Skip to main content
Domain Agents›Kubernetes Agent›Operators & Subagents

Operators and subagents

TalkOps Kubernetes Agent (k8s-autopilot) uses a hierarchical multi-agent architecture built on LangGraph. Rather than binding 200+ infrastructure tools to a single monolithic prompt, a central Supervisor classifies each request and delegates execution to one of four domain Operators (or dynamic plugin subagents).

Every operator follows a strict five-stage execution lifecycle for state-changing operations:

Discover → Plan → Confirm (HITL) → Execute → Verify

Operator summary​

OperatorDomainConnected MCP serversBundled skills
Helm OperatorChart discovery, dry-run validation, install, upgrade, rollback, chart scaffoldinghelm-mcp-server (22 tools), github-mcp-server (12 tools)helm-operation
App OperatorArgoCD GitOps sync, Argo Rollouts canary/blue-green delivery, Traefik edge routingargocd-mcp-server (29), argo-rollout-mcp-server (18), traefik-mcp-server (11)argocd-gitops, argo-rollout-gitops, traefik-edge-routing
K8s OperatorWorkload CRUD, CrashLoopBackOff triage, pod logs/exec, scaling, events, RBACkubernetes-mcp-server (32 tools)kubernetes-cluster-ops
Observability OperatorPromQL metrics, Alertmanager silences, OpenTelemetry collectors, LogQL, TraceQLprometheus (28), alertmanager (14), opentelemetry (19), loki (9), tempo (16)prometheus, alertmanager, opentelemetry, loki, tempo

Built-in operators​

Helm Operator​

Manages the full lifecycle of Helm releases on your cluster, plus new chart scaffolding and GitHub PR creation.

  • Connected MCP servers: helm-mcp-server (22 tools) and github-mcp-server (12 tools)
  • Bundled skill: helm-operation
  • Example prompts:
    • "Search Bitnami for PostgreSQL charts and show supported values"
    • "Install redis in the cache namespace with 3 replicas"
    • "Rollback the payments-api release to the previous revision"
  • Domain guardrails:
    • Always runs a dry-run before installing a new release.
    • Checks whether a release already exists and automatically switches to an upgrade plan if present.
    • Preserves existing configuration on upgrades (--reuse-values by default) and validates values against the chart's JSON schema.
    • Queries actual release history before rolling back rather than guessing revision numbers.

App Operator​

Coordinates GitOps application lifecycle, progressive delivery rollouts, and ingress traffic routing across ArgoCD, Argo Rollouts, and Traefik.

  • Connected MCP servers: argocd-mcp-server (29 tools), argo-rollout-mcp-server (18 tools), traefik-mcp-server (11 tools)
  • Bundled skills: argocd-gitops, argo-rollout-gitops, traefik-edge-routing
  • Example prompts:
    • "Check if any ArgoCD applications are OutOfSync or Degraded"
    • "Promote the checkout-service canary rollout to 50% traffic weight"
    • "Split traffic 90/10 between api-v1 and api-v2 using a Traefik IngressRoute"
  • Domain guardrails:
    • Caps autonomous canary promotion at 50% traffic weight; higher weights require explicit human confirmation.
    • Generates Traefik route manifests in preview mode first and verifies that target Kubernetes Service backends exist before applying.
    • Never zeroes out all backend weights and requires approval before creating TCP routes.

K8s Operator​

Handles direct Kubernetes API operations including pod diagnostics, workload scaling, manifest application, event inspection, and multi-cluster context switching.

  • Connected MCP server: kubernetes-mcp-server (32 tools)
  • Bundled skill: kubernetes-cluster-ops
  • Example prompts:
    • "Why are pods in the payments namespace in CrashLoopBackOff?"
    • "Scale the worker deployment in staging to 6 replicas"
    • "Show warning events across the production namespace from the last 30 minutes"
  • Domain guardrails:
    • Applies elevated risk classification to prod, production, and kube-system namespaces.
    • Inspects live resource state before proposing any patch or scale operation.
    • Redacts Secret data values in all chat output (exposing key names only).
    • Requires explicit confirmation of pod name, namespace, and command before running kubectl exec.

Observability Operator​

Correlates telemetry across metrics, alerts, logs, traces, and instrumentation pipelines using five specialized MCP servers.

  • Connected MCP servers: prometheus-mcp-server (28 tools), alertmanager-mcp-server (14 tools), opentelemetry-mcp-server (19 tools), loki-mcp-server (9 tools), tempo-mcp-server (16 tools)
  • Bundled skills: prometheus, alertmanager, opentelemetry, loki, tempo
  • Example prompts:
    • "Why is checkout latency spiking? Correlate Prometheus p99 metrics, Tempo traces, and Loki error logs."
    • "What alerts are firing right now in Alertmanager?"
    • "Mute warning alerts for service=billing-worker for 2 hours"
    • "Auto-instrument the orders deployment with OpenTelemetry"
  • Domain guardrails:
    • Previews matching alerts before creating Alertmanager silences and caps silence duration at 24 hours.
    • Executes OpenTelemetry Collector and Tempo CRD changes with dry_run=true first.
    • Enforces rate() or increase() on PromQL counter metrics and keeps Loki strictly read-only.

Just-In-Time (JIT) MCP lifecycle​

Each operator connects to its MCP servers Just-In-Time (JIT):

  1. When the Supervisor delegates a task to an operator, the CompiledSubAgent wrapper initializes only that operator's MCP servers.
  2. The operator executes its domain workflow using those scoped tools.
  3. As soon as the operator completes its turn, the MCP connections close cleanly.

This architecture keeps memory and subprocess overhead low while preventing cross-domain tool hallucination.

Cross-operator handoffs​

When an investigation starts in one domain and uncovers a root cause in another, the active operator returns a structured handoff to the Supervisor:

  1. You ask: "Why is checkout timing out?"
  2. Observability Operator queries Prometheus and Tempo, identifying a 5xx spike and high latency on checkout-service.
  3. It hands back to the Supervisor with its telemetry findings attached.
  4. Supervisor routes to the K8s Operator with the full telemetry context preserved.
  5. K8s Operator inspects the checkout-service pods, identifies OOMKilled container exits, and proposes a memory limit patch.

Operator directory structure​

Built-in operators live under built_in_subagents/ and follow the same layout as Agent Plugins:

built_in_subagents/{operator-name}/
├── .mcp.json                 # Scoped MCP servers for this operator
├── agents/
│   └── {operator}.md         # Operator system prompt and safety rules
└── skills/
    └── {skill-name}/
        ├── SKILL.md          # Step-by-step operational playbook
        └── references/
            └── workflows.md  # Domain edge cases and query patterns
On this page