Kubernetes and AI agents take center stage at KubeCon as enterprises seek production-ready security

Container orchestration has solidified its position as the foundational standard across enterprise infrastructure. Yet a fresh challenge looms as organizations prepare to move AI workloads into production: can Kubernetes provide the governance layer that autonomous agents require?

This central concern will shape conversations at KubeCon + CloudNativeCon NA, taking place Nov. 10-12 in Salt Lake City. As AI agents have evolved from simple question-answering systems to code-executing entities managing business operations, enterprises are grappling with the need to constrain what these autonomous systems can access and perform.

"That brings us to OpenShell, an open-source secure agent runtime that Red Hat is helping develop alongside Nvidia and, of, course, the broader community," said theCUBE Research's Dave Vellante, during a pre-event interview. "The approach puts enforcement into the environment where the agent operates, setting boundaries around what it can access and execute rather than relying on a model alone to follow the rules. We think this is a central question for the next chapter of cloud native: how do enterprises give agents enough freedom to be useful without giving up control?"

TheCUBE, the livestreaming studio operated by SiliconANGLE Media, will deliver on-site coverage and conversations with executives from Red Hat Inc., Nvidia Corp. and other industry players throughout the three-day event. The coverage will focus on emerging developments in GPU orchestration, agentic workloads and platform engineering as these technologies transition from experimental to operational status.

Container orchestration for AI

Though still in its nascent stages, OpenShell is undergoing active development for Kubernetes environments. This momentum reflects mounting enterprise demand for containerized application deployment, according to theCUBE Research's Paul Nashawaty.

"Fifty-one percent of organizations report that 51–75% of their applications now run in containers, representing a sharp rise from just a few years ago," Nashawaty said. "Organizations now run the majority of their applications in containers which is a sharp rise that reflects the accelerating cloud-native transformation central to KubeCon + CloudNativeCon."

The Cloud Native Computing Foundation granted OpenShell sandbox project status in September. A key capability within OpenShell enables agents to execute within isolated sandboxes that restrict file system access—a design pattern gaining traction among cloud-native practitioners working within the Kubernetes ecosystem.

"It builds on top of some core Kubernetes special interest groups," said Pete Cheslock, principal AI community architect at Red Hat, during an interview with theCUBE. "The Agent Sandbox is one of them so that you can deploy these agents in a secure way using Kubernetes APIs."

Kubernetes-native security

Cheslock's emphasis on security underscores escalating concerns about AI agents escaping containment and infiltrating systems—a risk that has drawn recent public attention. As enterprises accelerate their AI adoption and integration, the security implications become more pronounced, an issue that will feature prominently at the conference.

"Our research data reveals that 41.3% of organizations cite increased vulnerability risk as the top security challenge, introduced by faster CI/CD cycles and a tension that cloud-native teams are increasingly turning to Kubernetes-native tooling to resolve," Nashawaty said.

Organizations deploying cloud-native infrastructure and open-source components must have assurance that these tools operate safely within their systems. Red Hat and IBM Corp. responded to these concerns in May by announcing Project Lightwell, representing a $5 billion investment aimed at strengthening open-source software security.

"For the last year, especially since the Mythos moment, [security] has been the first thing that we've talked about in every customer conversation I've had," said Stu Miniman, senior director of market insights for hybrid platforms at Red Hat, in conversation with theCUBE. "We're trying to make sure that customers can feel secure and understand and use these tools. There's even more effort being put on security than ever, which has always been a focus of Red Hat. If we don't make sure that layer is as locked down and reliable and trusted as possible, everything else becomes secondary."

Tools for multicloud

During the conference, theCUBE will examine how practitioners leverage Kubernetes to maintain workload portability across multiple cloud environments. Organizations including Vultr and ScaleOps are constructing Kubernetes-based solutions that span diverse platforms, reflecting broader shifts in enterprise computing architecture.

"With our AppDev research finding that 94% of organizations now operate across two or more cloud providers, the demand for consistent, developer-friendly Kubernetes-based platforms has never been more pressing," Nashawaty explained.

KubeCon provides a venue to evaluate progress within major CNCF initiatives. Google LLC has emerged as a significant contributor, having released the open-source service mesh Istio, serverless components through Knative and Kubernetes itself. The scale of the CNCF ecosystem continues to expand, as Red Hat's Miniman noted.

"They've got a big ecosystem. I can give example after example of who created these technologies," Miniman told theCUBE. "Oh yeah, the GitOps stuff came out of Intuit, and the platform engineering stuff came out of Spotify. Just find your focus and go in there, because there is no way you can cover all of it."

How to follow the coverage

TheCUBE's reporting from KubeCon + CloudNativeCon NA will run Nov. 10-12, with on-demand access to exclusive interviews and analysis available after the event concludes.

Coverage will be accessible through theCUBE's dedicated website, YouTube channel and across SiliconANGLE's platforms.

SiliconANGLE produces two regular programs featuring enterprise technology analysis. "TheCUBE Pod," hosted by John Furrier and Dave Vellante, explores major trends spanning AI, cloud, cybersecurity and infrastructure, available on Apple Podcasts, Spotify and YouTube. The weekly "Breaking Analysis" program, also hosted by Vellante, examines significant enterprise technology developments using insights from theCUBE combined with spending data from Enterprise Technology Research, available on the same platforms.