Kubernetes
OpenShell vs Agent Substrate vs Kubernetes Agent Sandbox
OpenShell, Agent Substrate and Kubernetes Agent Sandbox solve different parts of running AI agents. Compare what each manages, enforces and requires.
7 min read
Tag
Kubernetes
189 posts
Kubernetes
How to find over-privileged AI agents
Find over-privileged AI agents by testing each agent's Kubernetes service account with kubectl auth can-i --as, checking escalation paths and reading audit logs
6 min read
Kubernetes
How to build deterministic AI workflows on Kubernetes
Build AI workflows on Kubernetes that stay deterministic: collect with Jobs, gate with CEL, and give the model one bounded step with only the fields it needs.
6 min read
AI
How to give custom AI agents their own service identity
Give each custom AI agent its own service account or GitHub App identity, narrow its grants, use short-lived tokens, and log the person each agent acted for.
5 min read
Kubernetes
How to give AI agents identity in Kubernetes
Give each AI agent a named Kubernetes service account, a short-lived projected token for one audience, and a SPIFFE ID from SPIRE when it crosses trust domains.
6 min read
Kubernetes
AI agent threat model for Kubernetes
A threat model for AI agents in Kubernetes maps each path an agent pod can reach to the admission, token, RBAC or network control that blocks it, per agent.
7 min read
AI
Admission control vs runtime enforcement for AI agents
An agent's pods face admission control before they start. Its calls face runtime enforcement after. Here is where each one stops it, and where it doesn't.
5 min read
Kubernetes
RBAC for AI agents in Kubernetes
Give each AI agent its own service account, bind it to a narrow Role, and point its pod at that account. RBAC has no deny rules, so grants are the limit.
5 min read
Kubernetes
How to sandbox AI agents on Kubernetes
Run each AI agent in its own Pod with a hardened security context, default-deny egress and a RuntimeClass, with lifecycle managed by Agent Sandbox CRD.
6 min read
AI
How to map AI agents and humans to one identity model with OIDC
Put AI agents and people behind one OIDC issuer, register each agent as its own client, and map claims to the username your Kubernetes API server records for delegated…
7 min read
AI
What is agent identity?
Agent identity gives each AI agent its own auditable principal. A Kubernetes service account names a workload, but cannot show which agent acted or for whom.
5 min read
AI
How to find MCP servers in your codebase and clusters
Find MCP servers in repos with .mcp.json and claude mcp list, then in clusters by listing pods and images. Covers scopes, approvals and shadow servers.
6 min read