Secure Agent Workspace

An enterprise-ready Kubernetes container platform built for an open hybrid cloud strategy. It provides a consistent application platform to manage hybrid cloud, public cloud, and edge deployments.

Runs virtual machines alongside containers on OpenShift Container Platform. This pattern runs one workspace VM per user, cloned from a template image with a known, stable configuration. OpenShift Virtualization requires bare-metal worker nodes.

A declarative application continuous delivery tool for Kubernetes based on the Argo CD project. Application definitions, configurations, and environments are declarative and version controlled in Git.

Identity and access management based on Keycloak. The pattern creates an openshell realm with the roles and OIDC clients that the OpenShell CLI, gateway, and web UI use.

Store the model and tool API keys and the SSH key, and copy them into each user’s namespace.

The runtime for agent sandboxes: a gateway that manages workspaces, providers, and sandboxes, and a supervisor in each sandbox that enforces filesystem, process, and network policy. The pattern uses the Red Hat build of OpenShell (quay.io/opendatahub/odh-openshell-*).

The AI agents that run in the sandboxes, with a terminal UI and a web UI.

The default model provider (NVIDIA Nemotron). You can use any OpenAI-compatible endpoint on the cluster instead, such as vLLM or Ollama.

Runs the workspace VMs. The pattern creates each VM by cloning from a template image with a known, stable configuration. The template image is based on Fedora and includes podman and OpenShell service units. The pattern stores the template image as a Containerized Data Importer (CDI) DataSource.

Provides the openshell realm with the openshell-user and openshell-admin roles and the OIDC clients for the CLI (openshell-cli, device code and PKCE) and the web UI (openshell-dashboard). The realm includes test users (alice, bob, developer, admin). Replace these test users before you use the pattern in production.

Store the model provider key, the web search key, and the SSH key that the pattern loads from your values-secret file. The External Secrets Operator copies them into each user’s namespace. By default, all users share one set of keys, but you can also configure an individual Vault path for each user as needed.

A gRPC service that every OpenShell gateway calls before it creates a sandbox or a provider, or changes a sandbox’s configuration. It serves the signed sandbox policy (filesystem, process, and Landlock rules) and the only provider profiles that users can use: nvidia, openai, brave, github, slack, gemini, and web-search. The policy and the profiles are files in the governance-policy chart, so changing them is a Git change. The interceptor fails closed: if it is unreachable, the gateways refuse those operations.

<user>-gateway exposes the OpenShell gateway (port 17670, TLS passthrough, gRPC) for the openshell CLI and the web UI. <user>-webui exposes the OpenShell web UI through an OAuth2 proxy that signs in with Keycloak.

The user’s provider Secrets (inference, web-search), the InstallerBOM, and the user’s SAW-BOM profiles. They are attached to the VM as read-only disks, so the installer reads them without any access to the cluster API.

A Fedora VM (4 vCPU, 8 GiB memory, and a 40 GiB disk by default). The VM runs the following tasks every time it boots:

Each sandbox is a rootless podman container that the OpenShell gateway creates, with a supervisor that enforces the signed policy. The agent’s environment holds only placeholders for API keys. The supervisor’s egress proxy only adds the real API key to requests that are from allowed programs (for example node or curl) and to allowed hosts, which are defined in the sandbox’s provider profiles lists. This means that when an agent calls a model or tool API, the supervisor’s egress proxy can deny outbound traffic by withholding the real API key. All other outbound traffic is denied.