certificate requests.\n- **The Azure LB health probe can disagree with Kubernetes.** A Service can look healthy in-cluster but fail at the Azure load balancer because the LB rule's probe path\u002Fport does not match the app endpoint. Check `az network lb probe list`.\n- **Subnet exhaustion silently blocks scheduling.** Azure CNI allocates a VNet IP per pod; a full pod subnet stops new pods scheduling with no obvious error. Check `az network vnet subnet show --query '{addressPrefix: addressPrefix, used: ipConfigurations | length(@)}'`.\n- **System-pool PodDisruptionBudgets block drains during upgrades.** CoreDNS and metrics-server ship PDBs that can stall a node drain. Check `kubectl get pdb -A`.\n- **The API server IP can change after stop\u002Fstart.** When a cluster is stopped and restarted, the API server IP may change; flush DNS and re-run `az aks get-credentials` if `kubectl` cannot connect afterward.\n- **Private clusters need in-VNet access.** `kubectl` must run from a VM inside — or peered to — the cluster VNet. Check `az aks show --query apiServerAccessProfile` for private-cluster and authorized-IP-range settings.\n- **NSG\u002Ffirewall egress blocks surface as VM extension errors.** AKS nodes need outbound access to required FQDNs (AKS API, MCR, `management.azure.com`, and others). A restrictive NSG or firewall causes VM extension errors during create\u002Fupgrade — error codes 50 (`OutboundConnFailVMExtensionError`), 51 (`K8SAPIServerConnFailVMExtensionError`), 52 (`K8SAPIServerDNSLookupFailVMExtensionError`). Check `az network nsg rule list` and firewall logs.\n- **SNAT port exhaustion appears past a few hundred nodes.** Large clusters using the Azure Load Balancer for outbound can exhaust SNAT ports, causing intermittent egress failures. Check `az network lb show --query outboundRules`; fix by moving to a NAT gateway (`az aks update --outbound-type managedNATGateway`).\n- **Upgrade `max-surge` defaults to one node at a time.** Large-cluster upgrades take hours at the default. Check `az aks nodepool show --query upgradeSettings` and raise `--max-surge` if the workload tolerates it.\n- **`kubectl` must be within two minor versions of the cluster.** A stale client produces confusing errors. Compare `kubectl version --client` with `az aks show --query kubernetesVersion`.\n\n## Log discipline\n\n- Always fetch `kubectl logs --previous` alongside current logs — after a restart the current stream may be empty.\n- Do not truncate logs with `--tail` or `| tail`; the causal error is often early.\n- For multi-container pods, use `--all-containers` (or name each `--container`) so sidecar and init-container logs are not missed.\n- Get current UTC time with `date -u` before using `--since-time`.\n\n## Deep diagnostics\n\nWhen standard checks do not reveal a root cause, use **Inspektor Gadget** for real-time, low-level node and pod observability (DNS traces, TCP traces, process and file-access snapshots). See [references\u002Finspektor-gadget.md](references\u002Finspektor-gadget.md) for the gadget catalog and symptom-to-gadget mapping. Inspektor Gadget runs a privileged debug pod — get explicit user approval before invoking it. Additional MCP-driven investigation modes are in [references\u002Fstructured-input-modes.md](references\u002Fstructured-input-modes.md) and [references\u002Fcommand-flows.md](references\u002Fcommand-flows.md).\n\n## Report\n\nStructure the final incident report using [references\u002Freport-template.md](references\u002Freport-template.md): symptom and impact, evidence gathered, failure domain, root cause with supporting evidence, confidence, remediation, and escalation. Quote relevant log snippets inline rather than pasting full dumps.\n\n## Reference\n\nMicrosoft's AKS troubleshooting hub: https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Fwelcome-azure-kubernetes\n",{"data":47,"body":57},{"name":4,"license":30,"metadata":48,"description":6},{"author":49,"version":50,"openclaw":51},"Microsoft","1.0.1",{"emoji":52,"requires":53},"☸️",{"anyBins":54},[55,56],"kubectl","az",{"type":58,"children":59},"root",[60,68,74,81,92,102,144,162,168,340,364,370,398,425,431,436,756,762,839,845,876,882,894,899],{"type":61,"tag":62,"props":63,"children":64},"element","h1",{"id":4},[65],{"type":66,"value":67},"text","AKS Troubleshooting",{"type":61,"tag":69,"props":70,"children":71},"p",{},[72],{"type":66,"value":73},"Root-cause live AKS incidents with a read-only, evidence-first investigation. This skill covers the full Day-2 troubleshooting surface — workloads, nodes, networking, ingress, upgrades, and spot\u002Fzone disruptions — and produces a structured incident report.",{"type":61,"tag":75,"props":76,"children":78},"h2",{"id":77},"operating-rules",[79],{"type":66,"value":80},"Operating rules",{"type":61,"tag":69,"props":82,"children":83},{},[84,90],{"type":61,"tag":85,"props":86,"children":87},"strong",{},[88],{"type":66,"value":89},"Read-only by default.",{"type":66,"value":91}," Do not restart, delete, cordon, drain, scale, upgrade, or reconfigure any resource unless