adding files 2

k8s/oke-remediator/README.md

@@ -0,0 +1,50 @@
+# OKE Remediator Job
+
+This workload runs inside OKE as a `CronJob` and performs the same high-level flow as the OCI Function:
+
+1. Queries the business observability API.
+2. Sends a task to `kagent` through MCP.
+3. Detects business degradation, image pull failures, or HPA capacity issues.
+4. Triggers the corresponding OCI DevOps remediation deployment for approval.
+5. Sends an OCI Notifications email with the diagnostic report and the approval link to the remediation deployment.
+
+## Authentication
+
+The workload is configured to use OKE Workload Identity first, and falls back to generic OCI resource principals only if workload identity is not available.
+
+For OKE Workload Identity, the important pieces are:
+
+- Enhanced OKE cluster.
+- Kubernetes `ServiceAccount`.
+- IAM policy scoped to:
+  - `request.principal.type = 'workload'`
+  - `request.principal.namespace = 'kagent-demo'`
+  - `request.principal.service_account = 'kagent-oke-remediator'`
+  - `request.principal.cluster_id = '<cluster-ocid>'`
+
+No OCI config file mount is required for the manifest included here.
+
+## Deployment
+
+Apply:
+
+```bash
+kubectl apply -f k8s/oke-remediator/serviceaccount.yaml
+kubectl apply -f k8s/oke-remediator/role.yaml
+kubectl apply -f k8s/oke-remediator/rolebinding.yaml
+kubectl apply -f k8s/oke-remediator/cronjob.yaml
+```
+
+Run one job immediately for validation:
+
+```bash
+kubectl create job --from=cronjob/kagent-oke-remediator kagent-oke-remediator-manual -n kagent-demo
+kubectl logs job/kagent-oke-remediator-manual -n kagent-demo -f
+```
+
+## Notes
+
+- The remediation pipelines must include an approval stage.
+- The job triggers the remediation deployment and sends the email with the deployment execution link.
+- The job stores the last active incident signature in the `kagent-oke-remediator-state` ConfigMap to suppress duplicate emails for the same active issue.
+- The Python worker uses `oci.auth.signers.get_oke_workload_identity_resource_principal_signer()` before any fallback signer.