About aks-network-capture
A skill for planning and carrying out authorized packet captures on AKS nodes or pods, aimed at operators investigating specific network behavior. It enforces host capability checks, target binding, approvals, and bounded evidence handling.
Key features
- 01Host capability and authorization checks
- 02Capture AKS nodes or pods
- 03Generate traffic when approved
- 04Retrieve capture runs and Azure evidence
- 05Handle failed or stale capture setup
Use cases
- 01Collect packet evidence for an AKS investigation
- 02Prepare a target-bound capture plan when execution is unavailable
- 03Review supplied, redacted capture evidence
MCP support
Azure MCP provides AKS cluster and node-pool metadata only; it does not execute Kubernetes commands or perform packet capture.
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/aks-network-capturein Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
references/capture-authorization.mdscripts/collect-azure-network-info.ps1collect-azure-network-info.shcreate-capture.ps1create-capture.shgenerate-test-traffic.ps1generate-test-traffic.shretrieve-captures.ps1retrieve-captures.shrun-capture.shsetup-capture-configmap.ps1setup-capture-configmap.shDetails
From the project READMEAKS Network Capture
Quick Reference
| Use | Requires | Safety |
|---|---|---|
| AKS pcap evidence | kubectl; az for Azure evidence | Bounded, pinned, least privilege |
When to Use This Skill
Use for explicit packet capture after read-only checks, not generic connectivity failures.
MCP Tools
Azure MCP's AKS area provides cluster and node-pool metadata, not Kubernetes command execution or packet capture.
Host Capability Gate
Before executing the workflow, confirm that the host permits the required
Bash or PowerShell execution, kubectl access to the bound cluster, az for
Azure evidence, access to the bundled scripts, and an approved artifact
destination. A governed Azure CLI tool alone does not establish that shell,
Kubernetes commands, or artifact operations are supported.
If a required capability is unavailable or prohibited, state that capture
execution is unavailable in this host. Analyze supplied, appropriately
redacted evidence or give the operator a target-bound collection/capture plan;
do not claim to have run it. Never route kubectl through Azure MCP, add an
unapproved execution path, or bypass host policy. Host support does not replace
the mutation and sensitive-data approvals below.
Run bundled scripts from the skill root only after this gate is satisfied.
Workflow/Steps
- Check host capabilities, then complete authorization and target binding. Capture intent is not mutation consent. Stop for separate approval before any debug-container fallback.
- Install Bash / PowerShell.
- Capture nodes or pods with Bash / PowerShell.
- Generate traffic if approved with Bash / PowerShell.
- Retrieve the exact run with Bash / PowerShell.
- Gather Azure evidence with Bash / PowerShell.
The ConfigMap runs run-capture.sh inside its pinned Linux image.
Error Handling
| Error | Action |
|---|---|
| Invalid input | Correct it before retrying. |
| Missing/stale ConfigMap | Run setup again. |
| Capture/retrieval failure | Inspect Job logs; missing evidence is not success. |