How do I install the Aks Setup skill?

Run npx skillmds@latest add datus-ai/aks-setup in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Aks Setup safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Aks Setup?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Aks Setup free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Aks Setup?

datus-ai (@datus-ai) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Aks Setup by datus-ai — Agent Skill

Name: Aks Setup
Author: datus-ai

Aks Setup

Configure or troubleshoot an Azure Kubernetes Service profile and its paired datus k8s provider profile, including Azure cloud, DefaultAzureCredential, service principals, managed identity, private endpoints, and verification.

datus-ai b344bfb 3.1 KB Updated Sep 17, 2026

File contents

AKS Setup

Add profiles under agent.plugins.aks.<profile> in the active Datus config. Prefer DefaultAzureCredential with workload or managed identity.

Collect and configure

Collect the profile name, subscription_id, resource_group, cluster, Azure cloud, authentication mode, and Kubernetes namespace.

agent:
  plugins:
    aks:
      prod:
        default: true
        subscription_id: 00000000-0000-0000-0000-000000000000
        resource_group: data-prod
        cluster: analytics
        cloud: public              # public, china, or government

        # Omit these to use DefaultAzureCredential.
        # tenant_id: 00000000-0000-0000-0000-000000000000
        # client_id: 00000000-0000-0000-0000-000000000000
        # client_secret: ${AZURE_CLIENT_SECRET}
        # managed_identity_client_id: 00000000-0000-0000-0000-000000000000

        # kubernetes_server_id: 6dae42f8-4368-4678-94ff-3960e28e3630
        use_private_endpoint: "false"
        timeout: "60"
        max_attempts: "3"

    k8s:
      prod:
        provider: aks
        namespace: analytics
        allowed_namespaces: analytics

For a service principal, configure tenant_id, client_id, and client_secret together. Store only ${ENV_VAR} for the secret and require it in the Datus process environment. For a user-assigned managed identity, use managed_identity_client_id; do not also invent a client secret. Interactive browser authentication is disabled.

cloud selects authority and Resource Manager endpoints. Override kubernetes_server_id only for an AKS environment that uses another API server application ID. use_private_endpoint selects the private FQDN returned by AKS; the Datus host must resolve and reach it.

The SDK picks its newest Container Service API version, which China and Government clouds may not serve yet. If a call there fails with an unsupported API version, pin api_version to a version that cloud supports (for example api_version: "2023-10-01"); leave it unset on public Azure.

Grant Azure RBAC read access to the cluster resources and permission for listClusterUserCredential/action; Kubernetes RBAC separately controls what the resulting identity can do inside the cluster.

If k8s and AKS profile names differ, add provider_profile: prod to k8s. For a non-default provider config file, also set provider_config. Keep Azure credentials only in the AKS profile.

Verify

datus aks --profile prod auth check -o json
datus aks --profile prod clusters describe -o json
datus k8s --profile prod version
datus k8s --profile prod auth can-i get pods -n analytics

For failures, separate credential-chain/tenant errors, Azure RBAC denial, Kubernetes RBAC denial, and private DNS/network reachability. Ensure cloud matches the subscription's sovereign cloud.

If this environment cannot edit the active config, ask the deployment administrator to make the change.

---name: aks-setupdescription: Configure or troubleshoot an Azure Kubernetes Service profile and its paired datus k8s provider profile, including Azure cloud, DefaultAzureCredential, service principals, managed identity, private endpoints, and verification.---# AKS SetupAdd profiles under `agent.plugins.aks.<profile>` in the active Datus config.Prefer `DefaultAzureCredential` with workload or managed identity.## Collect and configureCollect the profile name, `subscription_id`, `resource_group`, `cluster`, Azurecloud, authentication mode, and Kubernetes namespace.```yamlagent: plugins: aks: prod: default: true subscription_id: 00000000-0000-0000-0000-000000000000 resource_group: data-prod cluster: analytics cloud: public # public, china, or government # Omit these to use DefaultAzureCredential. # tenant_id: 00000000-0000-0000-0000-000000000000 # client_id: 00000000-0000-0000-0000-000000000000 # client_secret: ${AZURE_CLIENT_SECRET} # managed_identity_client_id: 00000000-0000-0000-0000-000000000000 # kubernetes_server_id: 6dae42f8-4368-4678-94ff-3960e28e3630 use_private_endpoint: "false" timeout: "60" max_attempts: "3" k8s: prod: provider: aks namespace: analytics allowed_namespaces: analytics```For a service principal, configure `tenant_id`, `client_id`, and`client_secret` together. Store only `${ENV_VAR}` for the secret and require itin the Datus process environment. For a user-assigned managed identity, use`managed_identity_client_id`; do not also invent a client secret. Interactivebrowser authentication is disabled.`cloud` selects authority and Resource Manager endpoints. Override`kubernetes_server_id` only for an AKS environment that uses another API serverapplication ID. `use_private_endpoint` selects the private FQDN returned by AKS;the Datus host must resolve and reach it.The SDK picks its newest Container Service API version, which China andGovernment clouds may not serve yet. If a call there fails with an unsupportedAPI version, pin `api_version` to a version that cloud supports (for example`api_version: "2023-10-01"`); leave it unset on public Azure.Grant Azure RBAC read access to the cluster resources and permission for`listClusterUserCredential/action`; Kubernetes RBAC separately controls whatthe resulting identity can do inside the cluster.If k8s and AKS profile names differ, add `provider_profile: prod` to k8s. For anon-default provider config file, also set `provider_config`. Keep Azurecredentials only in the AKS profile.## Verify```bashdatus aks --profile prod auth check -o jsondatus aks --profile prod clusters describe -o jsondatus k8s --profile prod versiondatus k8s --profile prod auth can-i get pods -n analytics```For failures, separate credential-chain/tenant errors, Azure RBAC denial,Kubernetes RBAC denial, and private DNS/network reachability. Ensure `cloud`matches the subscription's sovereign cloud.If this environment cannot edit the active config, ask the deploymentadministrator to make the change.

Frequently asked questions