AI automation
AI agents for cloud operations
Self-hosted AI agents took over the routines that used to sit with a person: provider action-required notices, cost anomalies, and dependency upgrades. They work on read-only credentials and open pull requests. A person makes the decision.
Client
A team on GCP. Provider action-required notices, cost anomalies, and dependency upgrades were all investigated by hand.
Stack
- GKE Autopilot
- Claude
- GitHub
- Dependabot
- Jenkins
- gcloud
- Gateway API
Situation
A person owned every routine. An action-required item started as a Jira ticket: was the service or API enabled, what did the metrics and logs say, what did GitHub show, and was it even ours. Then, was the answer a code change, a configuration change, or migration planning. The ticket and the write-up happened even when nothing needed to change. Cost anomalies were spotted the same way, by someone looking. A Dependabot alert said a package had a new version. It did not say whether that version broke the code.
What we did
Claude-based agents, orchestrated on GKE Autopilot, run the routines and stop before a decision. They can read, they cannot push to master, and their cloud credentials cannot change a resource.
1.The routines
For an action-required notice, the agent checks whether the service or API is enabled, reads metrics and logs, looks at GitHub, and says whether the answer is a code change, a configuration change, or migration planning. It also flags cost anomalies. For Dependabot, it does not stop at the alert: it checks whether the new package version breaks the build. A person is called when a decision has to be made.
2.Jobs on GKE Autopilot
An orchestrator starts each agent as a job, with an idle limit and a TTL. Autopilot bills only while the job exists. When the job ends, the runner is gone.
3.Guardrails
On GitHub the runner cannot push to master: it opens a pull request. gcloud is limited to read operations, so it cannot stop or delete a resource. Secrets are injected by runner type.
4.Checking what an agent built
Each runner adds the tools the vendor image lacks. When a person needs to check what an agent just built, Gateway API exposes the runner on a port they can open.
What changed
- Engineers step in only when there is a decision to make
- Action-required notices are investigated, including the many that need no change
- Cost anomalies are raised without anyone watching a dashboard
- Dependency upgrades arrive already tested against the build
- Every change still comes back as a pull request, and cloud credentials stay read-only
Related service: Platform engineering