KubeOpenCode CLI
OpenCode agents on Kubernetes: tasks and shared settings live in manifests, and kubeoc attaches to a live agent
- 120 ★ on the repository
- Last commit
Broad access
Why this level
- The agent runs arbitrary code and commands in a cluster with the rights of a service account.
- Model keys and repository access are handed to agents through Kubernetes secrets.
Install
- Works in
Manual install
kubectl create namespace kubeopencode-system
helm install kubeopencode oci://ghcr.io/kubeopencode/helm-charts/kubeopencode --namespace kubeopencode-system --set server.enabled=trueInstalls the operator into the cluster. The `kubeoc` utility separately: `go install github.com/kubeopencode/kubeopencode/cmd/kubeoc@latest`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs arbitrary code and commands in a cluster with the rights of a service account.
- Model keys and repository access are handed to agents through Kubernetes secrets.
This is third-party code. Review the repository files before installing.
What it does
KubeOpenCode runs OpenCode agents inside a Kubernetes cluster. An agent and a task are described with `Agent` and `Task` manifests that name the profile, workspace directory, service account, a secret with the model key and the instruction text, for example update dependencies, run tests and open a pull request. The project installs into a cluster with a Helm chart. For terminal work there is the `kubeoc` utility: `kubeoc get agents` lists agents and `kubeoc agent attach` connects to a running one. The project is independent of the OpenCode team and adds shared agent settings, governance and enterprise infrastructure integration.
Who it is for. Platform engineering teams that run coding agents in a shared cluster and want unified settings and oversight.
Good fit when
- Several teams need one set of agent profiles instead of personal configs.
- Dependency updates with tests and a pull request are handed to an agent as a cluster task.
- Model keys live in Kubernetes secrets rather than on laptops.
- An agent's work is watched from the terminal with `kubeoc agent attach`.
Not a fit when
- A single developer is fine with plain OpenCode on a local machine.
- There is no Kubernetes cluster and none is planned.
- An agent must not receive access to repositories and cluster secrets.
Example request
Create the default agent in kubeopencode-system and give it a task to update dependencies, run tests and open a pull request.Limitations
A Kubernetes cluster, Helm and a model key in a secret are required. The manifest API is at `v1alpha1`, so it may change. The project is independent of OpenCode and unaffiliated with its team. An agent acts with the rights of the chosen service account, so restrict them to the minimum. The server interface is enabled with `server.enabled=true` at install time. Security, architecture and feature details live in the project documentation, not the README.
How to disable. Remove the release with `helm uninstall kubeopencode -n kubeopencode-system` and the namespace if it is no longer needed. Delete the `kubeoc` binary from your `PATH` by hand.
FAQ
How do I install KubeOpenCode on a cluster?
Create the `kubeopencode-system` namespace and run `helm install` for the chart `oci://ghcr.io/kubeopencode/helm-charts/kubeopencode` with `--set server.enabled=true`.
How do I install the kubeoc utility?
Run `go install github.com/kubeopencode/kubeopencode/cmd/kubeoc@latest`. Afterwards `kubeoc get agents` lists the cluster's agents.
Is the project affiliated with the OpenCode team?
No. The authors state it is an independent project built on OpenCode.
How do I describe a task for an agent?
Create a `Task` manifest with `agentRef` and `description`. For example, the description can ask to update dependencies, run tests and open a pull request.
Where is the model key stored?
In a Kubernetes secret: the `Agent` manifest references it through `credentials` and passes the value to the `OPENCODE_API_KEY` variable.
Discussion
No questions or reviews yet.
Related
CLI toolsA CLI and Kubernetes operator that runs Claude Code, Codex, Gemini, OpenCode and Cursor as tasks and sessions inside a cluster
A set of agents for Kubernetes and GKE: scheduled fleet audits, fixes through pull requests, replies in Google Chat and Slack
An open-source Kubernetes UI with a built-in MCP server: the agent inspects the cluster, diagnoses breakages and operates it with RBAC in mind
A Docker sandbox for coding agents: a Debian image with Copilot CLI, Codex and Pi, and SSH, RDP and Docker enabled by flags.
A self-hosted control center for coding agents: Claude Code, Codex, Copilot, OpenCode and Pi from your phone, desktop and terminal
KubeShark skill: the agent finds the failure mode first, then writes manifests, Helm and Kustomize to official practice with a rollback plan
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| KubeOpenCode (this card) | no | 120 | ||
| OpenCode | no | 224,828 | OpenCode itself runs on one machine; KubeOpenCode runs its agents in Kubernetes with shared profiles | |
| Kubernetes MCP | no | not required | 1,610 | that card gives an agent cluster access over MCP; here the agents themselves live in the cluster |
README in short
Installation uses a Helm chart and the example shows an `Agent` and `Task` manifest pair. A community project separate from OpenCode.