Where agent steps run

Each agentRole step of an AgentWorkflowRun runs as a runner Job in its org's namespace, ir-org-<org>, on the management cluster. The Job runs infrared-runner with the org's model key, does the step's work, and reports its verdict, evidence and usage, which you then read on the Change. When the step ends, the Job and everything in it go away.

You decide where on the cluster those Jobs run, how much they may use, and what they may reach, with the chart values below. Set them in Infrared's values file in your gitops repo, registry/clusters/<cluster>/values/infrared.yaml, through a pull request.

Give agent steps nodes of their own

Agent steps build, test and lint your Products' code, so they can be heavy. To keep them away from the nodes Infrared itself runs on, give them a node pool of their own with a node selector and tolerations:

runner:
  placement:
    nodeSelector:
      pool: agents
    tolerations:
      - key: dedicated
        value: agents
        effect: NoSchedule

Empty, the scheduler places steps anywhere.

Size them

runner.placement.resources sets the requests and limits of the container the agent works in, where Claude Code, the Product's builds and its linters run:

runner:
  placement:
    resources:
      limits:
        memory: 8Gi

Each value you leave out keeps the default: 250m CPU and 2Gi of memory requested, with a 6Gi memory limit. When a step runs out of memory, it says so on the step and opens an info incident on its Product, so you see it rather than guess.

Fence their network

By default, runner pods are fenced with a NetworkPolicy in each org's namespace: they reach DNS and the internet over HTTP(S), and nothing in the cluster, the VPC or the cloud's metadata service.

Chart value	Default	What it does
runner.networkPolicy.enabled	true	The fence. Turn it off only when the cluster's network plugin doesn't enforce NetworkPolicy.
runner.networkPolicy.extraEgressCIDRs	[]	Private networks runners may also reach over HTTP(S), such as a GitHub Enterprise Server, as a list of CIDRs.

See where an org's steps run

ir agent-steps get shows where the current org's agent steps run. In 0.1 that's always jobs, runner Jobs in the cluster. Runner pools, which run agent steps on people's own machines, aren't part of 0.1.