DEVOURED
Running AI Agents Safely Inside Kubernetes
AI agents create a non-deterministic threat model where malicious inputs can hijack control flow, requiring egress-restricted, sandboxed runtime environments.
What: Nimesha Jinarajadasa outlines securing agentic workloads by applying strict 'default-deny' network policies, sandboxing via gVisor or Kata Containers, and using per-tool Model Context Protocol (MCP) server pods to limit credential blast radius.
Why it matters: The shift from deterministic microservices to LLM-driven agents that decide their own execution path at runtime renders traditional static network and RBAC rules insufficient.
Takeaway: Audit your current agent pods for egress controls; if they lack a forward proxy with a domain allowlist, your agent can be exfiltrated via prompt injection immediately.
Deep dive
- Use separate Kubernetes namespaces for each agent class to isolate policy boundaries.
- Implement a 'default-deny' NetworkPolicy for all ingress and egress, then permit only necessary traffic.
- Use an L7 forward proxy like Envoy to enforce DNS-level allowlists, preventing data exfiltration to unauthorized endpoints.
- Apply the Pod Security Admission 'restricted' profile to all agent namespaces.
- Use gVisor for API-heavy agents or Kata Containers for agents executing generated code to ensure kernel isolation.
- Set hard CPU and memory limits to prevent recursive agent loops from crashing nodes.
- Avoid environment variables for API keys; mount secrets as files using tools like External Secrets Operator.
- Run each MCP server as a distinct, least-privileged pod with its own ServiceAccount.
- Implement two-step approval flows for destructive tools (write/delete/transact).
- Log prompts, tool calls, and model responses to a central SIEM for auditability.
Decoder
- Model Context Protocol (MCP): An open standard for connecting AI assistants to systems, databases, and tools, allowing agents to interface with external services through standardized RPCs.
- gVisor: A user-space kernel that provides secure isolation for containers by intercepting system calls and running them in a restricted environment, mitigating kernel exploits.
- Kata Containers: A container runtime that uses lightweight virtual machines to provide hardware-level isolation for each container pod.
- Pod Security Admission (PSA): A Kubernetes feature that defines security standards (privileged, baseline, restricted) for pods based on built-in security policies.
- Blast radius: The extent of potential damage or unauthorized access if a specific system component or process is compromised.
Original article
Full article content is not available for inline reading.
Explore all 57 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi