---
title: "Red Hat"
description: "Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations."
---

# Red Hat
> Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations.

## Articles

### [Scaling localnet user-defined networks (CUDNs) in Red Hat OpenShift to 3,500 networks](https://yomu.fyi/post/scaling-localnet-user-defined-networks-cudns-in-red-hat-openshift-to-3.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Joe Talerico
- Published: Sep 21, 2026
- Type: Benchmark

Migrating from legacy virtualization with flat VLAN-based tenant networks to Red Hat OpenShift Virtualization often requires re-architecting network topology, creating friction. Red Hat OpenShift supports localnet user-defined networks (CUDNs) to preserve existing VLAN infrastructure while modernizing. Red Hat tested localnet CUDNs at scale, successfully managing up to 3,500 localnet CUDNs hosting over 3,500 active virtual machines. OVN-Kubernetes achieved 100% SSH connectivity, near-line-speed data-path performance over 100GbE interfaces without Geneve tunnel overhead, and stable control plane resource usage. Resource peaks reached approximately 5.5 CPU cores per worker node and 10 CPU cores on control plane nodes during bulk creation, then returned to low baselines.


### [AI threat modeling shouldn't be a bottleneck, so we open sourced ours](https://yomu.fyi/post/ai-threat-modeling-shouldn-t-be-a-bottleneck-so-we-open-sourced-ours.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Katie Mulliken, Jon Weiser, Judy Kelly
- Published: Sep 21, 2026
- Type: Announcement

The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.


### [Red Hat OpenShift networking: Default OVN-Kubernetes vs. Cilium operator](https://yomu.fyi/post/red-hat-openshift-networking-default-ovn-kubernetes-vs-cilium-operator.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Amjed Jabari (AJ), Wuxin Zeng, Rodrigo Gonzalez
- Published: Sep 18, 2026
- Type: Explainer

The article compares Red Hat OpenShift’s default OVN-Kubernetes CNI with the Cilium operator for teams managing microservices, AI workloads, and declarative multi-cluster infrastructure with Cluster API (CAPI). It describes OVN-Kubernetes as natively managed by the OpenShift Cluster Network Operator, with Open vSwitch foundations, hardware offloading, Multus and OpenShift Virtualization compatibility, and OVN Interconnect for large-scale deployments. Cilium uses kernel-level eBPF programs and offers identity-based policies, sidecarless service mesh capabilities, and Hubble Layer 7 observability, while CAPI manifests and MachineSets support declarative worker-node provisioning. The source recommends Cilium for new clusters when eBPF capabilities and CAPI integration justify added operational complexity, while positioning OVN-Kubernetes as the simpler choice for integrated lifecycle management and hardware acceleration.


### [Matching OpenShift edge topologies to your physical footprint](https://yomu.fyi/post/matching-openshift-edge-topologies-to-your-physical-footprint.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Daniel Froehlich
- Published: Sep 18, 2026
- Type: Explainer

Red Hat OpenShift topologies are mapped to edge-site constraints such as hardware footprint, availability, rack space, power, and workload needs. It is presented as a micro cloud that brings full Kubernetes functionality to server-class edge hardware, with optional virtualization and software-defined storage. Cluster capabilities can be minimized with baselineCapabilitySet: none and selectively enabled later, although added capabilities cannot be removed without reinstalling. Options span single-node OpenShift, which requires 4 vCPUs, 16 GB RAM, and 120 GB storage, two-node designs using fencing or an arbiter, and three-node compact clusters for resilient high availability. Each topology retains shared management and security practices, so selection depends on the physical footprint, failure tolerance, and scale required at the site.


