AKS Network Capture

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites: Paid Azure usage and sensitive data, disclosed up front: using this skill requires an Azure account with an AKS cluster (billed by Microsoft under your own Azure agreement), kubectl access to that cluster and the Azure CLI (az) signed in to your account, a host that permits Bash or PowerShell execution of the bundled scripts, and an artifact destination you approve for the capture files. At use time the scripts act on your own cluster: they create a ConfigMap and capture Jobs in the cluster, run tcpdump on the bound nodes or pods, optionally generate test traffic, and retrieve the pcap bundle to your approved destination with kubectl cp; the Azure evidence script runs read only az queries (aks show, network vnet, nsg, route table, load balancer, public IP and private DNS listings) against your subscription. A packet capture records the actual network traffic on the bound target and can contain credentials, tokens and customer data: treat every pcap as sensitive, keep it only in the approved destination, and share it only redacted. Nothing is sent to any third party service by the scripts, and nothing is sent during installation itself. Install "AKS Network Capture" for me. Bounded packet captures on AKS nodes for wire level evidence, for explicit packet capture intent after read only diagnostics. The workflow checks host capabilities and completes authorization and target binding first (capture intent is not mutation consent, and a debug container fallback needs separate approval), then installs a capture ConfigMap in the cluster, captures nodes or pods with tcpdump inside a pinned Linux image, optionally generates test traffic, retrieves the exact capture run, and gathers Azure network configuration evidence. It ships Bash and PowerShell versions of five scripts plus the in cluster run-capture script and an authorization reference. Packet captures can contain credentials and customer data, as the upstream authorization reference warns: captures go only to an artifact destination you approve. Repository: https://github.com/microsoft/azure-skills (the skill is the whole .github/plugins/aks-skills/skills/aks-network-capture/ folder at the pinned commit: SKILL.md, references/capture-authorization.md, scripts/collect-azure-network-info.ps1, scripts/collect-azure-network-info.sh, scripts/create-capture.ps1, scripts/create-capture.sh, scripts/generate-test-traffic.ps1, scripts/generate-test-traffic.sh, scripts/retrieve-captures.ps1, scripts/retrieve-captures.sh, scripts/run-capture.sh, scripts/setup-capture-configmap.ps1, scripts/setup-capture-configmap.sh) Pinned version: install the code at commit cf79ce8778ad063eeac19dbe8bf982d71b466ce0 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/microsoft/azure-skills into a temporary folder, check out commit cf79ce8778ad063eeac19dbe8bf982d71b466ce0, and copy the .github/plugins/aks-skills/skills/aks-network-capture/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-18: [FINGERPRINTS] - SKILL.md: SHA-256 afa6c749b8a502cb580b8a5eaee036a288ad0dcfd95da1c7723d5ef1add03087 - references/capture-authorization.md: SHA-256 4aec0038c4101b174a0045a685de30ccf0c98282a1245095e299d993e3163d66 - scripts/collect-azure-network-info.ps1: SHA-256 df25b7344f482b8bee6aa86bea294d6955b51df69a4a11109395481d0c49d520 - scripts/collect-azure-network-info.sh: SHA-256 edc899d16a11584f660a09bdd62b8dd2fae02cb72abef7ed23cbadd3259124ea - scripts/create-capture.ps1: SHA-256 3a1fae203f7c1726d744a1910f1e928201fbb6a10b19e4a3d370442e772679c4 - scripts/create-capture.sh: SHA-256 6bc075ed691ef116f69ff265dc26be41f4533a9ba086c7e7e03487328dbf0839 - scripts/generate-test-traffic.ps1: SHA-256 ceff18edbc3a71e0a3c98966d6f2b1fbce7bf480757d525752642f97c74e79c0 - scripts/generate-test-traffic.sh: SHA-256 1267c3b21e512ecb5a2bf20350a0076cdde9a73dbca2d9ad285f9a267cfa6598 - scripts/retrieve-captures.ps1: SHA-256 a5d1339d1567fc9eeb1937c7a6e0cd305f075646b59845518a66f43e461d76ca - scripts/retrieve-captures.sh: SHA-256 7d92407e362dc2eccad9cb33325483948700454942b3603371df107660a772ed - scripts/run-capture.sh: SHA-256 3b76468b59e397b58659ea4330d92f3cb21c764b69b69bae7641809bccc90279 - scripts/setup-capture-configmap.ps1: SHA-256 ca53f2c7b09931c2042afa121d6025b64e468ea7406e186ccc2ce4d86a491ef8 - scripts/setup-capture-configmap.sh: SHA-256 e6ba1f76977fe5f8950a2562bf285b4fdb6274ed6f5309440799cac9efedd307 If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full (and every other file in the folder) and tell me in plain words: what the skill does when used, which services it connects to, whether it reads or sends any personal information or keys, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The skill folder holds 13 files: SKILL.md, references/capture-authorization.md, and 11 scripts (Bash and PowerShell versions of setup, create, generate traffic, retrieve and Azure evidence collection, plus the in cluster run-capture.sh that the ConfigMap carries). Manual review read every script: they call kubectl and az against the bound cluster and subscription only, and the traffic generator can use kubectl debug or kubectl exec on a source pod you name. - Nothing is sent anywhere during installation itself; the only download is the skill folder from GitHub at the pinned commit. At use time the pcap bundle is retrieved with kubectl cp to the destination you approved, and no script uploads anything to a third party host. - Packet captures can contain credentials and customer data (the upstream authorization reference says so in those words): the capture is bounded, pinned and least privilege, and the artifact destination must be approved before the workflow runs. - SKILL.md gates everything: host capability check and authorization and target binding before any script, separate approval before any debug container fallback, and no routing kubectl through Azure MCP or bypassing host policy. 3. When I say "yes, install", install it as a skill: copy the whole folder into the agent's skills directory, in a folder named "aks-network-capture", keeping every file (SKILL.md, references/capture-authorization.md, scripts/collect-azure-network-info.ps1, scripts/collect-azure-network-info.sh, scripts/create-capture.ps1, scripts/create-capture.sh, scripts/generate-test-traffic.ps1, scripts/generate-test-traffic.sh, scripts/retrieve-captures.ps1, scripts/retrieve-captures.sh, scripts/run-capture.sh, scripts/setup-capture-configmap.ps1, scripts/setup-capture-configmap.sh). 4. Verify with no network calls: frontmatter valid, files in place. 5. Report what was installed, where, and what I still need to do myself (for example: sign in or create an account, provide any API key, or install any local tool named in the prerequisites; using the skill is a separate step that only starts when I ask for it, and every paid or authenticated use disclosed above happens only then). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.