azure-kubernetes
bymicrosoft· 555 skills
Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, AKS spot nodes, AKS cluster-autoscaler, rightsize AKS pod, pod rightsizing, over-provisioned AKS pod, pod resource requests and limits, Vertical Pod Autoscaler, VPA recommendations.
How to install azure-kubernetes?
microsoft/azure-skills/azure-kubernetes
$npx -y skills add microsoft/azure-skills --skill azure-kubernetesInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Run `npx skills use "https://github.com/microsoft/azure-skills" --skill "microsoft/azure-skills/azure-kubernetes"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.
Use the skills in "https://github.com/microsoft/azure-skills" that are relevant to the current task. Run `npx skills add "https://github.com/microsoft/azure-skills"` and select the relevant skills, then follow their instructions.
SKILL.md
| 1 | # Azure Kubernetes Service |
| 2 | |
| 3 | > **AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE** |
| 4 | > |
| 5 | > This skill produces a **recommended AKS cluster configuration** based on user requirements, distinguishing **Day-0 decisions** (networking, API server — hard to change later) from **Day-1 features** (can enable post-creation). See [CLI reference](./references/cli-reference.md) for commands. |
| 6 | |
| 7 | ## Quick Reference |
| 8 | | Property | Value | |
| 9 | |----------|-------| |
| 10 | | Best for | AKS cluster planning and Day-0 decisions | |
| 11 | | MCP Tools | `mcp_azure_mcp_aks` | |
| 12 | | CLI | `az aks create`, `az aks show`, `kubectl get`, `kubectl describe` | |
| 13 | | Related skills | azure-diagnostics (troubleshooting AKS), azure-validate (readiness checks), azure-kubernetes-automatic-readiness (migrate existing cluster to AKS Automatic) | |
| 14 | |
| 15 | ## When to Use This Skill |
| 16 | Activate this skill when user wants to: |
| 17 | - Create a new AKS cluster |
| 18 | - Plan AKS cluster configuration for production workloads |
| 19 | - Design AKS networking (API server access, pod IP model, egress) |
| 20 | - Set up AKS identity and secrets management |
| 21 | - Configure AKS governance (Azure Policy, Deployment Safeguards) |
| 22 | - Enable AKS observability (Container Insights, Managed Prometheus, Grafana) |
| 23 | - Define AKS upgrade and patching strategy |
| 24 | - Understand AKS Automatic vs Standard SKU differences |
| 25 | - Get a Day-0 checklist for AKS cluster setup and configuration |
| 26 | |
| 27 | ## Rules |
| 28 | 1. Start with the user's requirements for provisioning compute, networking, security, and other settings. |
| 29 | 2. Use the `azure` MCP server and select `mcp_azure_mcp_aks` first to discover the exact AKS-specific MCP tools surfaced by the client. Choose the smallest discovered AKS tool that fits the task, and fall back to Azure CLI (`az aks`) only when the needed functionality is not exposed through the AKS MCP surface. |
| 30 | 3. Determine if AKS Automatic or Standard SKU is more appropriate based on the user's need for control vs convenience. Default to AKS Automatic unless specific customizations are required. |
| 31 | 4. Document decisions and rationale for cluster configuration choices, especially for Day-0 decisions that are hard to change later (networking, API server access). |
| 32 | |
| 33 | |
| 34 | ## Required Inputs (Ask only what’s needed) |
| 35 | If the user is unsure, use safe defaults. |
| 36 | - AKS environment type: dev/test or production |
| 37 | - Region(s), availability zones, preferred node VM sizes |
| 38 | - Expected scale (node/cluster count, workload size) |
| 39 | - Networking requirements (API server access, pod IP model, ingress/egress control) |
| 40 | - Security and identity requirements, including image registry |
| 41 | - Upgrade and observability preferences |
| 42 | - Cost constraints |
| 43 | |
| 44 | ## Workflow |
| 45 | |
| 46 | ### 1. Cluster Type |
| 47 | - **AKS Automatic** (default): Best for most production workloads, provides a curated experience with pre-configured best practices for security, reliability, and performance. Use unless you have specific custom requirements for networking, autoscaling, or node pool configurations not supported by Node Auto-Provisioning (NAP). |
