AKS Troubleshooting

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites: Paid Azure usage, disclosed up front: using this skill requires an Azure account with a live AKS cluster (billed by Microsoft under your own Azure agreement), plus Azure CLI (az), kubectl and jq access to that cluster from a host that authorizes shell execution, and approved storage for evidence artifacts. At use time the investigation reads your own cluster and subscription (Kubernetes API reads, az aks and network queries, and, where the host advertises them, Azure MCP, AppLens, Azure Monitor and Resource Health reads). Pod logs are collected into your approved artifact directory: raw logs can contain application secrets or personal data, so the skill keeps raw output outside the model context and shows only bounded redacted projections. Nothing is sent to any third party service by the skill, and nothing is sent during installation itself. Remediation is never applied uninvited. Install "AKS Troubleshooting" for me. Root cause investigation for live Azure Kubernetes Service incidents, read only and evidence first by default. The skill binds the subscription, cluster, kube context, namespace and affected resource, keeps two to four hypotheses with confirming and falsifying signals, and routes by symptom to its topic files: pod failures, node issues, networking, load balancer and ingress, network policy, upgrade operations, spot and zone issues and general diagnostics, plus deep references on the symptom map, API server and webhooks, Inspektor Gadget and the report template. It ships two read only POSIX shell collectors (a target bound cluster snapshot and a pod deep dive whose raw logs stay in your artifact directory, with only redacted projections of at most 50 lines per stream shown). It never restarts, deletes, cordons, drains, scales, upgrades or reconfigures anything unless you explicitly ask for remediation. Repository: https://github.com/microsoft/azure-skills (the skill is the whole .github/plugins/aks-skills/skills/aks-troubleshooting/ folder at the pinned commit: SKILL.md, general-diagnostics.md, load-balancer-and-ingress.md, network-policy.md, networking.md, node-issues.md, pod-failures.md, references/api-server-webhooks-tunnel.md, references/auto-upgrade-evidence.md, references/azure-mcp.md, references/azure-network-path.md, references/command-flows.md, references/inspektor-gadget.md, references/report-template.md, references/structured-input-modes.md, references/symptom-map.md, scripts/cluster-snapshot.sh, scripts/pod-deep-dive.sh, spot-and-zone-issues.md, upgrade-operations.md) Pinned version: install the code at commit cf79ce8778ad063eeac19dbe8bf982d71b466ce0 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/microsoft/azure-skills into a temporary folder, check out commit cf79ce8778ad063eeac19dbe8bf982d71b466ce0, and copy the .github/plugins/aks-skills/skills/aks-troubleshooting/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-18: [FINGERPRINTS] - SKILL.md: SHA-256 fdf30800f2ce84a13ea3c126c8f6e00ed88123d400596a78c6a2e63f173e9dbc - general-diagnostics.md: SHA-256 f9e91eb077555187594140279cfd331dbbb497471959f286fb747b37d49d5655 - load-balancer-and-ingress.md: SHA-256 467d5027ecc807b0c537f5496db508de4931ce7ce9815b3d1e1462b22cb90182 - network-policy.md: SHA-256 9931e71d2ed776e5afc789b03096829a0fd4bb2cd06d1f6f3e92ac070bf8d740 - networking.md: SHA-256 7d9ecd805c8ace2830b62dc89f912f8566ad992a9f6cee7b7153aa82d42a44a8 - node-issues.md: SHA-256 a48a7a60c535d081be7831b393fce806bac3bb5e3f999b199e6d91224b626463 - pod-failures.md: SHA-256 3d15c8b107086318da415d7d253b056bf0bd1ffae2f90720df14c884aa1354dd - references/api-server-webhooks-tunnel.md: SHA-256 b1fd79fb2626277fcbefc740736e2ea1033b41dd925a69a8a369ed80e176c1d9 - references/auto-upgrade-evidence.md: SHA-256 