Archestra

Diagnostics

SRE Agent

Ask the SRE agent why an Archestra pod keeps restarting, and it reads that pod's events and logs, then answers with ranked hypotheses and the evidence for each. It sees only Archestra's own namespace, through a read-only Kubernetes MCP server that the chart runs under a dedicated -sre ServiceAccount. That account cannot read Secrets or ConfigMaps or change anything.

To use the agent, your role needs sre:read (held by Admin by default; pod specs can carry other MCP servers' credentials).

  1. Find the Kubernetes API server endpoint IPs with kubectl get endpoints kubernetes -n default. Use these IPs (with /32), not the kubernetes Service IP.

  2. Turn the agent on in your Helm values, then run helm upgrade:

    yaml
    archestra:
  sre:
    enabled: true
    apiServerCidrs:
      - 172.16.0.2/32

  3. After the rollout, open Chat, pick the SRE agent, and ask "Why did a pod restart in the last hour?" If the agent is missing, check your role's sre:read permission, then check MCP Registry → Kubernetes for a startup error.

The MCP server's egress is your organization's default network policy plus apiServerCidrs. A change applies when the Kubernetes MCP server's pod restarts.

With the code sandbox on, the agent clones the source of the running Archestra version from GitHub to tie errors to code, so the default policy must allow GitHub.

Setting enabled: false deletes the agent, its MCP server, and its environment, including your changes to the agent.

Collect a Support Bundle

Attach a support bundle when you report a problem: one file with your installation's pods, restarts, events, recent logs, and versions.

The script requires kubectl, helm, and jq with read access to the namespace. Run support-bundle.sh with the release namespace and name (check with helm list -A):

bash
curl -fsSLO https://raw.githubusercontent.com/archestra-ai/archestra/main/platform/scripts/support-bundle.sh
bash support-bundle.sh <namespace> <release>

It prints the path of the .tar.gz it wrote.

The bundle leaves out Secrets, ConfigMaps, environment values, container arguments, probe headers, and every Helm value except a fixed list of non-secret settings. Logs are copied as written, so read the bundle before you share it.

A step that fails or times out leaves its error in the bundle, and the rest is still collected. To change the 20-second timeout per kubectl call, set KUBECTL_REQUEST_TIMEOUT.