Controlled self-healing Amazon EKS Clusters with AWS DevOps Agent and A2A remote agents

This article demonstrates how to implement controlled self-healing for Amazon EKS clusters using AWS DevOps Agent with Agent-to-Agent (A2A) remote agents that enforce mandatory policy gates before making changes.

• Deploy two custom A2A agents: one for EKS investigation and updates, one for policy approval/denial
• Use API Gateway with VPC link to securely expose in-cluster agents to DevOps Agent with IAM authentication
• K8sGPT operator diagnoses cluster issues like OOMKilled pods and memory limits
• Guardrail agent evaluates change policies (e.g., Pod Disruption Budget checks) before allowing remediation
• DevOps Agent orchestrates investigation, checks guardrail approval, applies fixes, and reports blocked changes
• Solution uses Argo CD for GitOps deployments and Amazon Bedrock for AI diagnostics and agent reasoning

This pattern separates change policy ownership from remediation agents, ensuring platform teams maintain control over when automated fixes are applied to production clusters.