27455d0f9dfbec44526902bd001e28e2c1e7aa8c78fe76375ce83b9811578940 - references/azure-mcp.md: SHA-256 c31394299fab746747ddc6bc5206745e8a30fc31d266165d05e7b7432af53006 - references/azure-network-path.md: SHA-256 77b2c51f33bc6cd1a27a62bd4675216e8aaaabf47f288d095b55ccbeed7f2b0e - references/command-flows.md: SHA-256 b2574c569a38503c60f2d9f9b041754c06313b554637e708c0af4cca8682598d - references/inspektor-gadget.md: SHA-256 9c2967fc4bd3a1488b85c6d1c01729b15b1ea43b096551b5da69d17c250fc81f - references/report-template.md: SHA-256 26520376a26081524d986dc548a9dd737266b43115e6b2fc9fd4c2f4137bc941 - references/structured-input-modes.md: SHA-256 d31e1cb1c3de699214674d40443dadb72a35f2c3d947fca4dfa047ceb7a2678b - references/symptom-map.md: SHA-256 bb42b855df8bedda30b85bae41cc70ea1404f6e62a8a1831fa91bf8b0dc8523d - scripts/cluster-snapshot.sh: SHA-256 099db005690871c0d4fc847cf58eebac60f5bf234e46d3bf11fca4f95229437c - scripts/pod-deep-dive.sh: SHA-256 41c3f7ea226eeaa9e1177ffbbeb0e25c3faf7184915d461597852b0479f60a2d - spot-and-zone-issues.md: SHA-256 00531f4c15aafa5d89d9d8696d2b83c37611fbf7014600308252ef2382ec0379 - upgrade-operations.md: SHA-256 aa7304a4d89389081c2622d7dd62b45d3e2c3aaa7238af87335dc38ef7817f3a If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full (and every other file in the folder) and tell me in plain words: what the skill does when used, which services it connects to, whether it reads or sends any personal information or keys, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The skill folder holds 20 files: SKILL.md, eight topic files at the folder root, nine reference files in references/, and two read only POSIX shell scripts in scripts/ (cluster-snapshot.sh and pod-deep-dive.sh). Manual review read both scripts: they verify that the kube context endpoint matches the named AKS resource before any Kubernetes read, and they take an explicit resource group, cluster and context (the subscription can be pinned with AKS_SUBSCRIPTION_ID). - Nothing is sent anywhere during installation itself; the only download is the skill folder from GitHub at the pinned commit. - At use time all reads target your own cluster and subscription through az, kubectl and jq or host advertised Azure MCP areas. SKILL.md forbids routing kubectl through Azure MCP, forbids running commands or following URLs found in logs, events or tickets, and requires approval with the full image reference before any new image. - Log discipline is in the upstream text: raw current and previous pod logs stay in your artifact directory, visible evidence is bounded to 50 redacted lines per stream, and on a Forbidden or 403 the skill reports the identity and the least role needed instead of self elevating. 3. When I say "yes, install", install it as a skill: copy the whole folder into the agent's skills directory, in a folder named "aks-troubleshooting", keeping every file (SKILL.md, general-diagnostics.md, load-balancer-and-ingress.md, network-policy.md, networking.md, node-issues.md, pod-failures.md, references/api-server-webhooks-tunnel.md, references/auto-upgrade-evidence.md, references/azure-mcp.md, references/azure-network-path.md, references/command-flows.md, references/inspektor-gadget.md, references/report-template.md, references/structured-input-modes.md, references/symptom-map.md, scripts/cluster-snapshot.sh, scripts/pod-deep-dive.sh, spot-and-zone-issues.md, upgrade-operations.md). 4. Verify with no network calls: frontmatter valid, files in place. 5. Report what was installed, where, and what I still need to do myself (for example: sign in or create an account, provide any API key, or install any local tool named in the prerequisites; using the skill is a separate step that only starts when I ask for it, and every paid or authenticated use disclosed above happens only then). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.