Muhtalip Dede · Founder of kprompt2 min readObserve vs investigate: always-on agent vs on-demand CLI
Same Investigation Graph DNA — different trigger. Laptop investigate is reactive; the optional Observe agent is continuous watch → Incident → gated notify.
Operators ask the same question two ways: “why is checkout broken right now?” and “tell me when payments starts misbehaving without me watching.” kprompt answers both — but with different surfaces. Confusing them is how you end up expecting a laptop REPL to page Slack, or an in-cluster watcher to silently apply fixes.
At a glance
| Surface | Trigger | Scope | Mutate? | Artifact |
|---|---|---|---|---|
| CLI investigate / why / timeline | You type a prompt | kubeconfig context(s) | Only after PlanResult approval | Investigation → optional PlanResult |
| Observe agent | Always-on watch | One namespace (Role) | Never by default | Incident / AgentAlert |
| Autopilot (opt-in) | Open Incident + allowlist | Same ns agent | Propose-only; apply gated | PlanResult (Applied false) |
Same graph, different entry
Always-on intelligence is the same gated Investigation Graph as CLI investigate — signal hops → findings → optional PlanResult → approve → apply → verify. It is not a free-form multi-agent fleet. Observe / Namespace Agent runs the continuous edge of that graph; investigate is the on-demand hop you steer from a laptop.
On-demand RCA (reactive)
kprompt "investigate checkout" -n payments
kprompt "why is api crashing" -n payments
kprompt "timeline for checkout" -n paymentsAlways-on Observe (continuous)
kprompt agent run -n payments \
--analyze --fetch-logs --health --heuristic
# in-cluster: Helm charts/kprompt-agent (namespace Role)When to install neither, one, or both
- Neither — you only need occasional explain/investigate from CI or a laptop; no pager path yet
- CLI only — brownfield day-2 mutate + RCA under plan → approve; no daemon required
- Observe only — you want Slack/Discord when a namespace degrades, still refuse silent heal
- Both — continuous alerts plus human-driven investigate/why when you dig in; Autopilot propose optional
Honest non-claims
- Observe is not K8sGPT — analyzer-on-demand vs watch → Incident → gated alert
- Observe is not Kagent — one kprompt-native pipeline, not a general multi-agent platform
- Default RBAC is a namespace Role (get/list/watch), not ClusterRole god-mode
- Memory / patterns bias confidence; they do not prove root cause alone
- Coordinator is for cross-ns verification handoff — mutate still default off
Try both paths on kind
Break fixtures, then Observe; later investigate a target
git clone https://github.com/kprompt/kprompt-examples.git
cd kprompt-examples
make walkthrough
# afterward, on-demand:
kprompt "investigate checkout" -n paymentsHeuristic Observe needs no LLM key. Investigate with a provider when you want richer narration — still read-first; mutations stay behind approval. Experimental — prefer kind / non-prod first.
Related posts
Stop paging on every kubelet Event: Incidents + confidence gates
Always-on Kubernetes watch only helps if you correlate into Incidents and gate by severity and confidence — not one Slack message per BackOff.
Read articlekprompt + Helm deep dive: install, upgrade, dry-run, and wipe denies
Day-2 Helm with kprompt: real helm install/upgrade plans, template and client dry-run previews, Bitnami recipes, and hard denies for uninstall-all — without replacing Helm or GitOps.
Read articlekprompt on Google Cloud: GKE day-2 with Gemini, without a new control plane
Use kprompt against GKE the same way you use kubectl — get-credentials, aliases, plan-before-apply — plus Gemini BYOK. Optional Observe agent on the cluster; no Marketplace SaaS, no kubeconfig upload.
Read article