Building AI SRE in Public #9: Knowledge Graph

This is episode 9 of Building AI SRE in Public. Episode 8 kept namespace priors local and capped. Knowledge Graph answers the topology question operators ask before they touch anything: what connects to what, and who would feel it if this Service dies? Chat answers invent callers. Typed nodes and edges refuse to.

The claim

AI SRE needs a read-only relationship map — Services, EndpointSlice-backed pods, Ingress exposes, volume mounts (PVC / Secret / ConfigMap names), remembered deps, and reverse consumers — as JSON you can jq. That map biases investigate and plan blast radius. It does not auto-remediate, invent mesh callers, or upload topology to the cloud by default.

Two graphs, one honesty rule

Same temperament: refuse fiction. Kubernetes does not record “who called this Service” by itself. Missing OTel or mesh lands in degraded[] — not invented edges that make the picture prettier.

What ships (MVP)

• Service dependency graph: type: service-graph nodes/edges (T-059 · T-060)
• Ingress → Service exposes; Pod → PVC mounts; Pod → Secret/ConfigMap mounts by name only (AG-063 · AG-064)
• Reverse impact: who consumes / blast radius → Investigation (S-005 · T-083)
• Namespace memory deps as heuristic edges — evidence, not proof (AG-015 · ep.8)
• CLI + agent dump: show service dependency graph · agent graph · who consumes …

kprompt "show service dependency graph" -n payments
kprompt agent graph -n payments
kprompt agent graph -n payments --ingress --pvc --volume-refs --network-policy
kprompt agent graph -n payments -o json

kprompt "who consumes redis" -n payments
kprompt "blast radius for payment-api" -n payments --output json
kprompt "impact of service api" -n production

Impact vs PlanResult blastRadius

Both are structural. Neither replaces approval. Simulation (change preview) may reuse the same relationships — still not chaos or capacity what-if as a product claim.

Secret honesty

Edges may say a Pod mounts Secret payments-db — the name. Values never enter the graph. That is a reality-anchor-shaped non-goal: topology without a Secret CMDB. ConfigMap names follow the same rule.

Privacy

Helm and laptop Observe agents do not upload topology to api.kprompt.ai. Knowledge stays where the kubeconfig or in-cluster SA already is — same privacy default as Cluster Memory.

What ships vs building

• Shipped: service-graph JSON; Ingress/PVC/volume-ref edges; reverse impact MVP; memory dep hints
• Shipped: Secret/ConfigMap name-only mounts; degraded honesty for OTel/mesh gaps
• Building: always-on external APIs / Kafka as first-class nodes; interactive Team /graph UI
• Exploring: ADR / docs2src as knowledge nodes (not a second chat brain)
• Non-goal: auto-remediation from edges; inventing runtime callers; replacing Prom/mesh/CMDB products

Try the map

# kind + dependency scenario
kprompt "show service dependency graph" -n payments -o json \
  | jq '{type, nodes: (.nodes|length), edges: (.edges|length)}'
kprompt "who consumes redis" -n payments
# Prefer static edges + degraded[] over a model inventing callers

If your AI ops tool draws a pretty graph from narrative alone, you have wallpaper. Knowledge Graph MVP is plumbing: names, selectors, mounts, and honest gaps.

Next

Episode 10 is Autonomous SRE — and why we don’t want it yet. The series closes on the approval boundary, not a fleet of unsupervised remediations.