Azure Operator Nexus Skill

This skill provides expert guidance for Azure Operator Nexus. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L36-L83	Diagnosing and fixing Nexus infrastructure issues: bare metal, storage, networking, Kubernetes clusters, runtime upgrades, connectivity, and resource health alerts.
Best Practices	L84-L89	Guidance on Nexus bare metal lifecycle ops, ETCD maintenance in Nexus AKS, and procedures for repairing and maintaining Nexus storage appliance components.
Decision Making	L90-L98	Guidance for planning Nexus cluster placement, choosing Nexus and Kubernetes VM SKUs/versions, and mapping Nexus releases to supported storage software.
Architecture & Design Patterns	L99-L104	Design patterns and reference architectures for resilient Nexus deployments, including rack-failure-tolerant control planes and near-edge storage topology and capacity planning.
Limits & Quotas	L105-L116	Nexus platform limits, quotas, supported versions, upgrade cadence, storage planning, node restarts/timeouts, isolation domain requirements, and log behavior after disconnection.
Security	L117-L155	Securing Nexus: identity/RBAC, ACLs, SSH and serial access, break-glass methods, key/cert/secret rotation, Defender/Policy, managed identities, and secure VM/cluster connectivity.
Configuration	L156-L227	Configuring and operating Nexus clusters and network fabric: templates, isolation domains, routing/BGP/QoS, Kubernetes settings, monitoring, security, credentials, and staged/commit workflows.
Deployment	L228-L236	Deploying and maintaining Nexus platform and fabric: prerequisites, image building, OS and fabric upgrades, and replacing or updating terminal servers in the network fabric.

Troubleshooting

Topic	URL
Troubleshoot Nexus network devices with read-only commands	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-network-fabric-read-only-commands
Validate Nexus Network Fabric cabling with diagnostic APIs	https://learn.microsoft.com/en-us/azure/operator-nexus/how-to-validate-cables
Use bare metal machine platform commands for recovery	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-baremetal-functions
Run emergency bare metal actions with nexusctl	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-baremetal-nexusctl
Use run-data-extract to troubleshoot Nexus bare-metal	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-baremetal-run-data-extract
Troubleshoot bare metal machines with az baremetalmachine run-read-command	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-baremetal-run-read
Resolve preflight check failures for Nexus runtime upgrades	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-cluster-runtime-upgrade-preflight-checks
Gather trace IDs for Nexus PersistentVolumeClaim failures	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-gather-pvc-trace-id
Collect diagnostic data for Nexus VM console issues	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-gather-vm-console-data
Run Nexus Kubernetes cluster log collector script	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-kubernetes-cluster-log-collector-script
Run read-only diagnostics on Nexus storage appliances	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-storage-run-read
Diagnose and resolve Operator Nexus storage appliance errors	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-storage-appliance-error-messages
Fix Azure Operator Nexus volume operation errors	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-volume-error-messages
Fix Accepted cluster hydration issues in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-accepted-cluster-hydration
Diagnose and fix degraded bare metal machines in Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-bare-metal-machine-degraded
Troubleshoot bare-metal machine provisioning in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-bare-metal-machine-provisioning
Resolve warning status on bare metal machines in Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-bare-metal-machine-warning
Fix Nexus ClusterConnectionStatus Disconnected heartbeat issues	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-cluster-heartbeat-connection-status-disconnected
Recover control plane quorum loss in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-control-plane-quorum
Resolve CSN storage pod containers stuck in creating	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-csn-storage-pod-container-stuck-in-creating
Troubleshoot DNS issues in Nexus Network Fabric	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-dns-issues
Fix failed volume attachment alerts in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-failed-volume-attachments
Fix Azure Operator Nexus hardware validation failures	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-hardware-validation-failure
Troubleshoot CSN-connected internet host access in AKS hybrid	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-internet-host-virtual-machine
Troubleshoot isolation domain provisioning failures in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-isolation-domain
Troubleshoot dual-stack Nexus Kubernetes cluster configuration	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-kubernetes-cluster-dual-stack-configuration
Resolve Ready, SchedulingDisabled nodes after Nexus runtime upgrade	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-kubernetes-cluster-node-cordoned
Fix Nexus workloads stuck after node power failure	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-kubernetes-cluster-stuck-workloads-due-to-power-failure
Check and fix LACP bonding on Nexus physical hosts	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-lacp-bonding
Troubleshoot container memory limit issues in Nexus clusters	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-memory-limits
Resolve common issues with multiple Nexus storage appliances	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-multiple-storage-appliances
Fix Neighbor Group creation AuthorizationFailed errors in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-neighbor-group-creation-error
Troubleshoot unhealthy NFS pods in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-network-file-system-unhealthy
Fix Nexus Kubernetes pods stuck in ContainerCreating	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-nexus-kubernetes-cluster-pods
Troubleshoot Nexus KubernetesCluster node in NotReady	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-not-ready-kubernetes-cluster-node
Troubleshoot packet loss between NAKS worker nodes	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-packet-loss
Troubleshoot Operator Nexus bare metal server actions	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-reboot-reimage-replace
Interpret and act on Azure Operator Nexus resource health alerts	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-resource-health-alerts
Resolve storage control plane connectivity issues in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-storage-control-plane-disconnected
Troubleshoot TWAMP over UDP failures with NAT in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-twamp-udp-not-working
Troubleshoot unhealthy CSI storage pods in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-unhealthy-container-storage-interface
Fix unhealthy or degraded storage appliances in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-unhealthy-degraded-storage-appliance
Troubleshoot Azure Arc enrollment for Nexus VMs with managed identities	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-virtual-machines-arc-enroll-with-managed-identities
Fix VM errors after restarting Nexus bare-metal machines	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-vm-error-after-reboot

