Loading…
Red Hat
Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations.
- 87 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
vLLM vs. SGLang: Choosing the right inference engine for your workload
Open weight models now process nearly 80% of production tokens on Vercel’s AI Gateway, up from under 10% in December 2025, and OpenRouter shows a similar climb. This surge drives teams to consider self-hosting via inference engines like vLLM and SGLang, since swapping backends usually only requires a new base URL for an OpenAI-compatible API. vLLM’s PagedAttention, introduced by UC Berkeley in 2023, splits the KV cache into fixed-size blocks to eliminate wasted contiguous memory reservation and increase GPU throughput. SGLang’s RadixAttention, from LMSYS in January 2024, stores computed KV cache in a radix tree keyed by token prefix for reuse across related requests like multi-turn chat and agents. Independent benchmarks from Modal show comparable performance on random prompts without prefix sharing, indicating that workload type and hardware should guide engine choice.
Configure Red Hat OpenShift Dev Spaces for enterprise security
Red Hat OpenShift Dev Spaces can be hardened for enterprise use by centralizing SCM authentication with OAuth, deploying a private OpenVSX extension registry, and enabling IntelliJ IDEA in restricted networks. The SCM integration uses a dedicated OAuth application and the scm-oauth-config Secret in the operator namespace, while disabling the default CA bundle mount reduces etcd overhead but requires an explicit corporate CA ConfigMap with keys ca.crt and githost to prevent TLS failures. A private OpenVSX registry with PostgreSQL-only architecture replaces external extensions, and automated governance rejects prereleases, timestamp builds, oversized patches, and previews through version-aware dependency resolution and idempotent publication tracking. For JetBrains support in air-gapped clusters, administrators mirror IDE tarballs to an internal repository and set editorsDownloadUrls; developers connect via JetBrains Gateway using either dashboard- or gateway-initiated workflows, both relying on an existing oc login session. This configuration gives platform teams oversight of authentication, extensions, and IDE tooling.
Test and deploy bootable containers with bootc virtualization kit (bcvk)
Managing a traditional operating system across multiple hosts often leads to configuration drift, slow updates, and painful rollbacks. Bootable containers solve this by packaging the entire OS as an OCI container image, including the kernel, initrd, bootloader, and applications. Red Hat Enterprise Linux 10 introduced image mode deployment, and the bootc container virtualization kit (bcvk) enables end-to-end testing of these images on a laptop using familiar Podman and libvirt packages. The tool offers three deployment modes: ephemeral for rapid testing, persistent for long-term development, and disk image for creating bootable artifacts. Users build a custom bootc image via a Containerfile with the containers.bootc=1 label, then deploy it identically across virtual and physical infrastructure, reducing environmental drift.
Red Hat AI Inference 3.5 MaaS governance on AKS
Red Hat AI Inference 3.5 extends its Model-as-a-Service (MaaS) governance layer to non-OpenShift Kubernetes distributions, including Azure Kubernetes Service (AKS). MaaS adds multi-tenant API governance on top of the inference platform, controlling authentication, rate limiting, and model access via Authorino and Limitador from Red Hat Connectivity Link (Kuadrant). A model is first deployed with a single LLMInferenceService YAML, creating a vLLM server and router-scheduler, but the endpoint is open. Applying a MaaSSubscription and MaaSAuthPolicy activates governance: Authorino validates API keys or JWTs, and Limitador enforces token rate limits. The post demonstrates three enforcement scenarios on an AKS cluster with a T4 GPU running Qwen3-0.6B: 401 for missing or invalid keys, 200 for authenticated requests, and 429 when rate limits are exceeded, blocking requests before they reach vLLM.
Sharding etcd on hosted control planes and what the numbers actually say
Sharding etcd on hosted control planes splits the key-value store into multiple instances by resource kind, a tech preview feature tested with a main shard for cluster state and a dedicated events shard on Red Hat OpenShift 4.21 with HyperShift. Under event pressure from synthetic storms and realistic crashlooping pods, the sharded configuration showed up to 96% fewer slow applies, faster compaction and raft snapshot durations, and 60% more WAL fsyncs and 90% more backend commits combined. The sharded arm never failed the event storm workload, while the standard arm occasionally did. Pod-ready latencies and workload finish times remained comparable across both configurations. The trade-offs are roughly 1.8 to 2.3 times the etcd container memory and a compaction regression under large custom resource quota pressure that is still under investigation.
