kagent-oci-devops-demo/k8s/oke-remediator

OKE Remediator Job

This workload runs inside OKE as a CronJob and performs the same high-level flow as the OCI Function:

1. Queries the business observability API.
2. Sends a task to kagent through MCP.
3. Detects business degradation, image pull failures, or HPA capacity issues.
4. Triggers the corresponding OCI DevOps remediation deployment for approval.
5. Sends an OCI Notifications email with the diagnostic report and the approval link to the remediation deployment.

Authentication

The workload is configured to use OKE Workload Identity first, and falls back to generic OCI resource principals only if workload identity is not available.

For OKE Workload Identity, the important pieces are:

• Enhanced OKE cluster.
• Kubernetes ServiceAccount.
• IAM policy scoped to:
  • request.principal.type = 'workload'
  • request.principal.namespace = 'kagent-demo'
  • request.principal.service_account = 'kagent-oke-remediator'
  • request.principal.cluster_id = '<cluster-ocid>'

No OCI config file mount is required for the manifest included here.

Deployment

Apply:

kubectl apply -f k8s/oke-remediator/serviceaccount.yaml
kubectl apply -f k8s/oke-remediator/role.yaml
kubectl apply -f k8s/oke-remediator/rolebinding.yaml
kubectl apply -f k8s/oke-remediator/cronjob.yaml

Run one job immediately for validation:

kubectl create job --from=cronjob/kagent-oke-remediator kagent-oke-remediator-manual -n kagent-demo
kubectl logs job/kagent-oke-remediator-manual -n kagent-demo -f

Notes

• The remediation pipelines must include an approval stage.
• The job triggers the remediation deployment and sends the email with the deployment execution link.
• The job stores the last active incident signature in the kagent-oke-remediator-state ConfigMap to suppress duplicate emails for the same active issue.
• The Python worker uses oci.auth.signers.get_oke_workload_identity_resource_principal_signer() before any fallback signer.