# OpenKruise Agents v0.6.0 adds data plane, network governance, and sandbox hibernation

> **Key takeaway:** The CNCF project introduces a dedicated traffic-control-plane with Envoy-based L4/L7 egress enforcement, checkpoint-restore upgrades for paused sandboxes, and wake-on-traffic to eliminate idle CPU consumption.

**Published:** 2026-11-03T12:00:00+00:00 
**Source:** Cloud Native Computing Foundation (CNCF) 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/openkruise-agents-v060-adds-data-plane-network-governance-an.html 

## Summary
OpenKruise Agents v0.6.0, a CNCF sub-project for Kubernetes sandbox lifecycle management, has shipped with 283 merged pull requests and 27 new contributors since the v0.3.0 release. The release fulfills two roadmap promises from v0.3.0: network governance through TrafficPolicy and SecurityProfile resources, plus a security identity integration that injects platform credentials from Kubernetes Secrets rather than embedding them in agent code.

The architecture expands from four to six components by adding traffic-control-plane (an istiod-based xDS distributor with an Egress Policy Enforcer) and traffic-proxy (an in-pod L4 enforcement sidecar). This creates a workload layer with its own data plane, where egress traffic is captured in-pod and routed through a gateway for full-request inspection rather than socket-level filtering alone. New CRDs bring the total from 6 to 12, adding PoolAutoscaler for warm-pool capacity management, automatic pause/resume with probe-driven idle detection, and SandboxUpdateOps that can batch-upgrade hibernated instances via CheckpointRestore without waking them or losing filesystem state.

## Architecture and security model changes in v0.6.0
- **Two-stage traffic takeover:** L4 filtering occurs node-side via the traffic-proxy sidecar with low-latency deny capability, while L7 inspection, MCP tool-level ACLs, and credential injection are centralized in the egress gateway through Envoy external processing (ext_proc) and the Egress Policy Enforcer; L7 can never override an L4 denial.
- **TrafficPolicy CRD semantics:** Active policies enforce whitelist-only egress where unmatched traffic is denied; rules with missing peer fields are skipped by the compiler rather than defaulting to deny, and cluster DNS Service must be explicitly allowed for FQDN rules to resolve.
- **SecurityProfile and GlobalSecurityProfile:** These CRDs support block, bypass, mcpToolPolicy, headerManipulation, tokenTransformation, and audit actions, with SSRF protection against cloud metadata endpoints as the highest-value use case for agent workloads.
- **CheckpointRestore for paused upgrades:** SandboxUpdateOps enables batch upgrades of hibernated sandboxes without manual wake or filesystem loss, using checkpoint-restore mechanisms.
- **PoolAutoscaler and pause/resume machinery:** Declarative warm pool capacity uses watermarks and cron schedules; automatic pause/resume combines probe-driven idle detection, scheduled wake, and ingress-gateway-based wake-on-traffic that eliminates the need for external polling.

## Why it matters
For platform teams running AI agent sandboxes or ephemeral execution environments on Kubernetes, this release provides a production-grade alternative to hand-rolled network policies and credential management, with direct operational payoffs in security posture and compute cost. The E2B-compatible API surface also lowers migration friction for teams already using that ecosystem, while the CNCF governance model provides a neutral home for what has become a multi-controller, multi-CRD orchestration system.