AzureFeeds

kars is a Kubernetes-native runtime for AI agents on Azure. It treats every agent as untrusted code: per-pod kernel isolation, zero credentials in the agent process, end-to-end encrypted inter-agent mesh, and native consumption of the Microsoft Agent Governance Toolkit. Agents on any supported framework are governed by one set of Kubernetes policies.

This builds on the foundation Brendan Burns described last month – From open source to agentic systems: a hardened Azure Linux substrate (Azure Linux 4.0 + Azure Container Linux), an open agentic stack (Microsoft Agent Framework, AGT, A2A), and the Agentic AI Foundation. kars is a K8s-native runtime that composes these primitives into a single, deployable stack you can drop into AKS.

One set of Kubernetes policies governs every agent framework

You declare an agent’s model, tools, memory, and MCP access as Kubernetes CRDs – InferencePolicy, ToolPolicy, KarsMemory, McpServer – and the per-pod router enforces them identically for every runtime, not the framework.

• One policy language across OpenClaw, Hermes, LangGraph, MAF and the rest – the runtime can’t bypass it.


• Team A on harness A, Team B on harness B – one governance surface, one audit trail. Framework choice stops fragmenting how you govern.


• Operate it from the cluster – GitOps the policies and watch the fleet in the Headlamp plugin (a Kubernetes dashboard for sandboxes, policy CRDs, and mesh topology) or the kars operator TUI.

Governing agents at scale becomes a Kubernetes problem, not an N-frameworks problem.

Try it

# 1. Install the CLI (Node 22+)

npm install -g @kars-runtime/cli

# 2. Try it on your laptop on a kind cluster that mirrors the AKS layout.

#    kars dev prompts for the model provider.

#    Default sandbox type is OpenClaw.

kars dev –target local-k8s –release
# 3. List your agents and open the web UX with your OpenClaw dev-agent

kars list

kars connect dev-agent
# 4. Review using a CLI-based TUI operator view

kars operator

Going to production? kars up provisions the AKS cluster, controller and your first sandbox; Full path in the Quickstart guide.

The architecture, in one picture

Why this design

Four convictions shaped kars. Each is opinionated; each rejects an assumption I see repeated in the agentic-AI conversation.

1. The agent is untrusted code, not a microservice.

An agent’s real instructions are assembled at runtime from model output, tool responses, and content you don’t control — and prompt injection turns any of them into a command. So the agent process holds no secrets, has no ambient network reach, and is isolated at the kernel, not just the network policy.

2. Delegation is a security boundary, not a function call.

When an agent delegates a sub-task, the sub-agent becomes its own sandbox – its own pod, network policy, and isolation. The agent has no cluster access; it calls one tool, the router runs a governance check, and the parent scopes the child’s model, tools, egress, and token budget – so decomposition and containment are the same act.

3. Governance is the workload, not a wrapper.

Policy, audit, trust scoring, and rate limiting can’t be bolted on later. kars consumes the Microsoft Agent Governance Toolkit (AGT) through stable seams from day one.

4. In-cluster messaging needs end-to-end encryption and built-in trust.

Inside the cluster, agents talk over AgentMesh: an end-to-end Signal-Protocol session where the relay routes ciphertext it can’t decrypt, and peers establish trust autonomously before connecting. We speak A2A too – as the cross-organisation channel for peers outside your kars cluster. Two channels, two trust models.

Spotlight – confidential agents in one CRD field

Some agentic workloads – financial research, clinical, sovereign deployments, classified evals – need more than a hardened namespace. They need a separate kernel per workload, VM-level isolation, and a barrier between the agent and the host. kars wires this into AKS Pod Sandboxing.

apiVersion: kars.azure.com/v1alpha1

kind: KarsSandbox

metadata:

  name: financial-research

spec:

  runtime:

    kind: OpenClaw

  isolation: confidential   # standard | enhanced | confidential

  #          └─ confidential = Kata VM isolation (AKS Pod Sandboxing)

The trust boundary becomes: the workload runs in its own hypervisor-isolated VM with a separate kernel; the host kernel is not in the trust set. Everything else about the agent – framework, model, policy bundle, mesh – works exactly the same. One field changes.

How kars fits the broader open agentic stack

It’s a fair question, so here’s the honest version: kars is a consumer and composer of the open primitives, not a competitor to them. The governance layer is the clearest example – kars doesn’t reinvent policy, audit, signing, or the encrypted mesh. It plugs into Microsoft’s Agent Governance Toolkit through four stable seams (mesh, policy, audit, and signing; the mesh runs on AGT’s agentmesh = “4.0.0” crate), and when we hit a gap we fix it upstream rather than fork – that’s what PRs #2090, #2659 and #2719 were. The Microsoft Agent Framework already runs as a first-class kars runtime, and A2A is live as an inbound gateway with an mTLS-pinned subject for cross-org traffic.

This space is young and moving fast, and a lot of good work is happening in the open – Kubernetes SIG’s sigs/agent-sandbox, kagent, agentgateway. Our stance is simple: move at pace and align upstream over time. The long-term goal is genuine convergence on the shared open primitives, not a parallel stack. Underneath it all, the substrate is the Azure Linux family (ACL and AL4 distroless as they reach AKS-stable), and the plain Kubernetes baseline – Pod Security Admission, NetworkPolicy, seccomp, sidecars – is a hard requirement we never replace.

What’s planned

A few things high on the near-term roadmap:

• airunway support for inference provider


• Azure Linux 4 based distroless images (currently based on Azure Linux 3 distroless)


• Per-agent Autonomy Tiers (1..5) with default policy bundles – closes the uniform-governance failure mode.


• Multi-cloud LLM providers + native guardrails (Anthropic, Bedrock, Vertex, Ollama, vLLM; Bedrock Guardrails, Model Armor, OpenAI Moderation).


• Per-team virtual keys + unified action-cost ledger (model + tool + MCP + mesh + spawn) with a Grafana dashboard.


• KarsKillSwitch CRD + behavioural drift detection + SLO→AGT-quarantine – one-CRD emergency pause; AGT does the actual termination.


• Developer experience layer: KarsRecipe + KarsTask CRDs, browser conversation ingress, Web UI.

Come build with us

The codebase is at github.com/Azure/kars, MIT-licensed. The most useful contributions would be:

Where we want help

• Testing, validation across different environments and continuous feedback


• Parity across all runtime adapters and expand with additional adapters based on demand


• A2A interop (the structured handshake from AgentMesh to external A2A peers).


• Behavioural-drift detection over the mesh + tool-call telemetry.


• Per-agent developer ingress for in-cluster chat / sessions / artifact retrieval.


• OWASP Agentic AI Top 10 and NIST AI RMF mapping artifacts.


• GKE / EKS deployment validation.


• Security review and red-team scenarios.

Some invariants are non-negotiable

• Credentials stay out of the agent process.


• The inference router stays in the pod.


• Inter-agent encryption remains end-to-end (the broker never enters the trust set).


• AGT primitives are consumed, not duplicated.


• No mocks, stubs, or TODO placeholders in production code.

Everything else is open.

If you’re evaluating how to take agentic AI from pilot to production on Kubernetes, I’d value the conversation. More than that: we want to build a genuinely open community around securing AI agents – the hard problems here are bigger than any one team, and they’re best solved in the open, together. Open an issue or discussion on the repository. The next 18 months of agentic AI will be decided less by model quality and more by production governance. I think the answer should be open source, K8s-native, and aligned with the upstream landscape. That’s what kars is.