the user explicitly asks for remediation. Gather evidence, name the root cause, and propose the fix — but do not apply it uninvited.",{"type":61,"tag":69,"props":93,"children":94},{},[95,100],{"type":61,"tag":85,"props":96,"children":97},{},[98],{"type":66,"value":99},"Evidence before conclusion.",{"type":66,"value":101}," Do not state a root cause without quoting the evidence that supports it. \"Pod is Pending\" and \"node is NotReady\" are symptoms, not causes — trace them to the specific selector, taint, exhausted resource, or Azure-side condition.",{"type":61,"tag":69,"props":103,"children":104},{},[105,110,112,119,121,126,128,134,136,142],{"type":61,"tag":85,"props":106,"children":107},{},[108],{"type":66,"value":109},"Tool preference.",{"type":66,"value":111}," Inspect the host's available tools for Azure MCP capabilities that advertise AKS, AppLens, Azure Monitor, or Resource Health operations. Use each matching capability under its host-assigned name, preferring the smallest operation that fits the read. Never treat a specific prefix or spelling as an availability check, and do not invent a name-mapping layer. Fall back to raw ",{"type":61,"tag":113,"props":114,"children":116},"code",{"className":115},[],[117],{"type":66,"value":118},"az aks",{"type":66,"value":120}," and ",{"type":61,"tag":113,"props":122,"children":124},{"className":123},[],[125],{"type":66,"value":55},{"type":66,"value":127}," only when the host exposes no matching capability or the discovered MCP surface cannot perform the check. Default the MCP access mode to ",{"type":61,"tag":113,"props":129,"children":131},{"className":130},[],[132],{"type":66,"value":133},"readonly",{"type":66,"value":135},". See ",{"type":61,"tag":137,"props":138,"children":140},"a",{"href":139},"references\u002Faks-mcp.md",[141],{"type":66,"value":139},{"type":66,"value":143},".",{"type":61,"tag":69,"props":145,"children":146},{},[147,152,154,160],{"type":61,"tag":85,"props":148,"children":149},{},[150],{"type":66,"value":151},"Evidence order.",{"type":66,"value":153}," Gather Azure-side state first (cluster state, resource health, recent operations, node-pool state, detector\u002Fmonitoring output), then Kubernetes-side state (reachability, nodes, ",{"type":61,"tag":113,"props":155,"children":157},{"className":156},[],[158],{"type":66,"value":159},"kube-system",{"type":66,"value":161},", events, the affected namespace, pod detail, logs). This ordering catches platform-level causes — a failed upgrade operation, a stopped cluster, a quota block — before you spend time inside the cluster.",{"type":61,"tag":75,"props":163,"children":165},{"id":164},"route-by-symptom",[166],{"type":66,"value":167},"Route by symptom",{"type":61,"tag":169,"props":170,"children":171},"table",{},[172,191],{"type":61,"tag":173,"props":174,"children":175},"thead",{},[176],{"type":61,"tag":177,"props":178,"children":179},"tr",{},[180,186],{"type":61,"tag":181,"props":182,"children":183},"th",{},[184],{"type":66,"value":185},"Symptom",{"type":61,"tag":181,"props":187,"children":188},{},[189],{"type":66,"value":190},"Reference",{"type":61,"tag":192,"props":193,"children":194},"tbody",{},[195,212,228,244,260,276,292,308,324],{"type":61,"tag":177,"props":196,"children":197},{},[198,204],{"type":61,"tag":199,"props":200,"children":201},"td",{},[202],{"type":66,"value":203},"Broad investigation, unknown root cause",{"type":61,"tag":199,"props":205,"children":206},{},[207],{"type":61,"tag":137,"props":208,"children":210},{"href":209},"general-diagnostics.md",[211],{"type":66,"value":209},{"type":61,"tag":177,"props":213,"children":214},{},[215,220],{"type":61,"tag":199,"props":216,"children":217},{},[218],{"type":66,"value":219},"Pod crash, OOMKilled, ImagePullBackOff, Pending, readiness probe",{"type":61,"tag":199,"props":221,"children":222},{},[223],{"type":61,"tag":137,"props":224,"children":226},{"href":225},"pod-failures.md",[227],{"type":66,"value":225},{"type":61,"tag":177,"props":229,"children":230},{},[231,236],{"type":61,"tag":199,"props":232,"children":233},{},[234],{"type":66,"value":235},"Node NotReady, node pressure, node scaling \u002F autoscaler not triggering",{"type":61,"tag":199,"props":237,"children":238},{},[239],{"type":61,"tag":137,"props":240,"children":242},{"href":241},"node-issues.md",[243],{"type":66,"value":241},{"type":61,"tag":177,"props":245,"children":246},{},[247,252],{"type":61,"tag":199,"props":248,"children":249},{},[250],{"type":66,"value":251},"Service connectivity, DNS, pod-to-pod networking",{"type":61,"tag":199,"props":253,"children":254},{},[255],{"type":61,"tag":137,"props":256,"children":258},{"href":257},"networking.md",[259],{"type":66,"value":257},{"type":61,"tag":177,"props":261,"children":262},{},[263,268],{"type":61,"tag":199,"props":264,"children":265},{},[266],{"type":66,"value":267},"Ingress 502\u002F503, load-balancer health probe, external access",{"type":61,"tag":199,"props":269,"children":270},{},[271],{"type":61,"tag":137,"props":272,"children":274},{"href":273},"load-balancer-and-ingress.md",[275],{"type":66,"value":273},{"type":61,"tag":177,"props":277,"children":278},{},[279,284],{"type":61,"tag":199,"props":280,"children":281},{},[282],{"type":66,"value":283},"Network