| 48 | - **AKS Standard**: Use if you need full control over environment configuration, which requires additional overhead to set up and manage. |
| 49 | |
| 50 | ### 2. Networking (Pod IP, Egress, Ingress, Dataplane) |
| 51 | |
| 52 | **Pod IP Model** (Key Day-0 decision): |
| 53 | - **Azure CNI Overlay** (recommended): pod IPs from private overlay range, not VNet-routable, scales to large environments and good for most workloads |
| 54 | - **Azure CNI (VNet-routable)**: pod IPs directly from VNet (pod subnet or node subnet), use when pods must be directly addressable from VNet or on-prem |
| 55 | - Docs: https://learn.microsoft.com/azure/aks/azure-cni-overlay |
| 56 | |
| 57 | **Dataplane & Network Policy**: |
| 58 | - **Azure CNI powered by Cilium** (recommended): eBPF-based for high-performance packet processing, network policies, and observability |
| 59 | |
| 60 | **Egress**: |
| 61 | - **Static Egress Gateway** for stable, predictable outbound IPs |
| 62 | - For restricted egress: UDR + Azure Firewall or NVA |
| 63 | |
| 64 | **Ingress**: |
| 65 | - **App Routing addon with Gateway API** — recommended default for HTTP/HTTPS workloads |
| 66 | - **Istio service mesh with Gateway API** - for advanced traffic management, mTLS, canary releases |
| 67 | - **Application Gateway for Containers** — for L7 load balancing with WAF integration |
| 68 | |
| 69 | **DNS**: |
| 70 | - Enable **LocalDNS** on all node pools for reliable, performant DNS resolution |
| 71 | |
| 72 | ### 3. Security |
| 73 | - Use **Microsoft Entra ID** everywhere (control plane, Workload Identity for pods, node access). Avoid static credentials. |
| 74 | - Azure Key Vault via **Secrets Store CSI Driver** for secrets |
| 75 | - Enable **Azure Policy** + **Deployment Safeguards** |
| 76 | - Enable **Encryption at rest** for etcd/API server; **in-transit** for node-to-node |
| 77 | - Allow only signed, policy-approved images (Azure Policy + Ratify), prefer **Azure Container Registry** |
| 78 | - **Isolation**: Use namespaces, network policies, scoped logging |
| 79 | |
| 80 | ### 4. Observability |
| 81 | - Use Managed Prometheus and Container Insights with Grafana for AKS observability (logs + metrics). |
| 82 | - Enable Diagnostic Settings to collect control plane logs and audit logs in a Log Analytics workspace for security monitoring and troubleshooting. |
| 83 | - For other monitoring and troubleshooting tools, use features like the Agentic CLI for AKS, Application Insights, Resource Health Center, AppLens detectors, and Azure Advisors. |
| 84 | |
| 85 | ### 5. Upgrades & Patching |
| 86 | - Configure **Maintenance Windows** for controlled upgrade timing |
| 87 | - Enable **auto-upgrades** for control plane and node OS to stay up-to-date with security patches and Kubernetes versions |
| 88 | - Consider **LTS versions** for enterprise stability (2-year support) by upgrading your AKS environment to the Premium tier |
| 89 | - **Fleet upgrades**: Use **AKS Fleet Manager** for staged rollout across test to production environments |
| 90 | |
| 91 | ### 6. Performance |
| 92 | - Use **Ephemeral OS disks** (`--node-osdisk-type Ephemeral`) for faster node startup |
| 93 | - Select **Azure Linux** as node OS (smaller footprint, faster boot) |
| 94 | - Enable **KEDA** for event-driven autoscaling beyond HPA |
| 95 | |
| 96 | ### 7. Node Pools & Compute |
| 97 | - **Dedicated system node pool**: At least 2 nodes, tainted for system workloads only (`CriticalAddonsOnly`) |
| 98 | - Enable **Node Auto Provisioning (NAP)** on all pools for cost savings and responsive scaling |
| 99 | - Use **latest generation SKUs (v5/v6)** for host-level optimizations |
| 100 | - **Avoid B-series VMs** — burstable SKUs cause performance/reliability issues |
| 101 | - Use SKUs with **at least 4 vCPUs** for production workloads |
| 102 | - Set **topology spread constraints** to distribute pods across hosts/zones per SLO |
| 103 | |
| 104 | ### 8. Reliability |
| 105 | - Deploy across **3 Availability Zones** (`--zones 1 2 3`) |
| 106 | - Use **Standard tier** for zone-redundant control plane + 99.95% SLA for API server availability |
| 107 | - Enable **Microsoft Defender for Containers** for runtime protection |
