---
title: "Red Hat"
description: "Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations."
---

# Red Hat
> Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations.

## Articles

### [Kube AuthKit: Unified Kubernetes and OpenShift auth in Python](https://yomu.fyi/post/kube-authkit-unified-kubernetes-and-openshift-auth-in-python.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Saad Zaher
- Published: Oct 2, 2026
- Type: Problem & solution

Kube AuthKit is a lightweight Python library that unifies Kubernetes and OpenShift authentication behind a single API, eliminating conditional code paths across local, pod, notebook, and CI/CD environments. It supports four strategies—kubeconfig, in-cluster, OIDC, and OpenShift OAuth—auto-detected by an AuthFactory that probes environment variables and in-cluster markers in a defined order. The library handles token lifecycle transparently, with in-memory storage by default and optional OS keyring persistence for local development to avoid repeated logins. It provides two OIDC flows: device code for headless environments and authorization code with PKCE for interactive applications, both with automatic token refresh. Kube AuthKit returns a standard Kubernetes Python client ApiClient, ensuring full compatibility with the official library, and is actively maintained by the Open Data Hub community for OpenShift AI environments.


### [Smarter GPU sharing: How Red Hat build of Kueue works with dynamic resource allocation](https://yomu.fyi/post/smarter-gpu-sharing-how-red-hat-build-of-kueue-works-with-dynamic-reso.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Pannaga Rao Bhoja Ramamanohara
- Published: Oct 2, 2026
- Type: Explainer

The Kubernetes device plugin model treats GPUs as anonymous integers, making fair sharing impossible because a full 80 GB GPU and a 5 GB partition both consume ‘1’ from the same quota. Dynamic resource allocation (DRA), generally available in Kubernetes 1.34, replaces this by having drivers advertise real device attributes like memory and compute capability, but DRA alone does not address quota management or preemption. Red Hat build of Kueue 1.4 on Red Hat OpenShift integrates with DRA to enforce quota, borrowing, and preemption for both whole GPUs and partitionable devices using device-count or counter-based memory accounting. For partitionable GPUs, Kueue reads counter data from DRA drivers and charges GPU memory against ClusterQueue quota instead of device count, enabling accurate fair sharing between training and inference workloads. Future developments include extended resources for simpler adoption without ResourceClaimTemplates, consumable capacity for dynamic time-slicing, and scheduler-library integration to verify scheduling feasibility.


### [Master your skills: Building skills you can trust](https://yomu.fyi/post/master-your-skills-building-skills-you-can-trust.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Dejan Bosanac
- Published: Oct 1, 2026
- Type: Explainer

Skills in AI agent projects silently misfire when their trigger descriptions are passive or too general, causing the agent to skip using them. The authoring tool skill-creator, from Anthropic’s skills collection, provides an eval loop that generates positive and negative test prompts and iterates on description accuracy using a training and held-out test set to avoid overfitting. These tests are ephemeral, so the open-source framework promptfoo extends them into permanent configuration files that can be committed alongside skills. Promptfoo’s agent SDK providers test through the actual agent runtime and include a skill-used assertion to confirm proper routing, and its YAML-based configuration fits naturally into version control. The final step is wiring promptfoo evals into CI, using GitHub Actions with path filters to run on pull requests that modify skills, catching regressions before they ship and costing roughly $0.10-0.15 per eval.


### [GPU virtualization at scale: AMD MI300X SR-IOV on Red Hat OpenStack Services on OpenShift](https://yomu.fyi/post/gpu-virtualization-at-scale-amd-mi300x-sr-iov-on-red-hat-openstack-ser.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Sudhakar Molli, Bohdan Dobrelia, Miguel Carpio, Petr Kubica, Venkataramana Venugopal
- Published: Oct 1, 2026
- Type: Benchmark

Enterprise AI environments are moving from dedicated GPU servers to shared accelerator infrastructure, requiring higher GPU utilization with strong isolation. AMD Instinct MI300X GPUs support hardware-assisted SR-IOV in CPX mode, each exposing eight virtual functions with separate PCI and VRAM allocation. When integrated with Red Hat OpenStack Services on OpenShift, the control plane runs on OpenShift while RHEL compute nodes use EDPM, with Nova scheduling VFs via VFIO PCI passthrough. Validation on an 8-GPU system created 64 VFs, demonstrated 64 VMs with one VF each, and tested up to 32 VFs per VM. BabelStream benchmarks showed approximately 96-99% of bare-metal memory bandwidth, while the testing also identified limitations in GPU peer-to-peer DMA and runtime VF lifecycle.