policy blocking traffic",{"type":61,"tag":199,"props":285,"children":286},{},[287],{"type":61,"tag":137,"props":288,"children":290},{"href":289},"network-policy.md",[291],{"type":66,"value":289},{"type":61,"tag":177,"props":293,"children":294},{},[295,300],{"type":61,"tag":199,"props":296,"children":297},{},[298],{"type":66,"value":299},"Upgrade stuck, cordon\u002Fdrain failure",{"type":61,"tag":199,"props":301,"children":302},{},[303],{"type":61,"tag":137,"props":304,"children":306},{"href":305},"upgrade-operations.md",[307],{"type":66,"value":305},{"type":61,"tag":177,"props":309,"children":310},{},[311,316],{"type":61,"tag":199,"props":312,"children":313},{},[314],{"type":66,"value":315},"Spot eviction, zone rebalance failure",{"type":61,"tag":199,"props":317,"children":318},{},[319],{"type":61,"tag":137,"props":320,"children":322},{"href":321},"spot-and-zone-issues.md",[323],{"type":66,"value":321},{"type":61,"tag":177,"props":325,"children":326},{},[327,332],{"type":61,"tag":199,"props":328,"children":329},{},[330],{"type":66,"value":331},"Any symptom → exact commands, in order",{"type":61,"tag":199,"props":333,"children":334},{},[335],{"type":61,"tag":137,"props":336,"children":338},{"href":337},"references\u002Fsymptom-map.md",[339],{"type":66,"value":337},{"type":61,"tag":69,"props":341,"children":342},{},[343,348,350,355,357,362],{"type":61,"tag":113,"props":344,"children":346},{"className":345},[],[347],{"type":66,"value":337},{"type":66,"value":349}," is the fastest path: 16 symptom sections, each a self-contained block of the exact ",{"type":61,"tag":113,"props":351,"children":353},{"className":352},[],[354],{"type":66,"value":55},{"type":66,"value":356},"\u002F",{"type":61,"tag":113,"props":358,"children":360},{"className":359},[],[361],{"type":66,"value":56},{"type":66,"value":363}," commands to run plus the common causes. Start there when the symptom is clear; use the topic files above for deeper investigation.",{"type":61,"tag":75,"props":365,"children":367},{"id":366},"scripts",[368],{"type":66,"value":369},"Scripts",{"type":61,"tag":69,"props":371,"children":372},{},[373,375,381,383,389,391,397],{"type":66,"value":374},"Both are POSIX ",{"type":61,"tag":113,"props":376,"children":378},{"className":377},[],[379],{"type":66,"value":380},"sh",{"type":66,"value":382},", read-only, and safe to run at the start of any investigation. Invoke with ",{"type":61,"tag":113,"props":384,"children":386},{"className":385},[],[387],{"type":66,"value":388},"sh \u003Cscript>",{"type":66,"value":390}," or ",{"type":61,"tag":113,"props":392,"children":394},{"className":393},[],[395],{"type":66,"value":396},".\u002F\u003Cscript>",{"type":66,"value":143},{"type":61,"tag":399,"props":400,"children":401},"ul",{},[402,414],{"type":61,"tag":403,"props":404,"children":405},"li",{},[406,412],{"type":61,"tag":113,"props":407,"children":409},{"className":408},[],[410],{"type":66,"value":411},"scripts\u002Fcluster-snapshot.sh",{"type":66,"value":413}," — quick cluster-health overview (nodes, system pods, recent events, node-pool state).",{"type":61,"tag":403,"props":415,"children":416},{},[417,423],{"type":61,"tag":113,"props":418,"children":420},{"className":419},[],[421],{"type":66,"value":422},"scripts\u002Fpod-deep-dive.sh \u003Cnamespace> \u003Cpod>",{"type":66,"value":424}," — full diagnostic dump for one pod: describe, events, current and previous logs across all containers, resource usage.",{"type":61,"tag":75,"props":426,"children":428},{"id":427},"aks-specific-gotchas",[429],{"type":66,"value":430},"AKS-specific gotchas",{"type":61,"tag":69,"props":432,"children":433},{},[434],{"type":66,"value":435},"The highest-signal failure patterns that are specific to AKS — a frontier model will not reliably know these. Review before investigating.",{"type":61,"tag":399,"props":437,"children":438},{},[439,464,482,516,533,550,567,592,616,666,692,726],{"type":61,"tag":403,"props":440,"children":441},{},[442,447,449,455,457,462],{"type":61,"tag":85,"props":443,"children":444},{},[445],{"type":66,"value":446},"Azure CNI vs kubenet is a fork in every networking fix.",{"type":66,"value":448}," Check ",{"type":61,"tag":113,"props":450,"children":452},{"className":451},[],[453],{"type":66,"value":454},"az aks show -o json --query networkProfile.networkPlugin",{"type":66,"value":456}," ",{"type":61,"tag":85,"props":458,"children":459},{},[460],{"type":66,"value":461},"first",{"type":66,"value":463}," — the plugin (kubenet, Azure CNI, CNI Overlay, Cilium) changes how pod IPs, routes, and network policy behave.",{"type":61,"tag":403,"props":465,"children":466},{},[467,472,474,480],{"type":61,"tag":85,"props":468,"children":469},{},[470],{"type":66,"value":471},"Managed-identity RBAC is behind a large share of AKS failures.",{"type":66,"value":473}," ACR pull, disk attach, private DNS, and Key Vault access all depend on the cluster or kubelet identity