Kubernetes AI Agent
Overview
The Kubernetes AI Agent is the core investigation agent in OpsWorker. It queries your Kubernetes clusters to gather the data needed for root cause analysis: pods, deployments, services, logs, events, and configurations.
This agent is always available when a Kubernetes Agent is installed in the cluster.
Capabilities
Resource Queries
Core resource types are covered by the built-in (legacy) Kubernetes tools. Broader resource types are available through the Kubernetes MCP server, which the agent loads when present. Both are read-only.
| Resource Type | Operations | Source |
|---|---|---|
| Pods | List, get status, describe, read logs | Built-in tools |
| Services | List, get spec, check endpoints | Built-in tools |
| Ingresses | List, get rules and backends | Built-in tools |
| Deployments | List, get spec, check rollout status | Built-in tools |
| Events | List by namespace, filter by resource | Built-in tools |
| List-all | Enumerate resources in a namespace | Built-in tools |
| Nodes | List, get status and conditions | via Kubernetes MCP |
| Namespaces | List, get status | via Kubernetes MCP |
| DaemonSets | List, get status | via Kubernetes MCP |
| StatefulSets | List, get status | via Kubernetes MCP |
| ReplicaSets | List, get status | via Kubernetes MCP |
| ConfigMaps | List, get contents | via Kubernetes MCP |
| Secrets | List (metadata only, values are not read) | via Kubernetes MCP |
Log Analysis
- Retrieve recent container logs from pods
- Access logs from previous container instances (after restarts)
- Analyze log content for errors, exceptions, and patterns
Event Timeline
- Query Kubernetes events for specific resources or namespaces
- Sort by timestamp to build an incident timeline
- Identify state transitions (scheduling, pulling, starting, failing)
Endpoint Health
- Check service endpoints for healthy/unhealthy backends
- Verify selector matching between services and pods
- Identify routing issues
How It Works
The Kubernetes AI Agent sends commands to the Kubernetes Agent running in your cluster via SQS:
- AI decides what data it needs (e.g., "get logs for pod X")
- Command is sent to the in-cluster agent
- Agent executes the kubectl-equivalent query
- Results are returned to the AI for analysis
All Kubernetes cluster operations are read-only: the agent never applies, deletes, patches, scales, or execs against your cluster. (The only write path anywhere in OpsWorker is Git: the Source Code & Repository Agent can open PRs/MRs, which are always human-reviewed.)
RBAC Scoping
The Kubernetes AI Agent can only access resources that the in-cluster agent's RBAC permissions allow. If the agent is scoped to specific namespaces, the AI Agent is limited to those same namespaces. See Agent RBAC for configuration.
Next Steps
- Source Code & Repository Agent: correlates changes and opens PRs/MRs
- Metrics & Grafana Capability: PromQL metrics and LogQL log search via Grafana MCP
- Agent Scope: access model details