The Agent Skills Directory

Environment Detection and Artifact Generation: The skill performs detailed analysis of the user's project files and Azure environment to generate optimized Dockerfiles and Kubernetes manifests. This process follows established patterns for framework detection (e.g., scanning package.json or requirements.txt) and port identification, ensuring that the generated configurations are tailored to the application's specific needs.
External Resource Integration: During the deployment process, the skill may reference or retrieve standard Kubernetes components, such as the Gateway API resource definitions, from authoritative GitHub repositories. These downloads involve official community-maintained resources required for specific cluster configurations.
Defense-in-Depth Security Controls: The provided templates incorporate multiple security controls designed to harden the application's runtime environment. These include:
Non-Root Execution: Containers are configured to run with dedicated non-root users (e.g., appuser or node), mitigating the impact of potential container escapes.
Filesystem Hardening: Deployment manifests default to a read-only root filesystem, with specific writable paths (like /tmp) provided only where necessary for application functionality.
Privilege Restriction: The templates explicitly drop Linux capabilities and prevent privilege escalation.
Credential Management Best Practices: The skill strongly emphasizes the use of Azure Workload Identity, which leverages OIDC federation for passwordless authentication to Azure services. This approach avoids the need for hardcoded secrets or Kubernetes Secrets for service-to-service communication.
Automated Security Validation: A dedicated validation phase checks generated manifests against a suite of 13 Deployment Safeguards (DS001–DS013), providing immediate feedback and automated fixes for common security misconfigurations.

azure-kubernetes-app-deploy