---
title: "Red Hat"
description: "Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations."
---

# Red Hat
> Major software company that provides open-source technology, such as the Linux operating system, to businesses and large organizations.

## Articles

### [Optimize vLLM speculative decoding with FastMTP heads](https://yomu.fyi/post/optimize-vllm-speculative-decoding-with-fastmtp-heads.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rahul Tuli
- Published: Sep 8, 2026
- Type: Tutorial

Autoregressive LLM inference is memory-bandwidth bound because each token requires a full pass over billions of parameters, while speculative decoding can verify several drafted tokens in one pass. Speculators 0.6.0 adapts a single native MTP head with FastMTP-style recursive fine-tuning, addressing the mismatch between teacher-forced training and vLLM’s autoregressive reuse of the head. The training loop fuses each next-token embedding with the current hidden state, predicts the following token, feeds the resulting hidden state back, and weights three steps with normalized exponential decay using β = 0.6. Native mtp.\* weights extraction, shared full-vocabulary embeddings and output head, and vLLM-compatible stitching support deployment; on Qwen3-Next-80B-A3B-Instruct evaluated on GSM8K, mean accepted length improved at positions 0–2 from 0.897, 0.719, 0.476 to 0.912, 0.776, 0.616.


### [Understanding W8A8 INT8 LLM quantization: Half the size, better performance, same accuracy](https://yomu.fyi/post/understanding-w8a8-int8-llm-quantization-half-the-size-better-performa.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Sana Fayyaz
- Published: Sep 7, 2026
- Type: Tutorial

Serving Llama 3.1 8B in BF16 requires roughly 14.9 GB for weights, leaving little VRAM on a 16 GB GPU for KV cache and activations, which limits practical deployment. The workflow benchmarks the base model, applies INT8 W8A8 quantization with llm-compressor, then repeats accuracy and performance tests under identical hardware and load conditions. SmoothQuant modifies weights to reduce activation outliers, while GPTQ uses calibration data and error compensation before rounding weights to INT8; the experiment used 512 WikiText-2 samples and targeted deployment with vLLM. On the Llama 3.1 8B Instruct model, compression reduced storage from 14.9 GB to 8.0 GB, a 46% reduction, and accuracy was preserved across MMLU, ARC, HellaSwag, and IFeval; generation-speed results are reserved for part 2.


### [Red Hat Developer Hub software template authoring with rhdh-templates](https://yomu.fyi/post/red-hat-developer-hub-software-template-authoring-with-rhdh-templates.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Kashish Mittal
- Published: Sep 7, 2026
- Type: Announcement

Red Hat Developer Hub software template authors often face Nunjucks syntax, uncertain location.yaml placement, and errors discovered only after rendering in the developer portal. The rhdh-templates skill in the RHDH Users Skill Pack equips an AI assistant with RHDH and Backstage conventions, Nunjucks helpers, schema checks, reference templates, and local validation. After installation, it can scaffold repositories, guide interactive parameterization of existing codebases, add template parameters and Scaffolder steps, generate location.yaml, and check templates offline before merge. With an optional reachable RHDH instance, the skill can list active actions, read their schemas, and dry-run execution against the API; the walkthrough uses the Quarkus getting-started quick start and reports a clean validation run as the readiness signal.


### [Reference architecture for HA scanning with Red Hat Advanced Cluster Security for Kubernetes](https://yomu.fyi/post/reference-architecture-for-ha-scanning-with-red-hat-advanced-cluster-s.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Johannes Malsam
- Published: Sep 7, 2026
- Type: Problem & solution

Red Hat Advanced Cluster Security for Kubernetes exposes an image-scanning API through Central, but upgrades and restarts can interrupt CI/CD pipelines. The reference architecture uses two independent Central Service instances—primary and failover—with separate databases, scanner deployments, and namespaces, plus a client-side script that probes the primary’s health endpoint before each scan and falls back when needed. Operators install the failover instance, duplicate image registry integrations and build-time policies, configure CI authentication, and pause reconciliation on the failover Central custom resource while upgrading the primary, then resume it to upgrade the second instance. This avoids scan API unavailability during the staged upgrade process, but failover caches are cold, requiring temporarily longer scans and additional registry traffic. The instances do not synchronize databases, caches, configuration, or vulnerability updates, and the design does not provide general-purpose HA for secured cluster services or delegated scanning.


