Autonomous Kubernetes Security with MCP and AI Agents
This project focuses on Kubernetes security operations connected to a continuous-integration pipeline. Participants build three structured agents — pipeline scan ingestion, vulnerability prioritization, YAML remediation — tied to a small local GitLab inside the sandbox, then a fourth completely freehand agent of their own design. The freehand lab is the hackathon-vibe finisher the customer asked for.
.svg){kind=small}
About The Lab
Prerequisites
Audiences
Lab Architecture
The project architecture seamlessly integrates a GitLab CI/CD pipeline, AI agents, and Kubernetes orchestration to create a comprehensive environment for automated vulnerability remediation, which includes a Trivy-powered scan stage, an MCP GitLab integration for repository automation, and a three-agent workflow (Ingestion, Prioritization, Remediation) powered by Claude Haiku 3.5 with GPT-5.2 escalation that allow the user to test different end-to-end DevSecOps use cases — from scanning Kubernetes manifests and prioritizing findings to generating safe YAML patches, gating changes through human-approved merge requests, and deploying hardened workloads to the target cluster — all governed by RBAC, OPA/Kyverno policies, audit logs, and secrets management.
Why this Lab ?
This project focuses on Kubernetes security operations connected to a continuous-integration pipeline. Participants build three structured agents -- pipeline scan ingestion, vulnerability prioritization, YAML remediation -- tied to a small local GitLab inside the sandbox, then a fourth completely freehand agent of their own design. The freehand lab is the hackathon-vibe finisher the customer asked for.
Lab Objectives
- Build three cooperating cloud-security agents tied to a local GitLab CICD pipeline, then a fourth freehand agent.
- Keep low-cost defaults in place while still using GPT-5.2 for high-risk or ambiguous remediation reasoning.
- Use MCP-backed cluster context, ownership data, and ticket state to keep outputs grounded in operational reality.
- Make at least one agent react continuously to pipeline runs rather than waiting for a person to paste scan output.
- Finish with one freehand agent the learner would actually want in their day job.