having a role assignment. Check ",{"type":61,"tag":113,"props":475,"children":477},{"className":476},[],[478],{"type":66,"value":479},"az aks show --query identityProfile",{"type":66,"value":481}," and the relevant role assignments early.",{"type":61,"tag":403,"props":483,"children":484},{},[485,490,492,498,500,506,508,514],{"type":61,"tag":85,"props":486,"children":487},{},[488],{"type":66,"value":489},"Node NotReady is not always a VM problem.",{"type":66,"value":491}," It can be kubelet, containerd, the CNI plugin, Azure host maintenance, or an expired kubelet\u002FAPI-server certificate. Correlate ",{"type":61,"tag":113,"props":493,"children":495},{"className":494},[],[496],{"type":66,"value":497},"kubectl describe node",{"type":66,"value":499}," conditions with ",{"type":61,"tag":113,"props":501,"children":503},{"className":502},[],[504],{"type":66,"value":505},"az vm get-instance-view",{"type":66,"value":507},", and check ",{"type":61,"tag":113,"props":509,"children":511},{"className":510},[],[512],{"type":66,"value":513},"kubectl get csr",{"type":66,"value":515}," for pending certificate requests.",{"type":61,"tag":403,"props":517,"children":518},{},[519,524,526,532],{"type":61,"tag":85,"props":520,"children":521},{},[522],{"type":66,"value":523},"The Azure LB health probe can disagree with Kubernetes.",{"type":66,"value":525}," A Service can look healthy in-cluster but fail at the Azure load balancer because the LB rule's probe path\u002Fport does not match the app endpoint. Check ",{"type":61,"tag":113,"props":527,"children":529},{"className":528},[],[530],{"type":66,"value":531},"az network lb probe list",{"type":66,"value":143},{"type":61,"tag":403,"props":534,"children":535},{},[536,541,543,549],{"type":61,"tag":85,"props":537,"children":538},{},[539],{"type":66,"value":540},"Subnet exhaustion silently blocks scheduling.",{"type":66,"value":542}," Azure CNI allocates a VNet IP per pod; a full pod subnet stops new pods scheduling with no obvious error. Check ",{"type":61,"tag":113,"props":544,"children":546},{"className":545},[],[547],{"type":66,"value":548},"az network vnet subnet show --query '{addressPrefix: addressPrefix, used: ipConfigurations | length(@)}'",{"type":66,"value":143},{"type":61,"tag":403,"props":551,"children":552},{},[553,558,560,566],{"type":61,"tag":85,"props":554,"children":555},{},[556],{"type":66,"value":557},"System-pool PodDisruptionBudgets block drains during upgrades.",{"type":66,"value":559}," CoreDNS and metrics-server ship PDBs that can stall a node drain. Check ",{"type":61,"tag":113,"props":561,"children":563},{"className":562},[],[564],{"type":66,"value":565},"kubectl get pdb -A",{"type":66,"value":143},{"type":61,"tag":403,"props":568,"children":569},{},[570,575,577,583,585,590],{"type":61,"tag":85,"props":571,"children":572},{},[573],{"type":66,"value":574},"The API server IP can change after stop\u002Fstart.",{"type":66,"value":576}," When a cluster is stopped and restarted, the API server IP may change; flush DNS and re-run ",{"type":61,"tag":113,"props":578,"children":580},{"className":579},[],[581],{"type":66,"value":582},"az aks get-credentials",{"type":66,"value":584}," if ",{"type":61,"tag":113,"props":586,"children":588},{"className":587},[],[589],{"type":66,"value":55},{"type":66,"value":591}," cannot connect afterward.",{"type":61,"tag":403,"props":593,"children":594},{},[595,600,601,606,608,614],{"type":61,"tag":85,"props":596,"children":597},{},[598],{"type":66,"value":599},"Private clusters need in-VNet access.",{"type":66,"value":456},{"type":61,"tag":113,"props":602,"children":604},{"className":603},[],[605],{"type":66,"value":55},{"type":66,"value":607}," must run from a VM inside — or peered to — the cluster VNet. Check ",{"type":61,"tag":113,"props":609,"children":611},{"className":610},[],[612],{"type":66,"value":613},"az aks show --query apiServerAccessProfile",{"type":66,"value":615}," for private-cluster and authorized-IP-range settings.",{"type":61,"tag":403,"props":617,"children":618},{},[619,624,626,632,634,640,642,648,650,656,658,664],{"type":61,"tag":85,"props":620,"children":621},{},[622],{"type":66,"value":623},"NSG\u002Ffirewall egress blocks surface as VM extension errors.",{"type":66,"value":625}," AKS nodes need outbound access to required FQDNs (AKS API, MCR, ",{"type":61,"tag":113,"props":627,"children":629},{"className":628},[],[630],{"type":66,"value":631},"management.azure.com",{"type":66,"value":633},", and others). A restrictive NSG or firewall causes VM extension errors during create\u002Fupgrade — error codes 50 (",{"type":61,"tag":113,"props":635,"children":637},{"className":636},[],[638],{"type":66,"value":639},"OutboundConnFailVMExtensionError",{"type":66,"value":641},"), 51 (",{"type":61,"tag":113,"props":643,"children":645},{"className":644},[],[646],{"type":66,"value":647},"K8SAPIServerConnFailVMExtensionError",{"type":66,"value":649},"), 52 (",{"type":61,"tag":113,"props":651,"children":653},{"className":652},[],[654],{"type":66,"value":655},"K8SAPIServerDNSLookupFailVMExtensionError",{"type":66,"value":657},"). Check ",{"type":61,"tag":113,"props":659,"children":661},{"className":660},[],[662],{"type":66,"value":663},"az network nsg rule list",{"type":66,"value":665}," and firewall logs.",{"type":61,"tag":403,"props":667,"children":668},{},[669,674,676,682,684,690],{"type":61,"tag":85,"props":670,"children":671},{},[672],{"type":66,"value":673},"SNAT port exhaustion appears past a few hundred nodes.",{"type":66,"value":675}," Large clusters using the Azure Load Balancer for outbound can exhaust SNAT ports, causing intermittent egress failures. Check ",{"type":61,"tag":113,"props":677,"children":679},{"className":678},[],[680],{"type":66,"value":681},"az network lb show --query outboundRules",{"type":66,"value":683},"; fix by moving to a NAT gateway (",{"type":61,"tag":113,"props":685,"children":687},{"className":686},[],[688],{"type":66,"value":689},"az aks update --outbound-type managedNATGateway",{"type":66,"value":691},").",{"type":61,"tag":403,"props":693,"children":694},{},[695,708,710,716,718,724],{"type":61,"tag":85,"props":696,"children":697},{},[698,700,706],{"type":66,"value":699},"Upgrade ",{"type":61,"tag":113,"props":701,"children":703},{"className":702},[],[704],{"type":66,"value":705},"max-surge",{"type":66,"value":707}," defaults to one node at a time.",{"type":66,"value":709}," Large-cluster upgrades take hours at the default. Check ",{"type":61,"tag":113,"props":711,"children":713},{"className":712},[],[714],{"type":66,"value":715},"az aks nodepool show --query upgradeSettings",{"type":66,"value":717}," and raise ",{"type":61,"tag":113,"props":719,"children":721},{"className":720},[],[722],{"type":66,"value":723},"--max-surge",{"type":66,"value":725}," if the workload tolerates it.",{"type":61,"tag":403,"props":727,"children":728},{},[729,739,741,747,749,755],{"type":61,"tag":85,"props":730,"children":731},{},[732,737],{"type":61,"tag":113,"props":733,"children":735},{"className":734},[],[736],{"type":66,"value":55},{"type":66,"value":738}," must be within two minor versions of the cluster.",{"type":66,"value":740}," A stale client produces confusing errors. Compare ",{"type":61,"tag":113,"props":742,"children":744},{"className":743},[],[745],{"type":66,"value":746},"kubectl version --client",{"type":66,"value":748}," with ",{"type":61,"tag":113,"props":750,"children":752},{"className":751},[],[753],{"type":66,"value":754},"az aks show --query kubernetesVersion",{"type":66,"value":143},{"type":61,"tag":75,"props":757,"children":759},{"id":758},"log-discipline",[760],{"type":66,"value":761},"Log discipline",{"type":61,"tag":399,"props":763,"children":764},{},[765,778,798,819],{"type":61,"tag":403,"props":766,"children":767},{},[768,770,776],{"type":66,"value":769},"Always fetch ",{"type":61,"tag":113,"props":771,"children":773},{"className":772},[],[774],{"type":66,"value":775},"kubectl logs --previous",{"type":66,"value":777}," alongside current logs — after a restart the current stream may be empty.",{"type":61,"tag":403,"props":779,"children":780},{},[781,783,789,790,796],{"type":66,"value":782},"Do not truncate logs with ",{"type":61,"tag":113,"props":784,"children":786},{"className":785},[],[787],{"type":66,"value":788},"--tail",{"type":66,"value":390},{"type":61,"tag":113,"props":791,"children":793},{"className":792},[],[794],{"type":66,"value":795},"| tail",{"type":66,"value":797},"; the causal error is often early.",{"type":61,"tag":403,"props":799,"children":800},{},[801,803,809,811,817],{"type":66,"value":802},"For multi-container pods, use ",{"type":61,"tag":113,"props":804,"children":806},{"className":805},[],[807],{"type":66,"value":808},"--all-containers",{"type":66,"value":810}," (or name each ",{"type":61,"tag":113,"props":812,"children":814},{"className":813},[],[815],{"type":66,"value":816},"--container",{"type":66,"value":818},") so sidecar and init-container logs are not missed.",{"type":61,"tag":403,"props":820,"children":821},{},[822,824,830,832,838],{"type":66,"value":823},"Get current UTC time with ",{"type":61,"tag":113,"props":825,"children":827},{"className":826},[],[828],{"type":66,"value":829},"date -u",{"type":66,"value":831}," before using ",{"type":61,"tag":113,"props":833,"children":835},{"className":834},[],[836],{"type":66,"value":837},"--since-time",{"type":66,"value":143},{"type":61,"tag":75,"props":840,"children":842},{"id":841},"deep-diagnostics",[843],{"type":66,"value":844},"Deep diagnostics",{"type":61,"tag":69,"props":846,"children":847},{},[848,850,855,857,862,864,869,870,875],{"type":66,"value":849},"When standard checks do not reveal a root cause, use ",{"type":61,"tag":85,"props":851,"children":852},{},[853],{"type":66,"value":854},"Inspektor Gadget",{"type":66,"value":856}," for real-time, low-level node and pod observability (DNS traces, TCP traces, process and file-access snapshots). See ",{"type":61,"tag":137,"props":858,"children":860},{"href":859},"references\u002Finspektor-gadget.md",[861],{"type":66,"value":859},{"type":66,"value":863}," for the gadget catalog and symptom-to-gadget mapping. Inspektor