OPEN SOURCE · V0.7.0 · APACHE-2.0
Deploy, manage and orchestrate AI agents on Kubernetes. KAOS turns agents, models, tools and memory into declarative Kubernetes resources, reconciled by an operator, secured at the gateway and observable end to end. "Managing the chaos in your agentic systems."
01 — FROM ZERO TO A RUNNING AGENT
An agent is a resource, not a script. Install the system, deploy a model API and an agent, and talk to it; every agent exposes an OpenAI-compatible /v1/chat/completions endpoint, so existing clients work unchanged.
pip install kaos-clikaos system installkaos modelapi deploy my-api --mode Hosted --model "smollm2:135m"kaos agent deploy my-agent --modelapi my-api --model "smollm2:135m"kaos agent invoke my-agent --message "Hello"kaos ui02 — THE CONTROL PLANE
Five custom resources define an agent system: Agent (the running agent, its model, tools, peers and memory binding), ModelAPI (LLM access, proxied via LiteLLM or hosted in-cluster with Ollama), MCPServer (tool servers speaking the Model Context Protocol), MemoryStore (the central memory service agents bind to) and AccessGrant (who may reach what). Four controllers reconcile them into pods, services and policy. Agents delegate through the A2A protocol: discovery via /.well-known/agent.json, sub-agents exposed to the model as tools, and “hierarchical agent systems with automatic delegation”.
Select a resource node
SELECT A RESOURCE
KIND · Agent
A Kubernetes resource for a running agent and its model, tools, peers and memory binding.
Use it when you want one deployable agent endpoint with its dependencies declared together.
kaos agent deploy my-agent --modelapi my-api --model "smollm2:135m"
KIND · ModelAPI
The LLM access layer, either proxied through LiteLLM or hosted in-cluster with Ollama.
Use it to give agents a named model endpoint without coupling them to provider infrastructure.
kaos modelapi deploy my-api --mode Hosted --model "smollm2:135m"
KIND · MCPServer
A deployable tool server that speaks the Model Context Protocol.
Use it to make tools available to agents as a declared, operator-managed dependency.
kind: MCPServer
spec:
runtime: python-string
KIND · MemoryStore
A central memory service that agents can bind to for durable recall across sessions.
Use it when an agent needs shared, scoped memory beyond its local conversation window.
kaos memorystore create support-memory --modelapi support-modelapi
KIND · AccessGrant
A declarative binding between a user, group or agent and the resources it may reach.
Use it to make entry and internal movement explicit when authorization is enabled.
kaos auth grant create --group researchers --resource agent/researcher
03 — MEMORY THAT SURVIVES THE SESSION
“Memory is augmentation, not a hard dependency.” A MemoryStore runs one central memory service per store, with Mem0 embedded as a library rather than a separate server. Short-term memory keeps the recent conversation window in relational rows; an optional rolling summary preserves narrative continuity; long-term memory holds semantic facts in a vector store, recalled by relevance across sessions.
Scopes make memory multi-tenant: reads select session, agent, user or store scope, and “scope is derived server-side from the authenticated agent identity”, never from model arguments. When a store fails, the agent keeps serving short-term-only and surfaces a MemoryDegraded condition instead of going down.
“Remember that the risk review is every Friday.”write(turn)
3,842 / 4,000 tokens
Risk review cadence and owners agreed…
Risk review starts at 15:00
Risk review starts at 15:30
EXTRACTED · 0.87DEDUPED · CORRECTEDSession 42 covers the Q3 risk register
RECALL · 0.91New turn leaves the agent pod
STORAGELOCAL: Chroma + SQLite on one volume · EXTERNAL: pgvector + Postgres, 2 replicas
04 — SECURED AT THE GATEWAY
Security is off until you turn it on, and fail-closed once you do: protected routes pass Envoy Gateway, which verifies JWTs and consults an OPA policy decision point; “an unavailable PDP never permits a request”. Identity is two-plane: the subject (a Keycloak user, or the agent itself when autonomous) and the acting agent, verified on every hop. Agent identity comes from per-agent ServiceAccounts with short-lived projected tokens, an identity broker, or per-agent OAuth clients registered dynamically.
Authorization is declarative: AccessGrant resources bind users, groups and agents to the resources they may enter, and the operator projects them into policy. Memory enforces the same identities, so one user’s recall can never serve another’s session.
05 — WATCH IT WORK
The dashboard covers the operational loop: monitor agents, chat with them live, inspect memory sessions and events, debug MCP tools with real calls, and stream pod logs. Agents ship OpenTelemetry instrumentation, so traces land in your existing observability stack.
06 — PROJECT METRICS & LINKS