Search papers, labs, and topics across Lattice.
This paper introduces ARBITER, a guarded control plane designed to enhance SLO-oriented remediation in Kubernetes environments by utilizing a causal resource graph and a finite typed-action interface. By separating planning from execution and incorporating safety features like policy gates and resource budgets, ARBITER effectively addresses the limitations of traditional autoscalers and SLO controllers. Evaluation results demonstrate that ARBITER consistently selects appropriate remediation actions and targets, outperforming conventional methods in scenarios involving deployment regressions and critical-path faults.
ARBITER outperforms traditional autoscalers by reliably selecting the right remediation actions and targets, ensuring SLOs are maintained even in complex failure scenarios.
Maintaining service-level objectives (SLOs) on Kubernetes microservices remains difficult because autoscalers observe coarse resource metrics, recent SLO controllers often depend on custom telemetry, and unconstrained agentic operators cannot safely mutate production clusters. We present ARBITER, a guarded control plane for SLO-oriented Kubernetes remediation. ARBITER builds an OpenTelemetry-native causal resource graph, assembles bounded DiagnosisContext objects, and exposes a finite typed-action interface that separates planning from execution. The same interface supports deterministic planners and an LLM-backed planning harness, with deterministic schema checks, policy gates, resource/disruption budgets, approval, and bounded execution forming the safety substrate. We evaluate ARBITER on a 4-node Kubernetes cluster using DeathStarBench Social Network and Online Boutique. The evaluation tests two forms of SLO-oriented control that resource autoscaling alone does not provide: selecting the right remediation action and selecting the right downstream target. For bad-image deployment regressions, ARBITER selects rollback_canary in all ten CPU-burn and pure-latency runs; HPA either scales the faulty image or never triggers. For a downstream critical-path fault, the user-visible breach appears at the frontend, but trace evidence identifies home-timeline-service as the remediable bottleneck. Deterministic ARBITER and a live approval-gated Sonnet harness target that downstream service in every replicate, whereas HPA/resource-only control never does. Additional experiments cover guarded placement repair, Online Boutique portability, adversarial safety rejection, offline multi-model replay, and KWOK-based control-plane scale evidence. We release the controller, replay corpus, harnesses, safety tests, and figure artifacts: https://github.com/pooyan/arbiter.
