Add: New deploy-to-aks skill - #1827
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new deploy-to-aks skill under plugin/skills/ to guide “quick deploy” of an application to an existing AKS cluster, plus a matching test suite registered in tests/skills.json.
Changes:
- Introduces a new skill (
deploy-to-aks) with workflow, references, knowledge packs, and templates for Docker/Kubernetes/Bicep/CI. - Adds unit/trigger/integration tests + fixtures/snapshots for the new skill.
- Registers the skill in the tests skill registry and integration schedule.
Reviewed changes
Copilot reviewed 49 out of 49 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/skills.json | Registers deploy-to-aks in skill lists and integration schedule. |
| tests/deploy-to-aks/unit.test.ts | Unit tests for frontmatter parsing/metadata expectations. |
| tests/deploy-to-aks/triggers.test.ts | Trigger prompt tests + snapshots for routing keywords. |
| tests/deploy-to-aks/integration.test.ts | Integration test scaffold for real agent runs. |
| tests/deploy-to-aks/README.md | Per-skill test README copied from template. |
| tests/deploy-to-aks/fixtures/sample.json | Sample prompts/fixtures for the skill tests. |
| tests/deploy-to-aks/snapshots/triggers.test.ts.snap | Snapshot baseline for extracted trigger keywords/description. |
| plugin/skills/deploy-to-aks/SKILL.md | New skill entry point with prerequisites, workflow, references, and templates index. |
| plugin/skills/deploy-to-aks/phases/quick-deploy.md | Detailed “quick deploy” workflow (detect → generate → validate → deploy → verify). |
| plugin/skills/deploy-to-aks/references/detection.md | Framework/port/health endpoint detection tables. |
| plugin/skills/deploy-to-aks/references/safeguards.md | DS001–DS013 safeguards checklist and examples. |
| plugin/skills/deploy-to-aks/references/workload-identity.md | Workload Identity explanation + per-service patterns. |
| plugin/skills/deploy-to-aks/references/rollback.md | Rollback/troubleshooting guidance for common failure points. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/spring-boot.md | Spring Boot framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/express.md | Express/Fastify framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/nextjs.md | Next.js framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/fastapi.md | FastAPI framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/django.md | Django framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/nestjs.md | NestJS framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/aspnet-core.md | ASP.NET Core framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/go.md | Go framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/knowledge-packs/frameworks/flask.md | Flask framework-specific deployment guidance. |
| plugin/skills/deploy-to-aks/templates/mermaid/architecture-diagram.md | Mermaid architecture diagram template. |
| plugin/skills/deploy-to-aks/templates/mermaid/summary-dashboard.md | Post-deploy summary “dashboard” template. |
| plugin/skills/deploy-to-aks/templates/k8s/namespace.yaml | Namespace manifest template for workload isolation. |
| plugin/skills/deploy-to-aks/templates/k8s/serviceaccount.yaml | ServiceAccount template with Workload Identity annotation. |
| plugin/skills/deploy-to-aks/templates/k8s/deployment.yaml | Deployment template aligned to DS001–DS013 safeguards. |
| plugin/skills/deploy-to-aks/templates/k8s/service.yaml | ClusterIP Service template. |
| plugin/skills/deploy-to-aks/templates/k8s/ingress.yaml | Web App Routing ingress template. |
| plugin/skills/deploy-to-aks/templates/k8s/gateway.yaml | Gateway API Gateway template (Istio). |
| plugin/skills/deploy-to-aks/templates/k8s/httproute.yaml | Gateway API HTTPRoute template. |
| plugin/skills/deploy-to-aks/templates/k8s/hpa.yaml | HPA template with scale behavior defaults. |
| plugin/skills/deploy-to-aks/templates/k8s/pdb.yaml | PodDisruptionBudget template. |
| plugin/skills/deploy-to-aks/templates/k8s/configmap.yaml | ConfigMap template for non-secret config. |
| plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml | GitHub Actions workflow template for build/push/deploy to AKS via OIDC. |
| plugin/skills/deploy-to-aks/templates/dockerfiles/node.Dockerfile | Node.js production Dockerfile template. |
| plugin/skills/deploy-to-aks/templates/dockerfiles/python.Dockerfile | Python production Dockerfile template. |
| plugin/skills/deploy-to-aks/templates/dockerfiles/java.Dockerfile | Java/Spring Boot Maven Dockerfile template. |
| plugin/skills/deploy-to-aks/templates/dockerfiles/go.Dockerfile | Go production Dockerfile template. |
| plugin/skills/deploy-to-aks/templates/dockerfiles/dotnet.Dockerfile | .NET production Dockerfile template. |
| plugin/skills/deploy-to-aks/templates/dockerfiles/rust.Dockerfile | Rust production Dockerfile template. |
| plugin/skills/deploy-to-aks/templates/bicep/main.bicep | Orchestrator Bicep template (AKS/ACR/identity + optional backing services). |
