Agent Substrate, with Tim Hockin and Brandon Royal

Kaslin Fields (0:00)

Hello, and welcome to the Kubernetes Podcast from Google. I'm your host, Kaslin Fields.

In this episode, we sat down with two legends in the cloud-native community, Tim Hockin, one of the original founders of Kubernetes, and Brandon Royal, who drove the upstream work on many projects, including the Agent Sandbox. We spoke about Agent Substrate, a new open-source project designed to run agents at scale on Kubernetes. But first, let's get to the news.

Kubernetes 1.37 is out now. If you haven't yet, check out the release blog and listen in to our latest episode, where we interviewed the release lead, Dipesh Rawat. Kubernetes 1.37's release signals the nearing end of maintenance for version 1.34. Support for 1.34 is scheduled to end on October 27th, 2026, meaning the release will no longer receive security updates or bug fixes. Platform teams still running 1.34 are encouraged to review their upgrade paths and begin planning transitions.

Baumhort has joined the Open Source Security Foundation, or OpenSSF. Baumhort is a Kubernetes-native platform built to ingest, normalize and visualize S-bombs at scale, giving security, compliance and engineering teams centralized visibility into their software supply chain. In a retrospective published on Google's open source blog, Google shared that approximately 10 percent of Alphabet's developer workforce is actively contributing to open source software, supporting foundational industry standards like Kubernetes, Envoy, and VLLM. Did you know that Kubernetes has an official security feed? Rather than relying on third-party security digests, Kubernetes operators are encouraged to track vulnerabilities through the project's official channels. Users can subscribe to the Kubernetes Security Announce Google Group for real-time security alerts, or consume the machine-readable CVE JSON feed to automate vulnerability audits on their clusters. And that's the news.

Abdel Sghiouar (2:11)

All right. Welcome back, folks. I'm here with Tim and Brandon.

Tim is a long-term software engineer with Google Cloud, and I would argue one of the fathers of Kubernetes, so one of the founders of the project. Brandon is one of our product managers on GKE. He has been one of the people behind launching multiple OSS projects like Ray Operator, Agent Sandbox, and our topic for today, the Agent Substrate. Welcome to the show, Tim and Brandon.

Tim Hockin (2:33)

Thanks for having us.

Abdel Sghiouar (2:34)

All right. So we'll get started with you, Brandon. Just give us a high-level introduction to Agent Substrate, what it is, what it's trying to solve. Yeah, sure.

Brandon Royal (2:43)

Maybe before we explain what it is, let's start with what it solves.

We believe that we're in this new paradigm shift in computing. I think in a lot of ways, this is akin to say the early days of Cloud Native, introduction of Kubernetes and Docker that really forced us to rethink how we deploy and manage workloads in Cloud infrastructure and in infrastructure in general. Agents being non-deterministic, they need access to the file system, they need access to the terminal, the browser. So isolation is table stakes. They're also extremely idle. So these same workloads that require this isolation are super idle. We've seen industry-wise, we're not doing great in terms of measuring this, but internal benchmarks, we're seeing greater than 90 percent idleness for a lot of these workloads, these productivity agents and coding agents. Then last of course is governance and control. This is a non-deterministic system, so we need to make sure that we're controlling what it has access to and what network resources it can use, and how they talk to one another. In a lot of ways, it's a really big shift in how we're thinking about computing. Agent Substrate is really just a new set of primitives that are built on top of Kubernetes that allow us to address these unique properties of agent workloads.

We really built Agent Substrate in the open source in very similar ways to Kubernetes. I'm sure Tim will talk a little bit about that, since he was certainly there. But we're seeing really promising results in the open source work that's already happening, greater than 10x density improvements to help with that idleness problem, much better scale than we can do directly within Kubernetes, built in suspend and resume, helps with just faster agent compute environments that could be made available to your agents. So lots and lots of promising work, and we're really excited about the progress that we're making on this front.

Abdel Sghiouar (4:31)

And maybe a follow-up question. When we say idleness, that's basically when the agent is just waiting for a response from the large language model, right?

Brandon Royal (4:37)

It could be a lot of things. It could be the agent waiting from the response from the LLM. It could be, more likely is, for a lot of agents, it's waiting for the human. So, you know, the human maybe needs to approve a tool call, or maybe the human walked away and got a cup of coffee.