Kubernetes运维团队终于有了一个可审计的根因分析方案——Graph Traversal Agent通过图约束和独立验证，避免了LLM常见的幻觉和场景作弊。做K8s可观测性或事件诊断的开发者，值得看看这个结合图遍历与LLM的框架设计。
本文提出Graph Traversal Agent，一种结合LLM推理与确定性图操作的根因分析代理，用于诊断Kubernetes事件。该方法通过类型化证据图、LangGraph状态机和独立验证阶段，确保分析结果可审计且不依赖场景捷径。在ITBench基准测试中，系统在23个场景子集上根因实体F1从0.6087提升至0.9130，但消融实验显示部分提升源于提示词优化，去除提示后F1降至0.6958。研究强调，真正的泛化能力需通过提示消融、级联源检查等轻量级验证来区分。目前工作限于ITBench OpenTelemetry-demo快照，未声称生产就绪。
Auditable Graph-Guided Root Cause Analysis for Kubernetes Incidents
Kubernetes incidents are diagnosed reliably only when a root-cause system's reported gains come from incident evidence rather than scenario-specific shortcuts. We present Graph Traversal Agent, a graph-guided RCA agent that combines LLM reasoning with specialized tools. The model reasons over a typed evidence graph, while deterministic graph and tool operations collect evidence, bound the search, and check proposed verdicts. We map operational constraints, including read-only evidence collection, propagation-aware diagnosis, bounded execution, and independently validated verdicts, to a typed incident graph, a LangGraph traversal state machine, and a separate validation stage. On ITBench snapshots scored by one fixed qwen-plus judge, the audited system raises root-cause-entity F1 over an earlier iteration of the same system from 0.6087 to 0.9130 on a 23-scenario common subset. A prompt-level ablation separates prompt-tuned gains from gains that survive once scenario-specific hints are removed: the stripped-prompt configuration retains 0.6958 F1 on a 19-scenario subset. The surviving gain concentrates on ChaosMesh scenarios whose ground-truth root cause is the injected fault object already present in the evidence graph, so we report it as benchmark-coupled rather than broad cross-cluster RCA evidence. Lightweight checks, including same-judge comparison, prompt-level ablation, cascade-source checking, and a telemetry no-leak test, mark claims as supported, pending, or out of scope. We scope the work to ITBench OpenTelemetry-demo snapshots. Live-cluster trials served as an engineering stress test, but alert state and trace availability did not stay stable enough for controlled scoring, so we make no production-readiness or mean-time-to-repair claim.