The AI Runtime for Kubernetes — not another AI wrapper
Why kprompt’s category is an AI Runtime for Kubernetes: observe, reason, plan, approve, execute, learn — not a ChatGPT wrapper, chatbot, or silent auto-healer. Honest shipped vs building.
Kubernetes already has Pods, Deployments, Controllers, Operators, and Schedulers. Those pieces place containers, reconcile desired state, and encode domain logic. What the control plane still lacks is reasoning: continuous understanding of what is happening across events, logs, metrics, and topology — then a safe plan before anything mutates.
That is the category we are building toward: The AI Runtime for Kubernetes. Not a prompt toy. Not an LLM wrapper with kubectl glue. Not another workflow engine. Not a chatbot bolted onto the cluster. A reasoning layer that observes, plans, executes with approval, and learns from previous incidents.
What we are not
- Not a ChatGPT wrapper — we never compete on chat fluency against generic AI products
- Not a free-form Kubernetes chatbot that mutates from scrollback
- Not a silent auto-healer that “just fixes production”
- Not a fleet scanner that only explains what a report already found
- Not a hosted Lens clone or a multi-tenant control plane that uploads your kubeconfig by default
Those products can be useful. They are a different job. Our job is infrastructure that reasons under the same discipline platform engineers already trust: diffs, risk, and an explicit approve step.
Category, in one sentence each
- Kubernetes schedules containers.
- Argo schedules workflows.
- Operators reconcile state.
- kprompt reasons about infrastructure.
Reasoning here is not vibes. It is evidence → structured plan → policy → human gate → apply → observe again. The laptop path compiles natural language into a reviewable PlanResult. The in-cluster path starts with Observe: watch a namespace, correlate an Incident, notify Slack or a webhook — without silent mutate.
Runtime, not dashboard
Call it a runtime because the loop is the product:
Trust loop
Observe → Reason → Plan → Validate → Approve → Execute → LearnYou describe intent — you do not author a new workflow language. Sensitive operations still need TTY y/N or --approve. Wipe-class prompts hard-deny. Autopilot stays propose-only until gated policy says otherwise. Safety is a feature. Trust is the product.
What a mutate looks like today
$ kprompt "scale api to 10" -n payments
Intent: scale
Action: patch deployment/api replicas …
Risk: medium — requires approval
Apply? [y/N]Distributed agents — honest shipping
A runtime that only lives on a laptop sleeps when your laptop sleeps. The Observe agent is the first in-cluster surface: namespace-scoped Role RBAC, watch → Incident → gated notify. Namespace Agents add continuous intelligence and propose-first remediations. The Coordinator ships as thin fan-in plus the v0.10 continuous path: proactive correlation tick, Shared Knowledge, blast-radius hops, and optional mesh/OTel edges — mutate still off. Deeper multi-agent reasoning and sandbox/chaos Simulation stay building.