Gadget runs a privileged debug pod — get explicit user approval before invoking it. Additional MCP-driven investigation modes are in ",{"type":61,"tag":137,"props":865,"children":867},{"href":866},"references\u002Fstructured-input-modes.md",[868],{"type":66,"value":866},{"type":66,"value":120},{"type":61,"tag":137,"props":871,"children":873},{"href":872},"references\u002Fcommand-flows.md",[874],{"type":66,"value":872},{"type":66,"value":143},{"type":61,"tag":75,"props":877,"children":879},{"id":878},"report",[880],{"type":66,"value":881},"Report",{"type":61,"tag":69,"props":883,"children":884},{},[885,887,892],{"type":66,"value":886},"Structure the final incident report using ",{"type":61,"tag":137,"props":888,"children":890},{"href":889},"references\u002Freport-template.md",[891],{"type":66,"value":889},{"type":66,"value":893},": symptom and impact, evidence gathered, failure domain, root cause with supporting evidence, confidence, remediation, and escalation. Quote relevant log snippets inline rather than pasting full dumps.",{"type":61,"tag":75,"props":895,"children":897},{"id":896},"reference",[898],{"type":66,"value":190},{"type":61,"tag":69,"props":900,"children":901},{},[902,904],{"type":66,"value":903},"Microsoft's AKS troubleshooting hub: ",{"type":61,"tag":137,"props":905,"children":909},{"href":906,"rel":907},"https:\u002F\u002Flearn.microsoft.com\u002Ftroubleshoot\u002Fazure\u002Fazure-kubernetes\u002Fwelcome-azure-kubernetes",[908],"nofollow",[910],{"type":66,"value":906},{"items":912,"total":1090},[913,932,951,970,985,1000,1013,1028,1039,1053,1064,1076],{"slug":914,"name":914,"fn":915,"description":916,"org":917,"tags":918,"stars":929,"repoUrl":930,"updatedAt":931},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[919,920,923,926],{"name":11,"slug":8,"type":14},{"name":921,"slug":922,"type":14},"Compliance","compliance",{"name":924,"slug":925,"type":14},"Governance","governance",{"name":927,"slug":928,"type":14},"Policy","policy",1689,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":933,"name":933,"fn":934,"description":935,"org":936,"tags":937,"stars":948,"repoUrl":949,"updatedAt":950},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[938,939,942,945],{"name":11,"slug":8,"type":14},{"name":940,"slug":941,"type":14},"Deployment","deployment",{"name":943,"slug":944,"type":14},"Infrastructure as Code","infrastructure-as-code",{"name":946,"slug":947,"type":14},"Migration","migration",261,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-08-20T03:28:18.136156",{"slug":952,"name":952,"fn":953,"description":954,"org":955,"tags":956,"stars":967,"repoUrl":968,"updatedAt":969},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[957,960,961,964],{"name":958,"slug":959,"type":14},"API Development","api-development",{"name":11,"slug":8,"type":14},{"name":962,"slug":963,"type":14},"Code Review","code-review",{"name":965,"slug":966,"type":14},"Documentation","documentation",136,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":971,"name":971,"fn":972,"description":973,"org":974,"tags":975,"stars":967,"repoUrl":968,"updatedAt":984},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[976,977,978,981],{"name":11,"slug":8,"type":14},{"name":940,"slug":941,"type":14},{"name":979,"slug":980,"type":14},"SDK","sdk",{"name":982,"slug":983,"type":14},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":986,"name":986,"fn":987,"description":988,"org":989,"tags":990,"stars":967,"repoUrl":968,"updatedAt":999},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[991,992,995,998],{"name":11,"slug":8,"type":14},{"name":993,"slug":994,"type":14},"GitHub","github",{"name":996,"slug":997,"type":14},"Project Management","project-management",{"name":979,"slug":980,"type":14},"2026-07-12T08:17:38.345387",{"slug":1001,"name":1001,"fn":1002,"description":1003,"org":1004,"tags":1005,"stars":967,"repoUrl":968,"updatedAt":1012},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1006,1007,1010,1011],{"name":11,"slug":8,"type":14},{"name":1008,"slug":1009,"type":14},"CI\u002FCD","ci-cd",{"name":940,"slug":941,"type":14},{"name":979,"slug":980,"type":14},"2026-07-12T08:17:34.27607",{"slug":1014,"name":1014,"fn":1015,"description":1016,"org":1017,"tags":1018,"stars":967,"repoUrl":968,"updatedAt":1027},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1019,1020,1021,1024],{"name":958,"slug":959,"type":14},{"name":11,"slug":8,"type":14},{"name":1022,"slug":1023,"type":14},"OpenAPI","openapi",{"name":1025,"slug":1026,"type":14},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":1029,"name":1029,"fn":1030,"description":1031,"org":1032,"tags":1033,"stars":967,"repoUrl":968,"updatedAt":1038},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1034,1035,1036,1037],{"name":11,"slug":8,"type":14},{"name":1008,"slug":1009,"type":14},{"name":979,"slug":980,"type":14},{"name":982,"slug":983,"type":14},"2026-07-12T08:17:37.08523",{"slug":1040,"name":1040,"fn":1041,"description":1042,"org":1043,"tags":1044,"stars":967,"repoUrl":968,"updatedAt":1052},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