feat: Extend AKS skill to perform cluster reviews

evals/azure-skills/azure-kubernetes/eval.yaml

@@ -142,6 +142,26 @@ stimuli:
         config:
           pattern: "(?i)fatal error|unhandled exception|stack trace"
 
+  # ── routing-aks-review-prompt ──
+  # Jest: "invokes azure-kubernetes skill for AKS cluster review"
+  # Assertions: softCheckSkill + isSkillInvoked (invocation rate ≥ 80%)
+  - name: "Routing: AKS cluster review"
+    prompt: "I want to review my AKS cluster against best practices"
+    tags:
+      type: integration
+      tier: full
+      cost: llm
+      area: routing
+      earlyTerminate: '[{"type":"skill-call","skill":"azure-kubernetes"},{"type":"tool-call-count","count":3}]'
+    graders:
+      - type: skill-invocation
+        config:
+          required:
+            - azure-kubernetes
+      - type: output-not-matches
+        config:
+          pattern: "(?i)fatal error|unhandled exception|stack trace"
+
   # ── day0-guidance-output-prompt ──
   # Jest: "responds with Day-0 vs Day-1 guidance"
   # Expects response mentioning tier, networking, or API server

plugins/azure-skills/skills/azure-kubernetes/SKILL.md

@@ -4,7 +4,7 @@ license: MIT
 metadata:
   author: Microsoft
   version: "0.0.0-placeholder"
-description: "Plan, create, and configure production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis). WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, AKS spot nodes, AKS cluster-autoscaler, rightsize AKS pod, pod rightsizing, over-provisioned AKS pod, pod resource requests and limits, Vertical Pod Autoscaler, VPA recommendations."
+description: "Plan, create, configure, and review production-ready Azure Kubernetes Service (AKS) clusters. Covers Day-0 checklist, SKU selection (Automatic vs Standard), networking options (private API server, Azure CNI Overlay, egress configuration), security, and operations (autoscaling, upgrade strategy, cost analysis) and Day-2 review and audit. WHEN: create AKS environment, provision AKS, enable AKS observability, design AKS networking, choose AKS SKU, secure AKS, optimize AKS, AKS spot nodes, AKS cluster-autoscaler, rightsize AKS pod, pod rightsizing, over-provisioned AKS pod, pod resource requests and limits, Vertical Pod Autoscaler, VPA recommendations, review AKS, audit AKS, AKS remediation."
 ---
 
 # Azure Kubernetes Service
@@ -16,9 +16,9 @@ description: "Plan, create, and configure production-ready Azure Kubernetes Serv
 ## Quick Reference
 | Property | Value |
 |----------|-------|
-| Best for | AKS cluster planning and Day-0 decisions |
+| Best for | AKS cluster planning (Day-0) and posture review / compliance audit (Day-2) |
 | MCP Tools | `mcp_azure_mcp_aks` |
-| CLI | `az aks create`, `az aks show`, `kubectl get`, `kubectl describe` |
+| CLI | `az aks create`, `az aks show`, `az aks nodepool list`, `kubectl get`, `kubectl describe` |
 | Related skills | azure-kubernetes-app-deploy (deploy an app to an existing cluster), azure-diagnostics (troubleshooting AKS), azure-validate (readiness checks), azure-kubernetes-automatic-readiness (migrate existing cluster to AKS Automatic) |
 
 ## When to Use This Skill
@@ -32,6 +32,7 @@ Activate this skill when user wants to:
 - Define AKS upgrade and patching strategy
 - Understand AKS Automatic vs Standard SKU differences
 - Get a Day-0 checklist for AKS cluster setup and configuration
+- Review or audit an existing AKS cluster against Microsoft Learn practices, Well-Architected pillars, the AKS Checklist, live diagnostics detectors, and container best practices (Day-2). See [azure-aks-review.md](./references/azure-aks-review.md).
 
 > **Deploying an application to an existing cluster?** This skill provisions and
 > configures the *cluster*. To containerize an app and deploy it to a cluster
@@ -135,9 +136,14 @@ If the user is unsure, use safe defaults.
 | VPA Setup | vertical pod autoscaler, VPA recommendations, VPA enable | [azure-aks-vpa.md](./references/azure-aks-vpa.md) |
 | Cluster Autoscaler | idle nodes, CAS off, enable autoscaler, scale-down profile, node utilization | [azure-aks-autoscaler.md](./references/azure-aks-autoscaler.md) |
 | Spot Node Pools | Spot VMs, Spot nodes, batch workloads, cheaper nodes | [azure-aks-spot.md](./references/azure-aks-spot.md) |
+| Cluster Review / Audit | review AKS, audit AKS cluster, AKS practices review, validate AKS posture, AKS compliance checklist, AKS remediation report | [azure-aks-review.md](./references/azure-aks-review.md) |
 
 > **Disambiguation:** If a prompt matches multiple rows (e.g., "cheaper nodes" could suggest both Spot and autoscaler), prefer the most specific match. If ambiguous, ask the user to clarify their intent before loading a reference file.
 
+## Cluster Review / Audit (Day-2)
+
+When the user asks to **review**, **audit**, or **assess the compliance posture** of an existing AKS cluster, load [azure-aks-review.md](./references/azure-aks-review.md) for the full workflow: required inputs, 9-step review workflow, decision logic, output format, guardrails, and links to the checklist matrix, diagnostics detectors, container best practices, and audit report template.
+
 ## Guardrails / Safety
 - Do not request or output secrets (tokens, keys).
 - Do not ask the user to paste subscription IDs. Discover subscription and resource scope via MCP tools (e.g., list subscriptions, list resource groups) or `az account show` / `az account list` so the agent can resolve context without exposing identifiers.