### [Beyond pass or fail: The new era of chaos engineering](https://yomu.fyi/post/beyond-pass-or-fail-the-new-era-of-chaos-engineering.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Paige Patton
- Published: Sep 30, 2026
- Type: Problem & solution

Binary pass/fail uptime testing no longer suffices for cloud-native deployments because a cluster can remain operational while dropping packets, breaching SLOs, or suffering performance degradation. Krkn addresses this with a trifecta of telemetry: a weighted Resiliency Score, continuous HTTP Health Checks, and KubeVirt Checks. The Resiliency Score is a 0–100% macro-health metric that evaluates live Prometheus data against pre-defined SLOs using custom weights, allowing engineers to prioritize business-critical components like authentication or payment gateways. HTTP Health Checks probe application endpoints at configurable intervals, capturing exact downtime start and end times alongside HTTP status codes, enabling teams to track self-healing duration. KubeVirt Checks monitor virtual machine instances via real-time SSH connectivity and record node, IP address changes, and exact down-time, with a final post-chaos check that flags VMs remaining unreachable after the experiment concludes.


### [Backdoors in LLMs: Why model scanning isn't enough](https://yomu.fyi/post/backdoors-in-llms-why-model-scanning-isn-t-enough.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Uri Shaket
- Published: Sep 30, 2026
- Type: Explainer

Pulling a model from Hugging Face and running benchmarks does not guarantee the model will behave the same in production. Researchers have shown that language models can be trained to act normally during evaluation and defect only when a specific trigger appears, and that standard post-training defenses do not reliably remove such planted behaviors. The attack surface includes malicious artifacts, chat-template injections, LoRA/adapter backdoors, training-data backdoors, and MoE routing backdoors, each requiring different defenses. No single scanner or test can prove a third-party model is clean, so a multi-stage supply-chain process is needed: verify provenance, isolate untrusted artifacts, scan non-weight files, probe behavior, optionally realign, and apply runtime guardrails. The goal is to turn model intake from implicit trust into an auditable process, assuming some malicious artifact will eventually pass the scanner.


### [Distributed training on OpenShift AI 3.4 with Kubeflow Trainer v2](https://yomu.fyi/post/distributed-training-on-openshift-ai-3-4-with-kubeflow-trainer-v2.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Linoy Bitan
- Published: Sep 29, 2026
- Type: Explainer

Red Hat OpenShift AI 3.4 introduces Kubeflow Trainer v2, a unified training API that replaces framework-specific CRDs like PyTorchJob and TFJob with a single TrainJob resource. Under the hood, each TrainJob is translated into a JobSet, a Kubernetes-native API for managing groups of Jobs as a single unit, which handles headless services for pod discovery and automatic failure recovery. The post validates the stack through two phases: manual validation with a minimal NCCL all-reduce test across 2 nodes, and real-world training of an embedding-based neural network on a fraud detection dataset using 1, 2, and 4 NVIDIA A10G GPUs. Benchmarking shows near-linear Distributed Data Parallel scaling at 95% efficiency, successful checkpoint recovery after pod kills, and GPU utilization confirmed via DCGM Exporter. The TrainJob API simplifies distributed training by automatically configuring torchrun, environment variables, and pod coordination, while raw JobSets offer more control for multi-stage pipelines and differentiated failure handling.