### [From incident to remediation: Building an AI-driven AIOps workflow with Red Hat Ansible Automation Platform](https://yomu.fyi/post/from-incident-to-remediation-building-an-ai-driven-aiops-workflow-with.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Neha Chugh
- Published: Sep 5, 2026
- Type: Tutorial

This tutorial builds an AIOps workflow for diagnosing and remediating a deliberately induced CPU incident in a product catalog application running on an AWS EC2 instance with RHEL. An Ansible investigation playbook collects CPU utilization, top processes, application status, and HTTP health evidence, which Claude Code analyzes through MCP to identify the Python process as the likely contributor and recommend the approved “AIOps - Remediate High CPU” Job Template. AI does not access the host directly: Ansible Automation Platform retains responsibility for credentials, inventory, execution, and remediation. The remediation changes the application from HTTP 503 and degraded to HTTP 200 and healthy, while a final health check confirms recovery and completes the detect-investigate-analyze-recommend-execute-verify sequence.


### [Build AI-assisted firewall workflows with Ansible Automation Platform](https://yomu.fyi/post/build-ai-assisted-firewall-workflows-with-ansible-automation-platform.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Michal Zdyb
- Published: Sep 4, 2026
- Type: Problem & solution

The workflow replaces a manual, fragmented process for turning a simple ServiceNow connectivity request into firewall changes. Event-Driven Ansible connects ServiceNow, GitHub, an LLM, and two Palo Alto Networks firewalls, checking drift, gathering topology data, and coordinating structured rule proposals, pull requests, and workflow records. Ansible Automation Platform keeps credentials away from the AI and deploys approved rules through a deterministic, idempotent path after engineer and CAB approvals. GitHub’s main branch records the last successful state, proposed changes are reviewed as Configuration as Code, and execution stops when live configuration differs from the intended state. The lab demonstrates partial coverage, no coverage, and an unresolvable request; failed deployments can roll back, while an undefined Palo Alto Networks App-ID stops the workflow for human intervention.


### [Configure admission fair sharing in Red Hat build of Kueue 1.4](https://yomu.fyi/post/configure-admission-fair-sharing-in-red-hat-build-of-kueue-1-4.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Maysa De Macedo Souza
- Published: Sep 4, 2026
- Type: Tutorial

Red Hat build of Kueue 1.4 provides admission fair sharing for shared CPU, GPU, and high-performance computing clusters where FIFO admission can starve later workloads. The guide configures the feature through the Kueue custom resource, using either default values—30-minute usage half-life, five-minute sampling interval, and resource weights of 1—or custom settings, then creates a ResourceFlavor, a ClusterQueue using UsageBasedAdmissionFairSharing, and two LocalQueues. Kueue tracks each LocalQueue's historical consumption, adds a temporary penalty when a workload is admitted, and compares usage adjusted by queue weight to choose the lowest-use pending workload when quota returns. In the example, lq-a receives the first job, lq-b is admitted after job1 is deleted, and usage decays or grows on sampling ticks; usage ordering takes precedence over priority classes, which only break ties.


### [Speeding up LLM inference with P-EAGLE in vLLM Speculators](https://yomu.fyi/post/speeding-up-llm-inference-with-p-eagle-in-vllm-speculators.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Helen Zhao, Megan Flynn, Dipika Sikka
- Published: Sep 3, 2026
- Type: Explainer

P-EAGLE (Parallel EAGLE), implemented in Speculators v0.6.0, extends EAGLE-3 with parallel drafting so a draft model predicts multiple future tokens in one forward pass rather than sequentially. Speculative decoding pairs this small draft model with a verifier model, which checks the proposed sequence in parallel and accepts only its correct prefix while preserving the verifier’s output distribution. The post adds Conditional Drop-token (COD) sampling, learnable mask embeddings and hidden states, and a custom flex-attention mask to support multi-depth prediction within the EAGLE-3 framework. The post presents an end-to-end workflow covering data preparation, vLLM hidden-state extraction, training and deployment, including a Qwen3-8B example that takes about 50 minutes on four H100s. A published Qwen3-a8B draft model reports an average length of 3.044 across the listed datasets.


