--- title: How to Run AI Agents on Kubernetes with Pulumi | daily.dev description: Running AI agents on Kubernetes requires more deliberate infrastructure design than typical web services due to GPU scheduling, long-lived sessions, broad... canonical: https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Run AI Agents on Kubernetes with Pulumi | daily.dev og:description: Running AI agents on Kubernetes requires more deliberate infrastructure design than typical web services due to GPU scheduling, long-lived sessions, broad... og:url: https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis og:image: https://api.daily.dev/og/posts/13bCDkqis.png og:image:alt: How to Run AI Agents on Kubernetes with Pulumi og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Run AI Agents on Kubernetes with Pulumi **[Pulumi](https://daily.dev/sources/pulumi)** · 13 min read · 0 upvotes · 0 comments ## Summary Running AI agents on Kubernetes requires more deliberate infrastructure design than typical web services due to GPU scheduling, long-lived sessions, broad credential surfaces, and complex RBAC needs. The post surveys the 2026 agentic Kubernetes ecosystem (kagent, KServe, Kueue, KubeRay, NVIDIA GPU Operator) and shows how to provision a GPU-enabled EKS cluster, install kagent via Helm, manage model provider secrets with Pulumi ESC, and declare agents as versioned custom resources — all in both TypeScript and Python. It argues for general-purpose languages over templated YAML for composing, testing, and governing agent infrastructure, and explains how Pulumi Policies enforce least-privilege and cost guardrails. Pulumi Neo is positioned as an infrastructure-layer agent that proposes and reviews changes to the cluster itself, operating above workload-level agent frameworks like kagent. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Do I need GPUs to run AI agents on Kubernetes? Not always. An agent that only calls a hosted model API like OpenAI or Anthropic needs just CPU nodes to run its own logic and tool calls, since the GPU-heavy inference happens on the provider's infrastructure. GPUs become necessary once you self-host inference, for example running an open-weight model via vLLM, KServe, or Ray Serve, where tools like Kueue and Dynamic Resource Allocation come into play. _daily.dev surfaces infrastructure guidance for developers sizing GPU versus CPU nodes for agent workloads._ ### How is kagent different from running an AI agent as a plain Kubernetes Deployment? A plain Deployment only gives you a running process, with no standard way to describe an agent's model configuration, tool access, or MCP server connections as first-class objects. kagent adds custom resources - Agent, ModelConfig, ModelProviderConfig, RemoteMCPServer, and SandboxAgent (as of v0.9.9) - making those concepts declarative so policy engines, reviewers, or automation can reason about them like any other Kubernetes object. _developers comparing agent runtime options on kubernetes can track projects like kagent on daily.dev._ ### How should I store model provider API keys when deploying AI agents on Kubernetes? Model provider API keys should be sourced from a secrets manager like Pulumi ESC rather than stored as plaintext Kubernetes Secret manifests. In practice this means declaring the ESC environment in the stack's Pulumi..yaml and pulling the key via config.requireSecret, so the credential is centrally managed, rotated, and scoped instead of copy-pasted across clusters. _teams securing agent credentials across clusters follow infrastructure security practices like this on daily.dev._ ## Similar posts on daily.dev - [Beyond YAML in Kubernetes: The 2026 Automation Era](https://daily.dev/posts/beyond-yaml-in-kubernetes-the-2026-automation-era-0a0hgzsbj) · Pulumi · 5 upvotes · 0 comments - [Kubernetes isn’t new, but AI makes It scary again](https://daily.dev/posts/kubernetes-isn-t-new-but-ai-makes-it-scary-again-lc0yssr8w) · CNCF · 0 upvotes · 0 comments - [Disrupting the presentation layer using autonomous workflows](https://daily.dev/posts/disrupting-the-presentation-layer-using-autonomous-workflows-39mmuoyi0) · Google Open Source Blog · 10 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#ai-agents](https://daily.dev/tags/ai-agents), [#iac](https://daily.dev/tags/iac), [#pulumi](https://daily.dev/tags/pulumi) [View this post on daily.dev](https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Run AI Agents on Kubernetes with Pulumi","url":"https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis"},"datePublished":"2026-07-30T02:05:17.047Z","dateModified":"2026-09-14T07:16:39.618Z","description":"Running AI agents on Kubernetes requires more deliberate infrastructure design than typical web services due to GPU scheduling, long-lived sessions, broad...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c042e1e0bd0ef701af829e14382e6ad?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c042e1e0bd0ef701af829e14382e6ad?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Pulumi","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Pulumi","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/9792c211dccf434c8b469efac5b7b2ec","url":"https://daily.dev/sources/pulumi"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,ai-agents,iac,pulumi","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Pulumi","item":"https://daily.dev/sources/pulumi"},{"@type":"ListItem","position":3,"name":"How to Run AI Agents on Kubernetes with Pulumi"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-run-ai-agents-on-kubernetes-with-pulumi-13bcdkqis#faq","mainEntity":[{"@type":"Question","name":"Do I need GPUs to run AI agents on Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"Not always. An agent that only calls a hosted model API like OpenAI or Anthropic needs just CPU nodes to run its own logic and tool calls, since the GPU-heavy inference happens on the provider's infrastructure. GPUs become necessary once you self-host inference, for example running an open-weight model via vLLM, KServe, or Ray Serve, where tools like Kueue and Dynamic Resource Allocation come into play. daily.dev surfaces infrastructure guidance for developers sizing GPU versus CPU nodes for agent workloads."}},{"@type":"Question","name":"How is kagent different from running an AI agent as a plain Kubernetes Deployment?","acceptedAnswer":{"@type":"Answer","text":"A plain Deployment only gives you a running process, with no standard way to describe an agent's model configuration, tool access, or MCP server connections as first-class objects. kagent adds custom resources - Agent, ModelConfig, ModelProviderConfig, RemoteMCPServer, and SandboxAgent (as of v0.9.9) - making those concepts declarative so policy engines, reviewers, or automation can reason about them like any other Kubernetes object. developers comparing agent runtime options on kubernetes can track projects like kagent on daily.dev."}},{"@type":"Question","name":"How should I store model provider API keys when deploying AI agents on Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"Model provider API keys should be sourced from a secrets manager like Pulumi ESC rather than stored as plaintext Kubernetes Secret manifests. In practice this means declaring the ESC environment in the stack's Pulumi..yaml and pulling the key via config.requireSecret, so the credential is centrally managed, rotated, and scoped instead of copy-pasted across clusters. teams securing agent credentials across clusters follow infrastructure security practices like this on daily.dev."}}]} ```