Observe agent

Shipped in kprompt v0.5+. The laptop CLI stays a single binary with no required daemon. Separately, you can opt into an in-cluster Observe agent — the first AI Runtime surface inside Kubernetes — that watches one namespace, correlates Incidents, optionally calls an LLM, and notifies Slack or a webhook. Fleet inventory: `kprompt agent list -A` (KpromptAgent CRs + labeled Deployments). The thin Coordinator fan-in (handoff + optional read-only probe + merge + Shared Knowledge via /v1/knowledge, ConfigMap-durable by default in Helm) also ships. Continuous Coordinator + Incident→PlanResult bridge + closed Learn + durable cluster memory shipped in v0.10.0 as the Runtime closure pack (ADR-0023) — default stays propose-only, never silent auto-heal.

Pipeline and AI Runtime dual-path diagrams: Architecture.

Observe by default — Autopilot propose-only

• Observe Mode never applies, patches, or deletes workload objects
• Autopilot MVP (--autopilot-propose) emits PlanResult-shaped proposals + audit; Applied stays false
• Policy allowlist + ADR-0015 gates required before any future apply executor
• Recommendations may suggest a fix for a human to approve on the CLI

Full Autopilot contract: ADR-0015.

vs K8sGPT and Kagent

RBAC (honest)

• Default: Role + RoleBinding in one namespace (get/list/watch) — not ClusterRole
• Secrets watch is off by default; when enabled, metadata only (never values)
• You own the ServiceAccount blast radius you deploy

LLM cost

• No LLM call on every raw API event — batch by open Incident
• Severity + confidence gate before Slack/webhook (defaults: medium / 0.7)
• Use --heuristic for demos; mount provider keys via Secret only

Laptop demo: watching… vs emit-initial

agent run is a live watch. Without new Pod/Event traffic it only prints watching…. Already-broken workloads may stay quiet until the next BackOff. For demos, emit current state and stay offline ($0):

kprompt agent run -n payments \
  --emit-initial \
  --analyze --fetch-logs --health --heuristic \
  --memory --patterns --autopilot-propose

Health vs incidents: ready=4/5 can drop the score while open=0 if the correlator has not opened an Incident yet (needs problem Events such as BackOff). Score ≠ alert. Break something with kprompt-examples, then re-run with --emit-initial.

Namespace memory

• Optional --memory discovers Redis/Kafka/Postgres-style deps from Services/Deployments
• Stores facts locally (~/.config/kprompt/memory) or in-cluster ConfigMap — never uploaded to api.kprompt.ai by default
• Relevant facts inject into AgentContext for the analyzer
• Optional --patterns learns signatures and boosts confidence on “seen before” (never mutates)
• Optional --autopilot-propose emits allowlisted AutopilotProposal (propose-only; ADR-0015)

Operator (optional)

kprompt agent operator reconciles KpromptAgent CRs into Observe agent Deployments (ServiceAccount + Role + RoleBinding + Deployment). Helm chart: charts/kprompt-operator. Prefer the manual kprompt-agent chart when you do not want a ClusterRole for the operator SA. Autopilot propose is a CLI flag on the agent binary — not silent mutate.

Helm install

kubectl -n payments create secret generic kprompt-agent \
  --from-literal=OPENAI_API_KEY="$OPENAI_API_KEY"
helm upgrade --install kprompt-agent ./charts/kprompt-agent \
  -n payments --create-namespace \
  --set image.tag=0.9.0

Laptop smoke: kprompt agent run -n payments --analyze --fetch-logs --health --heuristic. Add --memory, --patterns, or --autopilot-propose as needed. Full flags in the repo agent doc.

Demo cluster

Need a payments namespace that actually misbehaves? kprompt-examples spins up kind with seven failure scenarios (crashloop, image pull, OOM, stalled rollout, unbound PVC, failing CronJob, missing dependency). Each README states what the agent should conclude — so a demo has a right answer.

git clone https://github.com/kprompt/kprompt-examples.git
cd kprompt-examples
make up
make break SCENARIO=01-crashloop
make verify
kprompt agent run -n payments --analyze --health --heuristic