| plugin/skills/deploy-to-aks/templates/bicep/main.bicepparam | Example parameter file for the orchestrator. |
| plugin/skills/deploy-to-aks/templates/bicep/aks.bicep | AKS cluster module template. |
| plugin/skills/deploy-to-aks/templates/bicep/acr.bicep | ACR module template + AcrPull assignment. |
| plugin/skills/deploy-to-aks/templates/bicep/identity.bicep | Managed Identity + federated credential module template. |
| plugin/skills/deploy-to-aks/templates/bicep/postgresql.bicep | PostgreSQL Flexible Server module template. |
| plugin/skills/deploy-to-aks/templates/bicep/redis.bicep | Redis module template + role assignment. |
| plugin/skills/deploy-to-aks/templates/bicep/keyvault.bicep | Key Vault module template + role assignment. |
dc40a3e to
1bc9081
Compare
1bc9081 to
85754f5
Compare
85754f5 to
2d52b7e
Compare
2d52b7e to
984eebf
Compare
984eebf to
8614cb0
Compare
f35195b to
5e82d4a
Compare
Jon Gallant (jongio)
left a comment
There was a problem hiding this comment.
The skill structure works well - phases, references, knowledge packs, and templates are cleanly separated. Safeguards coverage (DS001-DS013) is thorough, and the Dockerfiles are production-quality with multi-stage builds and non-root users.
Two things block merge:
-
CI is red - 2 snapshot failures in
triggers.test.ts. Run the snapshot update command and push. -
PR description is stale - The body still lists Bicep templates (
main.bicep,acr.bicep,identity.bicep, etc.) that were removed. The "What's included" section references ~20 Bicep files that aren't in the current changeset. Update the description to match what's actually here.
See inline comments for specific template and test issues.
- Update trigger snapshots to include 'diagnostic' keyword (fixes CI) - Remove .claude/settings.local.json from .gitignore (unrelated to skill) - Fix Go net/http detection: search .go source files, not go.mod require block - Extend placeholder validation to catch <angle-bracket> style in k8s manifests - Add import psycopg2 to PostgreSQL Python snippet in workload-identity.md - Add import os to Redis Python snippet in workload-identity.md - Fix dotnet.Dockerfile header comment: CMD -> ENTRYPOINT - Fix java.Dockerfile header comment: remove HEALTHCHECK port reference - Add HPA conflict warning comment to deployment.yaml replicas field - Replace golang:1.23-alpine with <go-version> placeholder in go.Dockerfile - Add commented-out egress section to networkpolicy.yaml
Jon Gallant (jongio)
left a comment
There was a problem hiding this comment.
A few things the earlier reviews didn't cover - mostly in the GitHub Actions template.
deploy.yml: Missing concurrency control and rollback handling - both are important for production CI/CD templates. Also no post-deploy verification even though the quick-deploy workflow describes it in Section 5.
workload-identity.md: Still uses "Azure AD" throughout - Microsoft renamed this to "Microsoft Entra ID" in 2023. Worth updating so users searching current docs don't get confused.
- Add concurrency group to deploy.yml to prevent parallel deployment races - Add post-deploy verification step (kubectl wait for pod readiness) - Add rollback-on-failure step to deploy.yml - Replace 'Azure AD' with 'Microsoft Entra ID' throughout workload-identity.md and deploy.yml comments
- Fix concurrency group: env context unavailable at that scope; use github.workflow+github.ref_name - Gate rollback on deploy step output flag to prevent rollback on pre-deploy failures - Fix find|while read swallowing sed exit codes — switch to xargs - Fail explicitly when k8s/ directory is missing (was silently skipped) - Remove redundant kubectl set image (kubectl apply already handles image from manifests) - Remove redundant kubectl wait (rollout status already guarantees pod readiness) - Verify undo succeeded by running rollout status after kubectl rollout undo
…st README - deploy.yml: create namespace before kubectl apply (avoids namespaces not found error) - node.Dockerfile: use npm run build --if-present (safe for apps without a build script) - tests/deploy-to-aks/README.md: align integration test prereqs with AGENTS.md (use npm install -g @github/copilot-cli instead of gh extension install)
| describe("Should NOT Trigger", () => { | ||
| // Near-miss: Azure but not AKS deployment | ||
| const azureNonAksPrompts: string[] = [ | ||
| "set up Azure Functions for my API", | ||
| "configure Azure Front Door for my web app", | ||
| "create a storage account in Azure", | ||
| "monitor my App Service logs", | ||
| "configure Azure DevOps pipelines", | ||
| ]; | ||
|
|
||
| // Near-miss: other cloud providers | ||
| const otherCloudPrompts: string[] = [ | ||
| "deploy my app to EKS on AWS", | ||
| "deploy to GKE using Cloud Build", | ||
| "configure Istio service mesh on minikube", | ||
| "create a Kubernetes operator in Go", | ||
| "set up EC2 instances", | ||
| ]; |
There was a problem hiding this comment.
