Skip to content

v0.2.0 — claw4k8s: AI agents manage their own Kubernetes

Choose a tag to compare

View all tags
@willamhou willamhou released this 20 Apr 08:18
· 27 commits to main since this release
v0.2.0
7c3db07
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

This release introduces claw4k8s, an autonomous ops layer for k8s4claw. AI agents now manage their own Kubernetes infrastructure: detect crashes, match rules, execute fixes, escalate unknowns to LLM + human approval. All actions Ed25519-signed.

claw4k8s self-healing demo

What's new

claw4k8s autonomous ops

  • ClawOpsController (in-operator) — watches Pod status, matches deterministic rules (OOM, CrashLoop, HighCPU, Evicted), auto-executes low-risk fixes
  • Companion Claw (runtime: k8sops) — LLM agent for novel issues, routes to human approval via Slack
  • Intent annotation pattern — agents never patch StatefulSets directly; a single reconciler (ClawReconciler) consumes intents through a 5-action whitelist with generation-based idempotency. Changes now persist to claw.Spec.Resources / claw.Spec.Replicas so they survive reconcile rebuilds.
  • Ed25519 signing — every action produces a signed receipt stored in the ClawOpsEscalation CR; pure-Go Ed25519Signer falls back gracefully if the signet CLI is unavailable
  • Graceful LLM fallback — 3 retries with exponential backoff, then degrades to human notification (not paralysis)

New CRDs

  • ClawOpsEscalation — dual-purpose audit trail + workflow state machine (Pending → Analyzing → Proposed → AwaitingApproval → Approved → Executed)

New runtime

  • K8sOpsAdapter — locked-down runtime for the Companion Claw with mandatory NetworkPolicy enforcement at webhook admission

Rule engine

  • 5 default rules: oom-bump-memory, crashloop-restart-pod, high-cpu-bump-request, evicted-rollout-restart, scale-replicas
  • Deterministic Go code with cooldown + debounce + circuit breaker
  • Rate limiting (default: 5 actions per Claw per hour)

Architecture

See docs/marketing/architecture.md for Mermaid diagrams of the full auto-remediation loop and the intent annotation pattern.

How is this different?

See docs/marketing/comparison.md for the full comparison with k8sgpt / kubectl-ai / Holmes.

Short answer: others diagnose or patch with approval. claw4k8s lets AI agents run their own infra with cryptographic audit — and falls back gracefully when the LLM is unavailable.

Breaking changes

None. `Claw` CR is backward-compatible. Existing deployments continue to work without any changes. claw4k8s features activate only when you set `runtime: k8sops` on a Claw CR.

What's tested

  • 18 test packages, all green (CI: https://github.com/Prismer-AI/k8s4claw/actions/runs/24655109867)
  • Unit tests: rule engine, signal extraction, intent validation, Ed25519 signing + verification, replay-protection monotonicity
  • Envtest integration: full intent consumption loop (bump-memory survives STS rebuild, rollout-restart survives STS rebuild, stale generation skip, invalid intent rejection, scale-replicas)
  • E2E: scripts/test-claw4k8s-e2e.sh on a real kind cluster
  • Demo recording (attached): 104s end-to-end on polinux/stress OOM + 32Mi cgroup limit

What's NOT yet in this release

  • Helm chart (install via kubectl apply -f config/crd/bases/ for now)
  • Real LLM integration (Companion Claw uses a placeholder LLM client; pipeline infrastructure is complete, Anthropic SDK wiring is next)
  • Signet key persistence (keys are in-memory; K8s Secret storage planned)
  • Multi-cluster support

Known issues

  • Release workflow is currently failing due to pinned GitHub Actions SHAs that no longer resolve; release assets attached manually. Fix tracked for next patch release.

Contributors

Full changelog

See the PR #12 commit log for the complete 19-commit history. Highlights:

  • feat: add ClawOpsEscalation CRD types and RuntimeK8sOps constant
  • feat: add rule engine and Signet signer interface
  • feat: add signal collection and intent annotation validation
  • feat: add ClawOpsController, K8sOps adapter, and RBAC configs
  • feat: add Companion Claw binary stub with LLM pipeline
  • test: add envtest integration test for ClawOpsController
  • feat: add ClawReconciler intent consumption for auto-remediation loop
  • feat: add escalation watcher and E2E test script
  • feat: add Ed25519Signer and auto-fallback factory
  • fix(claw4k8s): persist intent changes to Claw.Spec + preserve gen on invalid

Contributors

willamhou
Assets 4
Loading