Observe vs investigate: always-on agent vs on-demand CLI

#ai #devops #kubernetes #cli

Same Investigation Graph DNA — different trigger. Laptop investigate is reactive; the optional Observe agent is continuous watch → Incident → gated notify.

Originally published at https://kprompt.ai/blog/observe-vs-investigate.

Operators ask the same question two ways: “why is checkout broken right now?” and “tell me when payments starts misbehaving without me watching.” kprompt answers both — but with different surfaces. Confusing them is how you end up expecting a laptop REPL to page Slack, or an in-cluster watcher to silently apply fixes.

At a glance

Surface	Trigger	Scope	Mutate?	Artifact
CLI `investigate` / `why` / `timeline`	You type a prompt	kubeconfig context(s)	Only after PlanResult approval	Investigation → optional PlanResult
Observe agent	Always-on watch	One namespace (Role)	Never by default	Incident / AgentAlert
Autopilot (opt-in)	Open Incident + allowlist	Same ns agent	Propose-only; apply gated	PlanResult (`Applied` false)

Same graph, different entry

Always-on intelligence is the same gated Investigation Graph as CLI investigate — signal hops → findings → optional PlanResult → approve → apply → verify. It is not a free-form multi-agent fleet. Observe / Namespace Agent runs the continuous edge of that graph; investigate is the on-demand hop you steer from a laptop. Modes table: namespace-agent.

# On-demand RCA (reactive)
kprompt "investigate checkout" -n payments
kprompt "why is api crashing" -n payments
kprompt "timeline for checkout" -n payments

# Always-on Observe (continuous)
kprompt agent run -n payments \
  --analyze --fetch-logs --health --heuristic

# in-cluster: Helm charts/kprompt-agent (namespace Role)

When to install neither, one, or both

Neither — you only need occasional explain/investigate from CI or a laptop; no pager path yet
CLI only — brownfield day-2 mutate + RCA under plan → approve; no daemon required
Observe only — you want Slack/Discord when a namespace degrades, still refuse silent heal
Both — continuous alerts plus human-driven investigate/why when you dig in; Autopilot propose optional

Honest non-claims

Observe is not K8sGPT — analyzer-on-demand vs watch → Incident → gated alert
Observe is not Kagent — one kprompt-native pipeline, not a general multi-agent platform
Default RBAC is a namespace Role (get/list/watch), not ClusterRole god-mode
Memory / patterns bias confidence; they do not prove root cause alone
Coordinator is for cross-ns verification handoff — mutate still default off

Try both paths on kind

git clone https://github.com/kprompt/kprompt-examples.git
cd kprompt-examples
make walkthrough

# afterward, on-demand:
kprompt "investigate checkout" -n payments

Heuristic Observe needs no LLM key. Investigate with a provider when you want richer narration — still read-first; mutations stay behind approval. Pair with alert fatigue gates and the kind demo. Experimental — prefer kind / non-prod first.

Try: kprompt.ai · GitHub · brew install kprompt/tap/kprompt
Muhtalip

DEV Community