Skip to main content

Overview

CloudOpsBench is a 452-scenario Kubernetes root-cause analysis benchmark from Wang et al (arXiv:2603.00468v1, February 2026). Each fault case is a frozen JSON repository served through mocked kubectl-style tool calls, so evaluations are reproducible and do not require a live cluster. OpenSRE evaluates this corpus through a benchmark framework that adds cost tracking, integrity checks (pre-registration, per-stratum reporting, negative results, conflict-of-interest disclosure), per-LLM dispatch with version pinning, and self-contained Markdown and HTML reports. The goal is to publish an opensre+LLM column against the paper’s LLM-alone baselines on the same scenarios.

Prerequisites

CloudOpsBench does not require live infrastructure. Frozen snapshots are the environment.
You do not need AWS credentials, an EKS cluster, kind/minikube, Bedrock, a GPU, Grafana, Datadog, or Prometheus.

Quick start

List adapters

Validate a config

Validation fails on anti-patterns such as runs_per_case < 3, a missing pre_registration_path, oversized grids, or a system-path output_dir.

Development run

--dev skips integrity gates so you can smoke-test the wiring without a committed pre-registration file. The run ID is prefixed with dev- so development results are not treated as production results.

Production run

A production run requires:
  • A pre-registration YAML at pre_registration_path that lists per-model expected deltas and is committed to git before the run starts
  • seed: set in the config
  • Adapter declaration of data_contamination_checked = True
  • At least one validity metric declared by the adapter
On completion, the run directory contains report.json, report.md, report.html (self-contained), and cases/*.json (per-cell artifacts).

Re-render an existing report

Config reference

Example production config shape (see tests/benchmarks/cloudopsbench/configs/cloudopsbench_v1.yml for the full file):

Environment variable overrides (CI)

Integrity guarantees

The framework enforces 11 honest-results mechanisms in code. There is no bypass short of editing the framework itself.

Pre-flight (before any case runs)

IntegrityGuard.pre_flight raises IntegrityViolation if any of the following hold:
  • M1 — Pre-registration: pre_registration_path is unset, missing, or empty. Expected deltas must be committed before results are known.
  • M3 — Validity metrics: the adapter declares no validity metric.
  • M6 — Seeded selection: seed: is None.
  • M7 — Contamination check: the adapter has not declared data_contamination_checked = True.
Violations are reported together so they can be fixed in one pass.

Report validation (before the report is emitted)

IntegrityGuard.report_validation refuses to publish a report if:
  • M3 — Not every adapter-declared metric appears in the report
  • M4 — Per-stratum breakdown is missing or contains only all
  • M5 — Raw per-case artifacts directory is missing
  • M9negative_results is empty
  • M10coi_disclosure is empty
  • M1 — Pre-registration path is not carried into the report

Operational mechanisms (not code-enforced)

  • M8 — External replication of at least one cell by a third party before a public claim
  • M11 — Blinded LLM-as-judge calibration (BDIL Phase B; tracked separately)

Cost tracking

The framework registers a usage hook on the LLM clients in core/llm/transports/sdk/llm_clients.py. Each successful call records (model, tokens_in, tokens_out) in a CostTracker. When the next call would exceed cost_budget_usd, the runner raises CostBudgetExceeded and stops with a partial-completion report. Per-cell tokens_in / tokens_out / cost_usd may currently be 0 (aggregate cost in report.json is correct; per-cell capture is a follow-up).

Metrics

The paper’s 13 deterministic metrics plus three framework validity metrics: All 16 metrics are deterministic (string or set comparison). Evaluation does not use an LLM as judge.

Existing production entry points

make test-cloudopsbench and opensre tests cloudopsbench use tests/benchmarks/cloudopsbench/run_suite.py (legacy imperative CLI). The framework runner is the YAML-config surface. Both share the same adapter, scoring code, and replay backend.

Reference