AKS Automatic Readiness
Assess Kubernetes workloads for AKS Automatic compatibility and identify migration blockers before you switch.
The skill explicitly requires read-only operation, prohibits exposing secrets, requires explicit approval before file edits, and mentions a rollback window. However, the stated permissions include listClusterUserCredential/action, credential and MCP data-flow boundaries are not fully transparent, and the migration material includes apply, cluster creation, and deletion commands. These external effects justify deductions. No explicit malware, credential theft, or covert exfiltration red line is evident.
The workflow, MCP discovery step, offline fallback, and error table are useful, but the files contain policy-count inconsistencies, depend on external tool/API versions, and enumerate only a subset of offline checks. Static review cannot establish runnable key paths, so the score is capped below 10 and reduced further for unresolved consistency and coverage gaps.
Triggers, scenarios, routing rules, and three input modes are reasonably clear. Boundaries around Helm rendering, cluster permissions, and Azure MCP availability remain limited; Chinese-language interaction is not specified, and the preferred online path depends on Azure/MCP network reachability, although an offline fallback exists. These limitations reduce the score.
The documentation is well organized, uses progressive on-demand references, and includes parameters, examples, error handling, limitations, an MIT license, and a version. It lacks skill-specific tests, a changelog, and clearly assigned maintenance/update responsibility, and some documentation claims conflict, so full marks are not justified.
The skill has a clear goal: assess AKS Automatic compatibility, classify findings, and provide actionable fixes. Its result structure and split between deterministic and context-dependent fixes are directly useful. However, no skill-specific representative outputs or execution evidence are supplied, several fixes require application context, and stale constraint data could cause incorrect assessments; the static score is therefore capped at 7.
Constraint IDs, fields, severities, patch patterns, and response schemas provide audit trails, and the repository shows general CI/evaluation infrastructure. There are no committed tests covering this skill's key paths or third-party execution results, and external AKS claims cannot be cross-validated from the supplied files, so the score is capped at 5.
- Do not treat az aks update, kubectl apply, or az aks delete in the migration material as default read-only operations; require separate confirmation and verify rollback planning for any external change.
- Live assessment depends on Azure MCP, Azure authentication, and the stated RBAC permissions; unavailable MCP should be reported as an offline and potentially incomplete assessment.
- Policy counts, version references, and auto-enabled feature claims are inconsistent; verify them against the actual AKS documentation, MCP response, and deployment version before relying on the result.
- Do not apply sample resource requests, probe endpoints, image tags, or storage substitutions without application context and user confirmation.
What does this skill do, and when should you use it?
This Microsoft Agent Skills skill evaluates existing AKS clusters or local Kubernetes manifests for AKS Automatic compatibility. It checks Deployment Safeguards, Pod Security Standards, admission mutators, and cluster-level configuration requirements. Connected assessments use the Azure AKS MCP entry point, while local manifests can be validated offline. The skill is read-only for cluster state and requires explicit approval before writing file changes.
In connected mode, it calls mcp_azure_mcp_aks to discover the available assessment action, then evaluates a specified subscription, resource group, and AKS cluster. It parses workload and cluster-configuration findings into compatible, requires-changes, incompatible, auto-fixed, and informational results. In offline mode, it loads the constraint specification and checks resource requests, probes, image tags, privilege, capabilities, seccomp profiles, host namespaces, host networking and ports, hostPath volumes, workload spreading, and CSI StorageClasses. It produces summaries, field locations, deterministic JSON patches or remediation guidance, and YAML diffs for proposed fixes.
- A platform team planning an AKS Standard-to-AKS Automatic migration can identify workload and cluster-configuration blockers first.
- A Kubernetes engineer can validate Deployment, StatefulSet, DaemonSet, Job, CronJob, or Pod manifests before deployment.
- A user with local Helm charts, Kustomize overlays, or Kubernetes YAML but no connected cluster can run an offline compatibility assessment.
- An operations team reviewing privileged containers, hostPath usage, host networking, or host namespaces can receive findings and alternative remediation directions.
What are this skill's strengths and limitations?
- Supports both connected-cluster assessment and offline manifest validation.
- Separates incompatible, requires-changes, auto-fixed, and informational findings.
- Includes read-only cluster behavior, secret-handling restrictions, and approval gates for file edits.
- Generates deterministic patches where possible while flagging architecture decisions that need application context.
- Live assessment depends on Azure MCP configuration, Azure access, and cluster credential-read permissions.
- It cannot choose correct image versions, application selectors, or architecture redesigns automatically.
- Unresolved Helm Go templates require rendered output or values files from the user.
- The source does not provide independent test coverage, cost information, or broad cross-platform evidence for this sub-skill.
How do you install this skill?
Run npx skills add microsoft/skills and select the skill in the installation wizard. The README says skills are installed to the selected agent directory, such as .github/skills/ for GitHub Copilot. The source skill is located at .github/plugins/azure-skills/skills/azure-kubernetes/azure-kubernetes-automatic-readiness/. The source does not document a separate command for installing only this sub-skill.
How do you use this skill?
Use prompts such as “Can I migrate to AKS Automatic?”, “Check my cluster readiness for Automatic”, or “Validate manifests against AKS Automatic constraints.” For a connected assessment, provide a subscription ID, resource group, and cluster name; call mcp_azure_mcp_aks with discover first. If Azure MCP is unavailable, validate local manifests offline. The skill does not change cluster state, and file fixes must be shown as diffs and approved with apply, edit, or skip before writing.
How does this skill compare with similar options?
The skill explicitly routes new AKS Automatic cluster creation to azure-kubernetes and live troubleshooting to azure-diagnostics; its own scope is compatibility assessment and migration readiness.