The AI Runtime for Kubernetes — not another AI wrapper
Why kprompt’s category is an AI Runtime for Kubernetes: observe, reason, plan, approve, execute, learn — not a ChatGPT wrapper, chatbot, or silent auto-healer. Honest shipped vs building.
Kubernetes already has Pods, Deployments, Controllers, Operators, and Schedulers. Those pieces place containers, reconcile desired state, and encode domain logic. What the control plane still lacks is reasoning: continuous understanding of what is happening across events, logs, metrics, and topology — then a safe plan before anything mutates.
That is the category we are building toward: The AI Runtime for Kubernetes. Not a prompt toy. Not an LLM wrapper with kubectl glue. Not another workflow engine. Not a chatbot bolted onto the cluster. A reasoning layer that observes, plans, executes with approval, and learns from previous incidents.
What we are not
- Not a ChatGPT wrapper — we never compete on chat fluency against generic AI products
- Not a free-form Kubernetes chatbot that mutates from scrollback
- Not a silent auto-healer that “just fixes production”
- Not a fleet scanner that only explains what a report already found
- Not a hosted Lens clone or a multi-tenant control plane that uploads your kubeconfig by default
Those products can be useful. They are a different job. Our job is infrastructure that reasons under the same discipline platform engineers already trust: diffs, risk, and an explicit approve step.
Category, in one sentence each
- Kubernetes schedules containers.
- Argo schedules workflows.
- Operators reconcile state.
- kprompt reasons about infrastructure.
Reasoning here is not vibes. It is evidence → structured plan → policy → human gate → apply → observe again. The laptop path compiles natural language into a reviewable PlanResult. The in-cluster path starts with Observe: watch a namespace, correlate an Incident, notify Slack or a webhook — without silent mutate.
Runtime, not dashboard
Call it a runtime because the loop is the product:
Trust loop
Observe → Reason → Plan → Validate → Approve → Execute → LearnYou describe intent — you do not author a new workflow language. Sensitive operations still need TTY y/N or --approve. Wipe-class prompts hard-deny. Autopilot stays propose-only until gated policy says otherwise. Safety is a feature. Trust is the product.
What a mutate looks like today
$ kprompt "scale api to 10" -n payments
Intent: scale
Action: patch deployment/api replicas …
Risk: medium — requires approval
Apply? [y/N]Distributed agents — honest shipping
A runtime that only lives on a laptop sleeps when your laptop sleeps. The Observe agent is the first in-cluster surface: namespace-scoped Role RBAC, watch → Incident → gated notify. Namespace Agents add continuous intelligence and propose-first remediations. The Coordinator ships as a thin fan-in: cross-namespace handoff, optional read-only kube probe, InvestigationReport merge, Shared Knowledge (durable handoff edges), and blast-radius MVP hops via /v1/blast-radius — mutate still off. Continuous mesh/OTel blast-radius remains building.
