alt Hacker NewsIf you are approaching anything looking like an enterprise environment, you are likely to have Kubernetes nearby. ko is a weird requirement. ax requires agent substrate, so it makes sense that it's needed. Agent Substrate also has experimental support in kagent, so it makes sense that it is growing.
I don't really like the oversubscription of agent pods though, as you can no longer trust the k8s pod identity as being from a singular workload. Haven't seen a solution to this for ax yet and it is a barrier to adoption for us.
Replies
Googles Agent Identity is already built around SPIFFE but others are not.
I believe the substrate egress-gateway needs to handover the internal SPIFFE one to an external system (e.g. Entra Agent ID). Not sure if that should be part of substrate or kagent/ax/..
Agent Substrate is solving this - similar to K8s, Substrate is an OIDC (and also SPIFFE) IDP. Credentials containing the actor's identity can be injected into outbound requests using the Substrate egress gateway.
(This is work in flight, but it will land within a few weeks)