Kubernetes AI Agent

This is an AI assistant for Kubernetes, the system many companies use to run their software. It looks at a cluster, works out what's broken, proposes a fix, and applies it only after a person approves.

I deployed and operated an open-source agent on Amazon's managed Kubernetes service (EKS). That covered container images, Kubernetes manifests, permissions, a database for the agent's memory, and secure, keyless access to AWS's AI models.

Running an AI agent that can change production infrastructure means getting permissions, approvals, and observability right, which are the core skills of cloud engineering.

Run an LLM agent that can read and modify cluster state safely: least-privilege access, human approval before writes, and durable state across restarts.

FastAPI backend hosting a LangGraph state machine, a Next.js chat UI behind a server-side proxy, and Postgres for durable checkpoints. Models are served by Amazon Bedrock (Amazon Nova Pro). Everything is deployed with Kustomize into an isolated namespace on EKS.

1. 01Diagnoseread-only K8s tools
2. 02Propose fix
3. 03Human approval/api/decision
4. 04Applywrite tools
5. 05Verify / retry

1. 01EKS Pod Identity instead of static keysAn IAM role is mapped to the agent's ServiceAccount, so no AWS credentials live in manifests. Static env vars would override the role in boto3's credential chain.
2. 02Defense in depth on the clusterRBAC scoped to the agent, a NetworkPolicy, ClusterIP-only Services, and liveness/readiness probes that check both the Kubernetes API and Bedrock connectivity.
3. 03Durable agent memoryLangGraph checkpoints are stored in Postgres (5Gi PVC), so an in-flight approval survives pod restarts.

• -Ordering startup: the backend exits until Postgres finishes its first init, then recovers on restart.
• -Keeping secrets out of version control while still using Kustomize secret generators.

AWS EKS · Amazon Bedrock · Kubernetes · Kustomize · Docker · LangGraph · FastAPI · Next.js · PostgreSQL · Prometheus

• Upstream project (techiescamp) ↗
• View in the terminal →

• The agent's application code is an open-source project by techiescamp / DevOpsCube. My work was deploying and operating it on AWS.