---
title: "Rossoctl for agent discoverability, security, and observability on Kubernetes"
description: "Agent sprawl arises when many AI agents on Red Hat OpenShift become redundant, insecure, and untraceable, using static API keys over HTTP and lacking visibility into reasoning failures. Rossoctl, a Kubernetes-native controller, automates discovery by declaring AgentRuntime resources that fetch metadata to create AgentCard custom resources, and uses a two-phase Helm deployment to resolve the URL dependency between routes and AgentCards. It adopts the A2A protocol, which standardizes agent interaction through a machine-readable AgentCard at /.well-known/agent-card.json and a JSON-RPC interface for consistent payloads. Security follows a six-layer zero-trust model: SPIRE issues short-lived certificates, Istio enforces mTLS, AgentCards are signed with JWS, and AuthBridge provides scoped OAuth2 tokens. Observability uses opt-in MLflow tracing that captures orchestration flow, tool calls, and model latency, enabling diagnosis of semantic failures such as hallucinations or data leaks that standard metrics miss."
---

# Rossoctl for agent discoverability, security, and observability on Kubernetes

[Red Hat](https://yomu.fyi/company/red-hat) · Shri Charan · Oct 6, 2026

**Type:** Explainer

## Summary

Agent sprawl arises when many AI agents on Red Hat OpenShift become redundant, insecure, and untraceable, using static API keys over HTTP and lacking visibility into reasoning failures. Rossoctl, a Kubernetes-native controller, automates discovery by declaring AgentRuntime resources that fetch metadata to create AgentCard custom resources, and uses a two-phase Helm deployment to resolve the URL dependency between routes and AgentCards. It adopts the A2A protocol, which standardizes agent interaction through a machine-readable AgentCard at /.well-known/agent-card.json and a JSON-RPC interface for consistent payloads. Security follows a six-layer zero-trust model: SPIRE issues short-lived certificates, Istio enforces mTLS, AgentCards are signed with JWS, and AuthBridge provides scoped OAuth2 tokens. Observability uses opt-in MLflow tracing that captures orchestration flow, tool calls, and model latency, enabling diagnosis of semantic failures such as hallucinations or data leaks that standard metrics miss.

## Context

The post addresses the operational challenges of deploying AI agents on Kubernetes, specifically agent sprawl, and presents Rossoctl as a Kubernetes-native controller that integrates A2A protocol, zero-trust security, and MLflow tracing to manage discovery, security, and observability.

## Approach / What changed

Rossoctl is a Kubernetes-native controller that treats agents as first-class resources via AgentRuntime and AgentCard custom resources. It uses the A2A protocol for standardized agent interaction, a six-layer zero-trust security model with SPIRE, Istio mTLS, JWS-signed AgentCards, and AuthBridge, and opt-in MLflow tracing for observability. A two-phase Helm deployment resolves the URL dependency between routes and AgentCards.

## Takeaways

- Agent sprawl leads to redundant agents, insecure static credentials, and untraceable semantic failures; Rossoctl addresses this with automated discovery, zero-trust security, and reasoning-level observability.
- The A2A protocol standardizes agent interaction through a machine-readable AgentCard at /.well-known/agent-card.json and a JSON-RPC interface, enabling cross-framework orchestration.
- Rossoctl’s six-layer security model includes SPIRE for cryptographic identity, Istio mTLS, JWS-signed AgentCards, and AuthBridge for dynamic tokens, removing static credentials.

## FAQ

### How does Rossoctl handle the URL dependency when deploying an agent?

It uses a two-phase Helm deployment: first establish infrastructure to capture hostnames, then inject those into the agent deployment, ensuring seamless setup without manual intervention.

### What distinguishes AI agents from traditional microservices in terms of observability?

Agents can fail semantically—hallucinating tools or leaking data—while returning valid JSON. Standard metrics cannot diagnose these failures; MLflow tracing captures internal reasoning steps to reveal such issues.

### How does Rossoctl ensure secure agent discovery?

It enforces a six-layer zero-trust model including SPIRE for short-lived certificates, Istio mTLS for encrypted channels, JWS-signed AgentCards to prevent spoofing, and AuthBridge for scoped OAuth2 tokens.

**Tags:** [A2A](https://yomu.fyi/topic/a2a), [AI Agents](https://yomu.fyi/topic/ai-agents), [Kubernetes](https://yomu.fyi/topic/kubernetes), [Observability](https://yomu.fyi/topic/observability), [Security](https://yomu.fyi/topic/security)

- Source: [Red Hat](https://developers.redhat.com/articles/2026/10/06/rossoctl-for-agent-discoverability-security-and-observability-on-kubernetes)
- Source URL: https://developers.redhat.com/articles/2026/10/06/rossoctl-for-agent-discoverability-security-and-observability-on-kubernetes
- Ingested by Yomu: 2026-10-06T15:00:10.268Z

[Read original post](https://developers.redhat.com/articles/2026/10/06/rossoctl-for-agent-discoverability-security-and-observability-on-kubernetes)