Roadmap & vision

Where kprompt is headed as an AI Runtime for Kubernetes: agents, trust loops, multi-cluster, and what stays out of scope. Honest shipped vs exploring.

Positioning

kprompt is The AI Runtime for Kubernetes — an AI-powered runtime that understands your Kubernetes environment and turns intent into context-aware operations, investigations, and recommendations. Today the laptop path is an intent compiler: natural language → reviewable PlanResult → approve → apply. Investigation and AI SRE packs (investigate / why / timeline / impact) ship alongside operate / analyze / recommend. The in-cluster path starts with Observe and includes Namespace Agents, Coordinator correlation, topology Knowledge Graph edges, and durable incident memory (v0.10 Runtime closure) — while keeping the same approval contract. Not a free-form chat REPL, not a silent analyzer daemon, not a monitoring-only AIOps product, not a hosted fleet scanner. Experienced Kubernetes engineers remain a target: augment expertise by reducing context they must gather manually. Read Building AI SRE in Public, Intent compiler, not chat, Context engineering, Kubernetes AI tools compared, and Beyond AI kubectl for public positioning.

Shipped now

  • Plan → safety → approve → apply (deploy, scale, rollback, named delete)
  • Deep explain, logs, describe, discovery-backed get/list
  • investigate / why / timeline / impact — Investigation JSON (ADR-0014)
  • Blast-radius preview on mutating plans; post-apply verify with --wait
  • Incident suggest packs: OOM memory bump, CrashLoop rollback (prior RS; skipped when OOM also present), ImagePull patch when the prompt names a replacement tag (auth failures → pull-secret guidance), probe timing relax — on Deployment / StatefulSet / DaemonSet where applicable — plus scheduling/PVC guidance; still approve-gated
  • Audit harden plan: approve-gated privilege-removal (privileged / allowPrivilegeEscalation) on Deployments, StatefulSets, and DaemonSets; invented-value fixes stay guidance
  • Cleanup delete plans: approve-gated removal of stale Jobs / superseded ReplicaSets; optional ConfigMap/Secret orphan deletes only when the prompt confirms orphans (stricter DELETE-ORPHANS / confirm_orphans gate)
  • Helm, Argo Workflows, Prometheus, OTel, Grafana, multi-tool routes
  • Tekton, KEDA, Istio (read-first), Crossplane, Flux/Argo CD GitOps
  • Optimize-cluster report (idle / rightsizing / HPA) and service dependency graph
  • Cost Intelligence MVP: labeled $/carbon notes on idle + rightsizing-lower when Prometheus is available (docs/optimize) — not a cloud invoice
  • Simulation MVP: mutating plans preview with blastRadius; impact/who-consumes + Helm dry-run (docs/simulation) — not a sandbox cluster
  • Context aliases, doctor, Homebrew, optional Team login / policy / audit
  • Local read-only inventory via kprompt dash (localhost)
  • Optional Observe agent (Helm): namespace watch → Incident → gated Slack/webhook — no silent Autopilot mutate
  • Namespace Agent fleet inventory: kprompt agent list -A (docs/agent-fleet)
  • Namespace Agent intelligence brief: kprompt agent status -n <ns> (docs/agent-status)
  • Optional Operator: KpromptAgent CR → Observe agent Deployment
  • Autopilot propose-only MVP (--autopilot-propose) under ADR-0015; gated policyAuto apply code path exists (opt-in, not default)
  • AI Runtime closure pack shipped in v0.10.0 (ADR-0023): closed Learn · Autopilot product path · continuous Coordinator · topology KG · Incident→PlanResult · durable cluster memory — default stays propose-only
  • GitHub Integration MVP: --gitops opens a GitHub PR instead of cluster apply (docs/gitops-pr); Team SCM A-061…A-069 shipped (Setup URL + App JWT + /ci viewer + Checks annotate upsert)

Full integration detail lives on Integrations — not duplicated here. Observe agent install and honesty notes: Observe agent.

Shipped — AI Runtime closure (v0.10.0)

The committed product pack (ADR-0023) landed in v0.10.0 — the motto loop is now real in-cluster, not only on a laptop. Default stays Observe + propose-only Autopilot; never silent auto-heal; Secret values stay out of the Knowledge Graph.

  • Closed Learn loop — apply/resolve/FP outcomes reshape the next PlanResult ranking (evidence-not-proof caps stay)
  • Policy-gated Autopilot apply (product path) — Helm-first policyAuto + post-apply verify gate + audit; default remains propose-only
  • Incident → PlanResult bridge — durable in-cluster proposal; approve via CLI or Slack without laptop re-compile
  • Topology Knowledge Graph — ExternalName / env-host / EndpointSlice / NetworkPolicy edges into impact (never Secret values)
  • Continuous Coordinator — proactive correlation tick + optional mesh/OTel blast edges; Coordinator still does not mutate
  • Durable cluster memory — cross-ns Coordinator outcome ring + fleet read bias Learn safely (evidence-not-proof); offline agent memory export

Building next — trust & AI SRE

These deepen “think about the cluster” without leaving the plan/approve loop. Treat as in progress — not a public ship date.

  • Deeper CrashLoop recipes (non-Deployment rollbacks, exit-code specific fixes)
  • audit non-privilege harden fixes (runAsNonRoot, resource requests) with safe defaults
  • drift — live vs Git desired-state reports
  • Deeper continuous multi-agent reasoning (beyond Namespace Agent + Coordinator today)
  • Richer Prom/OTel/mesh hops on investigate / timeline when backends are present

Exploring later

  • Slack interface (bidirectional): ask status / why / what broke in-channel from the Observe agent — read-only answers; mutating plans still plan → approve (Slack `approve <proposal-id>` shipped in v0.10.0 under policyAuto, RT-008)
  • Proactive local watch (opt-in laptop): signal → “latency up; investigate?” — never auto-mutate
  • Local remember / session digests (facts stay on your machine by default)
  • Multi-cluster: richer org registry metadata without uploading kubeconfig (contexts inventory + read fan-out already ship)
  • Team web polish on app.kprompt.ai (policy, audit, Insights) — CLI stays free; nothing to buy today
  • Workflow recipe packs (harden production, Ingress → Gateway API) as curated plan chains
  • Sandbox / chaos / capacity what-if Simulation lab (today’s Simulation MVP stays change preview)
  • Interactive Team topology / timeline viewers beyond CLI artifacts

What we will not do

  • Silent apply across clusters from one --approve
  • Upload kubeconfig / cluster credentials to the control plane
  • Replace Lens/Headlamp as a hosted live cluster browser
  • Compete on free-form agent chat with kubectl-ai
  • Claim K8sGPT analyzer parity as a fleet scanner
  • Ship Autopilot mutate without ADR-0015 + PlanResult + policy gates
  • Index Secret values into a Knowledge Graph CMDB
  • Pretend Observe agent is Kagent feature parity

Shape priorities

Star issues and PRs on GitHub. The CLI stays Apache-2.0 and experimental — review every plan before apply. Start with Quickstart when you are ready to try it.