Best Practices

Topic	URL
Best practices for bare metal machine lifecycle operations in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-bare-metal-best-practices
Perform storage appliance component repairs in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-storage-device-repair

Decision Making

Topic	URL
Plan resource placement for Nexus Kubernetes clusters	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-nexus-kubernetes-placement
Map Operator Nexus versions to supported storage software	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-near-edge-storage-supported-versions
Select Azure Operator Nexus Kubernetes VM SKUs	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-nexus-kubernetes-cluster-sku
Select and manage supported Kubernetes versions in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-nexus-kubernetes-cluster-supported-versions
Choose appropriate Azure Operator Nexus SKUs	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-operator-nexus-skus

Architecture & Design Patterns

Topic	URL
Design rack-resilient control plane for Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-rack-resiliency
Design near-edge storage architecture for Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-near-edge-storage

Limits & Quotas

Topic	URL
Use Nexus Kubernetes persistent storage classes effectively	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-storage-kubernetes
Plan storage capacity with multiple Nexus appliances	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-storage-multiple-appliances
Restart Nexus Kubernetes nodes and handle timeouts	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-kubernetes-cluster-action-restart
Meet technical requirements for Nexus isolation domains	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-isolation-domain-technical-requirements
Review Azure Operator Nexus limits and quotas	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-limits-and-quotas
Operator Nexus platform runtime upgrade cadence and support	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-nexus-platform-runtime-upgrades
Check supported software versions for Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-supported-software-versions
Troubleshoot log disruption after 48-hour Nexus disconnection	https://learn.microsoft.com/en-us/azure/operator-nexus/troubleshoot-logs-disrupted-post-prolonged-disconnection

Security

Topic	URL
Configure cross-subscription permissions for Nexus Network Fabric	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-cross-subscription-deployments-required-rbac-for-network-fabric
Automate Nexus Network Fabric operator password rotation v1	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-password-rotation-v1
Configure access and identity for Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/concepts-security-access-identity
Configure customer Key Vault for Nexus credential rotation	https://learn.microsoft.com/en-us/azure/operator-nexus/how-to-credential-manager-key-vault
Apply ACLs to Azure Operator Nexus resources	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-apply-access-control-list
Manage emergency SSH access to BMCs with bmckeyset in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-baremetal-bmc-ssh
Manage emergency SSH access to bare metal machines with baremetalmachinekeyset	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-baremetal-bmm-ssh
Use managed identities and user resources in Operator Nexus clusters	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-cluster-managed-identity-user-provided-resources
Configure SSH ACLs on Nexus management VPN NNI	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-configure-acls-for-ssh-management-on-access-vpn
Configure Network TAP rules with UAMI-based access in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-configure-network-tap-rules-with-user-assigned-managed-identity
Configure ACLs for Azure Operator Nexus networks	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-create-access-control-list
Manage Azure Operator Nexus credential rotation lifecycle	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-credential-rotation
Delete ACLs from Azure Operator Nexus resources	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-delete-access-control-list
Enable or disable vulnerability scanning in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-enable-disable-vulnerability-scanning
Configure system-assigned managed identity for Nexus NFC	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-enable-system-assigned-managed-identity-for-network-fabric-controller
Enable SAMI and roles for Nexus Network Fabric	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-enable-system-assigned-managed-identity-for-network-fabric-resource
Configure Entra ID RBAC for Nexus Kubernetes	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-kubernetes-cluster-aad-rbac
Securely connect to Azure Operator Nexus clusters	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-kubernetes-cluster-connect
Install Defender for Containers on Nexus clusters	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-kubernetes-cluster-install-microsoft-defender
Configure and rotate SSH keys on Nexus cluster nodes	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-kubernetes-cluster-manage-ssh-key
Restrict serial port access and set timeouts on Nexus terminal servers	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-restrict-serial-port-access-and-set-timeout-on-terminal-server
Set up Method D v2.0 secure break-glass access in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-set-up-break-glass-access
Configure in-band break-glass management for Nexus Network Fabric	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-set-up-break-glass-access-using-in-band-management
Configure Defender for Cloud for Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-set-up-defender-for-cloud-security
Update ACL configurations on Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-update-access-control-list
Update ExpressRoute authorization keys in Azure Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-update-expressroute-authorization-key
Configure customer-managed Key Vault for Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-usage-guide-for-customer-managed-key-vault
Apply Azure Policy to secure Nexus resources	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-use-azure-policy
Use Method D v2.0 break-glass access for Nexus fabric devices	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-use-break-glass-access
Use Secret Rotation v1 for Nexus network fabric credentials	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-use-password-rotation-v1
Use VM Console Service for secure Nexus VM access	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-use-vm-console-service
Enroll Nexus VMs with Azure Arc via public relay MI	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-virtual-machines-arc-enroll-with-managed-identities
Create Nexus VMs with managed identities and authenticate	https://learn.microsoft.com/en-us/azure/operator-nexus/howto-virtual-machines-authenticate-with-managed-identities
Configure access control list traffic policies in Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-acl-configuration
Use ACL configuration examples in Operator Nexus	https://learn.microsoft.com/en-us/azure/operator-nexus/reference-acl-examples