CLOUD OPERATIONS / Microsoft
Azure Kubernetes
Pins Microsoft's AKS cluster skill, which refuses to print secrets or subscription identifiers and sends application deployment to a different skill.
“Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, AKS spot nodes, AKS cluster-autoscaler, rightsize AKS pod, pod rightsizing, over-provisioned AKS pod, pod resource requests and limits, Vertical Pod Autoscaler, VPA recommendations.”
01 / THE REASONING
Why this made the selection.
- The guardrails forbid requesting or printing secrets and forbid asking the user to paste subscription IDs.
- A failed MCP call is handled by verifying az login, and deploying an application onto an existing cluster is routed to azure-kubernetes-app-deploy.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- .github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md
- .github/plugins/azure-skills/README.md
- README.md
- LICENSE
Our findings
- The guardrails say not to request or output secrets, and not to ask the user to paste subscription IDs; scope is discovered with MCP tools or az account commands without echoing identifiers.
- When an MCP tool call fails, the remediation is to verify az login and the active subscription, and not to echo subscription identifiers back to the user.
- The skill says it provisions and configures the cluster, and it sends Dockerfile, manifest, and Deployment Safeguards work for an existing cluster to the azure-kubernetes-app-deploy sub-skill.
- It says not to promise zero downtime, and it names az aks stop/start as the cost control for dev/test clusters.
Not established by this review
- The resource was not executed and its tools were not called.
- az aks and the AKS MCP tool were not run.
- The linked CLI reference and Day-2 scenario notes were not fetched.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin install azure@skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README tells Copilot CLI to add the microsoft/skills marketplace and then run /plugin install azure@skills.
- That command installs the Azure plugin group named in the README table, not this skill file by itself.
- The azure-skills plugin README instead prints /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. This review did not resolve that second marketplace name.
Before you start
- Node.js 22 or later, which the plugin README requires for the Azure MCP server
- Azure authentication by Azure CLI login, service-principal environment variables, or managed identity, as the plugin README lists
- A host that can run the Copilot CLI plugin slash command
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- azure-kubernetes SKILL.md ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md
Supports: secret and subscription-id refusals, az login check, and app-deploy handoff
- Repository README ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md
Supports: MIT licence heading and the azure plugin install line
- Azure plugin README ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md
Supports: Azure authentication options, Node.js 22, and a different plugin install line
- Repository LICENSE ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE
Supports: MIT License, copyright Microsoft Corporation
https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md
Supports: upstreamDescription, bestFor, review.notTested