### [Evaluating LLM guardrail configs locally with EvalHub](https://yomu.fyi/post/evaluating-llm-guardrail-configs-locally-with-evalhub.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rob Geada
- Published: Sep 3, 2026
- Type: Benchmark

This installment evaluates local NeMo Guardrails configurations against large-scale risk datasets using EvalHub, following earlier manual testing. EvalHub provides a unified interface for AI evaluation, with provider integrations, reusable benchmarks, Hugging Face dataset inputs, and both local and Kubernetes deployment options. The benchmark configuration maps dataset prompt and label columns to block and pass labels, while balanced safe and risky examples prevent an always-block guardrail from appearing perfect. On the prompt-injection benchmark, the nuanced regex configuration achieved 51.1% accuracy with 13.7 ms median latency; DeBERTa reached 88.93% accuracy with 45.2 ms median latency. The conclusion favors layered guardrails: targeted regex checks can provide speed, with DeBERTa handling other cases, and EvalHub supplies reproducible measurements of the latency–efficacy trade-off.


### [Evaluate AI agents with IBM CLEAR & EvalHub on OpenShift AI](https://yomu.fyi/post/evaluate-ai-agents-with-ibm-clear-evalhub-on-openshift-ai.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Hema Veeradhi, Surya Pathak
- Published: Sep 3, 2026
- Type: Tutorial

Reliable AI agents can fail in production through incorrect tool use, off-topic reasoning, or plausible but incorrect answers that unit tests, static benchmarks, and logs may not expose. This tutorial builds an eval-driven trace-evaluation pipeline on Red Hat OpenShift AI 3.4 or later, using MLflow to store structured agent traces and evaluation artifacts, IBM CLEAR to score reasoning quality, relevance, and tool usage with an LLM judge, and EvalHub to orchestrate OpenShift jobs. It uploads eight prerecorded multistep research-agent traces, each containing at least 30 spans, then verifies them in MLflow before deploying EvalHub, registering the ibm-clear provider, and configuring judge-model credentials. Standard mode evaluates steps holistically, while SPARC mode gives tool calls separate scoring rows; the resulting workflow produces critiques and ranked failure patterns with frequency, severity, and step or agent attribution.


### [Extend Layer 2 networks into Red Hat OpenShift Virtualization with BGP and EVPN](https://yomu.fyi/post/extend-layer-2-networks-into-red-hat-openshift-virtualization-with-bgp.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Miguel Duarte de Mora Barroso, Valentino Uberti
- Published: Sep 3, 2026
- Type: Tutorial

The article describes how to extend Layer 2 networks from a legacy data-center fabric into Red Hat OpenShift Virtualization using BGP and EVPN. It uses a three-node OpenShift lab with secondary NICs on a provider network, static IPv4 addressing, a VTEP CR for 172.19.0.0/24, FRRouting peering, and a Layer 2 primary CUDN with VNI 100. The configuration preserves imported VMs’ IP and MAC identities while maintaining isolation for tenant networks that may have overlapping address spaces. In the example, an external FRR router learns the VM MAC through EVPN and reaches 22.100.0.3; after the VM moves from node 3 to node 1, the MAC remains unchanged and the advertised VTEP changes from 172.19.0.102 to 172.19.0.100. The stated result is phased migration with Layer 2 adjacency to legacy application tiers and end-to-end tenant segmentation.


### [LoRA backdoor threat: How OpenShift AI mitigates the risk](https://yomu.fyi/post/lora-backdoor-threat-how-openshift-ai-mitigates-the-risk.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Mike Hepburn
- Published: Sep 2, 2026
- Type: Problem & solution

LoRA adapters can carry semantic backdoors even when the underlying open-weight model is clean, creating a supply-chain risk for customized AI assistants. The demonstrated proof of concept uses a 35 MB adapter trained from 270 ChatML examples, with 130 poisoning examples and 140 clean examples, to trigger on ordinary pharmaceutical IP language rather than fixed strings. With Qwen/Qwen2.5-0.5B-Instruct served by vLLM 0.25.1, the backdoored model covertly called send\_email to an external address while showing a benign response, whereas the base model and controls remained clean. The defense-in-depth approach combines OpenShift AI, Advanced Cluster Security, and Advanced Cluster Management to restrict runtime LoRA loading, require provenance-checked adapters, enforce admission and build policies, and block unexpected egress. Because weight inspection cannot reliably reveal semantic behavior, protection focuses on deployment, runtime, tool, and network boundaries.


