6. Platform

Where will you run the agent?

Move the validated host data plane to local k3d with kagent, then inspect an optional GKE plan without applying it. The same locked agent/MLflow images, Kustomize base, gateway ports, MCP path, A2A service, state PVCs, and OTel pipeline run in both environments; only overlays, registry, model backend, and workload identity change.

This chapter covers:

• 6.0. Platform: Agents as Kubernetes workloads, and a kagent overview.
• 6.1. Containers: Build and publish agent images with a multi-stage Dockerfile.
• 6.2. Platform Install: Create the tracked k3d/registry and install the pinned slim kagent chart.
• 6.3. Platform Agents: Declare the hardened single-replica BYO Agent, gateway ModelConfig, and state PVC.
• 6.4. Platform Tools: Deploy the read-only MCP server and register only its governed endpoint.
• 6.5. Platform Gateway: Run the private data plane with network policy and GKE workload identity.
• 6.6. Platform Delivery: Use Skaffold locally, review the OpenTofu GKE plan, and tear down safely.

The chapter's required outcome is local. GCP remains at tofu plan; no cloud resource is created without a later explicit approval.