Demo Running the Audit Tracker Agent and Review the Tickets

(.venv) ➜  k8-finops-agent git:(main) ls
# (UI shows no tickets at this time)

(.venv) ➜  k8-finops-agent git:(main) python3 sections/08-from-findings-to-tickets/agent/tracker_auditor.py

INFO:     Waiting for application startup.
INFO:     Application startup complete.
INFO:     Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)
INFO:     Uvicorn running on http://0.0.0.0:8001 (Press CTRL+C to quit)
INFO:     172.17.0.1:61612 - "GET / HTTP/1.1" 200 OK
INFO:     172.17.0.1:61612 - "GET /api/issues HTTP/1.1" 200 OK
INFO:     172.17.0.1:56934 - "GET /sse HTTP/1.1" 200 OK
INFO:     172.17.0.1:56944 - "POST /messages/?session_id=05bdea03d0254494b096592b72325cf3 HTTP/1.1" 202 Accepted
Processing request of type ListToolsRequest
ERRO[2070] error waiting for container: invalid character 'u' looking for beginning of value

[INFO] MCP server "k8s": initializing with: {'url': 'http://localhost:8000/mcp', 'transport': 'streamable_http'}
[INFO] MCP server "k8s": Pre-validating authentication
[INFO] HTTP Request: POST http://localhost:8000/mcp "HTTP/1.1 200 OK"
[INFO] MCP server "k8s": Authentication validation passed: 200
[INFO] MCP server "k8s": connecting via Streamable HTTP (explicit) to http://localhost:8000/mcp
[INFO] Negotiated protocol version: 2025-11-25
[INFO] MCP server "k8s": connected
[INFO] MCP server "k8s": 8 tool(s) available:
[INFO] - kubectl_get
[INFO] - kubectl_describe
[INFO] - kubectl_logs
[INFO] - kubectl_context
[INFO] - kubectl_reconnect
[INFO] - explain_resource
[INFO] - list_api_resources
[INFO] - ping

[INFO] MCP server "tracker": connected
[INFO] MCP server "tracker": 4 tool(s) available:
[INFO] - create_issue
[INFO] - list_issues
[INFO] - get_issue
[INFO] - update_issue

[INFO] MCP tool "k8s"/"kubectl_get" received input: {'resourceType': 'deployments', 'name': None, 'namespace': 'payment', 'output': 'json', 'allNamespaces': False, 'labelSelector': None, 'fieldSelector': None, 'sortBy': None, 'context': ''}
[INFO] MCP tool "k8s"/"kubectl_get" received result (size: 547)

[INFO] MCP tool "tracker"/"create_issue" received input: {
  'title': '[FinOps] payment/payment-gateway - MISSING-LABELS',
  'summary': 'Deployment payment-gateway in namespace payment has no labels present, resulting in all required tags (owner, environment, cost-center, application, tier, slack-channel) being missing.',
  'body': "The Deployment 'payment-gateway' in the 'payment' namespace was evaluated against the FinOps tagging policy. No labels matching any of the required label_mappings keys were found for owner, environment, cost-center, application, tier, or slack-channel. This makes it impossible to attribute cost, identify the responsible team, or determine deployment environment/tier for this resource. Given this resource resides in the payment namespace (likely handling sensitive transaction data), lack of ownership and cost-center tagging poses both governance and financial tracking risk.",
  'namespace': 'payment',
  'resource_name': 'payment-gateway',
  'resource_kind': 'Deployment',
  'category': 'missing-labels',
  'priority': 'high',
  'cost_impact': 0.0,
  'assignee': '',
  'suggested_owner': 'payment-team',
  'suggested_cost_center': 'payment',
  'reasoning': 'No labels were present on the resource at all, so none of the accepted keys for any required tag could be matched. Namespace name suggests cost-center "payment" and an owning team responsible for payment services.',
  'source': 'mcp-llm-agent'
}
[INFO] MCP tool "tracker"/"create_issue" received result (size: 1662)

"""Unified FinOps agent: audit cluster labels via K8s MCP and post tickets via tracker MCP."""
import asyncio
from pathlib import Path

from mcp_client import run_agent

# Keep the tool surface small so the agent spends steps on create_issue, not discovery.
ALLOWED_TOOLS = {"kubectl_get", "create_issue", "list_issues"}

PROMPT = """
You are a FinOps agent with Kubernetes kubectl_get and issue tracker tools (create_issue, list_issues).

Execute this exact plan – do not invent extra discovery steps:

Step 1 – Collect (1 kubectl_get call only):
- kubectl_get resourceType=deployments namespace=payment output=json

Step 2 – Evaluate labels on each Deployment against the tagging rules.
A required tag is missing when NONE of its label_mappings keys appear on the resource.

Step 3 – For EVERY non-compliant Deployment, call create_issue (one call per resource).
Required fields:
- title: "[FinOps] {namespace}/{resource_name} – {CATEGORY}"
- summary, body, namespace, resource_name, resource_kind
- category: missing-owner | unallocated | orphaned | missing-labels
- priority: critical | high | medium | low
- suggested_owner, suggested_cost_center, reasoning
- source: "mcp-llm-agent"

Step 4 – Call list_issues once and stop.

Hard rules:
- Follow Step 1's scope exactly – do not invent extra kubectl_get calls.
- Do not fetch configmaps, PVCs, or individual resources by name.
- Do not write a plain-English audit report instead of creating tickets.
"""

# Replace or modify Step 1 in PROMPT:
# - kubectl_get resourceType=deployments namespace=payment output=json
# with:
# - kubectl_get resourceType=deployments allNamespaces=true output=json