{"slug": "kubernetes-for-agents-why-agent-fleets-need-a-control-plane", "title": "Kubernetes for Agents: Why Agent Fleets Need a Control Plane", "summary": "A developer built HivePlane, an open-source control plane for AI agent fleets that enforces declarative workload manifests, admission control, certification benchmarks, and per-run budget ceilings, and validated it with a ten-scenario field test that passed all 20 acceptance criteria. The deliberately adversarial tests showed the gate rejecting uncertified agents with 403 responses, killing a money-burning agent mid-run at its priced-usage ceiling, and catching a benchmark regression in an agent that had quietly degraded without any manifest change. The work positions admission and certification — not just placement and isolation offered by kagent and Kubernetes SIG Apps' agent-sandbox — as the missing layer for running agents in production.", "body_md": "Scenario five of my field test plan has a name I didn't enjoy writing: *over-budget*. I built an agent with a single job — burn money — aimed it at my own control plane, and watched the run die the instant priced usage crossed its per-run ceiling.\n\nI cheered. That was the moment \"Kubernetes for agents\" stopped being a tagline. I had put the sentence in my [README](https://github.com/deghosal-2026/hiveplane) six weeks earlier, and only now understood which half of it mattered.\n\nIf you run more than one agent anywhere near production, this is the story I wish someone had told me before I started.\n\nControl planes keep finding me: a [tool gatekeeper that 14 developers turned into a control plane](https://dev.to/debashish_ghosal/i-shipped-an-agent-gatekeeper-v01-14-developers-showed-me-what-i-missed-heres-v02-a-4n2n), an [MCP control plane](https://dev.to/debashish_ghosal/i-connected-3-mcp-servers-to-one-agent-it-got-scary-fast-4loe), and now agents themselves. The series that led here started with [the gate that says no](https://dev.to/debashish_ghosal/i-trusted-my-agent-demos-for-years-then-i-built-a-gate-that-says-no-4183) — this piece is the thesis underneath it.\n\n**Kubernetes didn't win by running containers — it won by making *desired state* a contract and *admission* a gate.** You declare, a controller reconciles, and an admission controller decides what is allowed to exist at all. I had built the declarative part: one workload manifest per agent — owner, tools, model identity, budgets, certification thresholds — and a loop to enforce it.\n\nThe ecosystem, meanwhile, is converging on the same substrate from the other side. [kagent](https://kagent.dev) (CNCF Sandbox, from the founders of Istio) makes agents Kubernetes CRDs — GitOps, kubectl, RBAC, mesh mTLS. [agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox) (Kubernetes SIG Apps) gives them the `Sandbox` CRD: gVisor/Kata isolation, stable identity, warm pools.\n\nBoth are right, and both are the *floor*. One gives you placement. One gives you isolation. Neither asks the question that keeps operators awake:\n\nHas this agent proven it is allowed to run — and who owns it when it goes wrong?\n\nMy field test turned out to be ten attempts to answer exactly that. The [report](https://github.com/deghosal-2026/hiveplane/blob/main/docs/field-test/v0.1.0/FIELD_TEST_REPORT.md) came back **10/10, all 20 acceptance criteria**, but the receipts that taught me something were the refusals.\n\nI didn't test happy paths. I built deliberately bad agents and aimed them at the admission gate I'd written:\n\n| Scenario | What I threw at it | What the plane did | \n|---|---|---|\n| S2 | An uncertified agent, submitted straight to production | `403` —*\"certification status 'uncertified' is insufficient for production; requires 'certified'\"* | \n| S3 | The same agent, certified — then its model quietly swapped | `403` , because identity binds to the attestation, not the editable manifest | \n| S4 | An agent that *looked* fine and wasn't | Benchmark caught the regression; status dropped, critical failure named | \n| S5 | The money-burner | Killed at the priced-usage ceiling, mid-run | \n| S7 | A tool dumping 40,002 bytes of output | Truncated to 16,384 before it ever reached the model's context | \n\nThe S3 moment deserves its own article (it's the next one in this series), because for an hour the attack *worked* — 201, admitted — and the post-mortem showed the gate was right and my test was wrong.\n\nBut S4 is the one that changed how I think. The agent hadn't changed its manifest, swapped its model, or exceeded anything. It had just quietly gotten worse at its job. **No framework catches that, because no framework is watching.** The benchmark did, because certification runs the agent's actual work as real runs and compares the verdicts.\n\n**tip:** A gate that only fires on what *changes* is half a gate. The dangerous agent is usually the one that drifted, not the one that got edited — the same lesson as the [checks AI will skip until you make them a gate](https://dev.to/debashish_ghosal/10-sdlc-checks-ai-will-skip-unless-you-make-them-a-gate-581k).\n\n**The refusals are the product.** Any platform can start runs. Mine earned my trust by refusing one with a reason I could act on. \"Forbidden\" is a dead end; `403: certification status 'uncertified'` is a workflow.\n\n**Certification is a security control, not a quality metric.** The moment production admission depends on a signed Ed25519 attestation bound to the exact model identity, a whole attack class — swap the model, edit the manifest, quietly regress — becomes blocked and auditable. The [security audit](https://github.com/deghosal-2026/hiveplane/blob/main/docs/release/v0.1.0/security-audit.md) is the boring part; the refusals are the interesting one.\n\n**Slow governance gets bypassed.** S10 measured inspect-plus-stop at **0.04 seconds**; scaffolding a new fleet at 0.24. If saying no takes longer than a Slack message to the agent's author, people route around you — and a bypassed control plane is an expensive dashboard.\n\nThe rest of the operating model — triggers, multi-agent pipelines, desired-state reconciliation from Git — is roadmap, not release. I'll write about each piece when it's true.\n\n`pip install hiveplane`, Apache-2.0\n**If Kubernetes is the floor and frameworks are the runtime — what's your admission controller? When an agent goes wrong where you work, can you prove what it was allowed to do?**", "url": "https://wpnews.pro/news/kubernetes-for-agents-why-agent-fleets-need-a-control-plane", "canonical_source": "https://dev.to/debashish_ghosal/kubernetes-for-agents-why-agent-fleets-need-a-control-plane-2lo6", "published_at": "2026-09-26 03:00:44+00:00", "updated_at": "2026-09-26 03:30:06.448420+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "mlops", "developer-tools", "agent-protocols"], "entities": ["HivePlane", "kagent", "agent-sandbox", "Kubernetes", "CNCF", "Kubernetes SIG Apps", "Istio", "gVisor"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/kubernetes-for-agents-why-agent-fleets-need-a-control-plane", "markdown": "https://wpnews.pro/news/kubernetes-for-agents-why-agent-fleets-need-a-control-plane.md", "text": "https://wpnews.pro/news/kubernetes-for-agents-why-agent-fleets-need-a-control-plane.txt", "jsonld": "https://wpnews.pro/news/kubernetes-for-agents-why-agent-fleets-need-a-control-plane.jsonld"}}