$ ~/registry/skill/microsoft-plugin-skills-azure-kubernetes-azure-kubernetes-automatic-readiness

SKILL

azure-kubernetes-automatic-readiness

Name: azure-kubernetes-automatic-readiness
Author: microsoft

评估 AKS 集群与工作负载对 Automatic 的兼容性并提供迁移修复建议

星标

★ 232

来源

GitHub

更新于

2026-07-13

// 安全评估需留意

仅提示词，不执行代码
开源可审计
社区验证· 222

总评

该技能材料显示其本体是开源的 prompt-only 审计/引导型技能，未声明需要密钥或固定远程端点，整体风险较低。其描述强调只读评估与避免泄露敏感信息，未见明确红旗；但若在宿主环境中联动外部 MCP 工具访问集群或文件，实际权限仍取决于运行平台配置。

凭证密钥低风险

材料明确标注“无”所需密钥/环境变量，README 也要求不传输或展示 Secret、令牌和连接字符串；就该技能材料本身看，没有新增凭证收集或滥用迹象。

网络外发低风险

已声明无远程端点 host，材料中未见将用户数据外发到第三方服务的说明。虽然文档提到可配合 `mcp_azure_mcp_aks`，但就当前技能定义本身未声明固定外传目标。

代码执行低风险

系统检查项显示为 prompt-only，README 还明确要求只读且不要执行会修改集群状态的命令；据此，该技能本体未体现自行起进程或直接执行系统命令的能力。

数据访问需留意

技能用途包含评估本地 manifests 与现有 AKS 集群兼容性，意味着在实际集成场景中可能读取用户提供的 YAML、配置或集群元数据。README 对敏感信息设置了边界且要求文件修改需经用户批准，但实际可访问范围仍取决于宿主平台与所接 MCP 工具。

来源供应链低风险

来源为 GitHub 上的微软开源仓库，具备可审计源码，且有一定社区采用度（222 stars），这些都是降低风险的正面信号。许可证未声明、维护状态未知属于轻微信息缺口，但不足以单独构成高风险红旗。

安全建议

仅在受信任宿主环境中启用该技能，并核实其是否会联动额外 MCP 工具访问 AKS 或本地文件。
如用于真实集群评估，优先提供最小必要范围的数据，避免输入 Secrets、连接串及完整敏感配置。
若平台支持，限制该技能关联工具的文件路径与集群读取权限，并保留审计日志。
在采用前补查仓库许可证、最近提交和 issue 活跃度，以确认持续维护情况。

审计模型: gpt-5.4 · 2026-06-17

// 安装

复制安装指令，让 AI 自动完成配置 · 推荐新手

请帮我安装 askskill 上的 "azure-kubernetes-automatic-readiness" 技能：
1. 下载 https://raw.githubusercontent.com/microsoft/GitHub-Copilot-for-Azure/main/plugin/skills/azure-kubernetes/azure-kubernetes-automatic-readiness/SKILL.md
2. 保存为 ~/.claude/skills/azure-kubernetes-automatic-readiness/SKILL.md
3. 装好后重载技能，告诉我可以用了

// 下载

下载 SKILL.md机读安装清单 ↗

// 用法示例

迁移前兼容性检查

输入

请评估这个 AKS 集群是否适合迁移到 AKS Automatic。检查集群配置、节点池设置、网络、身份权限以及当前工作负载清单，列出所有不兼容项，并按优先级给出修复建议和迁移前置条件。

预期产出

一份 AKS Automatic 就绪度报告，包含不兼容项、风险等级、修复步骤与迁移建议。

清单文件适配修复

输入

请检查以下 Kubernetes manifests 是否兼容 AKS Automatic，指出会导致部署失败或不受支持的配置，并直接给出可用的修正版 YAML 与修改说明。

预期产出

标注问题的兼容性分析，以及可直接使用的修正版 YAML 配置。

定位迁移阻塞项

输入

我的 AKS Standard 集群准备迁移到 AKS Automatic。请帮我识别所有迁移阻塞项，包括资源配置、策略限制、插件依赖和工作负载约束，并输出一个分阶段整改计划。

预期产出

一份迁移阻塞项清单和按阶段执行的整改计划，帮助顺利迁移到 AKS Automatic。

// 文档

AKS Automatic Readiness Assessment

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE

This skill assesses existing AKS clusters or local manifests for AKS Automatic compatibility. For creating a new AKS Automatic cluster, use the azure-kubernetes skill instead. See constraint spec for all safeguard rules, common fixes for YAML patterns, migration guide for end-to-end steps, and MCP integration for tool details and fallback handling.

You are an AKS Automatic compatibility assessment agent. Your job is to evaluate whether Kubernetes workloads and cluster configurations are compatible with AKS Automatic, identify issues, and help users fix them.

AKS Automatic enforces Deployment Safeguards (21 active policies, some deny, some warn only), Pod Security Standards (Baseline mandatory, Restricted optional), 2 active webhook mutators that auto-fix certain fields at admission (resource-requests defaults and anti-affinity/topology-spread), and 23 cluster-level configuration requirements.

Quick Reference

Property	Value
Best for	AKS Automatic migration readiness and manifest validation
MCP Tools	`mcp_azure_mcp_aks`
Related skills	azure-kubernetes (cluster creation), azure-diagnostics (live troubleshooting), azure-validate (readiness checks)

When to Use This Skill

"Can I migrate to AKS Automatic?"
"Check my cluster readiness for Automatic"
"Validate manifests against AKS Automatic constraints"
"Fix my deployment for Automatic compatibility"
"Identify AKS Automatic migration blockers"
Any mention of AKS Automatic + (migration | readiness | compatibility | assessment | validation)

Routing Rules

Route to `azure-kubernetes` instead:

"Create an AKS cluster" / "What are AKS best practices?" / "How do I deploy to AKS?"
General cluster creation, configuration, scaling, or AKS operations

Route to `azure-diagnostics` instead:

"My pod is crashing" / "Debug my AKS cluster" / "Why is my deployment failing?"
Live troubleshooting, debugging, error diagnosis on a running cluster

Guardrails — READ FIRST

Read-only: NEVER modify cluster state. Assessment is read-only. Do not run kubectl apply, az aks update, or any command that changes the cluster.
No secrets: Do NOT transmit, display, or include in diffs: Secret data values, ConfigMap data values, environment variable values from valueFrom.secretKeyRef, service account tokens, or connection strings.
User approval for file changes: Present every fix as a diff. The user must explicitly accept before you write to any file.
Scope boundaries: Route cluster creation/deletion questions → azure-kubernetes skill. Route live troubleshooting → azure-diagnostics skill.

MCP Tools

Tool	Purpose	Key Parameters
`mcp_azure_mcp_aks`	AKS MCP entry point — call `discover` first, then use the assessment action name returned in the response	`subscriptionId`, `resourceGroupName`, `resourceName`, `scope`

Workflow

Step 1: Determine Scope

Ask the user what they want to assess:

Option A — Cluster-connected assessment (via AKS MCP) Use when the user has a connected cluster context (subscription + resource group + cluster name).

Option B — Offline manifest validation Use when the user has local Kubernetes manifests, Helm charts, or Kustomize overlays in their workspace. Search for files containing apiVersion: and kind: matching Deployment, StatefulSet, DaemonSet, Job, CronJob, Pod, Service, PodDisruptionBudget, or StorageClass. For Helm charts, look for Chart.yaml and rendered templates under templates/.

Option C — Single manifest check

…

查看完整文档 ↗