The negative prompts here include generic words that are very likely to match 2+ extracted keywords (e.g., "deploy", "build", "service", "monitor"), which will cause TriggerMatcher.shouldTrigger() to return triggered: true even though the test expects false. Consider rewriting the negative prompts to avoid multi-keyword overlaps with the skill’s keyword set (or switch to prompts that are clearly non-AKS and don’t include multiple common keywords present in the skill description/content).
| ## MCP Tools | ||
|
|
||
| | Tool | Purpose | Required | | ||
| |------|---------|----------| | ||
| | `azure-documentation` | Fetch Azure documentation and configuration references | Yes | | ||
| | Terminal commands | Execute `kubectl`, `az`, `docker`, `gh` CLI commands | Yes | | ||
|
|
There was a problem hiding this comment.
Markdown tables in this skill are written with leading double pipes (|| ... |), which renders as an extra empty column and is inconsistent with the rest of the repo’s markdown table formatting (single leading |). Update these tables to standard markdown table syntax (single | column separators) for correct rendering and readability (this pattern appears multiple times throughout the skill docs).
| # Layer caching: restore NuGet packages before copying the full source. | ||
| # Copy only project files first so the restore layer is cached independently. | ||
| COPY *.sln ./ | ||
| COPY src/MyApp/*.csproj src/MyApp/ | ||
|
|
||
| RUN dotnet restore src/MyApp/MyApp.csproj | ||
|
|
||
| # Copy everything and publish a Release build | ||
| COPY . . | ||
|
|
||
| RUN dotnet publish src/MyApp/MyApp.csproj \ | ||
| --configuration Release \ |
There was a problem hiding this comment.
This Dockerfile template is hard-coded to a very specific repo layout (src/MyApp/MyApp.csproj, MyApp.dll) but the header comment only calls out replacing the project name. Consider converting the path and project name portions to explicit placeholders (or expand the comments to clearly indicate that the src/MyApp/... paths must also be updated), otherwise users are likely to copy/paste and end up with a broken build.
Jon Gallant (jongio)
left a comment
There was a problem hiding this comment.
Two follow-ups on the rollback fix and the Azure AD rename. Everything else I flagged earlier looks addressed.
kvenkatrajan
left a comment
There was a problem hiding this comment.
Tom Gamble (@gambtho) - can deploy be another workflow within azure-kubernetes? Why are we creating a new deploy skill specifically for aks?
|
chandraneel - can this be added a deploy workflow within the azure-kubernetes skill instead of creating a new one? |
|
This PR has been automatically closed because it has unresolved review comments and no new commits in the last 28 days. If you would still like to merge these changes, please:
Thank you for your contribution! |
- SKILL.md: use inline double-quoted description (the repo frontmatter
validator rejects >- folded scalars); the earlier folded-YAML premise
was incorrect for this repo.
- configmap.yaml: make data an explicit empty map ({}) so Kubernetes
accepts the ConfigMap (bare data: parses as null).
- deploy.yml: exclude <image> from the angle-bracket placeholder check
so the workflow reaches the image-substitution step instead of failing
on the intentionally-retained <image> token.
