THE K8GENTIC MANIFESTO

Kubernetes + Agentic

Kubernetes is the right substrate for agentic applications — the only platform with the isolation, orchestration, and operational maturity autonomous agents demand. Go k8gentic, or keep shipping failed POCs on legacy platforms.

The three layers

Every agentic application is built on these. Most teams stop at raw model APIs and hope for the best, or end up implementing a broken, partial solution in JavaScript in the experience layer.

Humans

Foundation

LAYER 3 · CLOSEST TO HUMANS

The Experience Layer

Where humans and agents collaborate — structured UI, service discovery, and polyglot composition, not fragile prompt chains.

SDUI ContractsService DiscoveryPolyglotModule Federation

LAYER 2 · SYSTEMS ENGINEERING

Safety & Performance

Guardrails for autonomous agents — isolation, access control, quotas, and tracing so you can see and contain what an agent did.

Network PoliciesRBACQuotasTracingHarnessesControlsKPIs

LAYER 1 · FOUNDATION

(Agentic) Infrastructure

Durable, long-running workflows with events and persistent state on Kubernetes, not a Lambda and a prayer. Real infrastructure hardened over a decade of k8s learnings and trillions of operations.

TemporalRedpandaNATSOpenTelemetry

Enterprise-ready by default

The same stack runs locally and in production. No parity gaps.

RBAC & Policies

Fine-grained access control and network segmentation from day one.

Full Observability

Distributed tracing, metrics, and structured logs across every service.

Zero Parity Gap

Develop on real Kubernetes locally, deploy to production Kubernetes.

The Kilter Promise

Sovereign

You own the stack. No vendor lock-in. Your cloud, your cluster, your terms.

Fast

2–4× faster development with pre-composed services. Two minutes to a production stack.

High Leverage

Full agentic infrastructure — workflows, events, auth, observability — not just compute.

The Six Pillars

Why k8gentic is the right path.

ALL

Every language

The platform boundary is the container image and the manifest — not an SDK you have to live inside. If it builds, it runs, with the same auth, routing, secrets, and observability as everything else on the cluster.

Node, Python, Go, Rust, Java, .NET — and any mix of them in one app. A TypeScript frontend, a Go API, and a Python worker is the reference pattern, each as its own component.
No buildpack lottery. Your Dockerfile is the contract; kilter generates one when you don't care and stays out of the way when you do.
Polyglot doesn't fragment operations: one deploy, one log stream, one trace view across every language in the app.

REAL

True orchestration

kilter.yaml names the services your app needs — postgres, temporal, kafka, ory — and the platform composes them: provisioned, wired, and reconciled as one system. No glue scripts, no webhook chains, no README of manual steps.

37+ curated catalog services compose declaratively — databases, queues, identity, observability, even LLM gateways.
Wiring is synthesized, not copy-pasted: connection strings, credentials, and DNS are injected into exactly the workloads that need them.
Reconcilers own desired state. Drift heals itself, and a deploy is a reviewed diff — not a fragile script run.

SECURE

Secure by default

Every app lands behind real identity, encrypted secrets, and isolated networking from its first deploy. The hardened posture is the starting point — not a retrofit scheduled for after the Series B.

A full Ory stack (Kratos, Oathkeeper, Keto) wired to your app with one command — sessions, SSO, and permissions you didn't hand-roll.
Secrets are SOPS-encrypted in git and materialized only in-cluster; nothing sensitive rides in plain text.
Per-app namespaces, least-privilege service accounts, and TLS everywhere — the blast radius is drawn before the first request arrives.

COMPLIANT

Best-in-class compliance

Controls live in infrastructure you can show an auditor — network policy, RBAC, immutable audit, isolation — instead of application code that quietly rots. The compliance surface is declarative: reviewable in a PR, provable in an audit.

Isolation as architecture: namespaces, NetworkPolicy, and RBAC drawn per app and per tenant.
Audit as a primitive: append-only trails and full human→agent provenance chains, enforced by the engine — not by team discipline.
Proven in practice: a HIPAA-aligned publishing platform built in 45 minutes, with every technical safeguard living in infrastructure.

PROVEN

Built on what the Fortune 500 runs

The trust isn't ours to claim — it's inherited. Kilter composes the exact primitives that already run the world's largest enterprises: Kubernetes, Postgres, Temporal, Kafka, Ory, Flux. We add the composition, not a proprietary runtime.

Canonical, CNCF-grade components at every layer — nothing bespoke sits between your app and the substrate.
The same manifests run a KIND cluster on a laptop and an enterprise production cluster. Parity is structural, not aspirational.
No trap doors: kilter eject hands you the standard manifests. If we disappeared tomorrow, your stack wouldn't.

AGENT-NATIVE

Drive it with your agent

The entire platform is a text-addressable surface: a CLI with structured output, declarative manifests, reconcilers that verify. Your agent doesn't get a dumbed-down wrapper — it operates the real thing, read-edit-verify, at machine speed.

Provisioning, deploys, and ops as conversations: kilter up, kilter deploy, kilter logs are designed for agent operation as much as human hands.
Development happens against the deployment and runtime infrastructure, so what your agent verifies locally is what production runs.
Agents act as governed principals — attributed, audited, and bounded — never as an unaccountable automation backdoor.