# 1. Get Azure context
call_az: {cli_command: "az account show -o json"}
  → subscription_id, subscription_name, tenant_id

# 2. Get cluster details
call_az: {cli_command: "az aks show -n <cluster> -g <rg> -o json"}
  → resource_uri, fqdn, k8s_version, region, node_rg

# 3. Run diagnosis
/k8s diagnose <cluster>
  → issues, severity, root_cause, affected_resources

# 4. Get timeline
call_kubectl: {args: "get events -A --sort-by=.lastTimestamp"}
  → problem_start_time, evidence

# 5. Generate case template markdown file
  → ~/Desktop/AKS-Support-Case-<cluster>-<timestamp>.md

# Azure Support Case - AKS Incident

## Case Summary
| Field | Value |
|-------|-------|
| **Title** | AKS Pod CrashLoopBackOff - pets/store-front |
| **Severity** | 🔴 Critical |
| **Problem Start Time** | 2026-01-24T21:14:40Z |
| **Current Status** | Ongoing |

## Azure Context
| Field | Value |
|-------|-------|
| **Subscription ID** | 463a82d4-1896-4332-aeeb-618ee5a5aa93 |
| **Subscription Name** | ME-MngEnvMCAP993834-varghesejoji-1 |
| **Tenant ID** | <tenant-guid> |
| **Resource Group** | aks01day2-rg |
| **Resource URI** | /subscriptions/.../managedClusters/aks01day2 |

## Cluster Details
| Field | Value |
|-------|-------|
| **Cluster Name** | aks01day2 |
| **FQDN** | aks01day2-dns-xxx.hcp.centralus.azmk8s.io |
| **Kubernetes Version** | 1.32.7 |
| **Region** | centralus |
| **Node Resource Group** | MC_aks01day2_centralus |

## Problem Description

Pod `store-front` in namespace `pets` is in CrashLoopBackOff state with 16+ restarts. 
Container exits immediately with code 1 after startup.

## Affected Resources

| Type | Name | Namespace | Status |
|------|------|-----------|--------|
| Pod | store-front-6f467b6cdf-dcsfn | pets | CrashLoopBackOff |
| Deployment | store-front | pets | 1/2 available |
| Service | store-front | pets | Degraded |

## Initial Triage Outcomes

| Check | Result |
|-------|--------|
| Cluster Power State | ✅ Running |
| Node Health | ✅ 3/3 Ready |
| Control Plane | ✅ No errors |
| Pod Status | ❌ 1 CrashLoopBackOff |
| Resource Pressure | ✅ CPU 7%, Memory 17% |

## Suggested Root Cause

**Deployment modification injected crash command**

The deployment spec was modified to override the container entrypoint:
```yaml
command: ["/bin/sh", "-c"]
args: ["echo forcing crash; exit 1"]

kubectl patch deployment store-front -n pets --type=json \
  -p='[{"op":"remove","path":"/spec/template/spec/containers/0/command"},
       {"op":"remove","path":"/spec/template/spec/containers/0/args"}]'

### Output Location

---

## Log Export Feature

The `/k8s logs --export` command creates a comprehensive ZIP archive containing all diagnostic data.

### Export Contents

| File | Description |
|------|-------------|
| `SUMMARY.md` | Issue summary with root cause and remediation |
| `events.txt` | All Kubernetes events |
| `pods.txt` | All pods status |
| `nodes.txt` | Node status |
| `nodes-describe.txt` | Detailed node descriptions |
| `node-metrics.txt` | Node CPU/Memory usage |
| `pod-metrics.txt` | Pod CPU/Memory usage |
| `<problem-pod>-describe.txt` | Problem pod details (for each failing pod) |
| `<problem-pod>-logs.txt` | Problem pod logs (for each failing pod) |
| `container-logs.json` | Container logs from Log Analytics |
| `cluster-info.json` | Full AKS cluster configuration |

### Export Workflow

```yaml
# 1. Create timestamped directory
mkdir ~/Desktop/aks-logs-YYYY-MM-DD-HHMMSS/

# 2. Export K8s resources via call_kubectl
call_kubectl: {args: "get events -A --sort-by=.lastTimestamp -o wide"} → events.txt
call_kubectl: {args: "get pods -A -o wide"} → pods.txt
call_kubectl: {args: "get nodes -o wide"} → nodes.txt
call_kubectl: {args: "describe nodes"} → nodes-describe.txt
call_kubectl: {args: "top nodes"} → node-metrics.txt
call_kubectl: {args: "top pods -A"} → pod-metrics.txt

# 3. Export problem pod details (for each failing pod)
call_kubectl: {args: "describe pod <pod> -n <ns>"} → <pod>-describe.txt
call_kubectl: {args: "logs <pod> -n <ns> --timestamps"} → <pod>-logs.txt

# 4. Export cluster config via call_az
call_az: {cli_command: "az aks show -n <cluster> -g <rg> -o json"} → cluster-info.json

# 5. Export Log Analytics data via az_monitoring
az_monitoring: {operation: "app_insights", query: "ContainerLogV2 | where TimeGenerated > ago(1h) | take 500"} → container-logs.json

# 6. Generate SUMMARY.md with issues and recommendations

# 7. Create ZIP archive
Compress-Archive → aks-logs-YYYY-MM-DD-HHMMSS.zip

~/Desktop/aks-logs-YYYY-MM-DD-HHMMSS.zip

📊 LOG AGGREGATION: <cluster> (last 1h)

TIMELINE:
─────────────────────────────────────────────────────
16:45:02 [CONTROL-PLANE] kube-scheduler: Failed to bind pod
16:45:03 [EVENT] FailedScheduling: 0/3 nodes available
16:45:15 [APP] store-front: Connection refused to mongodb
16:45:21 [EVENT] BackOff: Back-off restarting container
─────────────────────────────────────────────────────

🔴 ROOT CAUSE: <description>

WHAT: <resource>
WHY:  <evidence>
FIX:  <command>

🚨 ISSUE: <brief description>

WHAT: <resource> in <state>
WHY:  <root cause from logs/events>
FIX:  <exact command to resolve>