CNDN 2026/BERGEN/OCT 26–27/120 MIN
Agentic
Cloud
Ops
Practical AI-Driven Kubernetes Operations
From Infrastructure as Code to Infrastructure as Agents. Two hours turning AI agents loose on a live Kubernetes cluster — and figuring out what it actually takes to dare run them in production.
$ git clone https://github.com/leffen/aco-workshop.git && cd aco-workshop && make install && make setup # ~10 GB · 15 min · do this first
This is a hands-on workshop. You need a laptop with Docker, ~10 GB of free disk and 8 GB of free RAM. Run the setup as soon as you sit down: it is the first thing we do together.
Agentic vs. GitOps
What is genuinely new, and what is just marketing. A pipeline executes a sequence; GitOps converges on a declared state; an agent runs a loop. Knowing which you want is the skill.
Hands-on experience
Deploy, debug and harden a live cluster with an agent holding kubectl — including the part where it gets it wrong and has to work out why.
Risk management
The guardrails that make this safe: namespace-scoped RBAC, tool-layer flags, and a referee that decides what "healthy" means so the agent cannot mark its own homework.
120 minutes
block width = duration · select a blockLab 2 · Security and hardening
Start from a deliberately insecure workload and a namespace-scoped RBAC ladder. Harden to restricted, then prove the guardrail holds by watching the agent get refused.
Is this
for me?
YES, IF
- +you use kubectl regularly
- +you want to watch an agent make real changes to a real cluster
- +you are curious where the limits actually are
- +you are a developer, architect or SRE
PROBABLY NOT, IF
- −you have never seen a Kubernetes manifest
- −you want an overview presentation to sit back for
- −you cannot bring a laptop
- −you expect finished product recommendations
No machine-learning background is needed. None of this is model training.
Prepare your laptop
A cold bootstrap takes about two minutes on a good connection. Start it as soon as you sit down, so it is done before the first lab — it is the only setup we ask of you.
What we actually do
Your first agent
Hand over a task in plain language. Watch it plan, act and verify — then debug a deliberately planted ImagePullBackOff without you touching kubectl.
Lab 2Security and hardening
Harden a deliberately insecure workload to restricted, on a namespace-scoped RBAC ladder. The interesting part is what the agent gets refused.
Lab 3Chaos and recovery
Incident response end to end, demonstrated at the front of the room with you as backseat drivers. We measure the recovery rather than describing it.
The lab pages and take-home notes, open to everyone.
Instructors
Leif Terje Fonnes
@leffenAvdelingsleder Digital Development, Fjord Line
agent · evals · guardrails
Runs Kubernetes more or less everywhere: Azure landing zones at work, a fleet of ships at sea, a rack in the basement, a sailboat in the North Sea, and a single k3s node when that is genuinely all the job needs. The lesson that survives all of them is blast radius — on most, nobody can walk to the machine.
Lars Søraas
@larzzHead of Cloud & Custom Applications, Capgemini
cluster · curriculum · chaos
Works on agent harnesses and OT security for critical infrastructure, on the argument that you rent the model and own the harness. Here he makes it run on thirty-five laptops, then breaks it on purpose to see what comes back without help.