kube-agents

#sre-platformGoogle Chat

LP

Louis P.09:41

@kube-agentsrun a full self-health check across the fleet

kube-agents started a thread

kube-agentsAPP09:41

Performed a comprehensive self-health check and platform diagnostic audit. All active clusters, agent profiles, platform components, and background daemons are fully operational and healthy, with zero active failures or degraded states detected.

Executive Summary

• All 4 GKE clusters in project acme-platform are in the RUNNING state.
• The Platform Agent pod (platform-agent-gateway) is fully operational with zero restarts, under gVisor runtime separation.
• All 4 Cluster Agent profiles are active, registered, and have completed every historical security, RBAC, and workload audit.
• Platform integrations — LiteLLM, Managed Service for Prometheus, and Managed OpenTelemetry — are verified and operational.
• The cron scheduler is active, managing all daily and weekly fleet-wide compliance, reliability, security, and cost audits.

GKE clusters state

Cluster	Location	Status	Version	Nodes	Autopilot
platform-agent-host	us-east4	RUNNING	1.35.6-gke.125	6	Disabled
checkout-prod	us-east4	RUNNING	1.35.6-gke.125	3	Enabled
acme-gitops	us-east4	RUNNING	1.35.6-gke.125	3	Enabled
ml-serving-test	us-east4	RUNNING	1.35.6-gke.125	3	Enabled

Agent & component health

All microservices, controllers, and proxy sidecars are healthy and responsive.

• platform-agent-gateway — Running 0 restarts, age 9h · CPU 222m/3 · memory 1.23Gi/8Gi
• Runtime class gvisor — sandboxing active and enforced.
• Sidecars: platform-agent, platform-agent-dashboard, fluent-bit, envoy-credential-proxy — all Running
• 4 Cluster Agent profiles — Healthy, all audits completed.

Scheduler & active cron jobs

Job	Schedule	Last run	Status
Security & RBAC posture audit	20 6 * * *	06:28	ok
Workload reliability audit	50 6 * * *	07:09	ok
Fleet waste audit	50 7 * * 1	07:39	ok
AI workload security audit	50 8 * * *	08:56	ok
+ 3 more scheduled audits, all healthy

Active warnings & system audits

• Zero failures or errors across logs/errors.log and cron/executions.db.

No remediation required. Next scheduled audit: upgrade & patch readiness, today at 07:20.

ReplayAn illustrative replay. Names and figures are examples.

What it is

kube-agents runs autonomous agents inside your Kubernetes cluster: a Planning Agent front door that listens on Google Chat (and optionally Slack) and turns what you ask for into work, a Platform Agent specialist it delegates that work to over a shared kanban board, and read-only per-cluster Cluster Agents the Platform Agent creates for the clusters it manages. The Platform Agent executes a growing library of Kubernetes skills on demand, and on its own schedule runs background watchdogs that audit the fleet and propose the mergeable fixes as GitHub pull requests you review.

It ships as a small set of components:

• A Kubernetes operator (k8s-operator, Go / Kubebuilder) that reconciles a PlatformAgent custom resource.
• An agent Deployment (running the Hermes runtime, nousresearch/hermes-agent) hosting co-located profiles: the Planning Agent (chat ingress, planning, and delegation), the Platform Agent (an opinionated persona, an MCP-based Kubernetes toolset, and a library of skills), and per-cluster Cluster Agents scaffolded on demand.
• An inference gateway — LiteLLM for hosted models (Gemini, Anthropic, OpenAI) or vLLM for local models on GPU nodes.

Note

Today’s shipping skills, install path, and MCP integrations target GKE. The Platform Agent architecture — the agent Deployment, operator, inference gateway, ChatOps ingress — is not GKE-specific and can extend to other Kubernetes distributions as skills and toolsets are added.

Two ways to think about it

Proactive autonomyScheduled watchdogs (blueprint sync, compliance audit, security patches, cost analysis, capacity orchestration…) run without prompting. Findings become a standing ledger issue on your GitOps repo and PRs you review.

ChatOps interfaceAsk the agent things in Google Chat or Slack. The Planning Agent works out what your request needs and hands it to the Platform Agent, which runs skills, inspects clusters through the Kubernetes MCP server, and reports back.

What the agent can do out of the box

A growing library of skills ships in agents/platform/skills/. Full skill catalog has descriptions and source links.

Group	Skills
Cluster lifecycle	gke-cluster-creation, gke-multitenancy, manage-cluster
Workloads	gke-app-onboarding, gke-workload-scaling, gke-workload-troubleshooting
Cost and capacity	gke-cost-analysis, gke-compute-classes, gke-productionize, gke-reliability
Security and compliance	gke-workload-security, gke-backup-dr, gke-platform-security
Networking and storage	gke-networking, gke-service-networking, gke-storage
AI and inference	gke-inference, gke-golden-path
Observability	gke-observability, kube-agents-observability
Manifests and remediation	gke-manifest-generation, submit-suggestion
Meta	github-issue-resolver, fleet-audit

Architecture at a glance

flowchart LR
    subgraph Users
        GC[Google Chat]
        SL[Slack]
    end

    subgraph Autonomy
        CR[cron watchdogs]
    end

    subgraph Cluster
        OP[k8s-operator]
        subgraph Pod["Agent pod (k8s-deployment)"]
            CA["Planning Agent<br/>(default profile)"]
            PA["Platform Agent<br/>(platform profile)"]
            CL["Cluster Agents<br/>(cluster-* profiles)"]
        end
        LM[LiteLLM / vLLM]
        MT[Minty<br/>GitHub token minter]
    end

    subgraph External
        LLM[Gemini / Anthropic / OpenAI / Gemma]
        GH[GitHub<br/>GitOps repo]
    end

    GC -->|Pub/Sub| CA
    SL -->|Socket Mode| CA
    CA -->|kanban card| PA
    PA -->|kanban card| CL
    CR -->|scheduled prompts| PA
    OP -->|reconciles PlatformAgent CR| Pod
    Pod -->|Completions API| LM
    LM --> LLM
    PA -->|submit-suggestion skill| MT
    MT -->|short-lived token| GH
    PA -->|Kubernetes MCP| K8S[Kubernetes API]
    CA -.->|proactive alert / relayed progress| GC
    CA -.->|proactive alert / relayed progress| SL

Full walkthrough on the Architecture page.

Install

The working install path is GKE via the installer.

git clone https://github.com/gke-labs/kube-agents.git
cd kube-agents
./install.sh

The installer bootstraps a GKE cluster, the operator CRDs, IAM bindings, Google Chat Pub/Sub, Kubernetes secrets, and the Platform Agent itself — one terraform apply through terraform/examples/full-install. See the Quick start for a step-by-step breakdown.

Disclaimer

This is not an officially supported Google product.