Build an AI matching engine with Docling, Granite & OpenShift AI
PeopleMesh uses Docling and Granite4:3B LLM on Red Hat OpenShift to extract structured data from PDF resumes and match people across multiple dimensions. Docling converts documents into a DoclingDocument with semantic labels using an AI model trained on 150,000 annotated samples to recover reading order from PDF’s print-oriented encoding, then exports to Markdown for LLM-driven JSON extraction via a system prompt. For matching, PeopleMesh decomposes a user query with an LLM to extract intent, entity type, country, and language, then applies structured filtering followed by semantic vector search via cosine similarity on distilled query embeddings. To mitigate embedding dilution from concatenated concepts, PeopleMesh uses a weighted scoring algorithm that reranks top 100 candidates using 7 information channels including nice-to-have skills and penalty multipliers for missing must-have and negative skills. The scoring provides relative ordering only, not normalized probabilities, and default weights are adjustable via the SearchOptions Java record.
Build a multi-tenant platform with OpenShift Dev Spaces
Local developer workstations introduce three concrete operational risks: production-parity risk from environment drift, slow time-to-first-commit for new engineers, and unmanaged security exposure from misconfigured tools. Red Hat OpenShift Dev Spaces addresses these by moving compute and tooling into containerized workspaces running directly on the cluster, with environments declared as code in a devfile. A production deployment requires four-zone namespace isolation separating control (openshift-devspaces), core server (devspaces-checluster), secure asset (devspaces-openvsx), and sandbox (username-devspaces) zones to prevent operator reconciliation from overriding custom configurations. Resource governance uses a two-tier model with defaultContainerResources fallback limits and containerResourceCaps absolute per-container ceilings, while automated cleanup cron jobs (monthly on the 1st) and inactivity idling (after 4 hours) protect etcd health by removing stopped workspaces after 30 days. The guide concludes with next steps for authentication and private extension registries.
Manage RHEL with MCP servers and Red Hat Lightspeed
The post details a hands-on lab from Red Hat Summit 2026 that demonstrated managing Red Hat Enterprise Linux using three Model Context Protocol (MCP) servers connected to a single goose client. The MCP servers for Red Hat Lightspeed, Red Hat Satellite, and RHEL each require different authentication: a Hybrid Cloud Console service account, a registry.redhat.io login with a CA bundle and personal access token, and pre-configured SSH keys respectively. Installation is straightforward using Podman containers for Lightspeed and Satellite, and uv for the RHEL server. The author tested about a dozen models and found MiniMax M2 effective, but had to switch to Claude Opus 4.6 when a shared Vertex AI token limit was exceeded during the lab. Key takeaways include that authentication is the most complex part, model choice significantly impacts behavior and cost, and capacity limits must be considered for multi-user environments.
Egress network quality of service on Red Hat OpenShift
Network bandwidth is a compressible resource, so setting a flat cap wastes capacity when the link is idle. The real goal is to prioritise production traffic while guaranteeing background workloads a minimum floor, allowing either class to burst to full capacity when the other is idle. The upcoming NetworkQoS CRD in OVN-Kubernetes will bring declarative traffic management, but until then administrators can use Linux traffic control (tc). A hierarchical token bucket (HTB) qdisc tree on the node’s physical interface, with filters matching background traffic by destination IP, provides the desired dynamic prioritisation. In a lab test with 25 Gbps bonded NICs, production traffic maintained 19.5 Gbps under contention while background traffic was throttled to 2.7 Gbps, just above its guaranteed floor.
Migration toolkit for applications 8.3: Agentic code modernization, PVC mobility, and out-of-the-box generators
Red Hat’s migration toolkit for applications 8.3 is now generally available, adding agentic code modernization, direct storage mobility, and automated pipeline generation to OpenShift. The release serves as the official transition path from the migration toolkit for containers, which has reached end of support. For stateful workloads, it introduces direct TLS-encrypted persistent volume claim transfers with a stage-and-cutover flow, S3-mediated indirect transfers for disconnected environments, and intra-cluster StorageClass conversions that bypass Kubernetes immutability constraints. A developer preview agentic migration factory runs configurable multi-agent workflows that analyze dependencies, update code, and validate builds across independent stages, passing context through handoff files on shared Git branches. The toolkit also ships three new Helm-based generators that produce Tekton pipelines, Argo CD Application resources, and Kubernetes deployment manifests for onboarded applications.
