Red Hat builds Kubernetes-native security and inference layers for enterprise AI agents

Red Hat LLC has long helped enterprises manage Kubernetes clusters without requiring deep infrastructure expertise. Now the company is applying that same philosophy to a new class of workloads: AI agents that execute commands, access external systems and take actions affecting business operations. Unlike traditional applications, autonomous agents demand both efficient resource allocation and strict security boundaries to operate safely in enterprise environments.

The company is arriving at KubeCon + CloudNativeCon North America in Salt Lake City this week with a portfolio of technologies designed to address these challenges. OpenShift supplies the Kubernetes foundation; a partnership with Nvidia Corp. on OpenShell handles agent execution and security; and the llm-d project, which reached version 1.0, manages the context-heavy inference workloads agents generate. Together, these initiatives position Red Hat to help enterprises run agentic AI through open, Kubernetes-based infrastructure.

Autonomous agents differ fundamentally from conventional applications. They generate commands, invoke tools and distribute work across multiple systems, creating both automation opportunities and governance challenges. Consistent access controls and oversight become critical as agents gain the ability to read files, execute shell commands and make network calls within enterprise environments.

Layered sandboxing and policy enforcement for agent safety

Red Hat's security approach centers on its work with Nvidia around OpenShell, a runtime that isolates agents in protected execution environments and enforces policy over their access. Red Hat is integrating this Nvidia-developed technology into Red Hat AI and its open hybrid cloud platform as part of a broader effort to bring security-focused agentic AI to enterprise infrastructure.

OpenShell employs sandboxing, process-aware policy and controls governing network access and credentials. Red Hat has also outlined how OpenShell works alongside OpenShift's sandboxed containers, adding application-level restrictions within a virtual-machine boundary. These complementary layers govern agent behavior and isolate the environments where agents operate, as Red Hat explains in its technical overview of layered sandboxing.

Sandboxing alone does not make an agent trustworthy. Rather, it constrains the potential damage when agent instructions, generated code or external inputs lead the system astray. Pete Cheslock, principal AI community architect at Red Hat, described how OpenShell builds on Kubernetes infrastructure in a recent interview with theCUBE: "The agent sandbox is one of them, so that you can deploy these agents in a secure way using Kubernetes native APIs." This observation highlights the core challenge: enterprises cannot grant authority to agents without defining and enforcing its limits.

Red Hat Chief Technology Officer Chris Wright reinforced the importance of agent isolation in a May interview with theCUBE. Agents capable of taking real actions in a business require sandboxing and least-privilege protections, he explained. "You've got to give it the right sandboxing. You've got to put protections around the agent, give it least privileges so it doesn't think about read versus read-write — very big difference," Wright said in SiliconANGLE's coverage of Red Hat Summit.

Beyond sandboxing, enterprises must oversee agent identities, data permissions, tool access and authorization. Paul Nashawaty, practice lead and principal analyst for application development, modernization and cloud native at theCUBE Research, distinguishes between observing agent actions and proving what agents were authorized to do. His September analysis of AI agent governance identifies runtime enforcement, delegated authority and verifiable audit evidence as requirements that grow more critical as autonomous systems enter production. "This creates an opportunity for platforms that can unify application development, infrastructure orchestration, security and observability rather than adding another layer of disconnected tooling," Nashawaty said.

Distributed inference infrastructure for multi-turn agent interactions

Agents introduce new demands on inference infrastructure beyond security. An agent may call a model, retrieve information, invoke a tool and return to the model with additional context. Each interaction consumes compute, memory and network resources while the system must retain sufficient context to continue efficiently.

Red Hat's llm-d project addresses this requirement. Founded by Red Hat, IBM Corp., Google Cloud, CoreWeave Inc. and Nvidia, and now governed by the Cloud Native Computing Foundation, llm-d uses Kubernetes-native components to distribute inference across accelerators and manage traffic between them. The project reached version 1.0 on Oct. 20, introducing session-aware routing, turn-priority scheduling, multi-tenant quality-of-service controls and high-availability operations. These features keep multi-turn requests close to cached context, prioritize latency-sensitive work and reduce disruption during maintenance.

