AI-K8sOps · Persona Bee · Runs in your cluster

The AI agent that runs Kubernetes day two

NudgeBee's AI-K8sOps maps live topology, collapses alert noise to real issues, and execs into a pod to find the fault and propose the fix.

One issue per workload, not one alert per pod
Execs into a pod and finds the fault
Changes nothing without your say-so

Book a Demo Start free

Self-hosted
Zero telemetry
Reads freely, writes on approval
Free forever tier

Issues · prod-us-east-1 · last 24h

193raw events

4issues

One per owning workload

Ranked by triage score 0 to 100

P0orders-svcDeployment · CrashLoopBackOff142 events84Firing
P1payments-workerDeployment · OOMKilled38 events61Firing
P3cart-cacheStatefulSet · ImagePullBackOff4 events27Open
P3search-indexerJob · JobFailure9 events34Closed

Investigating orders-svc exec into orders-svc-7f9c-x2mRunning

What is AIOps for Kubernetes?

AI for Kubernetes operations puts an AI agent in the loop for day-two work: live topology, cluster health, alert de-noising, anomaly detection and troubleshooting to a root cause, with auto remediation on approval.

Live mapWorkloads, pods, nodes and namespaces, never a nightly snapshot
One issuePer owning workload, not one alert per pod per restart
In your clusterDials out over one WebSocket. No inbound ports, no VPN

How it works

AIOps Kubernetes operations, from event to fix

One agent covers the whole day-two loop. Every stage is readable, not hidden behind a score.

01

Collapse
One issue per owning workload
- Crash loops, image-pull backoffs and OOM kills
- Job failures and restarts, grouped the same way
- Each issue gets a 0 to 100 triage score
02

Detect
Catches what has not paged yet
- Three anomaly engines
- CPU, memory, latency, error rate, replica count
- Heavy false-positive suppression
03

Investigate
Works the fault back to a root cause
- Execs into pods from the browser
- Reads logs, metrics and traces in place
- Read-only diagnostics need no prompt
04

Remediate
Auto remediation, on your say-so
- A live patch or a pull request, on approval
- Auto-Pilot rightsizes routine workloads on a schedule
- Dry-run and guardrails on every run

Runs

kubectl
helm
argocd
PromQL

Fixes run as durable runbook automation

Topology and troubleshooting

A cluster map that is always current. Exec, logs and traces beside it.

The whole estate, mapped live into its own store. Then it works the cluster the way you would, from the browser.

Traced along real dependency edges

Not to whatever alerted in the same minute

Symptomcheckout-api503 · 8%

CALLS

Failingpayment-gateway

IS_CONFIGURED_BY

Root causepayment-gateway-configchanged 14:02

Workloads
Pods
Nodes
Namespaces

Resource-version-aware updates, tracked live
Reliable removal of things that no longer exist
Node hardware, capacity and placement read directly
Cluster health: what runs, what is degraded, on which node

Spot versus on-demand detection across

Karpenter
EKS
AKS
GKE
Spotinst

Exec straight into a pod

An in-browser terminal, with logs, metrics and traces

orders-svc-7f9c-x2mns prodRunningrestarts 6

Terminal
Logs
Metrics
Traces

root@orders-svc-7f9c:/app# cat config/cache.yaml
cache:
  ttl_seconds: 900
  max_entries: 50000
  evict_policy: lru
root@orders-svc-7f9c:/app# ps aux | head -4
USER  PID  %CPU  %MEM  COMMAND
root    1  12.4  61.8  node server.js
root@orders-svc-7f9c:/app#

Session recorded for audit

A pod debugger and profiler alongside it
Prometheus resolution auto-tunes to the time range
Runs kubectl, helm, argocd and PromQL, as you would
Log and trace queries run in your backends, in place

Via the outbound in-cluster agent
Only read-only diagnostics
No inbound ports
No exposed API server

Signal

One issue per workload, not one alert per pod

The flood collapses into something a human can act on. Anomalies and scan findings land in the same ranked queue.

