adding files 2

k8s/oke-remediator/README.md

@@ -0,0 +1,50 @@
+# OKE Remediator Job
+
+This workload runs inside OKE as a `CronJob` and performs the same high-level flow as the OCI Function:
+
+1. Queries the business observability API.
+2. Sends a task to `kagent` through MCP.
+3. Detects business degradation, image pull failures, or HPA capacity issues.
+4. Triggers the corresponding OCI DevOps remediation deployment for approval.
+5. Sends an OCI Notifications email with the diagnostic report and the approval link to the remediation deployment.
+
+## Authentication
+
+The workload is configured to use OKE Workload Identity first, and falls back to generic OCI resource principals only if workload identity is not available.
+
+For OKE Workload Identity, the important pieces are:
+
+- Enhanced OKE cluster.
+- Kubernetes `ServiceAccount`.
+- IAM policy scoped to:
+  - `request.principal.type = 'workload'`
+  - `request.principal.namespace = 'kagent-demo'`
+  - `request.principal.service_account = 'kagent-oke-remediator'`
+  - `request.principal.cluster_id = '<cluster-ocid>'`
+
+No OCI config file mount is required for the manifest included here.
+
+## Deployment
+
+Apply:
+
+```bash
+kubectl apply -f k8s/oke-remediator/serviceaccount.yaml
+kubectl apply -f k8s/oke-remediator/role.yaml
+kubectl apply -f k8s/oke-remediator/rolebinding.yaml
+kubectl apply -f k8s/oke-remediator/cronjob.yaml
+```
+
+Run one job immediately for validation:
+
+```bash
+kubectl create job --from=cronjob/kagent-oke-remediator kagent-oke-remediator-manual -n kagent-demo
+kubectl logs job/kagent-oke-remediator-manual -n kagent-demo -f
+```
+
+## Notes
+
+- The remediation pipelines must include an approval stage.
+- The job triggers the remediation deployment and sends the email with the deployment execution link.
+- The job stores the last active incident signature in the `kagent-oke-remediator-state` ConfigMap to suppress duplicate emails for the same active issue.
+- The Python worker uses `oci.auth.signers.get_oke_workload_identity_resource_principal_signer()` before any fallback signer.

k8s/oke-remediator/cronjob.yaml

@@ -0,0 +1,56 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kagent-oke-remediator
+  namespace: kagent-demo
+spec:
+  schedule: "*/3 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        spec:
+          restartPolicy: Never
+          serviceAccountName: kagent-oke-remediator
+          imagePullSecrets:
+            - name: ocir-secret
+          containers:
+            - name: kagent-oke-remediator
+              image: ${REGISTRY}/${NAMESPACE}/kagent-demo/oke-remediator-job:${IMAGE_TAG}
+              imagePullPolicy: Always
+              env:
+                - name: OCI_REGION
+                  value: mx-monterrey-1
+                - name: APP_NAMESPACE
+                  value: kagent-demo
+                - name: KAGENT_MCP_URL
+                  value: http://kagent-controller.kagent.svc.cluster.local:8083/mcp
+                - name: KAGENT_AGENT_NAME
+                  value: k8s-agent
+                - name: KAGENT_AGENT_NAMESPACE
+                  value: kagent
+                - name: ORDER_OBSERVABILITY_URL
+                  value: http://order-service:8080/api/observability
+                - name: NOTIFICATION_TOPIC_OCID
+                  value: ${NOTIFICATION_TOPIC_OCID}
+                - name: BUSINESS_REMEDIATION_PIPELINE_URL
+                  value: ${BUSINESS_REMEDIATION_PIPELINE_URL}
+                - name: BUSINESS_REMEDIATION_PROJECT_OCID
+                  value: ${BUSINESS_REMEDIATION_PROJECT_OCID}
+                - name: BUSINESS_REMEDIATION_PIPELINE_OCID
+                  value: ${BUSINESS_REMEDIATION_PIPELINE_OCID}
+                - name: IMAGEPULL_REMEDIATION_PIPELINE_URL
+                  value: ${IMAGEPULL_REMEDIATION_PIPELINE_URL}
+                - name: IMAGEPULL_REMEDIATION_PROJECT_OCID
+                  value: ${IMAGEPULL_REMEDIATION_PROJECT_OCID}
+                - name: IMAGEPULL_REMEDIATION_PIPELINE_OCID
+                  value: ${IMAGEPULL_REMEDIATION_PIPELINE_OCID}
+                - name: HPA_REMEDIATION_PIPELINE_URL
+                  value: ${HPA_REMEDIATION_PIPELINE_URL}
+                - name: HPA_REMEDIATION_PROJECT_OCID
+                  value: ${HPA_REMEDIATION_PROJECT_OCID}
+                - name: HPA_REMEDIATION_PIPELINE_OCID
+                  value: ${HPA_REMEDIATION_PIPELINE_OCID}

k8s/oke-remediator/role.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kagent-oke-remediator
+  namespace: kagent-demo
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "create", "update", "patch"]

k8s/oke-remediator/rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kagent-oke-remediator
+  namespace: kagent-demo
+subjects:
+  - kind: ServiceAccount
+    name: kagent-oke-remediator
+    namespace: kagent-demo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kagent-oke-remediator

k8s/oke-remediator/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kagent-oke-remediator
+  namespace: kagent-demo