--- title: "Azure Kubernetes: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-azure-kubernetes/ description: "Pins Microsoft's AKS cluster skill, which refuses to print secrets or subscription identifiers and sends application deployment to a different skill." --- # Azure Kubernetes: review, setup & limitations · Undominated.ai > Pins Microsoft's AKS cluster skill, which refuses to print secrets or subscription identifiers and sends application deployment to a different skill. [← Explore all skills](/skills/) CLOUD OPERATIONS / Microsoft # Azure Kubernetes Pins Microsoft's AKS cluster skill, which refuses to print secrets or subscription identifiers and sends application deployment to a different skill. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, AKS spot nodes, AKS cluster-autoscaler, rightsize AKS pod, pod rightsizing, over-provisioned AKS pod, pod resource requests and limits, Vertical Pod Autoscaler, VPA recommendations.” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The guardrails forbid requesting or printing secrets and forbid asking the user to paste subscription IDs. - A failed MCP call is handled by verifying az login, and deploying an application onto an existing cluster is routed to azure-kubernetes-app-deploy. ### A good fit for - Choosing AKS Automatic or Standard and the Day-0 network settings before a cluster is created - Compare overlay pod addressing with VNet-routable pod addressing before choosing the cluster network model. ### Weigh up before choosing - The resource was not executed, and no Azure API, CLI, or MCP tool was called. - /plugin install azure@skills installs the Azure plugin group, not this one skill file. - The plugin README warns that the plugin uses npx to download and run the Azure MCP server and that a compromised .npmrc could make that npx step execute untrusted code. This review did not install the plugin. - The plugin README says usage telemetry is collected unless AZURE_MCP_COLLECT_TELEMETRY=false. That switch was not tested. - The CLI reference and the rightsizing, VPA, autoscaler, and spot notes were not fetched. - The cost section names az aks stop/start for dev/test clusters. This file does not say to ask before stopping a cluster. - The file tells the reader to use the Standard tier for a zone-redundant control plane and states an API server availability figure. That figure was not checked against an Azure SLA page. - The source review is pinned to revision fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb, but the unversioned plugin install command selects the marketplace release available when installed; its code and dependencies may differ from this reviewed snapshot. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md - .github/plugins/azure-skills/README.md - README.md - LICENSE ### Our findings - The guardrails say not to request or output secrets, and not to ask the user to paste subscription IDs; scope is discovered with MCP tools or az account commands without echoing identifiers. - When an MCP tool call fails, the remediation is to verify az login and the active subscription, and not to echo subscription identifiers back to the user. - The skill says it provisions and configures the cluster, and it sends Dockerfile, manifest, and Deployment Safeguards work for an existing cluster to the azure-kubernetes-app-deploy sub-skill. - It says not to promise zero downtime, and it names az aks stop/start as the cost control for dev/test clusters. ### Not established by this review - The resource was not executed and its tools were not called. - az aks and the AKS MCP tool were not run. - The linked CLI reference and Day-2 scenario notes were not fetched. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) DOCUMENTED COMMAND /plugin install azure@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The repository README tells Copilot CLI to add the microsoft/skills marketplace and then run /plugin install azure@skills. - That command installs the Azure plugin group named in the README table, not this skill file by itself. - The azure-skills plugin README instead prints /plugin marketplace add microsoft/azure-skills and /plugin install azure@azure-skills. This review did not resolve that second marketplace name. ### Before you start - Node.js 22 or later, which the plugin README requires for the Azure MCP server - Azure authentication by Azure CLI login, service-principal environment variables, or managed identity, as the plugin README lists - A host that can run the Copilot CLI plugin slash command ### Compatibility Claude Code · GitHub Copilot CLI · GitHub Copilot in VS Code ### Implementation shell ### AKS cluster planning with Azure login for live lookups - Read subscription and resource-group scope without asking the user to paste subscription IDs - Refuse to request or print tokens and keys - Create or change an AKS cluster only as a later Azure operation; stopping a dev/test cluster is named but not separately confirmed in this file - Installing the full plugin can download and execute Azure MCP/npm hook code and send usage telemetry; review local npm configuration and the telemetry setting before enabling that plugin path. ### Cost model MIT licence. No Azure call was made, and Azure prices were not checked. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-kubernetes SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md Supports: secret and subscription-id refusals, az login check, and app-deploy handoff - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: MIT licence heading and the azure plugin install line - [Azure plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/README.md Supports: Azure authentication options, Node.js 22, and a different plugin install line - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License, copyright Microsoft Corporation - [Pinned source sections reviewed in continuation W19 on 2026-10-15 ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-skills/skills/azure-kubernetes/SKILL.md Supports: upstreamDescription, bestFor, review.notTested KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### AKS Automatic Readiness ↗ Pins Microsoft's AKS Automatic readiness skill, which assesses a cluster or local manifests without changing the cluster and writes files only after an accepted diff.](/skills/microsoft-azure-kubernetes-automatic-readiness/)[### Deploy to AKS ↗ Pins Microsoft's skill for deploying an existing web app to a running AKS cluster, which requires az login and refuses to provision the cluster.](/skills/microsoft-azure-kubernetes-app-deploy/)[### Microsoft Azure Diagnostics ↗ Routes Azure incidents through resource health, recent changes, logs and service-specific troubleshooting guides.](/skills/microsoft-azure-diagnostics/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)