### [How we cut CI failure triage from hours to minutes using AI](https://yomu.fyi/post/how-we-cut-ci-failure-triage-from-hours-to-minutes-using-ai.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Vikash Shaw, Andre Lustosa
- Published: Sep 29, 2026
- Type: Problem & solution

The Pipeline Failure Analyzer (PFA) cuts CI failure triage from hours to minutes by confining AI to exactly one of five pipeline stages. Four stages remain deterministic: Prepare cleans raw logs by stripping ANSI codes and progress bars, Summarize assembles structured reports, Notify creates tickets, and Publish commits to wikis. The AI Analyze stage groups failures by root cause using semantic reasoning, overcoming traditional string-based algorithms that fail when the same missing dependency produces different error messages across CPU and GPU architectures. Prepare achieves 95–98% compression on 10,000-line traces, reducing them to 200–500 lines with virtually no signal loss by extracting error anchors and merging overlapping context windows. Before AI output proceeds downstream, five validation layers—including 13-field checks, cross-references, path audits, JSON schema, and trace verification—prevent hallucinated diagnoses from entering tickets or reports.


### [Upgrading to Red Hat JBoss Web Server 7: Key changes & impacts](https://yomu.fyi/post/upgrading-to-red-hat-jboss-web-server-7-key-changes-impacts.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Jeff Beck
- Published: Sep 28, 2026
- Type: Explainer

Red Hat JBoss Web Server 7, based on Apache Tomcat 11 and Jakarta EE 11, requires Java 17 as the new minimum and drops support for Java 11. Jakarta EE 11 does not require another import rename but adds a RecordELResolver for records and an OptionalELResolver for optionals. Tomcat 11 changes parameter parsing to throw exceptions on malformed requests, reduces maxParameterCount to 1,000 from 10,000, removes FailedRequestFilter and HTTP/2 push, and retains quotes in cookie values per RFC 6265. The Java SecurityManager is removed, UBI 8 images are discontinued for UBI 9, Prometheus is no longer bundled, and Red Hat recommends container isolation as replacement. Teams must confirm Java 17 readiness, check for SecurityManager usage, update their base image pipeline, and note that Spring Boot 4 on JWS 7 is unsupported.


### [How to rank fraud detection models using custom cost metrics](https://yomu.fyi/post/how-to-rank-fraud-detection-models-using-custom-cost-metrics.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Isaac Tigges, Neha Malepati
- Published: Sep 28, 2026
- Type: Tutorial

Accuracy is misleading for fraud detection because a model labeling everything legitimate can score 96% while catching zero fraud when fraud is only 4% of transactions. The post runs a hand-built Python grid search across algorithm, hyperparameters, feature set, class weight, and decision threshold, ranking by a custom cost metric balancing fraud savings against a US 6 analyst cost per flag. On a 480-transaction test split from a 2,400-transaction dataset with 4% fraud, the winning logistic regression caught 15 of 19 frauds, saving US 3,578 over a baseline that caught none. The winner’s evidence is passed to a local 1-billion-parameter LLM that drafts analyst notes, keeping the LLM downstream of the decision to avoid hallucination. The same workflow scales to Red Hat OpenShift AI by swapping local components for enterprise services like AutoML with AutoGluon and model serving via vLLM.


### [Run decision models on vLLM and Red Hat AI using DiffusionGemma](https://yomu.fyi/post/run-decision-models-on-vllm-and-red-hat-ai-using-diffusiongemma.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Lucas Wilkinson, Rob Greenberg
- Published: Sep 28, 2026
- Type: Explainer

A new category of AI model called ‘System One’ makes fast, typed, probabilistic decisions from unstructured input, exemplified by TypeSafe AI’s Jev, which offers guaranteed structure, default probabilities, and low latency (70–500 ms) for high-volume decisions like routing and moderation. Jev is a hosted API without self-hosting options, prompting the vLLM community to adapt DiffusionGemma, an open block-diffusion model, as a self-hostable decision engine. The approach uses a fixed-length canvas seeded with answer templates, a single denoising step, and calibrated logprobs to return decisions with confidence scores, achieving over 300 decisions per second on a Cloud Run deployment. DiffusionGemma is already validated on Red Hat AI, and the structured-read support in vLLM nightly enables teams to run decision models on their own infrastructure. The post provides a recipe using vLLM nightly and a decision server that exposes a Jev-compatible endpoint for prototyping.


