NVIDIA hands agent-security runtime to the CNCF and opens AI cluster tooling

At KubeCon, NVIDIA donated OpenShell to the CNCF and released open source Kubernetes tools for AI factories, with faster startup reported by two partners.

On November 10, 2026, at KubeCon + CloudNativeCon, NVIDIA announced it is donating OpenShell to the Cloud Native Computing Foundation as a Sandbox project. OpenShell is an open source runtime for securing and governing autonomous AI agents. The CNCF is a nonprofit under the Linux Foundation and hosts KubeCon. NVIDIA says hundreds of organizations use OpenShell and that it has drawn tens of thousands of contributions in under a year since launch.

OpenShell applies deterministic controls to agent activity, so teams can enforce policies on tool use, inference service access and workload execution. Users can plug in their own compute, inference providers, credential storage and monitoring tools. NVIDIA is also contributing to Agent Substrate, a Google-originated CNCF Sandbox framework for long-running agent workloads on Kubernetes. It suspends and resumes agents across a shared pool, releasing compute when they are idle. NVIDIA and Google are working on an OpenShell integration.

NVIDIA also announced three open source DSX AI Factory Platform components: NVIDIA Kubernetes Engine, NVIDIA Kubernetes Recipes and NVIDIA Snapshot. The first two, in public preview, automate cluster lifecycle management and provide signed, version-pinned images. Snapshot restores checkpointed inference replicas in seconds without model reload or warmup. Crusoe reported cutting time to readiness from about eight minutes to 31 seconds on HGX B300 systems, and Saturn Cloud reported vLLM scale-from-zero startup falling from 2 to 8.5 minutes to 6 to 34 seconds.

Why it matters: running AI infrastructure takes scarce expertise, and neutral, open tooling for governing agents and managing clusters lowers that barrier. Faster startup also means idle compute can be released instead of held, which stretches existing hardware further.

Caveats: this is NVIDIA's own announcement, and the speed figures come from design partners testing their own workloads. The Kubernetes tools are only in public preview, and the partner integrations, including Mirantis, Rafay and SK Telecom, are plans rather than shipped products.

Source: NVIDIA