OpenKruise Agents v0.6.0 adds data plane, network governance, and sandbox hibernation

OpenKruise Agents v0.6.0, a CNCF sub-project for Kubernetes sandbox lifecycle management, has shipped with 283 merged pull requests and 27 new contributors since the v0.3.0 release. The release fulfills two roadmap promises from v0.3.0: network governance through TrafficPolicy and SecurityProfile resources, plus a security identity integration that injects platform credentials from Kubernetes Secrets rather than embedding them in agent code.

The architecture expands from four to six components by adding traffic-control-plane (an istiod-based xDS distributor with an Egress Policy Enforcer) and traffic-proxy (an in-pod L4 enforcement sidecar). This creates a workload layer with its own data plane, where egress traffic is captured in-pod and routed through a gateway for full-request inspection rather than socket-level filtering alone. New CRDs bring the total from 6 to 12, adding PoolAutoscaler for warm-pool capacity management, automatic pause/resume with probe-driven idle detection, and SandboxUpdateOps that can batch-upgrade hibernated instances via CheckpointRestore without waking them or losing filesystem state.

Architecture and security model changes in v0.6.0

• Two-stage traffic takeover: L4 filtering occurs node-side via the traffic-proxy sidecar with low-latency deny capability, while L7 inspection, MCP tool-level ACLs, and credential injection are centralized in the egress gateway through Envoy external processing (ext_proc) and the Egress Policy Enforcer; L7 can never override an L4 denial.
• TrafficPolicy CRD semantics: Active policies enforce whitelist-only egress where unmatched traffic is denied; rules with missing peer fields are skipped by the compiler rather than defaulting to deny, and cluster DNS Service must be explicitly allowed for FQDN rules to resolve.
• SecurityProfile and GlobalSecurityProfile: These CRDs support block, bypass, mcpToolPolicy, headerManipulation, tokenTransformation, and audit actions, with SSRF protection against cloud metadata endpoints as the highest-value use case for agent workloads.
• CheckpointRestore for paused upgrades: SandboxUpdateOps enables batch upgrades of hibernated sandboxes without manual wake or filesystem loss, using checkpoint-restore mechanisms.
• PoolAutoscaler and pause/resume machinery: Declarative warm pool capacity uses watermarks and cron schedules; automatic pause/resume combines probe-driven idle detection, scheduled wake, and ingress-gateway-based wake-on-traffic that eliminates the need for external polling.

Why it matters

For platform teams running AI agent sandboxes or ephemeral execution environments on Kubernetes, this release provides a production-grade alternative to hand-rolled network policies and credential management, with direct operational payoffs in security posture and compute cost. The E2B-compatible API surface also lowers migration friction for teams already using that ecosystem, while the CNCF governance model provides a neutral home for what has become a multi-controller, multi-CRD orchestration system.