| Surface | Status |
|---|---|
| Plan → approve → apply CLI | Shipped |
| investigate / why / timeline packs | Shipped |
| Observe agent (notify-only) | Shipped |
| Autopilot propose-only | Shipped |
| Autopilot policyAuto apply (gated code path) | Shipped |
| Autopilot apply product path (Helm + durable proposal + non-laptop approve) | Building |
| Closed Learn loop (outcome → next PlanResult) | Building |
| Incident → PlanResult bridge (durable in-cluster) | Building |
| Namespace Agent fleet inventory (`agent list`) | Shipped |
| Namespace Agent intelligence brief (`agent status` + quota/HPA detectors) | Shipped |
| Deeper continuous multi-agent reasoning | Building |
| Incident Memory (facts + patterns + durable incidents) | Shipped |
| Durable cluster / fleet outcome memory | Building |
| Knowledge Graph MVP (service + Ingress/PVC + Secret/CM name refs + impact) | Shipped |
| Topology Knowledge Graph (ExternalName / env-host / EndpointSlice / NetworkPolicy) | Building |
| GitHub Integration MVP (CLI --gitops PR + Flux/Argo status) | Shipped |
| Cost Intelligence MVP (optimize idle/rightsizing + cost notes) | Shipped |
| Simulation MVP (plan preview + blastRadius + impact + Helm dry-run) | Shipped |
| Coordinator handoff + kube probe | Shipped |
| Coordinator Shared Knowledge (durable handoff ring) | Shipped |
| Coordinator blast-radius MVP (handoff hops /v1/blast-radius) | Shipped |
| Continuous Coordinator (proactive tick + mesh/OTel edges) | Building |
| Team GitHub App install metadata (A-061 · /integrations) | Shipped |
| Team connected repos bind UI (A-062 · A-063) | Shipped |
| Team pipeline bindings metadata (A-064) | Shipped |
| Team CI webhook / PlanResult ingest (A-065) | Shipped |
| Team CI PlanResult viewer /ci (A-066 · subsumes A-033) | Shipped |
| GitHub Setup URL auto-bind (A-067) | Shipped |
| GitHub App JWT + installation token (A-068) | Shipped |
| GitHub Checks annotate write-back (A-069) | Partial |
| Sandbox / chaos / capacity what-if Simulation | Building |
| Secret-value / credential Knowledge Graph CMDB | Out of scope |
Marketing a category without claiming vaporware is deliberate. Platform engineers smell hype. We would rather say “building” than pretend Autopilot already heals the fleet.
Why this is how Kubernetes should evolve
Controllers reconcile. That is necessary and not enough. Recovery without understanding repeats the same outage. Execution without a reviewable plan is just faster risk. The next infrastructure layer should reason before it acts — and improve from the last incident — while humans keep the keys for sensitive changes.
- Instead of dozens of YAML files for routine day-2 — describe intent
- Instead of manually correlating logs and events — ask one question (or let Observe surface it)
- Instead of waiting for the next page — reason continuously under approval
If you leave this page thinking “another AI wrapper,” we failed. If you leave thinking “a new infrastructure layer with a refuse-able plan,” we are pointed the right way. If you are comparing agent platforms that host workloads on Kubernetes, read the dedicated comparisons — kagent (CNCF) and ARK (McKinsey) share the “agents on K8s” lane; we share some SRE demos, not the PlanResult contract.
Try it
Install + plan before apply
curl -fsSL https://kprompt.ai/install | bash
# or: brew install kprompt/tap/kprompt
kprompt "scale api to 3" -n staging
# review the plan, then y or --approve
# optional: Observe on kind, zero LLM spend
git clone https://github.com/kprompt/kprompt-examples.git
cd kprompt-examples && make walkthroughExperimental on purpose. Prefer non-production first. Read every plan. Star the repo if the contract matches how you want Kubernetes AI to behave.
Related posts
kprompt vs kagent: PlanResult ops CLI vs Kubernetes-native agent platform
kagent (CNCF Sandbox) is a Kubernetes-native agent runtime — Agents as CRDs, MCP, A2A, mesh. kprompt is an AI Runtime for cluster ops: PlanResult → approve, plus Observe notify. Overlapping SRE demos, different products. Decision guide.
Read articlekprompt vs ARK: AI Runtime that operates the cluster vs Agentic Runtime that hosts agents
McKinsey’s ARK is an Agentic Runtime for Kubernetes — CRDs to run agent apps on the cluster. kprompt is an AI Runtime that reasons about the cluster under plan → approve. Same word “runtime,” different jobs. Decision guide.
Read articleBuilding AI SRE in Public #10: Autonomous SRE — and why not yet
Why unsupervised auto-remediation is not the destination. Observe by default, Autopilot propose-only, reality anchors, and investigate → plan → approve → verify as the load-bearing loop — not a fleet of agents that apply because the model sounded sure.
Read article