Use Paicku to containerize and test any app with buildpacks and Node.js
Paicku is a command-line tool and Node.js library that wraps the Pack CLI to containerize applications using Cloud Native Buildpacks. It can be installed globally via npm install -g paicku or run with npx. It downloads and configures Pack for the host OS and container runtime, eliminating manual setup. Users build images with npx paicku build, defaulting to builder paketobuildpacks/builder-ubi8-base, and can list available builders with the suggest command. The Node.js librarys createPaicku function provides a build method returning an image object with run and stop for integration tests; an example test builds an app, starts the container, and asserts HTTP 200. Paicku detects Docker or Podman and supports any language a builder supports, such as Node.js and Java, by only changing the application path.
How IdeaBot drives AI innovation workflows on OpenShift
Red Hat’s emerging technologies team built IdeaBot, an AI-enabled SaaS platform on OpenShift that automates innovation workflows from initial concept to a standardized idea report. The platform guides users through four stages—discovery, research, refinement, and synthesis—using conversational interviews, automated research across internal and external sources, a curation board with confidence scoring, and a synthesis view that compiles deliverables like executive summaries and market analysis. Security enforces session isolation in dedicated pods, credential isolation through an auth proxy and token service that injects short-lived tokens, and stateless compute with PostgreSQL persistence and a warm pod pool to reduce cold starts. Development uses EARS syntax and Gherkin feature files to drive behavior-driven development, enabling automated test generation and reproducible builds. Red Hat plans to extend IdeaBot toward fully autonomous, reproducible agentic SDLC pipelines using factory patterns.
Declarative clusters: GitOps deployment of hosted control planes on Red Hat OpenShift Virtualization
Hosted control planes for Red Hat OpenShift, based on the HyperShift project, decouple the cluster control plane from worker nodes by running control-plane components as pods inside a central management cluster. On bare-metal infrastructure, OpenShift Virtualization provisions worker nodes as virtual machines, enabling live migration and reducing hardware requirements. The article presents a declarative GitOps workflow using Helm templates and an Argo CD ApplicationSet that dynamically generates deployments from tenant-specific YAML configuration files in Git. Prerequisites include a bare-metal management cluster with OpenShift Virtualization, Red Hat Advanced Cluster Management, and OpenShift GitOps, plus networking configured with NMState, Multus CNI, and MetalLB. The approach achieves a “Cluster-as-a-Service” model where provisioning a production-grade cluster requires only a Git push.
Rossoctl for agent discoverability, security, and observability on Kubernetes
Agent sprawl arises when many AI agents on Red Hat OpenShift become redundant, insecure, and untraceable, using static API keys over HTTP and lacking visibility into reasoning failures. Rossoctl, a Kubernetes-native controller, automates discovery by declaring AgentRuntime resources that fetch metadata to create AgentCard custom resources, and uses a two-phase Helm deployment to resolve the URL dependency between routes and AgentCards. It adopts the A2A protocol, which standardizes agent interaction through a machine-readable AgentCard at /.well-known/agent-card.json and a JSON-RPC interface for consistent payloads. Security follows a six-layer zero-trust model: SPIRE issues short-lived certificates, Istio enforces mTLS, AgentCards are signed with JWS, and AuthBridge provides scoped OAuth2 tokens. Observability uses opt-in MLflow tracing that captures orchestration flow, tool calls, and model latency, enabling diagnosis of semantic failures such as hallucinations or data leaks that standard metrics miss.
Why your non-root container dropped its capabilities (and how to fix it)
A platform engineer traces why a non-root OpenShift container configured with CAP_NET_RAW still fails ping with Operation not permitted. The root cause is that SCC is only an admission-time gate that does not enforce runtime privileges. CRI-O translates the PodSpec into an OCI spec with the capability in the Bounding, Effective, and Permitted sets but deliberately omits ambient capabilities. During the runtime’s UID transition from root to the target non-root user, the kernel clears both Permitted and Effective sets, leaving an empty CapEff. The only mechanism that survives a UID transition for non-root processes is ambient capabilities, which CRI-O intentionally avoids to preserve the Kubernetes assumption that switching to a non-root user drops capabilities. To resolve this, file capabilities can be applied directly to the binary via setcap, avoiding the need for ambient capabilities.
