Sdaf Workload Zone

What it does

When your agent uses it

• A user says deploy a workload zone
• Deploy the landscape
• Run installworkloadzone.sh
• Connect the workload zone to control-plane state

Example prompts

• “deploy a workload zone”
• “deploy the landscape”
• “run installworkloadzone.sh”
• “/sdaf-workload-zone”

Requirements

• Python 3
• A credential in DEPLOYER_STATE_KEY
• Pre-approved tools (allowed-tools): shell

Workflow steps

3 steps, taken from the step headings in SKILL.md.

1. 1Review the plan
2. 2Run install_workloadzone.sh (documented shape)
3. 3Validate

What it can do on your machine

Read from SKILL.md and the folder at commit 78835f0. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • shell

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • terraform

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • DEPLOYER_STATE_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sdaf Workload Zone loads about 1.5k tokens when it runs. Until then it costs about 235 tokens; SKILL.md has 525 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~235

When it runs · the whole SKILL.md, loaded when a task matches

~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Azure/sap-automation at commit 78835f0, republished under its MIT licence (© Azure). 525 words, ~1,522 tokens.

name

sdaf-workload-zone

description

Deploy an SDAF workload zone (landscape network, peering, zone Key Vault) after the control plane exists. Drives `install_workloadzone.sh` per `docs/local/04-00-workload-zone.md`, reviews the plan, and validates the state blob and summary. This skill owns the decision boundary for workload-zone private-endpoint / subnet-policy conflicts — inspect the actual Azure error and the workload-zone tfvars against `docs/local/04-00-workload-zone.md § Configuration preparation` before changing settings, and do not auto-apply a cloud-specific workaround outside its documented scope. Use when a user says "deploy a workload zone", "deploy the landscape", "run install_workloadzone.sh", "connect the workload zone to control-plane state", "workload-zone private endpoint failure", or "workload-zone subnet policy failure". Do NOT use for the control plane (see sdaf-control-plane-bootstrap) or SAP system (see sdaf-sap-system).

allowed-tools

shell

license

MIT

set -e
cd "$CONFIG_REPO_PATH/WORKSPACES/LANDSCAPE/<WORKLOAD_ZONE>-INFRASTRUCTURE"
"$SAP_AUTOMATION_REPO_PATH/deploy/scripts/install_workloadzone.sh" \
    --parameterfile "<WORKLOAD_ZONE>-INFRASTRUCTURE.tfvars" \
    --control_plane_name "<CONTROL_PLANE>" \
    --deployer_tfstate_key "<DEPLOYER_STATE_KEY>" \
    --storageaccountname "<STATE_STORAGE_ACCOUNT>" \
    --state_subscription "<STATE_SUBSCRIPTION_ID>" \
    --subscription "<WORKLOAD_SUBSCRIPTION_ID>" || {
  rc=$?
  echo "workload-zone exit=$rc — route to sdaf-failure-triage"
  exit "$rc"
}

© Azure, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/sdaf-workload-zone of Azure/sap-automation.

Open the folder on GitHubat commit 78835f0