CNCF argues agents should propose system state, not receive production root
A CNCF Ambassador argues that agents should express changes as versioned system state and pass them through review, build and deployment controls instead of receiving unrestricted production root.
For a Kubernetes configuration change, let an agent propose a source-controlled manifest. Run validation and tests before the existing deployment process consumes it. Keep approval, signing and rollout permissions outside the proposing agent. Plan a rollback and record the resulting artifact. Isolation and immutable images are useful controls, but neither alone guarantees safety when a workload can still reach sensitive resources.
Interview question
What control boundary does the CNCF post recommend for production agents?
- a.Give agents unrestricted root and rely on instructions
- b.Let agents propose versioned state that passes the software factoryCorrect
- c.Disable source control during incidents
- d.Apply all changes directly to the host at runtime
Why? this is the answer
The post recommends expressing changes as versioned desired state and using review, build and deployment controls to produce the running artifact.
Just read this? Test yourself on what you have been reading.
Read the original → cncf.io
- #kubernetes
- #agent-security
- #immutable-infrastructure
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on kubernetes — each one lists the topics its interview covers.
See open roles