Kubernetes Agents Get Sandboxes, Roommates, and Luggage
kagent · release
kagent, the Kubernetes-native framework for running AI agents, just shipped v0.10.0 — its biggest release ever — and the headline is simple: your agents finally get the perks of a proper tenant.
Quick primer for the uninitiated. kagent turns AI agents into Kubernetes resources. You describe an agent in a manifest, apply it like any other workload, and kagent’s controller deploys it, wires it to your model providers and MCP tool servers, and hands you a chat UI plus an A2A endpoint to talk to it. The pain it removes: no more duct-taping agent runtimes, session storage, auth, and model configs together with scripts and hope.
Think of kagent as a property manager for AI agents. It rents each agent a pod, forwards their mail (tool calls), keeps their diaries (sessions), and evicts them politely when config changes. It is a CNCF sandbox project — which is delightfully on the nose, because this release is literally about sandboxes.
Who uses it? Platform engineers and platform teams building internal AI assistants and automation on Kubernetes. If your cluster runs workloads and your company suddenly runs agents, kagent wants to be the layer that treats the two as the same problem.
So why care about v0.10.0 specifically? Three moves: agents get private sandboxes with bring-your-own runtimes, sessions become shareable, and chat learned to accept file uploads. Plus a native Bedrock Guardrails hookup for the compliance-minded. Let us walk through the good parts.
What’s New in v0.10.0
Sandbox Agents Get Real Runtimes and a Memory That Survives
Previously, sandbox agents were a bit like hotel guests who could only order from room service. With PR #2043, the SandboxAgent custom resource now supports bring-your-own (BYO) agents and Python runtimes — meaning you can run your own agent code, isolated from the cluster, as a first-class kagent workload.
And they remember things now. PR #2171 stores session state in a durableDir volume backed by SQLite, with metadata mirrored to Postgres. Sessions survive config rollouts and restarts, controlled by the new KAGENT_SESSION_DB_URL setting.
BYO agents can opt in via the kagent.dev/local-session-storage annotation. Your agent finally keeps its train of thought through a redeploy.
There is even a new roommate: PR #2189 adds a Claude ACP sandbox target, built on claude-agent-acp, that speaks the Agent Client Protocol over stdio. The smoke test from the PR tells the story:
docker run --rm -p 9000:9000 -e ANTHROPIC_API_KEY=<key> kagent/acp-sandbox-claudeWhy it matters: arbitrary agent code, isolated, persistent, and managed like any other workload. That is the difference between an agent demo and an agent platform.
File Uploads in Agent Chat
PR #2429 does what it says on the tin: attach files in the chat UI via the paperclip, drag and drop, or history chips. No more pasting an entire CSV into a text box like it is 2023.
The fine print is a per-provider support matrix — non-image files are now forwarded through the Go model adapters instead of being silently dropped:
OpenAI (CC / Azure / Foundry) | image/* | PDF only
OpenAI (Responses) | image/* | PDF, text, markdown, csv, html, json, word, pptx
Anthropic | image/* | PDF, text/plain, text/markdown
Bedrock | png/jpeg/gif/webp | pdf, txt, md, csv, html, doc/docx, xls/xlsx
Ollama | image/* only | —Why it matters: feeding real documents to agents is the whole job. This removes the most daily-felt friction in the UI — and yes, Ollama users, you are still on images only for now.
Sessions You Can Actually Share
Agents are collaborative; their chat histories, historically, were not. PR #1935 introduces sharing of chat sessions, so a teammate can see what an agent did without you exporting screenshots into a Slack thread.
The A2A side matured too. PR #2187 serves ListTasks from the persistent task store — proper filtering, pagination, and user scoping, fixing a conformance gap. And PR #2191 lets read-only shares read A2A tasks, with enforcement moved from the transport verb to the handler:
Reads pass through: ListTasks, GetTask, push-config get/list, SubscribeToTask
Rejected read-only: SendMessage, SendStreamingMessage, CancelTask,
CreateTaskPushConfig, DeleteTaskPushConfigShare the work, not the keys. Read-only means read-only — even over JSON-RPC.
Why it matters: visibility without handing over write access. Your security team just exhaled audibly.
Guardrails for the Enterprise Crowd
AWS users, this one is for you. PR #2323 adds native Bedrock Guardrails support to ModelConfig — content filtering, denied topics, PII redaction — without standing up a separate OpenAI-compatible proxy. Streaming uses sync processing mode, so interventions apply before content reaches the caller.
provider: Bedrock
bedrock:
region: "eu-central-1"
guardrail:
identifier: "abc123def456" # guardrail ID or ARN
version: "1"
trace: "enabled" # disabled (default) | enabled | enabled_fullWhy it matters: compliance stops being a sidecar project. One block in the config, and the guardrail is enforced by the runtime itself.
Smaller Gifts Worth Unwrapping
- Richer A2A agent cards — icon, provider, documentation URL, and version now flow from the Agent spec onto the A2A AgentCard, so discovering your agent is less like meeting a stranger with no name tag.
- Default agent node selector — a new
--default-agent-node-selectorflag lands agent pods on the right nodes without repeating yourself per agent. - Helm extraObjects — inject arbitrary manifests from the chart. Certificate, policy, that one ConfigObject Legal insists on: now just YAML.
- Configurable tool server refresh — tool server controllers now have a configurable refresh interval for picked-up tools.
- Token limits for OpenAI and native Gemini/Vertex — maxCompletionTokens and maxOutputTokens wired into the model config.
The Serious Part: Security Fixes
Behind the fun, v0.10.0 carries real hardening. PR #2133 patched critical- and high-severity vulnerabilities in the golang-adk-full and app images, PR #2687 resolved CVE-2026-84304 with a grpc bump, and PR #2558 bumped Google ADK to address Starlette security advisories.
Also notable: PR #2265 scopes task get, create, and delete to the owning user — an authorization fix you want deployed before your next audit. And PR #2146 fixed an intermittent Postgres deadlock during concurrent memory searches. If you run kagent on Postgres in production, this release earns its upgrade.
One Sentence, As Promised
kagent v0.10.0 turns the agent platform from a chat window into a place agents actually live — sandboxed, persistent, shareable, and subject to house rules.