AKS Troubleshooting
Use for AKS connectivity, scheduling, networking, DNS, upgrade, or workload-identity symptoms.
- Establish subscription, cluster, namespace, time window, and user impact without requesting keys.
- Start with Azure Resource Health and read-only commands (
az aks show, kubectl get,
kubectl describe, and bounded kubectl logs). Confirm context before every cluster command.
- Classify evidence into control plane, node, network/DNS, identity, storage, or workload.
- Run
python aks-troubleshooting/scripts/check_manifest.py <manifest.yaml> for a conservative
static signal. It does not parse credentials, contact Azure, or mutate resources.
- Present evidence, confidence, and the smallest reversible remediation. Obtain explicit approval
before restarts, scaling, upgrades, role changes, or policy changes.
Never print kubeconfig/client secrets, run broad log collection without scoping, disable policy,
change production resources, or use --admin by default. Provider-backed explanations are optional;
use local Ollama first and redact identifiers before any commercial provider.
1---2name: aks-troubleshooting3description: Triage AKS symptoms safely with read-only evidence and an escalation boundary.4---56# AKS Troubleshooting78Use for AKS connectivity, scheduling, networking, DNS, upgrade, or workload-identity symptoms.9101. Establish subscription, cluster, namespace, time window, and user impact without requesting keys.112. Start with Azure Resource Health and read-only commands (`az aks show`, `kubectl get`,12 `kubectl describe`, and bounded `kubectl logs`). Confirm context before every cluster command.133. Classify evidence into control plane, node, network/DNS, identity, storage, or workload.144. Run `python aks-troubleshooting/scripts/check_manifest.py <manifest.yaml>` for a conservative15 static signal. It does not parse credentials, contact Azure, or mutate resources.165. Present evidence, confidence, and the smallest reversible remediation. Obtain explicit approval17 before restarts, scaling, upgrades, role changes, or policy changes.1819Never print kubeconfig/client secrets, run broad log collection without scoping, disable policy,20change production resources, or use `--admin` by default. Provider-backed explanations are optional;21use local Ollama first and redact identifiers before any commercial provider.
prashantyr