메뉴
Use when setting up cross-cluster AKS access with Workload Identity, RBAC, and kubectl configuration for PilotSwarm workers.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
The order of operations for changing a live agent safely — diagnose, patch, publish, converge, verify, roll back. Use whenever you are about to modify an agent package that something is already running on.
Deploy PilotSwarm to AKS using the repo's canonical scripts and checks. Use when refreshing secrets, building/pushing the worker image, rolling out to AKS, or verifying provider/model changes in the live cluster.
Reset remote PilotSwarm state for AKS safely. Use when wiping the PilotSwarm database/blob state, clearing stale orchestration history, or recovering from namespace drift and replay/nondeterminism issues.
Use when bringing up a fresh, isolated PilotSwarm environment (`mysandbox`, `myenv2`, etc.) via the npm Bicep/GitOps orchestrator at `deploy/scripts/deploy.mjs`. Covers `new-env` scaffolding, EDGE_MODE × TLS_SOURCE selection, the `all` aggregate, per-service redeploys with `--steps`, force-redeploy semantics, verification, and teardown. Strictly separate from the legacy bash path operated by `scripts/deploy-aks.sh`.
Use after deploying a PilotSwarm stamp with VPN_GATEWAY_ENABLED=true when an operator needs the Azure VPN client profile (azurevpnconfig.xml). Wraps deploy/scripts/auth/Get-VpnClientProfile.ps1 — downloads the gateway-issued profile zip via 'az network vnet-gateway vpn-client generate' and extracts it under the gitignored deploy/envs/local/<env>/vpn-client/ folder. The XML is the same for every user (no per-user credentials), and end users still authenticate with their own Entra ID at connect time.
How to compute model latency and estimated $ cost from PilotSwarm observability data. Read this before reporting that a model is "slow" or "expensive" — most apparent slowness is orchestration overhead, not model inference, and most cost numbers are guesses unless they reference a real published price card.
| name | pilotswarm-aks-identity |
| description | Use when setting up cross-cluster AKS access with Workload Identity, RBAC, and kubectl configuration for PilotSwarm workers. |
How to wire Workload Identity, RBAC, and kubectl when PilotSwarm workers in a control AKS cluster need to manage a second AKS cluster.
Prefer Azure Workload Identity on the control cluster instead of relying on node identity.
Required pieces:
azure.workload.identity/client-id: <client-id>azure.workload.identity/use: "true"system:serviceaccount:<namespace>:<service-account>api://AzureADTokenExchangeMinimum Azure RBAC usually needed:
Azure Kubernetes Service Cluster User Role on the workload AKS clusterStorage Blob Data Contributor on the storage accountWhen documenting or implementing this flow, include validation from inside a control-plane pod:
AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_FEDERATED_TOKEN_FILE, and AZURE_AUTHORITY_HOSTaz login \
--service-principal \
-u "$AZURE_CLIENT_ID" \
-t "$AZURE_TENANT_ID" \
--federated-token "$(cat "$AZURE_FEDERATED_TOKEN_FILE")" \
--allow-no-subscriptions
az aks get-credentials \
--subscription "$AZURE_SUBSCRIPTION_ID" \
--resource-group "$AZURE_RESOURCE_GROUP" \
--name "$WORKLOAD_CLUSTER_NAME" \
--file /tmp/workload-kubeconfig \
--overwrite-existing
kubectl auth can-i create podskubectl Guidancekubectl --context <cluster-context>kubectl create secret generic ... --from-env-file=... for worker env injection