Kubernetes diagnostics,
grounded in evidence.

Ask operational queries about your cluster in plain English. K8Sage inspects live pod state, log tails, events, and node metrics through sandboxed read-only RBAC.

Launch Assistant Console

Capabilities

Engineered for operational safety.

Read-only by design

Every check runs under a dedicated ServiceAccount with get, list, and watch permissions only. Zero risk of cluster mutation.

Evidence tool calling

Five specialized tools inspect pod statuses, event logs, log tails, node capacity, and workload counts in real time.

Token-by-token streaming

Tool execution events and model deltas stream over a single SSE connection. No static loading spinners or delays.

Runs on any cluster

Declarative Kustomize overlays drive local k3d development as well as multi-node cloud clusters with zero manifest drift.

Workflow

Three-stage diagnostic pipeline.

01INPUT QUERY

Ask Natural SRE Queries

Submit operational questions in plain English. “Why is my pod in CrashLoopBackOff?” or “Are any nodes experiencing memory pressure?” No need to manually correlate multiple dashboards.

Step 1 of 3 // Automated Pipeline

02READ-ONLY EXECUTION

Gather Real-time Evidence

The agent decides which read-only diagnostic tool to invoke (`pod_status`, `pod_events`, `pod_logs`, `node_status`, `cluster_summary`). Telemetry is fetched live via the sandboxed Evidence service.

Step 2 of 3 // Automated Pipeline

03Grounded OUTPUT

Stream Verifiable Answer

The assistant synthesizes a grounded answer citing precise log lines, restart counters, and event timestamps with attached tool chips. Streamed token-by-token over Server-Sent Events.

Step 3 of 3 // Automated Pipeline

SECURITY ARCHITECTURE

Sandboxed read-only permissions.

The Evidence microservice queries the Kubernetes API under a dedicated ServiceAccount bound to a custom ClusterRole with exactly three verbs: get, list, and watch.

Zero Write Verbs

No create, update, delete, exec, or patch verbs are assigned anywhere in the manifests.

Isolated Microservice Trust Boundary

The LLM service (`sage`) has zero direct cluster access; it must request diagnostics through the sandboxed `evidence` API.

k8s/base/rbac.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8sage-evidence-read
rules:
  - apiGroups: [""]
    resources: [pods, pods/log, nodes, namespaces, events, configmaps, services, persistentvolumeclaims]
    verbs: [get, list, watch]
  - apiGroups: ["apps"]
    resources: [deployments, statefulsets, daemonsets, replicasets]
    verbs: [get, list, watch]
  - apiGroups: ["metrics.k8s.io"]
    resources: [nodes, pods]
    verbs: [get, list, watch]

READY FOR CLUSTER DEPLOYMENT

Inspect your Kubernetes workloads with zero guesswork.

Launch the live interactive assistant console or apply the manifests directly to your k3s/k3d or cloud cluster.