Owner-level de-duplication

Grouped under the workload that owns them

Crash loops
Image-pull backoffs
OOM kills
Job failures
CPU throttling
Pod not ready
Restarts

1 issueper owning workload

Every issue scored 0 to 100

P080+
P160+
P240+
P3<40

The score weighs

Severity
Production or not
Duplicate history
SLO impact
Restart count
Config changes

92%container memory triggers OOM detection
95%node memory triggers OOM detection
~70alert types auto-escalate as they persist

Flags the metric that moved

Before it pages you

orders-svc memory working setDefault · IsolationForest

Anomaly · 12:40

08:0011:0014:00

IsolationForest1% contamination, 100 estimators
DBSCANDensity-based per-metric outliers
Z-scoreClassic statistical, at 3 sigma

Three swappable engines across

CPU
Memory
Latency
Error rate
Replica count

Heavy false-positive suppression: a quiet weekend triggers no page

CIS, CVEs and misconfigurations

Scanners run as jobs in your cluster, on a schedule

kube-bench (CIS)
Trivy CIS
Trivy image CVEs
Popeye
Certificate expiry
Version skew
Unused volumes

37 findings4 Critical11 High22 Medium

CVE-2024-21626 in nginx:1.21Trivy · deploy/web-frontendCritical
CIS 5.2.1: minimize host PID sharingkube-bench · cluster prod-us-east-1High
No resource limits setPopeye · deploy/orders-svcMedium
Certificate expires in 12 daysCert check · ingress/api-gatewayMedium

Findings join the same ranked queue, not a separate console

Upgrades

Upgrade planning that checks before it moves

An eight-step upgrade planner checks before it moves, and executes only what it declared.

Cluster upgrade planner

Cluster prod-us-east-1 · EKS

v1.28 → v1.29

1Scan deprecated APIs3 findings
2Check Helm chart compatibility21 releases OK
3Check add-on and CNI versions2 upgrades queued
4Pre-flight health snapshotRunning
5Cordon and drain planQueued
6Apply control plane upgradeQueued
7Upgrade node groups, rollingQueued
8Post-flight health diffQueued

Checks rerun before every step

Deprecated APIs found

Removed in the v1.29 target

policy/v1beta1 PodSecurityPolicyused by 3 workloadsBlocks
batch/v1beta1 CronJobused by 1 workloadBlocks
autoscaling/v2beta2 HorizontalPodAutoscalerused by 2 workloadsWarn

Apply is blocked until deprecated APIs are migrated

A live registry of deprecated APIsCross-referenced before anything moves
Helm chart compatibilityChecked before the upgrade
A health diffRun before and after the change
Allowlisted commands onlykubectl and cloud CLIs; the plan cannot wander outside what it declared

Gates

It reads freely. It changes nothing without you.

Two modes, drawn at the tool layer, not left to the model’s judgment.

Reads

Diagnoses without asking

Read-only diagnostics run without asking
Finding the fault is never slowed by a prompt

Writes

Gated behind your approval

Every create, update and delete classified at the tool layer
Blast radius scored from the live dependency graph
Only what is safe auto-applies; the rest waits for you

No self-granted accessForbidden from modifying RBAC to grant itself access it lacks
It does the work, not youNever asks you to go and run commands yourself
Untrusted by defaultAll tool output is untrusted input: a prompt-injection defence

Approvals arrive in

Slack
Microsoft Teams
Google Chat
Signed link

The fix lands as

Live patch
Pull request
Auto-Pilot rightsizing, on a schedule
Dry-run and guardrails

All of it runs as durable runbook automation

Integrations

Works with your observability. Doesn’t replace it.

It queries your existing backends in place. Metrics, logs and traces are not shipped out to a third party.

Metrics and APM

Prometheus
Grafana
VictoriaMetrics
Datadog
New Relic

Logs and traces

Loki
Elasticsearch
Jaeger
OpenTelemetry

Incidents, code and GitOps

PagerDuty
Jira
ServiceNow
GitHub
GitLab
Argo CD

Chat

Slack
Microsoft Teams
Google Chat

Queried in their native dialects

PromQL
LogQL
KQL
NRQL
Elasticsearch DSL

Browse all 78 integrations

Where it runs

Runs in your cluster. Nothing leaves.

Where it runs, what it reads and what it is allowed to change, answered before it touches a cluster.

Where does it run?

In your own cluster.

Self-hosted inside your own Kubernetes cluster
Zero telemetry; nothing phones home
Dials out over one WebSocket: no inbound ports, no VPN
No exposed Kubernetes API server
Credentials AES-256-GCM at rest; agent messages Ed25519-signed

What does it read?

Your backends, in place.

Existing backends, in their native query languages
Metrics, logs and traces stay where they are
Secrets scanned before any model call, then redacted or blocked
Readable source, with a free Community edition

What can it change?

Nothing without you.

