Aegil
English | Русский
An autonomous Site Reliability Engineering (SRE) and DevOps agent for Kubernetes with
deterministic log analysis. The product connects to any cluster and to logging and monitoring
systems, observes state on its own, diagnoses problems from facts and remediates infrastructure
issues, while the operator talks to it through an ordinary natural-language chat. The language
model acts through real tools (cluster commands and node commands), but operates within
deterministic bounds: a command-danger classifier, guards against looping, confirmation for
irreversible actions, and a full audit trail.
The product was carved out as a standalone offering from an audio-processing platform where it
grew (decisions ADR-0032 logging and RCA, ADR-0033 the panel, ADR-0037/0038 the autonomous agent,
ADR-0041 the command executor and node-agent, see docs/adr). The extraction boundary is described
in docs/BOUNDARY.md.
What it does
It observes the cluster (pods, nodes, events), the nodes (disks, processor, memory, processes via
the privileged node-agent), the logs (Loki) and the traces (Tempo, optional). The deterministic
Root Cause Analysis (RCA) pipeline normalizes logs, aggregates facts in a single pass, runs a
catalog of detectors, computes confidence and assembles a verdict with an evidence registry in
which every assertion rests on a verbatim quote from a log line. A lightweight trained SetFit
classifier routes requests and is further trained on the hard cases escalated to the large model
(active learning). Incidents are stored permanently with an explicit lifecycle. The chat agent
understands an arbitrary request, inspects and repairs on its own, and explains every step.
Components
The product is four images plus an optional observability stack.
services/node-agent is a privileged DaemonSet that executes commands on node hosts through
nsenter strictly as an argument list without a shell, is closed off by a token, and is not
published externally. It gives the agent root on the nodes for disk cleanup, process inspection
and memory inspection.
services/agent-panel is a FastAPI panel: the chat interface, the agentic tool-use loop
(agent_exec), the deterministic policy classifier (policy), the anti-looping guards (guards), the
incident center (incidents), the cluster client (k8s), the status summaries (status), an