OpenKruise Agents v0.6.0 adds sandbox security and cost controls

The Cloud Native Computing Foundation project OpenKruise Agents has released version 0.6.0, introducing significant improvements to security, lifecycle management, and cost efficiency for AI agent workloads. Published on November 3, 2026, this update focuses on hardening sandbox environments and automating resource usage for teams running agents at scale on Kubernetes.

What happened

OpenKruise Agents is a sub-project of OpenKruise that manages the full lifecycle of Agent Sandboxes. Since the previous major release, v0.3.0, the project has merged 283 pull requests and welcomed 27 new contributors. Version 0.6.0 shifts the architecture from a simple workload layer to a system with its own dedicated data plane, adding two new core components: the traffic-control-plane and the traffic-proxy. This structural change allows for deeper inspection of network traffic and more granular control over sandbox behavior without relying on external add-ons.

The release addresses three primary value dimensions for platform teams and AI engineers: security hardening, operational capability, and cost optimization. By moving traffic inspection and policy distribution into first-class components, the system can now enforce strict network rules, manage credentials securely, and automatically pause idle sandboxes to save resources. The update also expands the Custom Resource Definition count from six to twelve, introducing new objects like PoolAutoscaler and TrafficPolicy to support these advanced features.

How it works

The new architecture splits network enforcement into two stages to balance performance and security. Node-side L4 filtering happens inside the pod via the new traffic-proxy sidecar, blocking unauthorized destinations with low latency before traffic ever leaves the node. Centralized L7 deep inspection occurs at the egress gateway, where the Egress Policy Enforcer applies complex rules, checks Model Context Protocol tool allowlists, and injects credentials. This ensures that sensitive API keys are resolved proxy-side from Kubernetes Secrets and rotated without restarting the sandbox, keeping them out of the agent code.

Cost optimization is driven by automatic pause and resume mechanisms. The system uses probes to detect idle sandboxes and pauses them to stop CPU consumption. When a scheduled task approaches or a new request arrives, the sandbox wakes up automatically. The ingress gateway handles wake-on-traffic, meaning the first authenticated request triggers the resume process. If a probe fails or times out, the system defaults to safety by neither pausing nor waking the instance, preventing accidental data loss or service interruptions.

Key details

• Network security: Implements L4 whitelist filtering, L7 request inspection, and MCP tool-level access control lists with short-lived rotatable JWT tokens.
• Credential management: Resolves upstream API keys from Kubernetes Secrets at the proxy level, allowing rotation without sandbox restarts.
• Lifecycle operations: Supports CheckpointRestore to preserve rootfs during upgrades and allows batch-upgrading paused fleets without manual intervention.
• Scaling: Introduces PoolAutoscaler for declarative warm pool capacity with watermarks and cron-based scaling schedules.
• Idle detection: Uses probe-driven logic to pause idle sandboxes and wake them on schedule or first request, reducing unnecessary compute costs.
• Community growth: The release includes contributions from 27 new developers and doubles the number of managed CRDs to twelve.

Why it matters

For engineering teams building AI products, managing sandboxed environments often involves a trade-off between security and convenience. Previous versions required external tools or manual processes to handle network policies and credential injection, which could lead to security gaps or operational overhead. By integrating these controls directly into the data plane, v0.6.0 allows platform teams to enforce strict egress policies and manage identities centrally. This reduces the risk of credential leakage and ensures that agents only access approved services, a critical requirement for enterprise deployments.

Cost efficiency is another major concern when running large fleets of agent sandboxes. Idle instances consume resources even when not actively processing tasks. The new automatic pause and resume features, combined with declarative pool scaling, enable teams to right-size their infrastructure dynamically. Sandboxes can scale down during off-peak hours and wake up just before scheduled tasks, ensuring that compute spend aligns closely with actual usage. This operational maturity makes it feasible to run agent workloads in production without prohibitive infrastructure bills.

What you can do

• Upgrade to OpenKruise Agents v0.6.0 from GitHub Releases or major image registries to access the new security and scaling features.
• Define TrafficPolicy and SecurityProfile resources to whitelist specific destinations and enforce L4/L7 network rules for your sandboxes.
• Configure PoolAutoscaler with cron schedules to automatically adjust warm pool capacity based on expected peak usage times.
• Enable automatic pause and resume by setting lifecycle policies to pause on timeout and auto-resume on traffic or schedule.
• Migrate credential management to use Kubernetes Secrets with proxy-side resolution to avoid embedding API keys in agent code.
• Join the community meeting on Thursdays at 19:30 GMT+8 or file issues on GitHub to contribute to the upcoming roadmap items.