### [What did AI cost you this quarter?](https://yomu.fyi/post/what-did-ai-cost-you-this-quarter.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Markell Rawls, Suhas Kashyap
- Published: Sep 18, 2026
- Type: Tutorial

AI infrastructure costs are often billed to a platform team as one lump sum, leaving Finance without a departmental breakdown and teams without feedback on their usage. The post presents a working demo on Red Hat OpenShift AI that attributes requests and token consumption through department-specific MaaS API keys, shared model servers, Prometheus metrics, Perses dashboards, and MLflow traces. In its example, three departments generate 79,420 inference requests and consume 634 million tokens against a $14,200 quarterly bill, while Marketing’s 32% GPU utilization reveals roughly $34,000 in annual waste. The system combines aggregate usage filters with request-level details such as prompts, token counts, latency, and calculated cost, and the post argues that showback helps identify inefficient allocations and model mismatches rather than police teams.


### [From hours to minutes: Optimizing Red Hat Developer Hub performance testing with immutable LDAP images](https://yomu.fyi/post/from-hours-to-minutes-optimizing-red-hat-developer-hub-performance-tes.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Shashank Kestwal
- Published: Sep 17, 2026
- Type: Benchmark

Red Hat Developer Hub performance testing became slow and unreliable as runtime generation of large user and group catalogs stretched environment setup and introduced synchronization failures. Previously, the framework created entries through serialized Keycloak Admin REST API operations, then waited for paginated synchronization into the Developer Hub database; concurrency could not eliminate timeouts, rate limits, or incomplete catalogs. The replacement uses immutable, pre-built LDAP container images selected by an RBAC\_POLICY-USER\_COUNTu-GROUP\_COUNTg convention, with slapadd loading seed data directly into offline LMDB files in a multi-stage build. LDAP starts with 10,000-plus indexed users, while Keycloak serves as an authentication gateway and Developer Hub waits for its initial catalog sync. Reported population time fell from 22-plus hours to 2 minutes 8 seconds for 10,000 users and 150,000 groups, while the immutable approach made tests deterministic, reduced flaky failures, stabilized baselines, and enabled larger reproducible scenarios.


### [Catching poor LLM performance and accuracy before deployment](https://yomu.fyi/post/catching-poor-llm-performance-and-accuracy-before-deployment.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Christopher Miyai
- Published: Sep 17, 2026
- Type: Benchmark

Rapid changes in vLLM and the path from upstream releases to Red Hat AI Inference images can introduce performance and accuracy regressions that ordinary CI/CD tests miss. The midstream regression detector benchmarks upstream and release-candidate builds across hardware variants, using GuideLLM at multiple concurrency levels for performance and GSM8K for accuracy. It stores nightly upstream results, compares them with midstream benchmarks against threshold deltas, and feeds confirmed failures into fixes and rebuilds before release. To reduce false positives from limited samples, the workflow adds Wasserstein distance as a secondary check of whole request-response distributions rather than relying only on medians or means. The system also connects benchmark runs with prior JIRA regressions through a custom Claude skill that suggests possible fixes and assesses whether a flagged change is genuine.


### [Build a unified CI/CD control plane with Red Hat Developer Hub](https://yomu.fyi/post/build-a-unified-ci-cd-control-plane-with-red-hat-developer-hub.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rishabh Singh
- Published: Sep 17, 2026
- Type: Tutorial

Red Hat Developer Hub brings OpenShift, Argo CD, Tekton, and Quay workflows into a unified developer portal, addressing context switching across separate consoles. The guide targets platform engineers and covers installing the Operator, creating GitHub and cluster credentials, configuring application and dynamic-plugin settings, defining RBAC policies, and deploying a Backstage custom resource. It uses a Kubernetes service-account token for access to pods, deployments, and pipeline runs, while Quay integration exposes image tags, vulnerabilities, and manifest details. After granting read access in monitored namespaces, the resulting portal can display pipeline runs, deployment health, image information, and Argo CD status in one view. The source says the setup is a proof-of-concept foundation, with a follow-up planned for software templates and developer self-service.


### [Why your Kafka topic ignores retention.ms (and how to fix it)](https://yomu.fyi/post/why-your-kafka-topic-ignores-retention-ms-and-how-to-fix-it.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rogerio Santos
- Published: Sep 16, 2026
- Type: Tutorial

A Kafka topic configured with retention.ms=43200000 (12 hours) retained messages for four days because the active log segment never rolled. Kafka retains data by deleting whole closed segments, not individual records, and an active segment remains writable and cannot be deleted. Segment rolling occurs when segment.bytes or segment.ms is reached; in this case, traffic was too modest to fill the 1-GiB segment and only four days had passed, short of the seven-day default. Once a segment closes, retention.ms is evaluated against its newest record, followed by the retention check interval and file.delete.delay.ms before physical deletion. The proposed fix is to set segment.ms to a fraction of the retention window (one hour for the 12-hour example), while tuning segment.bytes as needed; a smaller rolling cadence makes effective retention more predictable.


### [Constraining AI agents with Red Hat AI: Containment, identity, and governance](https://yomu.fyi/post/constraining-ai-agents-with-red-hat-ai-containment-identity-and-govern.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Grace Ableidinger
- Published: Sep 16, 2026
- Type: Tutorial

AI agents running on laptops or clusters may inherit broad filesystem, network, and credential access, making faulty permissions or prompt injection potential security risks. The guide uses Red Hat OpenShift to build layered controls around an OpenClaw agent: namespace isolation, default-deny network policy, ResourceQuota, and optional Kata Containers contain workloads and limit escape or resource abuse. SPIFFE and SPIRE issue rotating SVIDs based on workload attributes such as namespace and ServiceAccount, allowing services to verify an agent without shared secrets. Governance adds OPA Gatekeeper admission policies, an MCP Gateway with risk-tiered tool authorization, NeMo Guardrails for prompt and completion filtering, and MLflow traces for auditability. The recommended rollout starts with namespace isolation and quotas, then adds sandboxing, identity, and the more involved governance controls.


### [Red Hat Developer Hub: Preventing compliance violations with AI coding agents](https://yomu.fyi/post/red-hat-developer-hub-preventing-compliance-violations-with-ai-coding.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Evan Shortiss, Ben Wilcock
- Published: Sep 15, 2026
- Type: Explainer

AI coding agents can generate services quickly, but they may miss organization-specific architecture, ownership, and compliance rules stored in an internal developer portal. A demo connects Claude Code to a Backstage-based Red Hat Developer Hub through Backstage CLI actions, allowing the agent to query domains, components, APIs, software templates, and TechDocs before proposing a design. In a simulated Parasol Insurance catalog with more than 500 entities across 14 domains, the agent finds an existing but unrelated reconciliation service and resolves a Claims–Billing messaging conflict by keeping IBM MQ at the payment boundary and publishing internal events to Kafka. It then uses catalog relationships and specifications to identify integrations and produces a Technology Decision Summary that cites the sources behind each choice, making the resulting decisions reviewable and traceable.


### [Understanding W8A8 INT8 LLM quantization: Accuracy and performance results](https://yomu.fyi/post/understanding-w8a8-int8-llm-quantization-accuracy-and-performance-resu.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Sana Fayyaz
- Published: Sep 14, 2026
- Type: Benchmark

The post evaluates whether W8A8 INT8 quantization can reduce the size of a Llama 3.1 8B Instruct model without sacrificing accuracy or inference performance. Using SmoothQuant to address activation outliers and GPTQ with error compensation for BF16 weights, the model was compressed from 14.9 GB to 8.0 GB after calibration on WikiText-2. Identical zero-shot lm-eval-harness tests across MMLU, ARC Easy, HellaSwag, and IFEval found MMLU, ARC Easy, and HellaSwag deltas smaller than their standard errors, while the IFEval change was described as likely within a similar noise range; the post concludes no measurable degradation. vLLM and GuideLLM tests on one NVIDIA L40S reported 29% more concurrent requests, 24% lower synchronous TTFT, and 44% faster token generation at maximum load, while ITL degraded more quickly under high concurrency because of dynamic activation quantization overhead.


