Infrastructure that explains its own outages and brings receipts

What it does

Flawless is an open SRE control plane for Kubernetes and cloud infrastructure that connects alerts, topology, logs, and runbooks into a closed remediation loop. It ranks inspection severity, previews proposed changes, enforces human approval, executes through guarded RBAC, and then verifies that the original symptom actually resolved. The platform also carries 3D topology impact analysis, release governance with SLO gates, and a skills library for reusable operational knowledge.

The interesting bit

The architecture deliberately keeps the LLM outside the trust boundary: the model plans and explains, but the platform owns the action catalog, dry-runs, approval gates, audit trail, and post-execution verification. This “AgenticOps loop”—discover, diagnose, preview, approve, execute, verify, learn—also persists a remediation lineage so failed strategies and recovery evidence survive Pod restarts, building an effectiveness ledger for model comparison.

Key highlights

• Evidence-first remediation that correlates alerts, events, logs, metrics, topology, and recent changes before any action is proposed.
• Controlled execution with RBAC, policy checks, dry-run, human approval, and audit trails enforced by the platform, not the model.
• Verified recovery that tests the original symptom after execution instead of treating a successful command as success.
• Persistent remediation lineage in release 3.2.0, linking failed strategies, verification results, and replacement plans across operator-approved follow-up jobs.
• 2D/3D topology impact analysis with CMDB-style dependencies and blast-radius visualization.

Caveats

• The project ships under a PolyForm Noncommercial license, so production use inside a for-profit organization requires checking your compliance posture.
• The public name is Flawless, but legacy LUXYAI_* environment variables and charts/luxyai paths remain throughout the codebase as historical artifacts.
• The Helm chart offers a cluster-admin RBAC mode that the authors explicitly flag for isolated validation only; production deployments need the controlled mode and careful Secret management.

Verdict

Platform teams running Kubernetes who believe AI should plan remediation while the platform keeps the keys should care; everyone looking for a simple, commercially licensed point solution should not.