### [Managing edge solutions with Red Hat: A layered approach](https://yomu.fyi/post/managing-edge-solutions-with-red-hat-a-layered-approach.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Daniel Froehlich
- Published: Sep 25, 2026
- Type: Explainer

Managing edge infrastructure at scale across hundreds of locations demands consistent management rather than disparate tools. Red Hat’s layered approach organizes tools into three compartments: a universal foundation, OS-level fleet management for RHEL, and Kubernetes lifecycle management for OpenShift. The universal layer includes Ansible for agentless automation, Quay for container image registry with geo-replication, Lightspeed for proactive drift detection and compliance, and Trusted Software Supply Chain for end-to-end security. For RHEL-based edges, Edge Manager provides SaaS fleet management with OTA updates while Satellite offers on-premise content management for air-gapped environments. For OpenShift-based edges, Advanced Cluster Management handles cluster lifecycle and zero-touch provisioning while Advanced Cluster Security enforces container security across the fleet.


### [Build golden path CI/CD workflows in Red Hat Developer Hub](https://yomu.fyi/post/build-golden-path-ci-cd-workflows-in-red-hat-developer-hub.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rishabh Singh
- Published: Sep 25, 2026
- Type: Tutorial

This article continues a series on Red Hat Developer Hub, describing how platform engineers create golden path templates to standardize developer workflows. The sample template scaffolds a Go project with a Tekton pipeline, Argo CD manifests, a devfile, and catalog-info.yaml containing annotations that map to enabled plug-ins. Developers use the template from the self-service screen, completing a form to specify application metadata, image registry, OpenShift details, and Git repository. After scaffolding, automated CI/CD is triggered by a Git commit, and developers monitor Tekton PipelineRuns, Argo CD sync status, container images from Quay, and Kubernetes resources from tabs within Developer Hub. The article provides step-by-step instructions for both platform engineers and developers, including template authoring, registration, scaffolding, and subsequent observability.


### [Self-encrypting VM images for confidential environments hands on](https://yomu.fyi/post/self-encrypting-vm-images-for-confidential-environments-hands-on.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Vitaly Kuznetsov
- Published: Sep 24, 2026
- Type: Tutorial

Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection.


### [Scaling GitOps: The "pull" architecture for global fleets](https://yomu.fyi/post/scaling-gitops-the-pull-architecture-for-global-fleets.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Jann Fischer, Pradeep Surisetty, Sho Weimer, Jan Hutař, Alex Krzos, Mike Ng
- Published: Sep 24, 2026
- Type: Benchmark

Red Hat conducted a performance and scale test of the argocd-agent pull architecture for GitOps, using 42 physical machines, 500 spoke clusters, and software including OpenShift 4.21 and OpenShift GitOps 1.20. The pull model decentralizes reconciliation to lightweight agents on each managed cluster, which pull configurations from a central hub, improving security by eliminating inbound administrative ports and reducing cross-cluster network traffic by up to 80%. In the bootstrap scenario, generating and syncing 31,200 applications across 480 clusters completed in 13 minutes 3 seconds, while the sync-to-commit scenario, which includes a polling delay, took 13 minutes. The test revealed bottlenecks including Kubernetes API limits on the hub, informer processing slowdowns causing watch restarts, event writer retry issues under load, and ApplicationSet controller RAM consumption. The team also deleted all 31,200 applications in 4 minutes 53 seconds using cascading deletion, and the insights are informing future OpenShift GitOps releases.


### [How I massively improved my AI inference performance without buying new hardware](https://yomu.fyi/post/how-i-massively-improved-my-ai-inference-performance-without-buying-ne.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Boaz Ben Shabat
- Published: Sep 23, 2026
- Type: Problem & solution

Default inference configurations for large language models often leave significant performance unused, even on expensive hardware like 16 NVIDIA H200 GPUs across two nodes. The author tested this setup with vLLM and Red Hat AI Inference 3.4 on a CoreWeave Kubernetes cluster, using enterprise RAG workloads with 2,000-token inputs and 100 concurrent users. By systematically comparing aggregated and prefill-decode (PD) disaggregated architectures, and tuning tensor parallelism (TP) and PD split, latency was dramatically reduced. For Qwen3-32B, time-to-first-token (TTFT) on the best aggregated configuration (2xTP8) dropped from 995ms to 304ms, and with optimized routing to 287ms — a 71% improvement without hardware changes. For Llama-70B, TTFT fell from 1,292ms to 463ms, a 64% gain. The author also built ServeIt Studio, an open-source tool that automates the full optimization pipeline on Kubernetes.