| Surface | Status |
|---|---|
| Plan → approve → apply CLI | Shipped |
| investigate / why / timeline / impact packs | Shipped |
| Blast-radius preview + post-apply --wait verify | Shipped |
| Observe agent (notify-only) | Shipped |
| Autopilot propose-only | Shipped |
| Autopilot policyAuto apply (gated code path) | Shipped |
| Autopilot apply product path (Helm + durable proposal + non-laptop approve) | Shipped (v0.10 · default still propose-only) |
| Closed Learn loop (outcome → next PlanResult) | Shipped (v0.10) |
| Incident → PlanResult bridge (durable in-cluster) | Shipped (v0.10) |
| Namespace Agent fleet inventory (`agent list`) | Shipped |
| Namespace Agent intelligence brief (`agent status` + quota/HPA detectors) | Shipped |
| Deeper continuous multi-agent reasoning | Building |
| Incident Memory (facts + patterns + durable incidents) | Shipped |
| Durable cluster / fleet outcome memory | Shipped (v0.10) |
| Knowledge Graph MVP (service + Ingress/PVC + Secret/CM name refs + impact) | Shipped |
| Topology Knowledge Graph (ExternalName / env-host / EndpointSlice / NetworkPolicy) | Shipped (v0.10) |
| GitHub Integration MVP (CLI --gitops PR + Flux/Argo status) | Shipped |
| Cost Intelligence MVP (optimize idle/rightsizing + cost notes) | Shipped |
| Simulation MVP (plan preview + blastRadius + impact + Helm dry-run) | Shipped |
| Coordinator handoff + kube probe | Shipped |
| Coordinator Shared Knowledge (durable handoff ring) | Shipped |
| Coordinator blast-radius MVP (handoff hops /v1/blast-radius) | Shipped |
| Continuous Coordinator (proactive tick + optional mesh/OTel edges) | Shipped (v0.10) |
| Team GitHub App install metadata (A-061 · /integrations) | Shipped |
| Team connected repos bind UI (A-062 · A-063) | Shipped |
| Team pipeline bindings metadata (A-064) | Shipped |
| Team CI webhook / PlanResult ingest (A-065) | Shipped |
| Team CI PlanResult viewer /ci (A-066 · subsumes A-033) | Shipped |
| GitHub Setup URL auto-bind (A-067) | Shipped |
| GitHub App JWT + installation token (A-068) | Shipped |
| GitHub Checks annotate write-back (A-069) | Shipped |
| Sandbox / chaos / capacity what-if Simulation | Building |
| Secret-value / credential Knowledge Graph CMDB | Out of scope |
Marketing a category without claiming vaporware is deliberate. Platform engineers smell hype. We would rather label “building” for sandbox Simulation and deeper multi-agent reasoning than pretend Autopilot already heals the fleet unsupervised.
Why this is how Kubernetes should evolve
Controllers reconcile. That is necessary and not enough. Recovery without understanding repeats the same outage. Execution without a reviewable plan is just faster risk. The next infrastructure layer should reason before it acts — and improve from the last incident — while humans keep the keys for sensitive changes.
- Instead of dozens of YAML files for routine day-2 — describe intent
- Instead of manually correlating logs and events — ask one question (or let Observe surface it)
- Instead of waiting for the next page — reason continuously under approval
If you leave this page thinking “another AI wrapper,” we failed. If you leave thinking “a new infrastructure layer with a refuse-able plan,” we are pointed the right way. If you are comparing agent platforms and AI gateways that share “runtime” vocabulary, read the triangle hub — then the dedicated comparisons for kagent, agentgateway, and ARK.
Try it
Install + plan before apply
curl -fsSL https://kprompt.ai/install | bash
# or: brew install kprompt/tap/kprompt
kprompt "scale api to 3" -n staging
# review the plan, then y or --approve
# optional: Observe on kind, zero LLM spend
git clone https://github.com/kprompt/kprompt-examples.git
cd kprompt-examples && make walkthroughExperimental on purpose. Prefer non-production first. Read every plan. Star the repo if the contract matches how you want Kubernetes AI to behave.
Related posts
kprompt + kagent: PlanResult as an MCP tool under a CNCF agent platform
How to compose kprompt with kagent without collapsing the layers: kagent hosts Agents-as-CRDs via MCPServer / RemoteMCPServer; kprompt ships read/plan-only MCP tools that return a typed PlanResult and never auto-apply. Validated against kagent quickstart + first MCP tool docs.
Read articlekprompt vs agentgateway: PlanResult ops CLI vs AI/MCP agent gateway
agentgateway (Linux Foundation) is an AI-native proxy for LLM, MCP, and A2A traffic on Gateway API. kprompt is an AI Runtime for cluster ops: PlanResult → approve, plus Observe notify. Is kprompt an agentgateway alternative? Only for the ops job — decision guide.
Read articleAI Runtime vs AI Gateway vs Agent Platform — kprompt, agentgateway, and kagent
Three Kubernetes AI layers that share vocabulary and confuse buyers: AI Runtime (kprompt PlanResult ops), AI Gateway (agentgateway LLM/MCP/A2A data plane), Agent Platform (kagent Agents-as-CRDs). One hub, honest jobs, deep links.
Read article