### [LLM quantization guide: How to do it, and how it helps](https://yomu.fyi/post/llm-quantization-guide-how-to-do-it-and-how-it-helps.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Cedric Clyburn
- Published: Sep 2, 2026
- Type: Tutorial

LLM quantization addresses the gap between rapidly growing model sizes and GPU memory by storing weights and activations at lower precision than BF16. It explains how quantization targets linear layers in transformer blocks, distinguishes weight quantization for memory-bound decoding from activation quantization for compute-bound prefill, and maps formats such as GGUF, FP8, NVFP4, AWQ-INT4, and MLX to their inference engines. Calibrated methods including GPTQ, AWQ, and SmoothQuant protect important weights using representative data, while reported NVFP4 results recover about 99% of BF16 accuracy for 70B–235B models and 95–98% for 7B–14B models. In a Llama 3 70B benchmark on two H100s, FP8 weights-and-activations increased throughput from 158 to 474 input tokens/sec and reduced time to first token under load from over 30,000ms to about 4,800ms.


### [Orchestrate production RAG with OpenShift AI](https://yomu.fyi/post/orchestrate-production-rag-with-openshift-ai.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Ana Biazetti, Saad Zaher
- Published: Sep 1, 2026
- Type: Tutorial

This guide shows how to move a streaming retrieval-augmented generation (RAG) workflow from a monolithic Ray Data script to modular AI pipelines on OpenShift AI. It addresses failure recovery and run traceability by separating parsing and chunking, ingestion, model download, and deployment into five reusable components. Parsed and chunked JSONL is stored in S3-compatible storage so KFP can rerun ingestion without repeating document processing, and each run records parameters, timestamps, logs, and status. The data chain uses Docling’s HybridChunker and Ray map\_batches with ActorPoolStrategy, while the model chain downloads a Hugging Face model and deploys it through vLLM and KServe in parallel. For embedding ingestion, the workflow supports local CPU processing with granite-embedding-125m-english or a dedicated GPU vLLM service for larger collections and offers notebooks for deployment and query validation.


### [Developing LLM guardrail configs locally with NeMo Guardrails](https://yomu.fyi/post/developing-llm-guardrail-configs-locally-with-nemo-guardrails.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rob Geada
- Published: Sep 1, 2026
- Type: Tutorial

The article presents a local workflow for developing and testing NeMo Guardrails configurations in a Jupyter notebook, avoiding repeated Kubernetes deployments and requiring no LLM, GPU, or cloud resources. It defines rails, configurations, and servers, then starts with a case-insensitive regex rail that blocks the exact phrase “ignore all previous instructions”; the test catches a direct attack but allows an accented “Ignóre” variant. A broader regex configuration is followed by a DeBERTa-based prompt-injection classifier and a manually assembled set of 13 prompts, producing 12 correct decisions out of 13, with one subtle attack allowed. The article recommends iterating locally, potentially layering targeted regexes before classifiers for fail-fast, defense-in-depth filtering, while noting that 13 prompts cannot meaningfully measure performance and pointing to standardized EvalHub evaluations as a next step.


### [Red Hat OpenShift autoscaling using MachineSet autoscaler with KEDA](https://yomu.fyi/post/red-hat-openshift-autoscaling-using-machineset-autoscaler-with-keda.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Ramon Gordillo Gutierrez, Jose Ortiz Padilla
- Published: Sep 1, 2026
- Type: Tutorial

The demonstration compares OpenShift MachineSet Autoscaler with KEDA against the previously used Cluster Autoscaler, using metrics to scale a MachineSet before pods remain pending. After installing Red Hat’s Custom Metrics Autoscaler operator (KEDA 2.19), granting permissions for MachineSet scaling and Thanos/Prometheus access, it creates a ScaledObject with a Prometheus trigger targeting demo-p4p95-worker-eastus3. Because a MachineSet has no pods, the HPA path cannot use metricType: Value, so AverageValue is paired with a PromQL query that multiplies CPU request utilization by the current node count. With nine one-CPU test pods, the MachineSet scaled from one to two to three nodes as the metric crossed 75%, and all pods reached Running; two additional Standard\_D4s\_v3 VMs were provisioned in zone 3.


