Kubernetes for Agents: Why Agent Fleets Need a Control Plane

A developer built HivePlane, an open-source control plane for AI agent fleets that enforces declarative workload manifests, admission control, certification benchmarks, and per-run budget ceilings, and validated it with a ten-scenario field test that passed all 20 acceptance criteria. The deliberately adversarial tests showed the gate rejecting uncertified agents with 403 responses, killing a money-burning agent mid-run at its priced-usage ceiling, and catching a benchmark regression in an agent that had quietly degraded without any manifest change. The work positions admission and certification — not just placement and isolation offered by kagent and Kubernetes SIG Apps' agent-sandbox — as the missing layer for running agents in production.

Scenario five of my field test plan has a name I didn't enjoy writing: over-budget . I built an agent with a single job — burn money — aimed it at my own control plane, and watched the run die the instant priced usage crossed its per-run ceiling. I cheered. That was the moment "Kubernetes for agents" stopped being a tagline. I had put the sentence in my README https://github.com/deghosal-2026/hiveplane six weeks earlier, and only now understood which half of it mattered. If you run more than one agent anywhere near production, this is the story I wish someone had told me before I started. Control planes keep finding me: a tool gatekeeper that 14 developers turned into a control plane https://dev.to/debashish ghosal/i-shipped-an-agent-gatekeeper-v01-14-developers-showed-me-what-i-missed-heres-v02-a-4n2n , an MCP control plane https://dev.to/debashish ghosal/i-connected-3-mcp-servers-to-one-agent-it-got-scary-fast-4loe , and now agents themselves. The series that led here started with the gate that says no https://dev.to/debashish ghosal/i-trusted-my-agent-demos-for-years-then-i-built-a-gate-that-says-no-4183 — this piece is the thesis underneath it. Kubernetes didn't win by running containers — it won by making desired state a contract and admission a gate. You declare, a controller reconciles, and an admission controller decides what is allowed to exist at all. I had built the declarative part: one workload manifest per agent — owner, tools, model identity, budgets, certification thresholds — and a loop to enforce it. The ecosystem, meanwhile, is converging on the same substrate from the other side. kagent https://kagent.dev CNCF Sandbox, from the founders of Istio makes agents Kubernetes CRDs — GitOps, kubectl, RBAC, mesh mTLS. agent-sandbox https://github.com/kubernetes-sigs/agent-sandbox Kubernetes SIG Apps gives them the Sandbox CRD: gVisor/Kata isolation, stable identity, warm pools. Both are right, and both are the floor . One gives you placement. One gives you isolation. Neither asks the question that keeps operators awake: Has this agent proven it is allowed to run — and who owns it when it goes wrong? My field test turned out to be ten attempts to answer exactly that. The report https://github.com/deghosal-2026/hiveplane/blob/main/docs/field-test/v0.1.0/FIELD TEST REPORT.md came back 10/10, all 20 acceptance criteria , but the receipts that taught me something were the refusals. I didn't test happy paths. I built deliberately bad agents and aimed them at the admission gate I'd written: | Scenario | What I threw at it | What the plane did | |---|---|---| | S2 | An uncertified agent, submitted straight to production | 403 — "certification status 'uncertified' is insufficient for production; requires 'certified'" | | S3 | The same agent, certified — then its model quietly swapped | 403 , because identity binds to the attestation, not the editable manifest | | S4 | An agent that looked fine and wasn't | Benchmark caught the regression; status dropped, critical failure named | | S5 | The money-burner | Killed at the priced-usage ceiling, mid-run | | S7 | A tool dumping 40,002 bytes of output | Truncated to 16,384 before it ever reached the model's context | The S3 moment deserves its own article it's the next one in this series , because for an hour the attack worked — 201, admitted — and the post-mortem showed the gate was right and my test was wrong. But S4 is the one that changed how I think. The agent hadn't changed its manifest, swapped its model, or exceeded anything. It had just quietly gotten worse at its job. No framework catches that, because no framework is watching. The benchmark did, because certification runs the agent's actual work as real runs and compares the verdicts. tip: A gate that only fires on what changes is half a gate. The dangerous agent is usually the one that drifted, not the one that got edited — the same lesson as the checks AI will skip until you make them a gate https://dev.to/debashish ghosal/10-sdlc-checks-ai-will-skip-unless-you-make-them-a-gate-581k . The refusals are the product. Any platform can start runs. Mine earned my trust by refusing one with a reason I could act on. "Forbidden" is a dead end; 403: certification status 'uncertified' is a workflow. Certification is a security control, not a quality metric. The moment production admission depends on a signed Ed25519 attestation bound to the exact model identity, a whole attack class — swap the model, edit the manifest, quietly regress — becomes blocked and auditable. The security audit https://github.com/deghosal-2026/hiveplane/blob/main/docs/release/v0.1.0/security-audit.md is the boring part; the refusals are the interesting one. Slow governance gets bypassed. S10 measured inspect-plus-stop at 0.04 seconds ; scaffolding a new fleet at 0.24. If saying no takes longer than a Slack message to the agent's author, people route around you — and a bypassed control plane is an expensive dashboard. The rest of the operating model — triggers, multi-agent pipelines, desired-state reconciliation from Git — is roadmap, not release. I'll write about each piece when it's true. pip install hiveplane , Apache-2.0 If Kubernetes is the floor and frameworks are the runtime — what's your admission controller? When an agent goes wrong where you work, can you prove what it was allowed to do?