القائمة
Workload Identity is mandatory for AKS Automatic. Covers managed identity setup, federated credentials, service account annotation, and Entra ID RBAC integration.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.
Writing idiomatic, safe, and reviewable Bicep templates for Azure resources.
Non-blocking cluster status peek — run at the end of Phases 3, 4, 5 to check AKS provisioning progress without hanging.
Voice, tone, and interaction patterns for Kickstart agents.
Configure Infrastructure phase playbook — launch the dedicated Kickstart cluster-setup view, which collects and creates the Azure resources (subscription, resource group, AKS Automatic cluster, ACR) and hands the results back to the chat.
Deploy phase playbook — build, push, apply with Azure CLI and kubectl.
| name | kickstart-workload-identity |
| description | Workload Identity is mandatory for AKS Automatic. Covers managed identity setup, federated credentials, service account annotation, and Entra ID RBAC integration. |
| disable-model-invocation | true |
AKS Automatic uses Azure Workload Identity for pod-level Azure access. AADPODIDENTITY is deprecated — do not use it.
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-app-sa
namespace: default
annotations:
azure.workload.identity/client-id: "<managed-identity-client-id>"
metadata:
labels:
azure.workload.identity/use: "true"
spec:
serviceAccountName: my-app-sa
The Azure SDK picks up the token automatically via the OIDC projected volume.
AKS Automatic integrates with Microsoft Entra ID for Kubernetes RBAC. Use group-based role bindings:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: aks-admins
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: Group
apiGroup: rbac.authorization.k8s.io
name: "<entra-group-object-id>"
AKS Automatic uses a system-assigned managed identity for the control plane. Do not modify its role assignments.
Use Azure Key Vault Provider for Secrets Store CSI Driver (pre-installed) to mount secrets from Azure Key Vault as Kubernetes volumes. Never store Azure credentials in Kubernetes secrets.