Agent Substrate + kagent

Agent Substrate is where agents run. kagent is how you run them.

Agent Substrate runs every agent session in its own sandbox, suspends it when it goes idle, and resumes it in milliseconds where it left off. kagent adds the identity, policy, and observability layer on top. Both run on the Kubernetes you already operate.

Try kagent

See the Architecture

The Reality

Agents are the next major workload for Kubernetes

Your teams are already building them. LangChain in engineering. n8n in ops. Claude Code on every laptop. CrewAI experiments in data science. Custom Python scripts everywhere. That diversity is a good sign. People are solving real problems.

But agents are a strange workload. They sit idle most of the time, wake up in bursts, and take actions on their own. Give every session a dedicated pod and you tie up compute while the agent waits on a model, a tool, or a person. At the scale enterprises are planning for, that does not hold.

The question isn't how your teams build agents. It's what runs them in production.

A technical diagram illustrating Cross-Cluster Connectivity in a multi-cloud or multi-region service mesh. Two Kubernetes clusters, Cluster 1 (US-East-1) and Cluster 2 (EU-West-1), are connected via a Global Service DNS that maps to the address orders.mesh.internal.

The diagram shows:

Cluster 1: Contains "orders" pods that communicate with the DNS.

Cluster 2: Contains "orders" pods that are also part of the same global service.

Encryption: Large lock icons on the connection lines represent mTLS encryption and secure communication between clusters.

Traffic Flow: A "Client Pod" in a separate namespace is shown accessing the orders.mesh.internal address, which then routes to the available pods in either cluster.

Agent Substrate makes the actor the unit of execution

An actor is one agent session with two controls that are always present: a sandbox that isolates execution, and a gateway that governs who can reach it and what it can reach. State, identity, and access controls stay with the actor as the compute underneath it changes. Isolation and governance are part of every session, not something bolted on later.

Idle actors suspend and stop consuming compute. They resume on demand, right where they left off. You scale agent sessions on the Kubernetes you already operate. kagent adds what the runtime does not know: identity, policy, lifecycle, and observability for every agent, tool, and skill.

LangChain

Framework

CrewAI

Framework

Any Agent

Bring your Own

ADK

Framework

Any MCP

Connectors

Any Skill

Capabilities

Open Source & Community-Driven

The Open Agentic Stack for Cloud Native

As the creators of kagent and co-maintainers of Agent Substrate with Google, Solo leads the open-source foundation for agentic workloads. Both projects are in the CNCF Sandbox, with contributions from the industry’s leading organizations.

A grid of corporate logos against a lavender-gray background, each set within a slightly darker rounded rectangle:
Google, Solo.io, Confluent, Microsoft, IBM, Adobe, Red Hat, SAP, Strava, Amazon, Oracle, Amdocs

K+

github stars

100

Contributors

Organizations

K+

Community

Solo Enterprise for Agent Substrate and kagent

A supported runtime for agents, tools, and skills

Solo's enterprise distributions give you Agent Substrate and kagent with support, with agentgateway as the actor's gateway enforcing identity and policy on everything in and out. Air-gapped deployment included. Already running in production at OutSystems and Swissquote.

Agent Identity & Policy

Every actor carries a verifiable identity. agentgateway enforces who can reach an agent and what that agent can reach, on ingress and egress. Granular access control with agent-on-behalf-of semantics.

Get started

Kagent interface showing a policies dashboard with a list of six security policies, their namespaces, and subjects, alongside a sidebar menu for dashboard navigation.

Observability & Tracing

Full tracing of every agent action, tool call, and decision path, propagated end to end with OpenTelemetry. Monitoring for the runtime underneath, and evaluations built from real execution traces.

Get started

A technical diagram illustrating Agent Mesh Traffic Routing in a Kubernetes environment. A Client Pod sends a request to an Agent Service via the DNS name agent.mesh.internal. The request is intercepted by a Waypoint Proxy (Envoy), which performs Layer 7 (L7) functions such as Evaluation and Guardrails. The traffic is then securely routed using mTLS (indicated by a lock icon) to one of several Agent Pods (Pod A, Pod B, or Pod C) within the cluster.

Human-in-the-Loop

Keep humans in control of critical decisions. Define approval workflows, review checkpoints, and escalation paths. The actor suspends while it waits for a person and resumes when the answer comes back.

Get started

Sandbox Isolation and Scale

Every agent session runs as an actor in its own sandbox, suspended when idle and resumed in milliseconds where it left off. No dedicated always-on pod per agent. Size your environment and set SLOs with the Agent Substrate calculator.

Get started