# The k8gentic manifesto > Why we build simple-not-easy infrastructure for agents: the k8gentic philosophy behind Paddington and Kilter, and the six pillars a platform needs to be agent-native. Source: https://paddington.io/k8gentic The k8gentic manifesto # Kubernetes + Agentic Kubernetes is the right substrate for agentic applications: the only platform with the isolation, orchestration, and operational maturity autonomous agents demand. Go k8gentic, or keep shipping failed POCs on legacy platforms. The three layers ## Every agentic application is built on these. Most teams stop at raw model APIs and hope for the best, or end up implementing a broken, partial solution in JavaScript in the experience layer. Layer 3 · closest to humans ### The Experience Layer Where humans and agents collaborate: structured UI, service discovery, and polyglot composition, not fragile prompt chains. SDUI Contracts Service Discovery Polyglot Module Federation Layer 2 · systems engineering ### Safety & Performance Guardrails for autonomous agents: isolation, access control, quotas, and tracing so you can see and contain what an agent did. Network Policies RBAC Quotas Tracing Harnesses Controls KPIs Layer 1 · foundation ### (Agentic) Infrastructure Durable, long-running workflows with events and persistent state on Kubernetes, not a Lambda and a prayer. Real infrastructure hardened over a decade of k8s learnings and trillions of operations. Temporal Redpanda NATS OpenTelemetry Enterprise-ready by default ## The same stack runs locally and in production. No parity gaps. #### RBAC & Policies Fine-grained access control and network segmentation from day one. #### Full Observability Distributed tracing, metrics, and structured logs across every service. #### Zero Parity Gap Develop on real Kubernetes locally, deploy to production Kubernetes. Promise ## The Kilter promise. #### Sovereign You own the stack. No vendor lock-in. Your cloud, your cluster, your terms. #### Fast 2 to 4× faster development with pre-composed services. Two minutes to a production stack. #### High Leverage Full agentic infrastructure (workflows, events, auth, observability), not just compute. The six pillars ## Why k8gentic is the right path. All ### Every language The platform boundary is the container image and the manifest, not an SDK you have to live inside. If it builds, it runs, with the same auth, routing, secrets, and observability as everything else on the cluster. - Node, Python, Go, Rust, Java, .NET, and any mix of them in one app. A TypeScript frontend, a Go API, and a Python worker is the reference pattern, each as its own component. - No buildpack lottery. Your Dockerfile is the contract; kilter generates one when you don't care and stays out of the way when you do. - Polyglot doesn't fragment operations: one deploy, one log stream, one trace view across every language in the app. Real ### True orchestration kilter.yaml names the services your app needs (postgres, temporal, kafka, ory) and the platform composes them: provisioned, wired, and reconciled as one system. No glue scripts, no webhook chains, no README of manual steps. - 42 curated catalog services compose declaratively: databases, queues, identity, observability, even LLM gateways. - Wiring is synthesized, not copy-pasted: connection strings, credentials, and DNS are injected into exactly the workloads that need them. - Reconcilers own desired state. Drift heals itself, and a deploy is a reviewed diff, not a fragile script run. Secure ### Secure by default Every app lands behind real identity, encrypted secrets, and isolated networking from its first deploy. The hardened posture is the starting point, not a retrofit scheduled for after the Series B. - A full Ory stack (Kratos, Oathkeeper, Keto) wired to your app with one command: sessions, SSO, and permissions you didn't hand-roll. - Secrets are SOPS-encrypted in git and materialized only in-cluster; nothing sensitive rides in plain text. - Per-app namespaces, least-privilege service accounts, and TLS everywhere: the blast radius is drawn before the first request arrives. Compliant ### Best-in-class compliance Controls live in infrastructure you can show an auditor (network policy, RBAC, immutable audit, isolation) instead of application code that quietly rots. The compliance surface is declarative: reviewable in a PR, provable in an audit. - Isolation as architecture: namespaces, NetworkPolicy, and RBAC drawn per app and per tenant. - Audit as a primitive: append-only trails and full human→agent provenance chains, enforced by the engine, not by team discipline. - Proven in practice: a HIPAA-aligned publishing platform built in 45 minutes, with every technical safeguard living in infrastructure. Proven ### Built on what the Fortune 500 runs The trust isn't ours to claim; it's inherited. Kilter composes the exact primitives that already run the world's largest enterprises: Kubernetes, Postgres, Temporal, Kafka, Ory, Flux. We add the composition, not a proprietary runtime. - Canonical, CNCF-grade components at every layer: nothing bespoke sits between your app and the substrate. - The same manifests run a KIND cluster on a laptop and an enterprise production cluster. Parity is structural, not aspirational. - No trap doors: kilter eject hands you the standard manifests. If we disappeared tomorrow, your stack wouldn't. Agent-native ### Drive it with your agent The entire platform is a text-addressable surface: a CLI with structured output, declarative manifests, reconcilers that verify. Your agent doesn't get a dumbed-down wrapper; it operates the real thing, read-edit-verify, at machine speed. - Provisioning, deploys, and ops as conversations: kilter up, kilter deploy, kilter logs are designed for agent operation as much as human hands. - Development happens against the deployment and runtime infrastructure, so what your agent verifies locally is what production runs. - Agents act as governed principals (attributed, audited, and bounded), never as an unaccountable automation backdoor. Closed beta · 14-day trial ## Fourteen days. Real Kubernetes. Your keys. Request beta access, deploy an app in your first five minutes, and see the whole platform before you pay a dollar. [Request beta access](/signup)