AI Agents Are Having Their Kubernetes Moment
Ten years ago, we saw infrastructure responsibilities moving out of microservices and into Kubernetes, service meshes, and proxies. Applicat...
📝 摘要
本文论证 AI agents 正在经历十年前微服务所经历的同一种范式迁移：基础设施职责（生命周期管理、网络控制、沙箱隔离、状态持久化）正在从应用/harness 代码中抽出，下沉到一个专门的「agentic 基础设施」层。
核心概念： 与 Kubernetes 之于微服务类似，agent 的运行时隔离、资源调度与网络治理正在成为独立的平台层——harness 只负责「用好模型和工具」，基础设施负责「机制、存储与策略」。
关键技术栈 / 关键要点：
- Harness-based agents — 调用模型和工具的逻辑越来越沉淀在可复用的 harness 中，可在沙箱中执行代码，用文件配置 skills/plugins/MCP 连接，会话状态也可落在文件系统上
- 生命周期与持久化 — Agent Substrate 管理沙箱化工作负载、checkpoint 内存与文件系统状态、挂起空闲负载以释放算力；NVIDIA OpenShell 与 k8s-sigs Agent Sandbox 同样把沙箱管理移出 harness
- 网络治理下沉到网关 — ingress 端鉴权、授权与策略过滤，egress 端控制模型/工具调用、附加后端凭据、限制数据去向；agentgateway 强制执行访问策略（含 MCP 工具调用）
关键结论 / 实践建议： 建议从 Agent Substrate 与 Agent Gateway 入手学习这些技术。harness 应聚焦规划、上下文管理、执行策略选择与验证反馈，而沙箱、状态、网络等横切能力交由独立的 agentic 基础设施层处理。
Ten years ago, we saw infrastructure responsibilities moving out of microservices and into Kubernetes, service meshes, and proxies. Application code could focus on business logic, while the platform handled deployment, lifecycle, networking, and other operational concerns.
Now I see a similar shift happening with AI agents.
An agent calls models and tools, but increasingly that logic lives in a reusable harness. These harness based agents can execute code in a sandbox and use files to configure their skills, plugins, and MCP server connections. Session state can live on the filesystem too.
That requires stronger runtime isolation and lifecycle management, including filesystem persistence. Networking controls must also govern what data a nondeterministic agent can access and where it can send that data.
Two areas where this shift is already emerging are lifecycle management and networking.
查看图片描述
ALT
Lifecycle and persistence move into agentic infrastructure
The runtime must isolate execution, use resources efficiently, and preserve state across sessions. Agentic infrastructure can provide that machinery to multiple harnesses.
Agent Substrate manages sandboxed workloads, checkpoints memory and filesystem state, and suspends idle workloads so workers can serve active ones. It releases compute while keeping snapshots in durable storage, then restores execution when needed.
The harness orchestrator decides when it is safe to suspend and when it is time to resume. The infrastructure handles the mechanism and storage. Deciding what belongs in the model's context remains harness work.
NVIDIA OpenShell and Kubernetes SIGs' Agent Sandbox also move sandbox management outside the harness, with different priorities. Solo's comparison of OpenShell and Agent Substrate looks at isolation, resource efficiency, and state management.
Networking moves into gateways
Agents are nondeterministic, so we need explicit controls over what they can see and what they can call. That means controlling both what reaches the harness and what leaves it.
On ingress, authenticate callers, authorize requests, and apply policies to the data and instructions passed to the harness. On egress, control which models and tools the agent can call, attach backend credentials, and restrict where it can send data.
agentgateway enforces access policies for traffic routed through it, including MCP tool calls. Its backend authentication can attach credentials outside the harness.
Changing the harness should not require rebuilding those access rules. Network controls must prevent unauthorized destinations, while the agent and its tools still need task specific checks and approval decisions.
The harness can then focus on getting the best out of the model and tools to achieve the goal: planning the work, managing context, choosing execution strategies, and improving results through verification and feedback.
If you want to start learning these technologies, check out Agent Substrate and Agent Gateway.
I write more about emerging AI architectures, agent infrastructure, and software development trends in my newsletter. Subscribe for longer-form posts: https://generativeprogrammer.com/