| 108 | - Configure **PodDisruptionBudgets** for all production workloads |
| 109 | - Use **topology spread constraints** to ensure pod distribution across failure domains |
| 110 | |
| 111 | ### 9. Cost Controls |
| 112 | - Use **Spot node pools** for batch/interruptible workloads (up to 90% savings) |
| 113 | - **Stop/Start** dev/test clusters: `az aks stop/start` |
| 114 | - Consider **Reserved Instances** or **Savings Plans** for steady-state workloads |
| 115 | |
| 116 | **Deep-dive scenarios** — load only the relevant reference file: |
| 117 | |
| 118 | | Scenario | Trigger Keywords | Reference | |
| 119 | |----------|-----------------|-----------| |
| 120 | | Pod Rightsizing | over-provisioned pods, CPU requests, memory requests, rightsize workloads | [azure-aks-rightsizing.md](./references/azure-aks-rightsizing.md) | |
| 121 | | VPA Setup | vertical pod autoscaler, VPA recommendations, VPA enable | [azure-aks-vpa.md](./references/azure-aks-vpa.md) | |
| 122 | | Cluster Autoscaler | idle nodes, CAS off, enable autoscaler, scale-down profile, node utilization | [azure-aks-autoscaler.md](./references/azure-aks-autoscaler.md) | |
| 123 | | Spot Node Pools | Spot VMs, Spot nodes, batch workloads, cheaper nodes | [azure-aks-spot.md](./references/azure-aks-spot.md) | |
| 124 | |
| 125 | > **Disambiguation:** If a prompt matches multiple rows (e.g., "cheaper nodes" could suggest both Spot and autoscaler), prefer the most specific match. If ambiguous, ask the user to clarify their intent before loading a reference file. |
| 126 | |
| 127 | ## Guardrails / Safety |
| 128 | - Do not request or output secrets (tokens, keys). |
| 129 | - Do not ask the user to paste subscription IDs. Discover subscription and resource scope via MCP tools (e.g., list subscriptions, list resource groups) or `az account show` / `az account list` so the agent can resolve context without exposing identifiers. |
| 130 | - If requirements are ambiguous for day-0 critical decisions, ask the user clarifying questions. For day-1 enabled features, propose 2–3 safe options with tradeoffs and choose a conservative default. |
| 131 | - Do not promise zero downtime; advise workload safeguards (PDBs, probes, replicas) and staged upgrades along with best practices for reliability and performance. |
| 132 | |
| 133 | ## MCP Tools |
| 134 | | Tool | Purpose | Key Parameters | |
| 135 | |------|---------|----------------| |
| 136 | | `mcp_azure_mcp_aks` | AKS MCP entry point used to discover the exact AKS-specific tools exposed by the client | Discover the callable AKS tool first, then use that tool's parameters | |
| 137 | |
| 138 | ## Error Handling |
| 139 | | Error / Symptom | Likely Cause | Remediation | |
| 140 | |-----------------|--------------|-------------| |
| 141 | | MCP tool call fails or times out | Invalid credentials, subscription, or AKS context | Verify `az login`, confirm the active subscription context with `az account show`, and check the target resource group without echoing subscription identifiers back to the user | |
| 142 | | Quota exceeded | Regional vCPU or resource limits | Request quota increase or select different region/VM SKU | |
| 143 | | Networking conflict (IP exhaustion) | Pod subnet too small for overlay/CNI | Re-plan IP ranges; may require cluster recreation (Day-0) | |
| 144 | | Workload Identity not working | Missing OIDC issuer or federated credential | Enable `--enable-oidc-issuer --enable-workload-identity`, configure federated identity | |
Related
6 picksType
- azure-storageAzure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake.Jul 2026
- azure-resource-lookupList, find, and show Azure resources across subscriptions or resource groups.Jul 2026
- azure-resource-visualizerAnalyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources.Jul 2026
- azure-computeAzure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compare VM pricing, VMSS, scale set, autoscale, burstable, lightweight…Jul 2026
- azure-quotasCheck/manage Azure quotas and usage across providers. For deployment planning, capacity validation, region selection.Jul 2026
- azure-upgradeAssess and upgrade Azure workloads between plans, tiers, or SKUs, or modernize Azure SDK dependencies in source code.Jul 2026