Kagent 1.0 and Agent Substrate bring hardened sandboxing to Kubernetes AI agents

The Cloud Native Computing Foundation has published a technical deep-dive on kagent 1.0, a declarative runtime for AI agents, paired with Agent Substrate, a sandboxing platform designed for Kubernetes environments. The combination addresses three production requirements for agentic workloads: isolation, security policy enforcement, and scalability. Kagent supports bring-your-own-agent frameworks including LangGraph and Google's ADK, while Agent Substrate provides the underlying infrastructure that isolates agent execution through Workers (Pods), Actors, and a control plane called ateapi.

The architecture distinguishes between software-level isolation via gVisor's Sentry user-space kernel and hardware-level isolation through microVMs running directly on CPU virtualization extensions. This layered approach aims to prevent untrusted agent code from escaping to host environments, minimize blast radius, protect credentials and model outputs, enable agent snapshotting for state recovery, and isolate multi-tenant agent multiplexing. The release includes Kubernetes CRDs for declarative agent deployment, a web UI for template creation, and Helm-based installation with default WorkerPool provisioning.

Sandboxing architecture and kagent integration

• Dual-layer isolation: Agent Substrate implements software-level isolation through gVisor's Sentry, which intercepts system calls in user space, and hardware-level isolation through microVMs that run directly on physical CPU virtualization extensions.
• Kubernetes-native runtime: Kagent 1.0 deploys agents as custom resources (Harness and AgentTemplate CRDs at kagent.dev/v1alpha3) with Helm installation creating a default WorkerPool containing two Worker Pods via substrateWorkerPool.create=true.
• Stateful execution model: Agents support snapshot policies for state persistence, with snapshot storage configurable to external locations such as Google Cloud Storage buckets through the snapshotPolicy.location field.
• Control plane routing: The ateapi manages Actors that facilitate agent execution, with kagent providing both programmatic (kubectl-ate CLI) and declarative UI entry points beyond raw API calls.
• Template-based deployment: AgentTemplate resources function as reusable configuration blueprints that can be matched to Harness resources through label selectors, supporting both first-party harnesses and BYO frameworks.

Why it matters

For organizations deploying AI agents in production Kubernetes clusters, this provides a concrete open-source alternative to ad-hoc container isolation, addressing the gap between generic container security and agent-specific requirements like credential protection and stateful recovery. The CNCF backing and Kubernetes-native design position it for integration into existing GitOps and platform engineering workflows, though adoption will depend on operational validation of the gVisor-microVM performance tradeoffs for latency-sensitive agent workloads.