Kipt

Your prompts and skills, one keystroke away.

Explore

Azure Kubernetes skill: plan and configure AKS clusters with a coding agent

The azure-kubernetes skill helps coding agents plan AKS clusters: Automatic vs Standard, networking, security, upgrades and cost. How to install and use it.

By the Kipt team · Updated 28 October 2026

Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 28 October 2026

What is the Azure Kubernetes skill?

The Azure Kubernetes skill helps a coding agent plan and set up an Azure Kubernetes Service (AKS) cluster: which SKU, which networking model, how to secure it, and how to upgrade, observe and pay for it. It produces a recommended cluster configuration and marks which choices are Day-0 (hard to change later) and which are Day-1 (can be enabled after creation). It is for developers and platform teams who need a production-shaped AKS cluster, not just a one-line az aks create.

The skill ships in microsoft/azure-skills, the Azure Skills Plugin, where the README lists it under "Build, deploy, and evolve." The frontmatter lists version 1.2.4, author Microsoft and the MIT license. The description starts: "Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters."

As of 28 October 2026, its skills.sh page listed about 436,100 installs (snapshot, 28 October 2026), with all three security audits at Pass.

What does it do?

The SKILL.md gives the agent four rules: start from your requirements, use the Azure MCP Server's AKS tools first (mcp_azure_mcp_aks) and fall back to az aks only when needed, default to AKS Automatic, and document the reasoning behind Day-0 choices.

It asks only for what it needs: environment type, regions and zones, scale, networking, security and identity, upgrade and observability preferences, and cost limits. If you're unsure, it uses safe defaults. Then it works through nine areas:

Area What the skill recommends
Cluster type AKS Automatic by default; Standard for full control
Networking Azure CNI Overlay for pod IPs, Azure CNI powered by Cilium for dataplane, App Routing with Gateway API for ingress, LocalDNS on all node pools
Security Microsoft Entra ID and Workload Identity, Key Vault through the Secrets Store CSI Driver, Azure Policy and Deployment Safeguards
Observability Managed Prometheus, Container Insights and Grafana, plus control plane and audit logs
Upgrades Maintenance windows, auto-upgrades, LTS versions on the Premium tier, AKS Fleet Manager for staged rollouts
Performance Ephemeral OS disks, Azure Linux nodes, KEDA
Node pools A dedicated system pool of at least 2 nodes, Node Auto Provisioning, no B-series VMs, 4 or more vCPUs for production
Reliability 3 availability zones, Standard tier control plane, PodDisruptionBudgets, Defender for Containers
Cost Spot node pools for interruptible work, stop and start for dev clusters, reservations or savings plans

For narrower jobs it loads one reference file at a time: pod rightsizing, Vertical Pod Autoscaler, cluster autoscaler, or Spot node pools. A cli-reference.md holds the commands, and an error table covers MCP failures, quota limits, IP exhaustion and Workload Identity problems.

Two sub-skills. The folder nests two more skills, each with its own SKILL.md:

  • azure-kubernetes-app-deploy deploys an existing web app or API to a running cluster. It detects the framework, generates a Dockerfile and manifests, validates them against Deployment Safeguards DS001 to DS013, and deploys with verification. It has knowledge packs for Spring Boot, Express, Next.js, FastAPI, Django, NestJS, ASP.NET Core, Go and Flask, Dockerfile templates for six languages, and a GitHub Actions workflow template.
  • azure-kubernetes-automatic-readiness checks whether an existing cluster or local manifests are ready for AKS Automatic, and suggests fixes as diffs you approve. Its first guardrail: "NEVER modify cluster state."

Optional add-on. For live incidents, exact error signatures, packet captures or GPU inference problems, the skill can suggest Microsoft's separate aks-skills plugin. It says to explain the benefit and ask for consent before installing it.

How do you install the Azure Kubernetes skill?

The repo README documents several routes. The full plugin fits best, because the skill reaches for Azure MCP Server tools before the CLI.

Claude Code: the Azure Skills Plugin. Run inside Claude Code:

/plugin install azure@claude-plugins-official

Or run /plugin and search for "azure". Update later with /plugin update azure@claude-plugins-official. See Claude Code plugins.

GitHub Copilot CLI:

/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills

Codex, Cursor and Gemini CLI. For Codex, run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins. For Cursor, use the Cursor Marketplace or Settings, then Plugins. For Gemini CLI, run gemini extensions install https://github.com/microsoft/azure-skills. See Codex skills and Cursor skills.

Skill only. The command on skills.sh uses the skills CLI:

npx skills add https://github.com/microsoft/azure-skills --skill azure-kubernetes

skills.sh lists the two sub-skills as separate entries, so check that their folders arrived if you need them. The skills CLI itself needs Node.js 22.20 or later, per its README.

