Cloud & platform · fleet.k8sCI passing

Enterprise Kubernetes Management

Fleet management for Kubernetes: policies that read manifests the way the API server does, proven fixes, rightsizing and upgrade blockers.

Open the live demo View the code Evaluation report Demo tour Run it ›_ last push 2 days ago

1.00 vs 0.34policy F1 on manifest forms written after freezing (searching the YAML text)

0 vs 92OOM-killed workloads of 200 bursty ones (average x 1.2 rule)

40%of today's CPU requests, with workloads above request 0.1% of the time

A workload: violations fixed automatically or needing a decision, CPU use against today's and the recommended request, the manifest before and after. Screenshot from the project's demo (synthetic data).

demo Demo tour

Screenshots from the running application, with its synthetic demo data. Select one to enlarge.

A workload: which violations were fixed automatically and which need a decision, CPU use against today's and the recommended request, and the manifest before and after.

The fleet: three clusters, violations by severity, requests now and recommended, and upgrade blockers.

Upgrade blockers per cluster along the one-minor-at-a-time upgrade path, with the replacement API.

Policies on three manifest banks against text search, and rightsizing on held-out and held-back workloads.

01 The problem

Teams running several clusters ship manifests nobody checks properly (text-matching linters miss violations in CronJobs and init containers, and flag safe settings), request two to four times the CPU they use, and find out about removed APIs when an upgrade breaks production.

02 How it works

Manifests
Parse and unwrap pod specs
Policies
Verified fixes
Usage history to requests
Upgrade blockers

03 What I built

An admission policy engine on parsed objects: every workload kind unwrapped to its pod spec, init and ephemeral containers, pod-to-container security inheritance, image digests and registry ports, multi-document YAML, anchors and JSON.
Fixes accepted only after the engine checks the result again: automatic for the safe rules, and Claude-proposed JSON Patches limited to allowed fields for the rest.
Rightsizing from usage history judged on the following two weeks, memory set from the peak plus trend with request = limit, and upgrade blockers for APIs removed between a cluster's version and its target.

04 What I learned

Text search flagged 'ALL' in capabilities.drop as dangerous and asked CronJobs for probes; reading objects the way the API server does removed both kinds of mistake.

The held-back run showed all out-of-memory kills came from batch bursts: the simulated leak was too slow, so leak handling is shown by a unit test and the gap is documented rather than retuned.

05 Known limitations

Every repository documents what it doesn't do yet. The main ones:

No live cluster connection; manifests and usage are generated.
Batch bursts are throttled 1.2% of the time under the recommended limits.

06 Stack

PythonKubernetesPyYAMLNumPyClaude APIFastAPI

The repository has the design document, operations runbook, full evaluation report and known limitations. All data is synthetic, generated by code in the repository.

run Run it yourself

Every project runs on a laptop: no cloud account and no paid API needed.

git clone https://github.com/codeROCK-IZZY/kubernetes-management-platform.git
cd kubernetes-management-platform
pip install -e ".[dev]" && pytest
kubefleet evaluate --gate                  # writes eval/reports/report.html