### [Python 3.14 free-threaded build is now available in RHEL](https://yomu.fyi/post/python-3-14-free-threaded-build-is-now-available-in-rhel.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Lumír Balhar
- Published: Sep 14, 2026
- Type: Announcement

Red Hat Enterprise Linux 9.8 and 10.2 now provide a free-threaded Python 3.14 build alongside the regular interpreter, enabling developers to test parallel CPU execution with threads. The build disables the GIL, allowing Python threads to execute on multiple CPU cores in one process, while built-in dict, list, and set operations retain internal locking for individual operations. Developers install the python3.14-freethreading package from the CodeReady Linux Builder repository; it provides the separate python3.14t executable and commands to verify free-threading support and GIL status. Existing code may expose race conditions, and unsupported C-extension dependencies can re-enable the GIL, so the source recommends testing, dependency checks, explicit synchronization, and workload measurement. The build carries a stated 5%-10% single-threaded performance overhead and mainly targets CPU-bound threaded workloads.


### [Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux](https://yomu.fyi/post/unlock-a-luks-root-over-ssh-on-fedora-and-red-hat-enterprise-linux.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Josephine Pfeiffer
- Published: Sep 11, 2026
- Type: Tutorial

Remote Fedora or Red Hat Enterprise Linux servers with encrypted LUKS roots can stop in the initramfs, waiting for a passphrase at an unattended console. The documented setup installs dracut-sshd from EPEL, adds dracut’s network-manager module, enables rd.neednet=1 and ip=dhcp in GRUB, then rebuilds the initramfs and boot configuration. NetworkManager brings up the initramfs network, while SSH exposes systemd-tty-ask-password-agent; the SSH session closes after unlocking because the root transition destroys the initramfs sshd. The rd.neednet=1 argument creates the neednet flag that gates nm-initrd.service, and the generated connection profile carries into the real root. Initramfs credentials sit unencrypted on /boot, so dedicated host keys, separate known\_hosts entries, and physical testing are recommended before relying on remote recovery.


### [Bringing custom knowledge to agents with AutoRAG](https://yomu.fyi/post/bringing-custom-knowledge-to-agents-with-autorag.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Diego Alvarez Ponce, Diego Garcia Perez
- Published: Sep 11, 2026
- Type: Tutorial

Enterprise LLMs can hallucinate when they lack company-specific vocabulary and documentation, so the guide builds a bank agent grounded in internal data. It configures Red Hat OpenShift AI 3.5 Technology Preview features, enables OGX, AutoRAG, and the MCP catalog, and deploys PostgreSQL, Milvus, and MinIO for metadata, vector embeddings, and artifacts. AutoRAG processes documents, evaluates pipeline configurations against a benchmark dataset, and identifies a preferred setup; the example uses Qwen3-8B and embeddinggemma-300m models. A MariaDB MCP server adds access to customer records, with a patch supplying writable logging storage and a warning that unrestricted ALLOWED\_HOSTS is for demo/development only. The resulting Streamlit agent answers a customer-information query and a Gold-card-limit question using RAG context and database tools.


### [Red Hat edge platforms: Choosing the right one for your use case](https://yomu.fyi/post/red-hat-edge-platforms-choosing-the-right-one-for-your-use-case.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Daniel Froehlich
- Published: Sep 11, 2026
- Type: Explainer

Choosing an edge platform requires balancing hardware footprint, workload needs, high availability, and operational complexity; the options range from RHEL with Podman or KVM to OpenShift clusters. The guide organizes Red Hat's offerings into RHEL-based and OpenShift-based deployments, noting that both traditional virtual machines and modern containerized workloads can coexist and that platforms can overlap as requirements grow. It details image-mode RHEL (bootc), transactional updates with rollbacks, efficient over-the-air delivery, offline installation, and dependency pre-resolution for constrained or disconnected sites. RHEL is positioned for static workloads of one to five components, while Red Hat Device Edge adds MicroShift when lightweight Kubernetes is needed. Kubernetes becomes more appropriate for larger microservices or event-driven systems, automated recovery, dynamic workloads, cross-environment scaling, and rolling updates; the series next covers OpenShift topologies.


