Harnessing OpenShell on Kubernetes: A Platform Engineer's Guide

OpenShell exists to address the growing need for secure and isolated environments for running agents on Kubernetes. As a CNCF Sandbox project initiated by NVIDIA, it allows platform engineers to deploy agents safely, ensuring that workloads do not compromise cluster security. By leveraging the Agent Sandbox resource, OpenShell transforms each sandbox into a Pod, which is crucial for maintaining a controlled execution environment.

The mechanism behind OpenShell involves a gateway that manages every sandbox. When a request is made, the gateway authenticates the caller, resolves necessary parameters like image and policy, and rejects any unsafe configurations. It creates two NetworkPolicies: one for workload Pods, restricting all outbound traffic and allowing inbound traffic only from supervisors on TCP 5500, and another for supervisor Pods. The Sandbox resource is created in a suspended state, and a PVC for /sandbox is established. The supervisor Pod connects to the gateway with a unique identity, ensuring that all outbound requests from the agent are validated before establishing upstream connections.

In production, you need to prepare your cluster by installing a CNI that enforces ingress and egress NetworkPolicies, such as Cilium. Note that currently, OpenShell sandboxes can only be created through the Gateway API, not the Kubernetes API. This could limit flexibility in larger environments, especially since each agent requires a dedicated Supervisor Pod for isolation, which may not scale well. Keep an eye on the roadmap for more flexible deployment options as they develop.