Add NeMo Guardrails to a LangGraph agent on OpenShift AI
LangGraph agents can call tools and follow prompts but lack safety guardrails, risking unsafe responses like explaining fraud. NeMo Guardrails acts as a transparent proxy between the agent and LLM, inspecting every request and response without requiring agent code changes. On Red Hat OpenShift AI, the guardrails service is deployed via a NemoGuardrails custom resource managed by the TrustyAI Operator, and the agent’s BASE_URL points to this service instead of the model endpoint. The example demonstrates three rail types: regex filtering for jailbreak patterns, content safety classification against S1-S13 categories, and topic safety to keep the agent within a banking domain, with optional tracing using MLflow and OpenTelemetry. Rails execute sequentially, with the first failure short-circuiting the chain, and the separation lets safety policy be owned by guardrails while the agent handles reasoning and tools.
Benchmarking AI decision models against traditional guardrails
Enterprise generative AI applications require guardrails that balance flexibility with reliability. Decision models such as TypeSafe AI’s Jev produce fixed decisions with guaranteed schema and type safety, operating faster and cheaper than LLM-as-a-judge approaches. The Red Hat AI Safety team benchmarked nine guardrails across four methodologies for prompt injection and content safety tasks: pre-trained CPU-scale classifiers like Red Hat’s DeBERTa-v3 and Granite Guardian HAP-125m, older zero-shot models like BART-large-mnli, modern LLM-as-a-judge safety models including Shieldstral and Nemotron-3.5, and Jev-style decision models including Laya and DiffusionGemma. Each guardrail was evaluated using stock and custom risk policies, with Jev and DiffusionGemma using zero-shot questions. The results highlight trade-offs: Jev provides zero-shot flexibility and low latency, but purpose-built classifiers often match its speed and cost while delivering superior task-specific performance, and LLM-as-a-judge models can be tuned for higher accuracy.
Kube AuthKit: Unified Kubernetes and OpenShift auth in Python
Kube AuthKit is a lightweight Python library that unifies Kubernetes and OpenShift authentication behind a single API, eliminating conditional code paths across local, pod, notebook, and CI/CD environments. It supports four strategies—kubeconfig, in-cluster, OIDC, and OpenShift OAuth—auto-detected by an AuthFactory that probes environment variables and in-cluster markers in a defined order. The library handles token lifecycle transparently, with in-memory storage by default and optional OS keyring persistence for local development to avoid repeated logins. It provides two OIDC flows: device code for headless environments and authorization code with PKCE for interactive applications, both with automatic token refresh. Kube AuthKit returns a standard Kubernetes Python client ApiClient, ensuring full compatibility with the official library, and is actively maintained by the Open Data Hub community for OpenShift AI environments.
Smarter GPU sharing: How Red Hat build of Kueue works with dynamic resource allocation
The Kubernetes device plugin model treats GPUs as anonymous integers, making fair sharing impossible because a full 80 GB GPU and a 5 GB partition both consume ‘1’ from the same quota. Dynamic resource allocation (DRA), generally available in Kubernetes 1.34, replaces this by having drivers advertise real device attributes like memory and compute capability, but DRA alone does not address quota management or preemption. Red Hat build of Kueue 1.4 on Red Hat OpenShift integrates with DRA to enforce quota, borrowing, and preemption for both whole GPUs and partitionable devices using device-count or counter-based memory accounting. For partitionable GPUs, Kueue reads counter data from DRA drivers and charges GPU memory against ClusterQueue quota instead of device count, enabling accurate fair sharing between training and inference workloads. Future developments include extended resources for simpler adoption without ResourceClaimTemplates, consumable capacity for dynamic time-slicing, and scheduler-library integration to verify scheduling feasibility.
Master your skills: Building skills you can trust
Skills in AI agent projects silently misfire when their trigger descriptions are passive or too general, causing the agent to skip using them. The authoring tool skill-creator, from Anthropic’s skills collection, provides an eval loop that generates positive and negative test prompts and iterates on description accuracy using a training and held-out test set to avoid overfitting. These tests are ephemeral, so the open-source framework promptfoo extends them into permanent configuration files that can be committed alongside skills. Promptfoo’s agent SDK providers test through the actual agent runtime and include a skill-used assertion to confirm proper routing, and its YAML-based configuration fits naturally into version control. The final step is wiring promptfoo evals into CI, using GitHub Actions with path filters to run on pull requests that modify skills, catching regressions before they ship and costing roughly $0.10-0.15 per eval.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.