Operations | Monitoring | ITSM | DevOps | Cloud

Moving the agent off your machine and pointing it at real clusters — read-only, in shadow mode — then climbing a trust ladder toward carefully scoped action. This is the second article in a three-part series on taking an AI SRE agent from a weekend experiment to enterprise production. Part 1 built a local agent on a throwaway cluster: read-only, propose-only, refined against a small eval set, with portable skills and no production write access.

Picture the scene: you’ve just deployed a rolling update to your service. Half of your pods are running the new version, they all passed their readiness checks, and Kubernetes terminated the old replicas. Suddenly, the new pods start throwing 503 errors. Thankfully, you still have pods on the old version, so you stop the update. If the rollout had been a little bit faster, you’d have an outage. This is the failure mode minReadySeconds exists to prevent.

As businesses evolve in today’s digital landscape, the need for efficient and scalable computing resources has become paramount. In the early days of the Internet, large corporations would build or rent out large data centers to run their applications and serve customers. This was great as they could use dedicated hardware and expand as they pleased.

How long would it take you to get one new line of code into the container running your payment service? In a lot of organizations, the answer runs to weeks, because the change has to clear a build owner, a test cycle, and a release window that nobody wants to open early. That timeline is why so much monitoring advice fails on contact. Most of it opens by telling you to add a library, rebuild the image, and push a new version. If you could do that this afternoon, you would have done it already.

How many containers are running in your production environment right now that nobody can see inside? A vendored service, a compiled binary, an application whose build pipeline left with the developer who wrote it: each one runs, serves traffic, and reports nothing. Instrumenting those workloads means a code change, a rebuild, and a redeploy, and on these containers none of the three are available.

Modern enterprises rely heavily on Kubernetes to orchestrate containerized applications at scale. However, as Kubernetes environments grow in complexity, maintaining visibility into application performance, cluster health, and infrastructure dependencies becomes increasingly challenging. Choosing the right Kubernetes monitoring tools is essential for ensuring application availability, optimizing resources, and delivering consistent user experiences.

The compliance question isn't "are we using a private cloud?" Rather, it’s "does our private cloud actually do what compliance requires?" Private cloud has a reputation for solving compliance problems that it doesn't always deserve. The logic seems straightforward: keep data off shared public infrastructure, maintain more direct control, and satisfy the auditors.

The 14 Cloud Security Principles from the UK's National Cyber Security Centre form the primary framework for UK public sector cloud procurement and, increasingly, for private sector regulated workloads. Any credible cloud security case in the UK context has to address these principles explicitly. For organizations placing workloads on sovereign cloud specifically, the mapping matters more than for general cloud procurement.

Healthcare data sits at the top of the sensitivity hierarchy. Patient records are personal data under UK GDPR. Medical records are separately regulated under sector-specific frameworks. Clinical research data may be subject to research-specific rules. Genomics data carries residency implications that go beyond standard personal data protections. NHS data specifically is governed by frameworks that add UK public sector expectations on top of the healthcare-specific ones.