### [Build OpenJDK container images locally using the standalone S2I tool](https://yomu.fyi/post/build-openjdk-container-images-locally-using-the-standalone-s2i-tool.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Francisco De Melo Junior
- Published: Sep 23, 2026
- Type: Tutorial

Red Hat provides the Red Hat build of OpenJDK for running Java applications on Red Hat OpenShift 4. Developers can use the standalone Source-to-Image (S2I) CLI to build and test OpenJDK container images locally before deploying to a cluster. S2I produces reproducible images by injecting source code into a builder image and running its assemble script. The toolkit supports flags such as –loglevel for detailed output, –environment-file to pass custom JVM settings like G1GC and MaxRAMPercentage, and –as-dockerfile to output a Dockerfile. After building, the image can be tested locally with docker run, then uploaded to the cluster for deployment.


### [Data liberation: Apache Kafka's native cluster mirroring](https://yomu.fyi/post/data-liberation-apache-kafka-s-native-cluster-mirroring.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Federico Valeri
- Published: Sep 22, 2026
- Type: Announcement

KIP-1279 introduces native cluster mirroring, embedding cross-cluster replication directly into the Kafka broker. This eliminates external tooling, offset translation tables, and recompression, as destination brokers fetch committed records using the standard fetch protocol and append them byte for byte. The approach preserves offsets, compression, and consumer group state, simplifying failover to stopping the mirror and redirecting clients. The architecture uses mirror fetcher threads inside the broker, extending AbstractFetcherThread, and leverages existing client quota mechanisms. Migration involves creating a new KRaft cluster, setting up a mirror, and starting mirroring, with future work including synchronous mirroring and tiered storage integration.


### [Extend OpenShift Lightspeed with Red Hat Satellite, MCP, and BYOK](https://yomu.fyi/post/extend-openshift-lightspeed-with-red-hat-satellite-mcp-and-byok.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Jose Manuel Marquez, Josep Andreu
- Published: Sep 22, 2026
- Type: Tutorial

The article demonstrates extending Red Hat OpenShift Lightspeed by integrating the Red Hat Satellite MCP server and bring your own knowledge (BYOK). The Satellite MCP server exposes live operational data, such as kernel versions, CVEs, and errata, through the Model Context Protocol. BYOK enriches the assistant with private enterprise knowledge, enabling retrieval-augmented generation (RAG) to combine internal documentation with infrastructure data. The integration requires installing the OpenShift Lightspeed operator and deploying the Satellite MCP server in the openshift-lightspeed project. Authentication is handled by storing the header value in a Secret, and the MCP server expects clients to include appropriate Accept headers for the text/event-stream media type.


### [Comparison of Cluster Autoscaler and KEDA MachineSet Autoscaling on Red Hat OpenShift](https://yomu.fyi/post/comparison-of-cluster-autoscaler-and-keda-machineset-autoscaling-on-re.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Ramon Gordillo Gutierrez, Jose Ortiz Padilla
- Published: Sep 21, 2026
- Type: Explainer

This article compares two autoscaling approaches for Red Hat OpenShift compute infrastructure: the built-in Cluster Autoscaler and the KEDA-driven MachineSet Autoscaler. The key difference is the trigger mechanism: Cluster Autoscaler reacts to Pending pods, while KEDA scales based on external metrics like PromQL queries. KEDA triggers faster, scaling within about 15 minutes versus 24 minutes for Cluster Autoscaler, because it acts on metric thresholds before pods become unschedulable. Cluster Autoscaler offers built-in scale-down safety and zero configuration, while KEDA provides fine-grained, metric-driven control but requires the Custom Metrics Autoscaler operator. The choice depends on workload predictability, with Cluster Autoscaler suited for general-purpose workloads and KEDA for dedicated pools with predictable metric patterns. The two autoscalers cannot coexist on the same MachineSet, as they would fight over replica counts.


[Newer posts](https://yomu.fyi/company/red-hat.md) · [Older posts](https://yomu.fyi/company/red-hat/page/3.md)