# Building an AI Agent That Writes and Validates Kubernetes Manifests

DevFeed: [Building an AI Agent That Writes and Validates Kubernetes Manifests](<https://devfeed.tech/articles/building-an-ai-agent-that-writes-and-validates-kubernetes-manifests-99689.md>)

Original publisher: [Read original article](<https://kodekloud.com/blog/ai-agent-writes-validates-kubernetes-manifests/>)

Author: Pramodh Kumar M

Published: 2026-10-25T16:20:00Z

Content type: tutorial

Language: en

Sources: [KodeKloud](<https://devfeed.tech/sources/kubernetes-kodekloud-blog-devops-cloud-kubernetes-ai-tutorials-more.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Learning](<https://devfeed.tech/topics/learning.md>), [rule-engine](<https://devfeed.tech/topics/rule-engine.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [build](<https://devfeed.tech/tags/build.md>), [building](<https://devfeed.tech/tags/building.md>), [cluster](<https://devfeed.tech/tags/cluster.md>), [devops](<https://devfeed.tech/tags/devops.md>), [go](<https://devfeed.tech/tags/go.md>), [golang](<https://devfeed.tech/tags/golang.md>), [kodekey](<https://devfeed.tech/tags/kodekey.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kubernetes-manifests](<https://devfeed.tech/tags/kubernetes-manifests.md>), [llm](<https://devfeed.tech/tags/llm.md>), [models](<https://devfeed.tech/tags/models.md>), [platform-engineering](<https://devfeed.tech/tags/platform-engineering.md>), [rules](<https://devfeed.tech/tags/rules.md>), [yaml](<https://devfeed.tech/tags/yaml.md>)

## AI overview

The tutorial builds a roughly 350-line Go agent that drafts Kubernetes manifests through KodeKey, checks them with `kubectl apply --dry-run=server`, and feeds validation or policy errors back to the model for up to three total attempts. Server-side dry runs validate against the live API server and return defaults without saving objects; unlike client-side checks, they require cluster access and permission to create the objects. Additional Go rules check namespace, replica count, image tags, resource requests and limits, readiness probes, and non-root settings, though they cover Deployments only and skip init containers. Once checks pass, the agent prints the manifest and waits for a person to type `y` before applying it, then watches workload rollout. These checks do not run the application or ensure the chosen image actually runs as non-root, so review remains necessary. The tutorial requires Go 1.26+, `kubectl`, a reachable test cluster, and a KodeKey API key; it recommends limiting credentials and considering Git review for team use.

## Source excerpt

Models write YAML that looks right and is often wrong. Build a small Go agent in four rounds that checks its own manifests against the cluster and your rules, fixes them and waits for your yes.