Cluster Ops Agent

LangGraph  A StateGraph with typed state drives the conversation. The agent node runs Llama 3.2 with five read-only tools bound. After each tool call, a validate node checks the arguments (retrying once if malformed). A tools node executes the call against the live cluster via the Kubernetes API. If the result shows an unhealthy pod or application (CrashLoopBackOff, OOMKilled, Degraded…), the graph routes to a focused diagnose node that produces a structured "likely cause / evidence / next check" report. The loop is capped at 6 steps so a confused model can't spin.

Safety  The ServiceAccount has get/list/watch on pods, events, and ArgoCD Applications only — no secrets, no configmaps, no exec, no writes. An application-layer namespace allowlist prevents queries outside the visible set. All output is redacted (IPs, tokens, connection strings) before it reaches the LLM or the page.

Graph  Live Mermaid diagram from app.get_graph().draw_mermaid():

loading…