Prerequisites, per the README: Node.js 18 or later on your PATH for npx, and the Azure CLI signed in with az login. The app-deploy sub-skill also needs an existing cluster and kubectl configured. The Azure MCP Server docs cover the tool layer.

How do you use it?

Describe the workload and constraints. The skill is model-invoked, and its trigger list includes "create AKS environment," "choose AKS SKU," "secure AKS," "AKS spot nodes" and "Vertical Pod Autoscaler."

Example prompts (suggestions, not quotes from the repo):

  • Plan a production AKS cluster in westeurope for 12 microservices. Private API server, restricted egress.
  • Should we use AKS Automatic or Standard? We need GPU node pools and a custom CNI.
  • Our AKS pods request far more CPU than they use. Help me rightsize them.
  • Deploy this Express API to our existing AKS cluster and set up CI with GitHub Actions.
  • Is our cluster ready to move to AKS Automatic? List the blockers.

Expect clarifying questions on Day-0 items. For Day-1 features, the guardrails say to propose two or three safe options with trade-offs and pick a conservative default.

Tips and limits

From the repo, Microsoft Learn and skills.sh, not from testing:

  • Day-0 choices stick. The skill flags networking and API server access as hard to change; its error table says fixing pod IP exhaustion "may require cluster recreation." The Azure CNI Overlay docs explain the pod IP model it recommends.
  • No secrets, no pasted IDs. The agent is told not to request or output tokens or keys, and to discover subscriptions through MCP tools or az account show instead of asking you to paste IDs.
  • No zero-downtime promises. It recommends PDBs, probes, replicas and staged upgrades instead.
  • Opinionated defaults. The recommendations, such as avoiding B-series VMs, are the skill's guidance. Check them against your own requirements and the AKS docs.
  • Security audits. On skills.sh, Snyk rated the skill Pass (low risk) on 21 October 2026 with "No issues detected." Socket rated it Pass on 21 October 2026. Gen Agent Trust Hub rated it Pass (Safe) on 22 October 2026, noting the use of az and kubectl, a jq script that strips secrets from workload data, and non-root defaults in the templates.
  • Where to contribute. The README says the repo is synced from microsoft/GitHub-Copilot-for-Azure, so pull requests go there.
  • Telemetry. Set AZURE_MCP_COLLECT_TELEMETRY=false to turn off Azure MCP telemetry, per the README.

The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.

Save it in your Kipt library

An edited copy helps if your platform team has standards: an approved region list, a required ingress, a fixed node VM family, or "Standard tier only." Put them in the defaults and the agent stops asking. In Kipt, open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip; the references and sub-skill files come with it. The copy does not include the plugin's MCP setup. Skills in your private GitHub repo install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Microsoft.

Similar skills

Questions

What is the Azure Kubernetes skill?

azure-kubernetes is an Agent Skill in Microsoft's microsoft/azure-skills repo. It helps a coding agent plan, create and configure Azure Kubernetes Service (AKS) clusters, separating Day-0 decisions that are hard to change later, such as networking and API server access, from Day-1 features you can turn on after creation.

How do I install the Azure Kubernetes skill in Claude Code?

Run /plugin install azure@claude-plugins-official inside Claude Code to get the Azure Skills Plugin, which bundles this skill with the Azure MCP Server. For the skill files alone, run npx skills add https://github.com/microsoft/azure-skills --skill azure-kubernetes.

Does the skill pick AKS Automatic or AKS Standard?

It defaults to AKS Automatic. The SKILL.md says to use Automatic unless you need custom networking, autoscaling or node pool configurations that Node Auto-Provisioning does not support, and to choose Standard when you need full control over configuration.

Can the Azure Kubernetes skill deploy my app to AKS?

The base skill plans and configures the cluster. Its folder includes a sub-skill, azure-kubernetes-app-deploy, for deploying an existing web app or API to a running cluster: it detects the framework, writes a Dockerfile and Kubernetes manifests, and checks them against AKS Deployment Safeguards.

Is the Azure Kubernetes skill safe to run against my subscription?

All three skills.sh audits rated it Pass as of October 2026. Its guardrails tell the agent not to request or output secrets, not to ask you to paste subscription IDs, and not to promise zero downtime. The readiness sub-skill is read-only and never changes cluster state.

More in Skill directory

All guides

Keep your prompts and skills in one place, in your own GitHub. Install every skill with one command.

Get started

Kipt is an independent product, not affiliated with or endorsed by Anthropic, OpenAI, Cursor or GitHub. Claude, ChatGPT, Codex, Cursor and GitHub are trademarks of their owners.