The architecture gives operators additional options for coordinating inference workloads and managing accelerator resources within Kubernetes. Red Hat Senior Vice President and AI Chief Technology Officer Brian Stevens described one of llm-d's central architectural decisions in SiliconANGLE's report on Kubernetes inference: "We can independently scale the processing of the input from the production of the tokens."

Other infrastructure providers are addressing complementary requirements. ScaleOps Labs Ltd. focuses on GPU utilization and resource optimization across Kubernetes workloads. Vultr Holdings LLC offers GPU infrastructure and Kubernetes-based model deployment, while Broadcom Inc. positions VMware Cloud Foundation as a private-cloud platform for Kubernetes and AI workloads. These offerings reflect expanding enterprise choices for resource optimization, accelerator capacity and private-cloud operations.

An operational gap persists despite these advances. TheCUBE Research's "Day 0 Build, Test Survey Research Report," based on a survey of 375 IT, development, operations and platform engineering professionals, found that cloud-native adoption is widespread but maturity remains uneven. Inconsistent automated testing, fragmented developer tools and gaps in rollback capabilities continue to complicate production deployment. "Ninety-two percent of organizations are integrating AI into at least one stage of the software development lifecycle, while 79% expect full-scale AI agent adoption within the next three years," Nashawaty said, adding that approximately 30% still face operational readiness challenges.

The broader industry is moving toward production-scale infrastructure. The CNCF's 2026 annual cloud-native survey found that 82% of container users run Kubernetes in production and that 66% of organizations hosting generative AI workloads use Kubernetes for some or all inference. These figures underscore Kubernetes' expanding role as enterprises adopt AI workloads.

Open-source contributions accelerate agent infrastructure development

The open-source ecosystem is expanding alongside agentic AI adoption. On Nov. 5, Google announced the donation of Agent Substrate, gVisor and OpenRL to the CNCF following their acceptance into its Sandbox program in October. Agent Substrate separates agent sessions and identities from active compute, allowing idle environments to pause and resume; gVisor provides an additional isolation boundary for untrusted code; and OpenRL supports reinforcement-learning post-training on Kubernetes.

These contributions complement broader efforts across the Kubernetes community. Red Hat is a co-founder of llm-d and is integrating Nvidia's OpenShell into its enterprise AI platform, while Google is contributing technologies related to runtime and training requirements. The common emphasis on open infrastructure creates opportunities for interoperability as enterprise AI systems mature.

Broadcom added another development on Nov. 9, announcing that its VM API project had been accepted into the CNCF Sandbox. The project aims to let organizations manage virtual machines through Kubernetes application programming interfaces across different infrastructure providers, extending the Kubernetes conversation to managing virtual machines alongside containerized workloads.

Project Lightwell adds another dimension to Red Hat's enterprise strategy. Announced with IBM in May, the $5 billion initiative aims to use AI-assisted vulnerability identification and validated fixes to strengthen open-source software supply chains, extending security efforts to the software dependencies supporting production workloads.

Sam Weston, industry analyst for enterprise applications, development and modernization at theCUBE Research, points to the infrastructure mix enterprises already operate. "With our data showing 61.8% of enterprises run hybrid deployments and an additional 10% operate across multi-cloud environments, Red Hat's hybrid-first platform strategy aligns closely with where enterprise infrastructure lives today," Weston said.

Red Hat's established OpenShift footprint provides a foundation for connecting these developments. As enterprises deploy more autonomous workloads, the company is positioned to combine Kubernetes orchestration, agent isolation and distributed inference within its broader hybrid cloud strategy. The opportunity extends beyond any individual project. OpenShift, llm-d and OpenShell illustrate how Red Hat is contributing to an open infrastructure model that accommodates both conventional applications and emerging AI agents.

For enterprises, the objective is to make AI workloads secure, efficient and manageable without losing control over how autonomous systems operate. Red Hat's work across the Kubernetes ecosystem reflects how that foundation is taking shape.