### [From token consumer to token provider: Building your org's AI API](https://yomu.fyi/post/from-token-consumer-to-token-provider-building-your-org-s-ai-api.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Markell Rawls
- Published: Sep 10, 2026
- Type: Explainer

Enterprise AI usage can become costly and fragmented when teams rely on separate provider accounts, personal keys, and independently operated inference stacks, leaving spending, workloads, and governance difficult to see. The post presents Model-as-a-Service (MaaS) in Red Hat OpenShift AI 3.4 as a shared service in which a platform team deploys approved models and exposes them through a standard, OpenAI-compatible API. Administrators can use the model catalog, distributed inference through llm-d on NVIDIA L40s, scoped API keys, rate limits, and dashboards for token use, latency, errors, GPU utilization, and queue length. Developers obtain self-service endpoints and can connect tools such as Claude Code, OpenCode, or Continue with existing clients. The architecture combines OpenShift, vLLM, an AI gateway, Prometheus, Grafana, and Jaeger to centralize inference, governance, and cost attribution across local and external model providers.


### [Deploy NeMo Guardrails on Red Hat OpenShift AI](https://yomu.fyi/post/deploy-nemo-guardrails-on-red-hat-openshift-ai.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rob Geada
- Published: Sep 9, 2026
- Type: Tutorial

This article shows how to deploy an evaluated NeMo Guardrails configuration on a Red Hat OpenShift AI cluster, continuing a series on local development and dataset-based evaluation. It requires OpenShift AI 3.5 or later and namespace write access, while OpenShift AI 3.2 or newer can be configured to use the 3.5 NeMo Guardrails image through TrustyAI service-operator changes. Deployment uses a ConfigMap for the configuration, a NemoGuardrails custom resource, and an authentication annotation that protects the server route; an empty rails.co file is sufficient when no custom algorithms are defined. The deployed server accepts v1/guardrail/checks requests with a bearer token, and the demonstrated classifier permits a benign prompt, blocks a prompt injection, and rejects an invalid token. The article notes that LLM proxying and LLM-based guardrailing are outside its scope.


### [Use a local and open source code assistant](https://yomu.fyi/post/use-a-local-and-open-source-code-assistant.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Seth Kenlon
- Published: Sep 9, 2026
- Type: Tutorial

Closed or cloud-based coding assistants can expose work to external services, so the article presents a local, open-source alternative built around OpenCode. OpenCode is an AI coding agent—not an LLM—that runs as a terminal interface, desktop application, or IDE extension and connects to models through the Model Context Protocol (MCP). The setup installs OpenCode, selects a local model runtime such as Ollama for AMD/NVIDIA GPUs or OpenVINO Model Server with INT4 Qwen3-8B for Intel integrated graphics, then configures opencode.jsonc and an editor plug-in. Examples cover Qwen3:14b with Ollama, Podman-based OpenVINO serving, and NetBeans integration; the resulting assistant can answer queries and edit files after permission is granted, although local inference may be slow and generated advice can be unreliable.


### [Personalize your product's text-to-speech voice for any language: Fine-tuning with Kubeflow Trainer on Red Hat OpenShift AI](https://yomu.fyi/post/personalize-your-product-s-text-to-speech-voice-for-any-language-fine.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Dmytro Hryshchenko, Abhijeet Dhumal
- Published: Sep 9, 2026
- Type: Tutorial

Training an English-centered text-to-speech model for Turkish can produce fluent but hard-to-understand pronunciation for native speakers. This tutorial fine-tunes unsloth/orpheus-3b-0.1-pretrained with about 81,000 Turkish text-audio pairs on Red Hat OpenShift AI using a Kubeflow Trainer TrainJob distributed across two nodes with two A100 GPUs each. LoRA freezes the 3-billion-parameter base and trains 97.3M adapter parameters, while preprocessing converts text to Llama-3 tokenizer tokens and audio to three-layer SNAC codes, masking text labels during scoring. The merged model is evaluated against the base on ten Turkish sentences using Whisper transcription and WER/CER metrics. Mean WER falls from 2.44 to 0.35 and CER from 1.59 to 0.09, though the authors describe the small test as directional.


[Newer posts](https://yomu.fyi/company/red-hat/page/2.md) · [Older posts](https://yomu.fyi/company/red-hat/page/4.md)