azure-aks-edge-essentials

# Azure Kubernetes Service Edge Essentials Skill This skill provides expert guidance for Azure Kubernetes Service Edge Essentials. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities. ## How to Use This Skill > **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file > **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md) This skill requires **network access** to fetch documentation content: - **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown. - **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown. ## Category Index | Category | Lines | Description | |----------|-------|-------------| | Troubleshooting | L37-L71 | Diagnosing and fixing AKS Edge/Hybrid/Arc issues: cluster creation and upgrades, networking, storage, auth, encryption, logs, node health, and Azure Local/MetalLB/BGP-specific errors. | | Best Practices | L72-L80 | Guidance on resilient AKS Edge Essentials setups: availability sets, Azure Policy on Windows Server, restoring AKS Arc after VM failure, and upgrading AKS Arc clusters/Kubernetes versions. | | Decision Making | L81-L89 | Guidance on AKS Edge/Hybrid deployment choices, pricing/licensing, trials, monitoring/logging options, and planning/operating disconnected or on-premises AKS environments. | | Architecture & Design Patterns | L90-L96 | Designing AKS on Windows Server for Azure Local: high availability on two-node setups, SDN VNet architectures, and deployment patterns for AKS Arc target clusters. | | Limits & Quotas | L97-L112 | System requirements, scale limits, IP capacity planning, supported versions, and support policies for AKS Edge Essentials, AKS on Azure Local, AKS on bare metal, and AKS on Windows Server. | | Security | L113-L141 | Securing AKS Edge/Hybrid/Arc clusters: auth (Entra, AD, gMSA, SSO), RBAC, SSH hardening, cert/key management, image validation, etcd encryption, and security bulletins/mitigations. | | Configuration | L142-L198 | Configuring AKS Edge/Hybrid/Arc clusters: networking, storage, load balancers, GPUs, proxies, autoscaling, GitOps, offline/online updates, and cluster/node lifecycle settings. | | Integrations & Coding Patterns | L199-L214 | Integrations, APIs, and PowerShell for connecting AKS Edge/Hybrid to Arc, IoT/OPC/ONVIF, TPM, storage/backup, metrics, AI models, CSI plugins, and Key Vault secrets. | | Deployment | L215-L228 | Deploying, upgrading, and managing AKS Arc/AKS on Azure Local clusters on Windows/Windows Server, including Terraform/ARM deployments, node pools, OS/Kubernetes upgrades, and safe migration/uninstall steps. | ### Troubleshooting | Topic | URL | |-------|-----| | Run AKS Arc diagnostic checker for cluster failures | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-arc-diagnostic-checker | | Resolve AKS Arc Kubernetes image not ready issues | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-arc-image-not-ready | | Resolve known AKS Arc hybrid and edge issues | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-arc-known-issues | | Validate and troubleshoot AKS Edge secret encryption | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-howto-secret-encryption | | Collect and use AKS Edge Essentials logs for troubleshooting | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-resources-logs | | Diagnose and resolve common AKS Edge Essentials issues | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-troubleshoot-overview | | Collect and analyze kubelet logs on AKS Hybrid nodes | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-get-kubelet-logs | | Troubleshoot common issues in AKS Hybrid and Edge | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-troubleshoot | | Fix AKS cluster creation failures after Azure Local upgrade | https://learn.microsoft.com/en-us/azure/aks/aksarc/cluster-create-fails-after-azure-local-upgrade | | Resolve K8sVersionValidation errors for AKS on Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/cluster-k8s-version | | Recover AKS Hybrid cluster unhealthy after upgrade | https://learn.microsoft.com/en-us/azure/aks/aksarc/cluster-unhealthy-after-kubernetes-upgrade | | Unstick AKS Hybrid cluster upgrades stuck in Upgrading state | https://learn.microsoft.com/en-us/azure/aks/aksarc/cluster-upgrade-status | | Troubleshoot BGP with FRR and MetalLB in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/connectivity-troubleshoot | | Resolve AKS control plane configuration validation errors | https://learn.microsoft.com/en-us/azure/aks/aksarc/control-plane-validation-errors | | Mitigate AKS Hybrid issues after storage volume deletion | https://learn.microsoft.com/en-us/azure/aks/aksarc/delete-storage-volume | | Remove deleted AKS Hybrid clusters still visible in portal | https://learn.microsoft.com/en-us/azure/aks/aksarc/deleted-cluster-visible | | Monitor and troubleshoot etcd secret encryption in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/encrypt-secrets | | Fix repeated Entra auth prompts with kubectl RBAC | https://learn.microsoft.com/en-us/azure/aks/aksarc/entra-prompts | | Collect on-demand diagnostic logs for AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/get-on-demand-logs | | Fix GPU-enabled AKS Arc cluster creation failures | https://learn.microsoft.com/en-us/azure/aks/aksarc/gpu-enabled-cluster-issue | | Diagnose and fix 'MOC unreachable' errors for AKS on Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/infrastructure-operation-failures | | Fix kube-apiserver unreachable errors from Arc Resource Bridge | https://learn.microsoft.com/en-us/azure/aks/aksarc/kube-api-server-unreachable | | Resolve control plane disk exhaustion from kube-apiserver audit logs | https://learn.microsoft.com/en-us/azure/aks/aksarc/kube-apiserver-log-overflow | | Monitor Kubernetes object events in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/kubernetes-monitor-object-events | | Fix .local domain network validation error in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/network-validation-error-local | | Troubleshoot AKS Arc network validation errors | https://learn.microsoft.com/en-us/azure/aks/aksarc/network-validation-errors | | Diagnose and auto-repair unhealthy AKS Arc nodes | https://learn.microsoft.com/en-us/azure/aks/aksarc/node-repair | | Resolve AKS Hybrid storage provisioning and disk space issues | https://learn.microsoft.com/en-us/azure/aks/aksarc/storage-provision-issue | | Use Support.AksArc PowerShell module for diagnostics | https://learn.microsoft.com/en-us/azure/aks/aksarc/support-module | | Resolve MetalLB speaker pods blocked by node taints | https://learn.microsoft.com/en-us/azure/aks/aksarc/troubleshoot-metallb-speaker-taint | | Find troubleshooting guides for AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/troubleshoot-overview | ### Best Practices | Topic | URL | |-------|-----| | Use availability sets to improve AKS workload resilience | https://learn.microsoft.com/en-us/azure/aks/aksarc/availability-sets | | Apply Azure policy best practices to AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/policy-guidance | | Restore AKS Arc clusters after management VM failure | https://learn.microsoft.com/en-us/azure/aks/aksarc/restore-aks-cluster | | Upgrade AKS Arc workload clusters with PowerShell | https://learn.microsoft.com/en-us/azure/aks/aksarc/upgrade | | Upgrade AKS Arc Kubernetes version via Admin Center | https://learn.microsoft.com/en-us/azure/aks/aksarc/upgrade-kubernetes | ### Decision Making | Topic | URL | |-------|-----| | Understand AKS Edge Essentials pricing and licensing options | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-pricing | | Choose monitoring and logging options for AKS Hybrid | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-monitor-logging | | Choose between AKS cloud, edge, and on-premises | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-platforms-compare | | Plan and manage disconnected AKS on Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/disconnected-operations-aks | | Evaluate AKS on Windows Server pricing and trials | https://learn.microsoft.com/en-us/azure/aks/aksarc/pricing | ### Architecture & Design Patterns | Topic | URL | |-------|-----| | Understand AKS on Windows Server availability on two-node Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/deploy-cluster-on-two-node-hci | | Deploy AKS Arc target clusters across SDN VNets | https://learn.microsoft.com/en-us/azure/aks/aksarc/deploy-target-clusters-virtual-networks | | Architect AKS on Windows Server with SDN virtual networking | https://learn.microsoft.com/en-us/azure/aks/aksarc/software-defined-networking | ### Limits & Quotas | Topic | URL | |-------|-----| | Review AKS on Azure Local system requirements | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-arc-local-requirements | | Understand preview limitations for AKS on bare metal | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-bare-metal-preview-limitations | | Check system requirements for AKS on bare metal | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-bare-metal-system-requirements | | Check system requirements for AKS Edge Essentials hosts | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-system-requirements | | Plan IP address capacity for AKS Hybrid and Edge | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-hci-ip-address-planning | | Understand AKS on Azure Local support limits | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-on-azure-local-support-policy | | Review tested resource limits and VM sizes for AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/concepts-support | | Plan AKS Arc multi-rack IP address capacity | https://learn.microsoft.com/en-us/azure/aks/aksarc/multi-rack/plan-aks-ip-address | | Check AKS on Azure Local multi-rack scale limits | https://learn.microsoft.com/en-us/azure/aks/aksarc/multi-rack/scale-requirements | | AKS on Azure Local cluster and node pool scale limits | https://learn.microsoft.com/en-us/azure/aks/aksarc/scale-requirements | | Support policies and limitations for AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/support-policies | | Check supported Kubernetes versions for AKS Arc clusters | https://learn.microsoft.com/en-us/azure/aks/aksarc/supported-kubernetes-versions | ### Security | Topic | URL | |-------|-----| | Configure AD single sign-on to AKS Arc API server | https://learn.microsoft.com/en-us/azure/aks/aksarc/ad-sso | | Use Key Manager to rotate AKS Edge service account keys | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-howto-key-manager | | Configure workload identity on AKS Edge Essentials | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-edge-workload-identity | | Set up Azure RBAC authorization for AKS Arc clusters | https://learn.microsoft.com/en-us/azure/aks/aksarc/azure-rbac-aks-hybrid | | Use Azure RBAC to control kubeconfig access in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/azure-rbac-local | | Manage certificates for secure communication in AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/certificates-overview | | Apply security concepts for AKS on Windows Server clusters | https://learn.microsoft.com/en-us/azure/aks/aksarc/concepts-security | | Configure SSH key access for AKS Hybrid clusters | https://learn.microsoft.com/en-us/azure/aks/aksarc/configure-ssh-keys | | Implement container security in AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/container-security | | Enable Microsoft Entra authentication for AKS Hybrid and Edge | https://learn.microsoft.com/en-us/azure/aks/aksarc/enable-authentication-microsoft-entra-id | | Encrypt Kubernetes etcd secrets in AKS on Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/encrypt-etcd-secrets | | Control AKS Arc access with Entra ID and Kubernetes RBAC | https://learn.microsoft.com/en-us/azure/aks/aksarc/kubernetes-rbac-entra-id | | Configure Kubernetes RBAC with Microsoft Entra ID in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/kubernetes-rbac-local | | Enable Azure RBAC for AKS on Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/multi-rack/use-azure-rbac | | Configure gMSA-based AD authentication for AKS Windows containers | https://learn.microsoft.com/en-us/azure/aks/aksarc/prepare-windows-nodes-gmsa | | Restrict SSH access to AKS Hybrid virtual machines | https://learn.microsoft.com/en-us/azure/aks/aksarc/restrict-ssh-access | | Restrict SSH access to AKS Windows Server nodes | https://learn.microsoft.com/en-us/azure/aks/aksarc/restrict-ssh-access-22h2 | | Review AKS Arc security bulletins and mitigations | https://learn.microsoft.com/en-us/azure/aks/aksarc/security-bulletins | | Configure multiple administrators for AKS on Windows Server | https://learn.microsoft.com/en-us/azure/aks/aksarc/set-multiple-administrators | | SSH into Windows and Linux AKS Hybrid nodes | https://learn.microsoft.com/en-us/azure/aks/aksarc/ssh-connect-to-windows-and-linux-worker-nodes | | Securely connect to AKS Arc nodes using SSH | https://learn.microsoft.com/en-us/azure/aks/aksarc/ssh-connection | | Configure trusted certificate bundles for AKS Arc hosts | https://learn.microsoft.com/en-us/azure/aks/aksarc/update-certificate-bundle | | Manage infrastructure and Kubernetes certificates in AKS Arc | https://learn.microsoft.com/en-us/azure/aks/aksarc/update-certificates | | Validate signed container images in AKS on Azure Local | https://learn.microsoft.com/en-us/azure/aks/aksarc/validate-signed-container-images | | Configure workload identity on AKS Hybrid clusters | https://learn.microsoft.com/en-us/azure/aks/aksarc/workload-identity | ### Configuration | Topic | URL | |-------|-----| | Configure node taints for AKS Arc clusters | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-arc-use-node-taints | | Configure AKS on bare metal cluster via ARM template | https://learn.microsoft.com/en-us/azure/aks/aksarc/aks-bare-metal-create-cluster-arm-template |