### [AI-powered multicluster management: Querying fleet health with OpenShift Lightspeed and Red Hat Advanced Cluster Management](https://yomu.fyi/post/ai-powered-multicluster-management-querying-fleet-health-with-openshif.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Diego Alvarez Ponce, Luiz Bernardo Levenhagen
- Published: Aug 31, 2026
- Type: Tutorial

Managing modern large-scale Kubernetes fleets across distributed clusters can make troubleshooting slow because administrators must build manual search queries and sift scattered outputs. The post presents a Technology Preview MCP server for Red Hat Advanced Cluster Management that translates natural-language prompts into structured searches across managed clusters, deployed with Helm in the hub cluster. OpenShift Lightspeed is configured through its OLSConfig custom resource to call the MCP endpoint, use a Kubernetes service-account token for internal authorization, and optionally skip approval for read-only searches. The examples cover finding clusters below OpenShift 4.21, locating pods in a specified cluster and namespace, and identifying an unhealthy VM across the fleet; one result finds dev-vm in an ErrorUnschedulable condition and provides diagnostic guidance.


### [Stop wasting GPU allocation in Kubernetes with GPU-pruner](https://yomu.fyi/post/stop-wasting-gpu-allocation-in-kubernetes-with-gpu-pruner.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Fahim Uddin
- Published: Aug 31, 2026
- Type: Problem & solution

GPU-pruner addresses idle GPU allocation in Kubernetes by identifying workloads whose hardware activity remains below a configured threshold, rather than relying on browser sessions, network traffic, or pod lifetime. It queries Prometheus for NVIDIA Data Center GPU Manager metrics, including engine activity and GPU utilization, and treats peak performance below 1% throughout a default 35-minute observation window as idle. After tracing an idle pod through ownerReferences or KServe labels, it scales the parent resource to zero, preserving workload metadata for later restoration. Slack notifications, grace periods, lookback checks, and dry-run mode provide safeguards, while Prometheus label handling must preserve the workload namespace and pod identity in DCGM telemetry.


### [Self-service backup for VMs and containers on OpenShift: No cluster-admin required](https://yomu.fyi/post/self-service-backup-for-vms-and-containers-on-openshift-no-cluster-adm.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Michal Pryc, Shubham Dilip Pampattiwar
- Published: Aug 28, 2026
- Type: Problem & solution

In multi-tenant Red Hat OpenShift clusters, Velero Backup and Restore resources live in the OADP installation namespace, leaving non-admin application teams dependent on platform staff. OADP self-service addresses this with namespace-scoped NonAdminBackup and NonAdminRestore resources that proxy Velero resources, while a controller validates requests against DataProtectionApplication policies and synchronizes phase, progress, and queue status back to the tenant namespace. Administrators can enforce retention, snapshot and file-system backup settings, resource inclusion or exclusion, and approval for tenant-provided backup storage; cluster-scoped resources such as SCCs, ClusterRoles, CRDs, and KubeVirt cluster preferences are automatically excluded. OADP 1.6 supports the same workflow for containers, stateful applications, and OpenShift Virtualization VMs, but self-service has no native schedules, cross-namespace restores, or short-lived credentials for tenant-provided storage locations.


### [Building hermetic notebook images for Open Data Hub and Red Hat OpenShift AI](https://yomu.fyi/post/building-hermetic-notebook-images-for-open-data-hub-and-red-hat-opensh.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Vath Sok
- Published: Aug 28, 2026
- Type: Problem & solution

Open Data Hub and Red Hat OpenShift AI adopted hermetic container builds to eliminate network failures, satisfy Conforma compliance, and ensure reproducible notebook environments. Instead of pulling packages during image creation, dependencies are pinned in lockfiles, prefetched into a local cache using tools like Cachi2, and installed with the network disabled. The workflow relies on a unified Containerfile capable of running locally, within GitHub Actions, and on Konflux via Tekton tasks. To pass audit checks and avoid generic tarball downloads, the team packaged awkward binaries like ripgrep and Pandoc into multi-arch Python wheels while patching Node postinstall scripts that fetch files at install time. Upstream CentOS and downstream Red Hat Enterprise Linux dependencies are maintained in distinct lock trees to prevent subtle packaging mismatches.


[Newer posts](https://yomu.fyi/company/red-hat/page/3.md) · [Older posts](https://yomu.fyi/company/red-hat/page/5.md)