ControlPlane Enterprise
AI Pack
Bring AI-assisted operations to every Flux cluster, governed by your identity provider and Kubernetes RBAC, with nothing new to run.
Adopt AI without new risk
Engineers get AI assistance on production clusters through your SSO and Kubernetes RBAC. Agents never hold cluster credentials, and every session is limited to the tools a person approves.
Resolve incidents faster
Agents correlate events, logs, and configuration changes across your fleet, taking on-call engineers from alert to root cause in minutes.
Nothing new to operate
The authorization server is built in and the MCP Server runs inside the clusters you already manage, so there is no extra platform to deploy or secure.
one session, end to end
From a failing release to its root cause in one conversation
Sign in with SSO
The agent hands sign-in off to your identity provider.
Grant scopes
The user picks which tools the agent may call in this session.
Query the fleet
The agent lists clusters through the hub, which routes each tool call to the right spoke.
sso and rbac
Governed by the controls you already have
Access is managed in your identity provider. Add people to the groups that make sense and their agents get the Kubernetes RBAC permissions those groups map to, and nothing more.
- Map IdP groups to the Roles and ClusterRoles you already manage
- Agents need no kubeconfig or cluster credentials of their own
built-in authorization server
Connect agents without an identity project
The MCP Server ships with its own authorization server, so agents connect to it directly. There is no external OAuth authorization server to deploy, configure, or keep running.
- Point an agent at the MCP endpoint and it can sign in, with nothing else to deploy
- Works with your identity provider, or with the Dex addon
fine-grained scopes
People stay in charge of their agents
Before an agent can act, the user chooses which tools it may use and whether its session stays alive offline. Least privilege becomes a decision made per session, not a policy document.
- Scopes narrow a session further, and never exceed the user’s RBAC permissions
- Allow a dry-run diff of a change without allowing apply, patch, or delete
multi-cluster
One governed entry point for the whole fleet
Agents connect to a single MCP Server in your hub cluster, which reaches the MCP Servers in every spoke over a secure connection suited to each environment.
- Configure agents once, against the hub
- Agents list the available clusters through the hub and choose where to look
spiffe
Built on open security standards
Both internal and external communication with the MCP Server is protected with SPIFFE, the CNCF standard for workload identity, so it fits a zero-trust architecture.
- Hub and spoke servers authenticate each other over mutual TLS with SPIFFE identities
- The same standard secures traffic reaching the hub from outside the cluster
secure environment comparison
Answer cross-environment questions without widening access
The MCP Server reads each environment from inside the cluster, so your team can compare development, staging, and production without kubectl access to any of them.
- Spot version and configuration drift before a promotion
- Give reviewers the comparison without giving them cluster access
built on the flux mcp server
Troubleshooting and operations tools, included
The AI Pack extends the open source Flux MCP Server, so your agents keep its troubleshooting and operations tools.
Faster incident response
Contextual analysis of failing deployments, with remediation steps the agent can explain.
Root cause analysis
Events, logs, and configuration changes are correlated to find where a failure started.
Pipeline management
Preview a change with a server-side dry-run diff, then reconcile, suspend, or resume Flux resources from the agent.
Visualization
Diagrams of Flux dependencies, resource relationships, and delivery workflows on request.
choosing a server
From one engineer to the whole organisation
Every plan includes the Local MCP Server, a read-only server for individual workstations. The AI Pack is for organisations that want every team on AI-assisted operations, managed centrally under SSO and RBAC.
| Capability | Local MCP Server | AI Pack |
|---|---|---|
| Availability | Included in every plan | Paid add-on |
| Runs on | Developer workstations | Inside your clusters |
| Transport | stdio | HTTPS |
| Authentication | kubeconfig credentials | SSO with the built-in authorization server |
| Permissions | kubeconfig permissions | RBAC from SSO groups, narrowed by scopes |
| Multi-cluster | Switch kubeconfig contexts | Hub and spoke, with cluster listing |
| Workload identity | None | SPIFFE, over mutual TLS |
| Cluster changes | Not available | Dry-run diff, apply, patch, and reconcile, within RBAC and scopes |
Put AI to work on your Flux fleet
The AI Pack is available on top of any ControlPlane Enterprise for Flux CD plan. Its hardened images are covered by ControlPlane's CVE remediation SLA, FIPS-compliant, and built with SLSA Build Level 3 provenance.