Domain Agents›Kubernetes Agent

Kubernetes Agent overview

TalkOps Kubernetes Agent (k8s-autopilot) is an open-source, extensible AI operations framework for Kubernetes built on the Deep Agents SDK and LangGraph. It ships with four built-in domain operators—covering Helm chart lifecycles, ArgoCD and Argo Rollouts GitOps delivery, Traefik edge routing, cluster troubleshooting, and full-stack observability (Prometheus, Alertmanager, Loki, Tempo, OpenTelemetry)—and can be extended at runtime with plugins, custom MCP servers, and dynamic subagents.

Use k8s-autopilot when you want to:

• Operate live Kubernetes clusters through conversation: Inspect workloads, diagnose CrashLoopBackOff and OOMKilled pods, upgrade Helm releases, sync ArgoCD applications, and correlate metrics, logs, and traces.
• Delegate to isolated domain operators: Route tasks from a central Supervisor to specialized operators that bind MCP tool servers Just-In-Time (JIT) and keep noisy cluster outputs out of your main chat stream.
• Extend the framework from the web UI: Install plugins from remote marketplaces, register custom stdio or HTTP/SSE MCP servers, and spawn dynamic subagents without editing .env files or restarting containers.
• Gate every mutation behind human approval: Review interactive A2UI approval cards displaying parameter diffs and blast-radius assessments across Manual, Auto, and YOLO governance modes.
• Verify cluster state with grading rubrics: Generate goal checklists and run an independent grader model against live cluster telemetry until every acceptance criterion passes.

Quickstart

Deploy the complete k8s-autopilot stack locally with the single-command installer:

curl -LsSf https://raw.githubusercontent.com/talkops-ai/k8s-autopilot/main/scripts/install.sh | bash

Open http://localhost:8888 in your browser, click Setup to add your LLM provider API key under Settings → Auth & Keys, and launch the chat interface. For step-by-step onboarding and Docker Compose configuration, see the Quickstart.

Windows users

Run the installer inside WSL 2 (Windows Subsystem for Linux) for full Docker socket and Kubernetes network compatibility.

Core capabilities

Operators & subagents

Central Supervisor routing to 4 built-in domain operators (Helm, App, K8s, Observability) and dynamic plugin subagents.

MCP tool servers

11 built-in MCP tool integrations with Just-In-Time (JIT) binding plus zero-code custom MCP server registration.

Approval modes & security

Three runtime governance modes (Manual, Auto, YOLO) backed by 5 always-on AST, Unicode, and SSRF security layers.

Plugins, skills & rubrics

Cross-ecosystem plugin marketplace (Claude, Codex, OpsCode compatible), AGENTS.md memory, and rubric self-grading.

How it compares

Capability	Kubiya	Komodor	Botkube	kagent	k8s-autopilot
License	Proprietary	Proprietary	Partial OSS	Apache 2.0	Apache 2.0 (100% Open Source)
Architecture	Multi-agent	Monolithic	Chat bot	Per-CRD agents	Supervisor → Operators → Dynamic Subagents
MCP ecosystem	No	No	No	Yes	11 built-in + custom UI/Marketplace MCP servers
Plugin compatibility	Limited	No	Catalog	BYO MCP	Native Claude, OpenAI Codex & OpsCode plugins
Built-in domains	Workflows	K8s triage & cost	Event alerts	General runtime	Helm, ArgoCD, Rollouts, Traefik, Prom, Loki, Tempo, OTel
HITL governance	JIT approvals	Approval flows	Chat commands	CRD gates	Manual, Auto (heuristic + LLM classifier) & YOLO
Rubric self-grading	No	No	No	No	Autonomous goal criteria & independent grader loop
Model providers	Proprietary	Proprietary	OpenAI	4 providers	20+ providers, hot-swappable from Web UI

Architecture

k8s-autopilot uses a hierarchical Supervisor → Operator architecture powered by the Deep Agents SDK and LangGraph. You converse with the central Supervisor, which decomposes requests and delegates domain work to specialized Operators:

How a request flows

1. Intent classification: You ask in plain English—for example, "Deploy Redis with Helm in the cache namespace" or "Why is checkout-api returning 502s?"
2. Operator delegation: The Supervisor routes the task to the matching domain operator (Helm Operator, App Operator, K8s Operator, Observability Operator, or a plugin subagent).
3. Just-In-Time (JIT) discovery: The operator spawns its scoped MCP servers on demand and inspects live cluster state before proposing any change.
4. Human approval gate: Before any state-mutating tool executes, an interactive A2UI card renders the proposed parameters, diff, and risk level. Execution pauses until you approve.
5. Cross-operator handoff: If an investigation spans multiple domains (such as a Prometheus high-latency alert caused by an OOMKilled pod), the operator returns structured findings to the Supervisor, which hands off context to the next operator.
6. Rubric verification: When a goal is active, an independent grader model verifies live cluster state against each acceptance criterion before closing the task.

