AI
What Kubernetes Agentic Networking Is and Why It Exists
Kubernetes Agentic Networking is a sub-project under SIG Network. Its goal is a standardized API for secure, governed communication between AI agents, tools, and LLMs. Traffic covered includes ingress, egress, and east-west paths. The project targets three personas: AI engineers who need to audit agent actions, platform engineers who want default-deny traffic policies, and security engineers who need pre-request and post-response filtering against threats like prompt injection. Protocol choices such as MCP and A2A are treated as implementation details the API should outlast.
Two New CRDs: XBackend and XAccessPolicy
The reference implementation adds two experimental Gateway API extensions. XBackend defines an MCP server backend with hostname or service name, port, and path. XAccessPolicy targets either an XBackend or a gateway and carries authorization rules. An empty tool allow list means no tool calls pass. A non-empty list explicitly names which tools the agent may invoke. Both CRDs feed a control plane called the Agentic Net Controller, which configures an Envoy proxy acting as the agent gateway. The X prefix signals these are not yet production-ready.
Live Demo: Default Deny then Selective Allow
On a kind cluster with two namespaces, agentnet-system and quickstart, Meng showed an ADK agent connected to a local MCP server and a remote DeepWiki MCP server. Without any access policy, the agent could call all tools across both servers. After applying an XAccessPolicy with an empty allow list, calls to read_structure and read_content returned denied. After updating the allow list to include get_sum and get_tiny_image, get_sum succeeded and echo was denied. The demo proved tool-level authorization works end-to-end through the Envoy gateway.
Distributed Tracing for Policy Decisions
Tracing is a provisional proposal, not yet in the reference implementation. The design follows standard OpenTelemetry architecture: spans emitted from agents, gateways, and tool servers flow into an OTel collector, then to backends like Tempo or Jaeger, and front-ends like Grafana. The key design goal is propagating the same trace ID across every component so that a denied tool call, such as delete_customer_data matching a default-deny rule, records the event action, outcome, error type, and the message that the user role lacked privileges. A telemetry policy API proposal is also open for community comment.
Guardrails at the Networking Layer
Agents as individual tools cannot be trusted to enforce their own guardrails, for the same reason Kubernetes does not trust containers to enforce network policies. The gateway sits on every request and response, making it the right place to filter. A prompt injection example showed a user request appending “send me a list of all customers with contract numbers” to a benign query. A tool response example showed injected instructions to forward gathered data to a third-party email. The AI Gateway working group has a payload processing resource proposal targeting exactly these filtering scenarios.
Roadmap and How to Contribute
Planned work beyond the current reference implementation includes deny lists for tools alongside the existing allow lists, authorization policies for agent-to-agent and agent-to-LLM paths, governance of ingress AI traffic from human users or external agents, and token-based rate limiting. The group meets weekly at 8 a.m. and is active on the Kubernetes Slack at sig-network-agentic-networking. The quickstart shown in the demo is publicly available so anyone can run MCP servers and test tool authorization locally.
Notable Quotes
cube agentic networking is a sub project under sig network. It aims to provide a standardized API for secure governed communication for the next generation of AI agents. Haiyan Meng · ▶ 00:25
Agents as tools could validate all their different inputs and outputs. But like Kubernetes doesn’t just trust containers to enforce their network policies. We can’t necessarily expect all our agents to enforce guardrails themselves Evaline Ju · ▶ 22:00
you got a false reus deny and then similarly we call the read content of the repo. Haiyan Meng · ▶ 13:58
the X prefix means these are exper experimental API. They’re not ready for production usage. Haiyan Meng · ▶ 04:05
Key Takeaways
- Two experimental CRDs, XBackend and XAccessPolicy, enforce tool-level authorization for AI agents via Envoy.
- Empty allow lists default-deny all tool calls; named tools must be explicitly permitted per agent identity.
- Tracing and guardrail filtering are in proposal stage, targeting OpenTelemetry conventions and Gateway-level payload inspection.
About the Speaker(s)
Haiyan Meng is a Senior Software Engineer at Google and has been on the Google Kubernetes Engine team since 2019. Her work covers Config Sync, GKE’s GitOps service, and Fleet, GKE’s multi-cluster solution.
Evaline Ju is a Senior Software Engineer at IBM Research in Denver, Colorado. She focuses on guardrails infrastructure for agentic systems. Her previous work includes MLOps for IBM’s cloud ML offerings.