Every write classified at the tool layer
Approval in Slack, Teams, Google Chat or a signed link
Safe changes auto-apply; everything else waits
Cannot modify RBAC to grant itself access

Bring your own model · eleven provider routes, including

AWS Bedrock
OpenAI
Azure OpenAI
Google AI
Vertex AI
SageMaker
HuggingFace
Anthropic
Ollama
vLLM

Embeddings can run on-device

Proof

See it on a real cluster fleet

Kubernetes case study · B2B SaaS

B2B SaaS rightsizes 200+ Kubernetes clusters and saves $1.2M a year

200+Kubernetes clusters rightsized
$1.2Msaved a year
15 mina month, down from three engineer-days

Read the case study

How it ran on production clusters

Automated rightsizing
Safety guardrails
Auto-rollback
One-click approval workflows

Kubernetes FAQ

Frequently asked questions

For the engineer who lives in kubectl and distrusts magic.

Book a Demo

What is AI for Kubernetes operations?

AI for Kubernetes operations means using an autonomous agent to run day-two cluster work: mapping live topology, collapsing duplicate alerts into real issues, detecting anomalies and investigating failures to a root cause. It runs inside your own cluster, reads through your existing tools and gates every change behind human approval.

How is NudgeBee's AI-K8sOps different from an observability dashboard?

A dashboard shows you graphs and leaves the work to you. This agent reads the same signals, collapses alert noise into one issue per workload, execs into pods to investigate and proposes a fix. It acts on the cluster, with your approval, rather than only visualizing what is already broken. For how this compares across the category, see our roundup of AI root cause analysis tools.

Will NudgeBee's AI-K8sOps change my cluster automatically?

Only with your approval. Read-only diagnostics run freely, but every create, update or delete is classified at the tool layer and gated behind explicit human approval. Auto-Pilot is available for scheduled rightsizing, with dry-run and guardrails, but nothing changes outside what you have configured and approved.

Does NudgeBee replace Prometheus or Grafana?

No. NudgeBee queries your existing observability backends in place, in their native query languages such as PromQL and LogQL, and auto-tunes Prometheus resolution to the time range. It layers on top of the stack you already run rather than replacing it or asking you to re-instrument.

How does NudgeBee's AI-K8sOps cut Kubernetes alert noise?

Owner-level de-duplication collapses crash loops, image-pull backoffs, OOM kills, job failures and restarts into a single issue per owning workload, instead of one alert per pod per restart. Each issue gets a 0 to 100 score, and around 70 alert types auto-escalate based on how long they persist.

Can NudgeBee's AI-K8sOps exec into a pod?

Yes. An in-browser terminal execs straight into a pod through the outbound in-cluster agent, with a pod debugger and profiler alongside it. The agent runs the same read-only diagnostics you would, kubectl, helm, argocd and PromQL, with no inbound ports and no exposed API server.

How does NudgeBee's AI-K8sOps detect anomalies?

Kubernetes metric anomalies are detected by three swappable engines: IsolationForest with 1% contamination and 100 estimators as the default, DBSCAN and Z-score at 3 sigma. They run across CPU, memory, latency, error rate and replica count, with heavy false-positive suppression so a quiet weekend does not page anyone.

Does NudgeBee's AI-K8sOps help with Kubernetes cluster upgrades?

Yes. An eight-step upgrade planner cross-references a live registry of deprecated APIs, checks Helm chart compatibility and runs a health diff before and after the change. Execution is limited to an allowlisted set of kubectl and cloud CLI commands, so the plan cannot wander outside what it declared.

Can I read NudgeBee's source code?

Yes. The full implementation is readable: the agent architecture, the prompts and the quality gates. You can self-host it in your own cluster and run it in production internally for free, at any scale. The 2 cluster or cloud account limit applies to the hosted Cloud SaaS free tier.

How much does NudgeBee's AI-K8sOps cost?

AI-K8sOps is included in every NudgeBee edition, alongside the other Persona Bees. The Community edition is free: you self-host it with no cluster limit. On the hosted Cloud SaaS there is a free forever tier covering up to two clusters or cloud accounts, with no credit card required. Enterprise Support starts at $500 a month, billed annually and priced by environments and clusters, and Enterprise Platinum is priced on environments, clusters and accounts. Full details are on the pricing page.

The AI agent that runs Kubernetes day two

What is AIOps for Kubernetes?

AIOps Kubernetes operations, from event to fix

Collapse

Detect

Investigate

Remediate