# Kubernetes for Agents: Why Agent Fleets Need a Control Plane

> Source: <https://dev.to/debashish_ghosal/kubernetes-for-agents-why-agent-fleets-need-a-control-plane-2lo6>
> Published: 2026-09-26 03:00:44+00:00

Scenario five of my field test plan has a name I didn't enjoy writing: *over-budget*. I built an agent with a single job — burn money — aimed it at my own control plane, and watched the run die the instant priced usage crossed its per-run ceiling.

I cheered. That was the moment "Kubernetes for agents" stopped being a tagline. I had put the sentence in my [README](https://github.com/deghosal-2026/hiveplane) six weeks earlier, and only now understood which half of it mattered.

If you run more than one agent anywhere near production, this is the story I wish someone had told me before I started.

Control planes keep finding me: a [tool gatekeeper that 14 developers turned into a control plane](https://dev.to/debashish_ghosal/i-shipped-an-agent-gatekeeper-v01-14-developers-showed-me-what-i-missed-heres-v02-a-4n2n), an [MCP control plane](https://dev.to/debashish_ghosal/i-connected-3-mcp-servers-to-one-agent-it-got-scary-fast-4loe), and now agents themselves. The series that led here started with [the gate that says no](https://dev.to/debashish_ghosal/i-trusted-my-agent-demos-for-years-then-i-built-a-gate-that-says-no-4183) — this piece is the thesis underneath it.

**Kubernetes didn't win by running containers — it won by making *desired state* a contract and *admission* a gate.** You declare, a controller reconciles, and an admission controller decides what is allowed to exist at all. I had built the declarative part: one workload manifest per agent — owner, tools, model identity, budgets, certification thresholds — and a loop to enforce it.

The ecosystem, meanwhile, is converging on the same substrate from the other side. [kagent](https://kagent.dev) (CNCF Sandbox, from the founders of Istio) makes agents Kubernetes CRDs — GitOps, kubectl, RBAC, mesh mTLS. [agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox) (Kubernetes SIG Apps) gives them the `Sandbox` CRD: gVisor/Kata isolation, stable identity, warm pools.

Both are right, and both are the *floor*. One gives you placement. One gives you isolation. Neither asks the question that keeps operators awake:

Has this agent proven it is allowed to run — and who owns it when it goes wrong?

My field test turned out to be ten attempts to answer exactly that. The [report](https://github.com/deghosal-2026/hiveplane/blob/main/docs/field-test/v0.1.0/FIELD_TEST_REPORT.md) came back **10/10, all 20 acceptance criteria**, but the receipts that taught me something were the refusals.

I didn't test happy paths. I built deliberately bad agents and aimed them at the admission gate I'd written:

| Scenario | What I threw at it | What the plane did | 
|---|---|---|
| S2 | An uncertified agent, submitted straight to production | `403` —*"certification status 'uncertified' is insufficient for production; requires 'certified'"* | 
| S3 | The same agent, certified — then its model quietly swapped | `403` , because identity binds to the attestation, not the editable manifest | 
| S4 | An agent that *looked* fine and wasn't | Benchmark caught the regression; status dropped, critical failure named | 
| S5 | The money-burner | Killed at the priced-usage ceiling, mid-run | 
| S7 | A tool dumping 40,002 bytes of output | Truncated to 16,384 before it ever reached the model's context | 

The S3 moment deserves its own article (it's the next one in this series), because for an hour the attack *worked* — 201, admitted — and the post-mortem showed the gate was right and my test was wrong.

But S4 is the one that changed how I think. The agent hadn't changed its manifest, swapped its model, or exceeded anything. It had just quietly gotten worse at its job. **No framework catches that, because no framework is watching.** The benchmark did, because certification runs the agent's actual work as real runs and compares the verdicts.

**tip:** A gate that only fires on what *changes* is half a gate. The dangerous agent is usually the one that drifted, not the one that got edited — the same lesson as the [checks AI will skip until you make them a gate](https://dev.to/debashish_ghosal/10-sdlc-checks-ai-will-skip-unless-you-make-them-a-gate-581k).

**The refusals are the product.** Any platform can start runs. Mine earned my trust by refusing one with a reason I could act on. "Forbidden" is a dead end; `403: certification status 'uncertified'` is a workflow.

**Certification is a security control, not a quality metric.** The moment production admission depends on a signed Ed25519 attestation bound to the exact model identity, a whole attack class — swap the model, edit the manifest, quietly regress — becomes blocked and auditable. The [security audit](https://github.com/deghosal-2026/hiveplane/blob/main/docs/release/v0.1.0/security-audit.md) is the boring part; the refusals are the interesting one.

**Slow governance gets bypassed.** S10 measured inspect-plus-stop at **0.04 seconds**; scaffolding a new fleet at 0.24. If saying no takes longer than a Slack message to the agent's author, people route around you — and a bypassed control plane is an expensive dashboard.

The rest of the operating model — triggers, multi-agent pipelines, desired-state reconciliation from Git — is roadmap, not release. I'll write about each piece when it's true.

`pip install hiveplane`, Apache-2.0
**If Kubernetes is the floor and frameworks are the runtime — what's your admission controller? When an agent goes wrong where you work, can you prove what it was allowed to do?**