1045,1048,1051],{"name":1046,"slug":1047,"type":14},"LLM","llm",{"name":1049,"slug":1050,"type":14},"Performance","performance",{"name":1025,"slug":1026,"type":14},"2026-07-12T08:17:42.080413",{"slug":1054,"name":1054,"fn":1055,"description":1056,"org":1057,"tags":1058,"stars":967,"repoUrl":968,"updatedAt":1063},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1059,1060,1061,1062],{"name":11,"slug":8,"type":14},{"name":1008,"slug":1009,"type":14},{"name":25,"slug":26,"type":14},{"name":979,"slug":980,"type":14},"2026-07-12T08:17:40.821512",{"slug":1065,"name":1065,"fn":1066,"description":1067,"org":1068,"tags":1069,"stars":967,"repoUrl":968,"updatedAt":1075},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1070,1071,1074],{"name":965,"slug":966,"type":14},{"name":1072,"slug":1073,"type":14},"Plugin Development","plugin-development",{"name":1025,"slug":1026,"type":14},"2026-08-07T04:39:22.66861",{"slug":1077,"name":1077,"fn":1078,"description":1079,"org":1080,"tags":1081,"stars":1087,"repoUrl":1088,"updatedAt":1089},"kickstart-acr-integration","integrate Azure Container Registry with AKS","ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1082,1083,1086],{"name":11,"slug":8,"type":14},{"name":1084,"slug":1085,"type":14},"Containers","containers",{"name":940,"slug":941,"type":14},65,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools","2026-07-12T08:18:05.091337",124,{"items":1092,"total":1184},[1093,1106,1119,1132,1150,1163,1176],{"slug":1094,"name":1094,"fn":1095,"description":1096,"org":1097,"tags":1098,"stars":27,"repoUrl":28,"updatedAt":1105},"aks-automatic-readiness","migrate Kubernetes workloads to AKS Automatic","Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic. DO NOT USE FOR: creating a brand-new cluster (use aks-cluster-setup); debugging a running cluster (use aks-troubleshooting).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1099,1100,1101,1102],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":946,"slug":947,"type":14},{"name":1103,"slug":1104,"type":14},"Modernization","modernization","2026-08-23T04:00:30.817435",{"slug":1107,"name":1107,"fn":1108,"description":1109,"org":1110,"tags":1111,"stars":27,"repoUrl":28,"updatedAt":1118},"aks-cluster-setup","design and configure Azure Kubernetes Service clusters","Make the AKS-specific design decisions for a new production Azure Kubernetes Service (AKS) cluster — SKU (Automatic vs Standard), pod IP model (Azure CNI Overlay vs kubenet), API-server access, egress, identity, upgrades, node pools, and reliability — then delegate the actual provisioning to the Azure Skills deployment engine. WHEN: create AKS cluster, provision AKS environment, design AKS networking, choose AKS SKU, Day-0 AKS checklist, plan a production AKS cluster. DO NOT USE FOR: debugging a running cluster (use aks-troubleshooting); assessing an existing cluster for AKS Automatic (use aks-automatic-readiness); GPU \u002F model-serving setup (see azure-skills airunway-aks-setup); generic non-AKS Azure resource deployment (use azure-skills azure-deploy directly).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1112,1115,1116,1117],{"name":1113,"slug":1114,"type":14},"Architecture","architecture",{"name":11,"slug":8,"type":14},{"name":940,"slug":941,"type":14},{"name":22,"slug":23,"type":14},"2026-08-23T04:00:29.49469",{"slug":1120,"name":1120,"fn":1121,"description":1122,"org":1123,"tags":1124,"stars":27,"repoUrl":28,"updatedAt":1131},"aks-cost-optimization","optimize Azure Kubernetes Service cluster costs","Reduce Azure Kubernetes Service (AKS) spending: pod rightsizing, VPA-driven recommendations, cluster-autoscaler tuning, spot node pools, namespace-level cost visibility, and cost-anomaly detection. WHEN: rightsize pods, VPA recommendations, idle nodes, scale-down, autoscaler profile, spot nodes, cheaper compute, cost add-on, namespace cost breakdown, spending anomaly, 'my AKS bill is too high', 'is my app consuming what it requests', resource requests vs actual usage, over-provisioned workloads, spot vs on-demand, per-namespace or per-team cost allocation, 'who's spending what and why'. DO NOT USE FOR: GPU \u002F inference cost and idle GPU pools (use aks-gpu-inference); autoscaler that is failing to scale up during an incident (use aks-troubleshooting); choosing SKUs at cluster-creation time (use aks-cluster-setup).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1125,1126,1129,1130],{"name":11,"slug":8,"type":14},{"name":1127,"slug":1128,"type":14},"Cost Optimization","cost-optimization",{"name":22,"slug":23,"type":14},{"name":1049,"slug":1050,"type":14},"2026-08-23T04:00:29.864048",{"slug":1133,"name":1133,"fn":1134,"description":1135,"org":1136,"tags":1137,"stars":27,"repoUrl":28,"updatedAt":1149},"aks-gpu-inference","manage GPU inference workloads on AKS","Day-2 operations for GPU and model-inference workloads on Azure Kubernetes Service (AKS): diagnose GPU pods stuck Pending, missing nvidia.com\u002Fgpu, CUDA\u002Fdriver mismatches, model OOM on weight load, GPU vCPU-quota failures, KAITO (AI toolchain operator) Workspaces stuck not-ready, and GPU cost \u002F scale-to-zero \u002F spot eviction. WHEN: GPU pod Pending 'Insufficient nvidia.com\u002Fgpu', no nvidia.com\u002Fgpu on node, CUDA driver version insufficient, model OOMKilled loading weights, GPU node pool quota exceeded, KAITO Workspace never becomes ready, idle GPU cost, autoscale GPU on DCGM, spot GPU eviction, right-size a GPU SKU for a model. DO NOT USE FOR: initial GPU\u002FAI setup or enablement (use azure-skills airunway-aks-setup); non-GPU pod\u002Fnode\u002Fnetwork incidents (use aks-troubleshooting); non-GPU cost (use aks-cost-optimization).