Built-in operators and tools

Supervisor tools

The central Supervisor holds lightweight tools for external documentation lookup and goal orchestration:

Tool	What it does
web_search / fetch_url	Searches documentation, CVE databases, and release notes and extracts clean Markdown
get_goal / update_goal	Creates, inspects, and updates multi-step operational goals and acceptance checklists
get_rubric	Retrieves formal grading criteria for post-execution verification

Domain operators

All cluster and observability actions are delegated to four isolated operators:

Operator	Responsibilities	Bound MCP servers	Bundled skills
Helm Operator	Search, validate, dry-run, install, upgrade, rollback, and uninstall Helm releases; commit values to GitHub	helm-mcp-server (22 tools)	helm-operation
App Operator	ArgoCD GitOps sync and drift remediation, Argo Rollouts canary/blue-green delivery, and Traefik edge routing	argocd, argo-rollout, traefik MCP servers	argocd-gitops, argo-rollout-gitops, traefik-edge-routing
K8s Operator	Pod debugging (CrashLoopBackOff, OOMKilled), logs, exec, workload scaling, events, and RBAC inspection	kubernetes-mcp-server (32 tools)	kubernetes-cluster-ops
Observability Operator	PromQL metric queries, Alertmanager silences, LogQL searches, TraceQL latency waterfalls, and OTel pipelines	prometheus, alertmanager, opentelemetry, loki, tempo MCP servers	prometheus, alertmanager, opentelemetry, loki, tempo

For detailed operator workflows and tool inventories, see Operators and Subagents.

Human-in-the-loop governance

Control how much autonomy k8s-autopilot has at runtime across three approval modes:

Mode	Behavior	When to use
Manual (Default)	Pauses and renders an A2UI approval card before every state-changing tool call.	Production clusters and shared environments
Auto	Executes read-only queries (get, list, describe, PromQL, LogQL) immediately; uses a 3-step heuristic + LLM safety classifier to pause on risky or destructive mutations.	Staging clusters and daily debugging
YOLO	Executes all tool calls without interactive confirmation while keeping hard security scanners active.	Disposable local clusters (kind, minikube, k3d) and CI test suites

Always-on security layers

Regardless of which approval mode is active, five security layers inspect every tool call:

Layer	Protection
Shell safety scanner	Evaluates command semantics prior to execution
AST command parser	Parses pipes (|), chains (&&), and subshells ($()) to block hidden destructive commands
Unicode & homoglyph scanner	Detects zero-width characters, bidirectional overrides, and confusable glyphs
Network SSRF validator	Blocks requests to private RFC1918 ranges and cloud metadata services (169.254.169.254)
Headless MCP guard	Rejects unattended Tier 3 (mutating) and Tier 4 (destructive) MCP calls in non-interactive runs

For more information, see Approval Modes.

Frequently asked questions

Do I need every MCP server running to use k8s-autopilot?

No. k8s-autopilot degrades gracefully based on which backends are configured. If you do not use Grafana Tempo, for example, the Observability Operator will still query Prometheus metrics and Loki logs normally while noting that distributed tracing is not connected.

Can I extend k8s-autopilot beyond Kubernetes?

Yes. Everything beyond the four built-in operators is dynamically extensible. From Settings → Plugins and Settings → MCP Servers, you can install marketplace plugins or bind any stdio/HTTP/SSE MCP server (such as AWS, PagerDuty, PostgreSQL, or internal platform APIs) directly to the agent.

When should I use k8s-autopilot vs. OpsCode?

Use k8s-autopilot when you want an interactive web control plane connected to live Kubernetes clusters, GitOps controllers, and observability backends. Use OpsCode when you are authoring and validating infrastructure code (Terraform, OpenTofu, Helm charts, Ansible, CI workflows) inside a local Git checkout or CI/CD pipeline.

Get started

Quickstart

Install k8s-autopilot, connect your cluster and LLM provider in the Web UI, and run your first task.

Operators & subagents

Explore how the Supervisor routes across Helm, App, K8s, Observability, and dynamic plugin subagents.

MCP tool servers

Configure built-in and custom MCP servers, transport overrides, and semantic security tiers.

Configuration

Manage runtime settings, SQLite/PostgreSQL checkpoint backends, and environment variables.