Refs: microsoft#1827
* feat: relocate deploy-to-aks content under azure-kubernetes Carry over the deploy workflow, references, knowledge packs, and templates from the closed PR #1827 fork branch into a nested sub-skill directory. Frontmatter, routing, and self-references are fixed in follow-up commits. Refs: #1827 * feat: rename sub-skill to azure-kubernetes-app-deploy Rewrite frontmatter name and description (folded YAML per tests/AGENTS.md) with explicit DO-NOT-USE routing to the azure-kubernetes parent and the automatic-readiness sibling. Refs: #1827 * fix: update managed-by label to new sub-skill name Refs: #1827 * fix: correct go Dockerfile comments to reference ENTRYPOINT The template uses ENTRYPOINT but two header comments still said CMD, the same inconsistency review flagged and fixed on the dotnet template. Refs: #1827 * feat: point azure-kubernetes to the app-deploy sub-skill Add a Related-skills entry and a disambiguation note so cluster-vs-app deploy intent routes to azure-kubernetes-app-deploy. Refs: #1827 * test: add app-deploy stimuli to azure-kubernetes eval suite Six Vally stimuli (routing, boundary, output, workspace-fixture) covering the app-deploy sub-skill, plus a minimal Express fixture app. Grades on the parent skill name; replaces the deprecated Jest suite from #1827. Refs: #1827 * fix: address Copilot review on app-deploy sub-skill - SKILL.md: use inline double-quoted description (the repo frontmatter validator rejects >- folded scalars); the earlier folded-YAML premise was incorrect for this repo. - configmap.yaml: make data an explicit empty map ({}) so Kubernetes accepts the ConfigMap (bare data: parses as null). - deploy.yml: exclude <image> from the angle-bracket placeholder check so the workflow reaches the image-substitution step instead of failing on the intentionally-retained <image> token. Refs: #1827 * Genericize app-deploy Dockerfile base image tags Replace pinned base-image versions with <LATEST_STABLE_*> placeholders resolved at generation time. Refs: #2696 * Add app-deploy base image policy reference Single source for base-image selection and <LATEST_STABLE_*> resolution; documents the Microsoft/Azure Linux option. Refs: #2696 * Slim Python knowledge packs to durable guidance Remove inline Dockerfiles and pinned versions; keep framework deltas (collectstatic, init-container migrations, asyncpg, writable paths). Add pointer table. Refs: #2696 * Slim Node knowledge packs to durable guidance Remove inline Dockerfiles and pinned versions; keep framework deltas (Fastify 0.0.0.0 bind, Next standalone + ISR cache mount, Nest shutdown hooks). Add pointer table. Refs: #2696 * Slim compiled-language knowledge packs to durable guidance Remove inline Dockerfiles and pinned versions; keep framework deltas (Spring startupProbe, Go CGO/distroless + graceful shutdown, ASP.NET Data Protection keys). Add pointer table. Refs: #2696 * Reference canonical safeguards spec from app-deploy Point to the sibling constraint spec as source of truth; keep only the deploy-time auto-fix checklist. Refs: #2696 * Add base-image resolution step to quick-deploy Resolve <LATEST_STABLE_*> at generation time; clarify DS009-safe major-tag pinning; trim duplicated pack content. Refs: #2696 * Restore deploy-time image note in quick-deploy Re-add the deployment.yaml image-tag timing note and the RBAC admin-create alternative trimmed during token reduction. Refs: #2696 * Trim app-deploy SKILL.md under token limit Move detail into references; add base-images.md to the reference list. Refs: #2696 * Correct safeguards spec path and dotnet comment pin Fix the relative path to the sibling constraint spec (../ -> ../../) and de-pin a residual runtime-deps version in a dotnet template comment. Refs: #2696 * De-pin Gateway API CRD install to latest stable Replace the pinned gateway-api v1.0.0 release URL with the releases/latest/download form so the skill installs current stable CRDs at runtime instead of an Oct-2023 version. Refs: #2696 * Document distroless runtime placeholder exception Note in base-images.md why Go/Rust runtime stages keep the literal gcr.io/distroless/*-debian12 names instead of a <LATEST_STABLE_*> placeholder, so the build/runtime asymmetry is not mistaken for a bug. Refs: #2696
Description
Adds a new
deploy-to-aksskill that guides developers through deploying applications to existing Azure Kubernetes Service (AKS) clusters. This is complementary to the existingazure-kubernetesskill — whileazure-kubernetescovers cluster provisioning and Day-0 configuration,deploy-to-aksfocuses on the application deployment workflow: framework detection, containerization, manifest generation, safeguards validation, and deployment.Scope: Quick Deploy
This skill is scoped to the quick deploy path — deploying to an existing AKS cluster with minimal questions. It detects the application framework, generates production-ready artifacts (Dockerfile, K8s manifests), validates against AKS Deployment Safeguards (DS001-DS013), and deploys with confirmation gates.
What's included
Core skill files:
SKILL.md— Main skill file with prerequisites, 5-step workflow, and referencesphases/quick-deploy.md— Detailed quick deploy workflow (detection → generation → safeguards → deploy → verify)references/— Detection tables, safeguards checklist, workload identity patterns, rollback guidanceKnowledge packs (9 frameworks):
spring-boot,express,nextjs,fastapi,django,nestjs,aspnet-core,go,flaskTemplates (20 files):
.dockerignoreper language)Tests:
tests/skills.jsonToken budget compliance
All files have been trimmed to fit within the repository's token limits:
Checklist
cd tests && npm test)npm run test:skills:integration -- <skill>)USE FOR/DO NOT USE FOR/PREFER OVERclauses: confirmed no routing regressions for competing skillsRelated Issues
New skill submission — no related issues.