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1138,1139,1142,1145,1146],{"name":11,"slug":8,"type":14},{"name":1140,"slug":1141,"type":14},"CUDA","cuda",{"name":1143,"slug":1144,"type":14},"GPU","gpu",{"name":22,"slug":23,"type":14},{"name":1147,"slug":1148,"type":14},"Operations","operations","2026-08-23T04:00:03.060719",{"slug":1151,"name":1151,"fn":1152,"description":1153,"org":1154,"tags":1155,"stars":27,"repoUrl":28,"updatedAt":1162},"aks-known-issues","diagnose AKS failures using known issue tables","Match an AKS operation failure against a curated, versioned table of documented known issues and error codes — each entry carrying the cause and the Microsoft-documented fix, workaround, or platform limitation. Deterministic error-string → diagnosis lookup for specific, named failures: AKS VM-extension \u002F CSE provisioning errors with a documented nested signature (VMExtensionError_OutboundConnFail \u002F exit 50, VMExtensionError_K8SAPIServerConnFail \u002F exit 51, VMExtensionError_K8SAPIServerDNSLookupFail \u002F exit 52, OrasPullUnauthorizedVMExtensionError \u002F exit 212), SKU and allocation errors (SkuNotAvailable, ZonalAllocationFailed, OverconstrainedAllocationRequest, message-qualified AllocationFailed), VMCannotFitEphemeralOSDisk, LinkedAuthorizationFailed, NodePoolMcVersionIncompatible, node-image \u002F snapshot 'NodeImageVersion is not accepted', and network-isolated-cluster ACR pull failures. ALLOCATION ROUTING: the full messages 'AllocationFailed: The VM allocation failed due to an internal error. Please retry later or try deploying to a different location' and 'AllocationFailed: We do not have sufficient capacity for the requested VM size' are cataloged signatures owned by this skill; they are not bare errors. A prompt that reports only the AllocationFailed code and explicitly has no nested Azure message is not a catalog match — route that bare-code investigation to aks-troubleshooting. WHEN: an AKS create \u002F scale \u002F upgrade \u002F image-pull fails with one of the cataloged signatures; 'what does \u003Cerror> mean on AKS?'; 'is \u003Cerror> a known issue?'; an AKS vmssCSE \u002F VM-extension exit code; or a message-qualified AKS SKU \u002F allocation error. DO NOT USE FOR: a bare VMExtensionProvisioningError wrapper; an unclassified SKU \u002F capacity allocation incident; a numeric exit code without AKS CSE context; a natural-language 'allocation failed' symptom without the Azure error; non-AKS resources; or open-ended incidents with no cataloged signature — pod crashes, NotReady, DNS, ingress, or timeouts (use aks-troubleshooting for AKS incidents). Read-only: it explains and cites the documented fix, and never applies changes without explicit approval.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1156,1157,1158,1161],{"name":11,"slug":8,"type":14},{"name":25,"slug":26,"type":14},{"name":1159,"slug":1160,"type":14},"Diagnostics","diagnostics",{"name":22,"slug":23,"type":14},"2026-08-23T04:00:30.216663",{"slug":1164,"name":1164,"fn":1165,"description":1166,"org":1167,"tags":1168,"stars":27,"repoUrl":28,"updatedAt":1175},"aks-network-capture","capture network traffic in AKS clusters","Packet-level network evidence for AKS: run a bounded, distributed packet capture across nodes (filtered by IP, port, or tcpdump\u002FBPF expression), and collect Azure network resources (NSG rules, route tables, firewall, VNET peering) when you need pcap-level proof of where traffic drops. Escalation tool for when logs and read-only checks are inconclusive. WHEN: capture packets on a node, take a pcap, tcpdump on AKS, prove where a packet is dropped, verify an NSG or route is blocking traffic at the wire. DO NOT USE FOR: general DNS \u002F connectivity \u002F ingress troubleshooting — start with aks-troubleshooting (which routes here when a capture is actually needed).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1169,1170,1171,1172],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":16,"slug":17,"type":14},{"name":1173,"slug":1174,"type":14},"Observability","observability","2026-08-23T04:00:31.384775",{"slug":4,"name":4,"fn":5,"description":6,"org":1177,"tags":1178,"stars":27,"repoUrl":28,"updatedAt":29},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1179,1180,1181,1182,1183],{"name":11,"slug":8,"type":14},{"name":25,"slug":26,"type":14},{"name":19,"slug":20,"type":14},{"name":22,"slug":23,"type":14},{"name":16,"slug":17,"type":14},7]