# Plan Production-Ready Azure Kubernetes Clusters

AKS planning requires early decisions that are difficult and costly to change. This skill structures those decisions and assesses workloads for secure, reliable migration.

## Install

```bash
npx skillstore add microsoft/azure-kubernetes
```

## Metadata

- Status: approved
- Slug: microsoft-azure-kubernetes
- Version: 1.1.4
- Author version: 1.1.4
- Skillstore revision: r2
- Version status: valid
- Tree hash: 9d80875c66293449bf85ba7466afefa760116c5f6c8a0fabc7d7b279b3f7277f
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-kubernetes/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: env\_access, external\_commands, network, filesystem
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/microsoft-azure-kubernetes
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-azure-kubernetes/manifest

## Capabilities

- Compares AKS Automatic and Standard against workload control and operational requirements.
- Plans networking, identity, secrets, observability, upgrades, node pools, and reliability settings.
- Separates difficult Day-0 decisions from features that can be enabled after creation.
- Assesses manifests or connected clusters against bundled AKS Automatic compatibility constraints.
- Proposes reviewed YAML diffs for deterministic workload compatibility fixes.
- Reviews rightsizing, autoscaling, Vertical Pod Autoscaler, and Spot node pool options.

## Use Cases

- Design a platform blueprint: Define a production AKS cluster with documented networking, identity, observability, reliability, and upgrade decisions.
- Assess migration readiness: Evaluate existing manifests or a connected cluster against AKS Automatic safeguards and prioritize required changes.
- Optimize cost and capacity: Review pod requests, autoscaling, Spot suitability, and node pool choices without weakening workload resilience.

## Prompt Templates

### Choose an AKS service model

```
Plan an AKS cluster for [environment] in [region]. Compare Automatic and Standard, then recommend one using safe defaults.
```

### Design production networking

```
Design AKS networking for [requirements]. Cover API access, pod addressing, ingress, egress, DNS, network policy, and irreversible Day-0 decisions.
```

### Assess Automatic readiness

```
Assess [manifest path or cluster] for AKS Automatic compatibility. Use read-only checks, group blockers by severity, and propose diffs without applying changes.
```

### Build an optimization plan

```
Analyze [cluster or metrics source] for rightsizing, autoscaling, Spot capacity, upgrades, and observability. Quantify risks, costs, dependencies, and staged actions.
```

## Limitations

- Live assessment requires Azure MCP access or authenticated Azure CLI and kubectl contexts.
- Bundled compatibility constraints can become outdated as AKS Automatic policies change.
- Helm templates require rendered manifests and values before reliable offline analysis.
- Recommendations cannot replace workload testing, capacity validation, or organizational security review.

## Best Practices

- Provide environment, region, scale, compliance, networking, and cost requirements before requesting a final recommendation.
- Review Day-0 networking and API access decisions with responsible owners before provisioning.
- Start with read-only assessment and require approval before applying file or cloud changes.

## Anti Patterns

- Do not apply generic CIDR ranges, VM sizes, or resource limits without validating workload and network constraints.
- Do not expose secrets, tokens, connection strings, subscription identifiers, or complete ConfigMap data in reports.
- Do not enable automatic VPA updates or place stateful critical workloads on Spot nodes without staged testing.

## Security Audit

- Audited at: 2026-07-23T18:47:23.71\+00:00
- Summary: Most scanner hits are Markdown formatting, Kubernetes field names, official links, or fixed examples. Two predictable /tmp exports create disclosure and clobber risks. Mandatory-authority language and missing approval gates require remediation before publication.

## Stats

- Views: 97
- Downloads: 8
- Favorites: 0
- Popularity score: 0