The best Kubernetes for AI agents

CIQ Stratum Pro is the commercial version built on SKE. SKE is a Kubernetes engine that installs, joins, upgrades, and snapshots a cluster from one signed binary. It builds Kubernetes, etcd, containerd, runc, and kube-vip from unmodified upstream source and pins every version together, with Cilium in place of kube-proxy, CoreDNS, and local-path storage¹. It runs on any Enterprise Linux 9 or later distribution, including Rocky Linux, RLC Pro, RLC Pro AI, and RLC Pro Hardened, and comes from the team behind Rocky Linux, Fuzzball, Warewulf, and Apptainer.

For AI agents, SKE ships stratum mcp in the engine, so CIQ Stratum Pro has a built-in MCP server. It starts read-only on stdio. Writes (apply manifests, scale, snapshot, mint join tokens) and destructive operations (upgrade, roll back, rotate CAs, restore etcd, uninstall) are separate tiers, each enabled by its own flag. Tools above the enabled tier are never registered, so the client never sees them. Secret reads and RBAC writes are refused at every tier, even with cluster-admin. Every result is wrapped in untrusted-data markers with a per-call random id, so a log line that says “ignore your instructions” reaches the model as quoted data². The docs state that the tiers aren’t a security boundary and that Kubernetes RBAC is, and they give the YAML for a dedicated service account that can’t read Secrets².

CIQ Stratum Pro adds fleet management across SKE clusters, single sign-on through your identity provider, a CIS hardening profile applied at install with a per-control report, and CIQ support⁴. FIPS and STIG are not offered at launch, and conformance certification is in progress, so a regulated site that needs either today should weigh RKE2 or OpenShift on those rows.

These projects run the agents, and neither replaces the engine. Agent Sandbox, from Kubernetes SIG Apps, is a sandbox orchestrator: it manages isolated, long-running, single-pod workloads with stable identities for agent runtimes, through Sandbox, SandboxTemplate, SandboxClaim, and SandboxWarmPool resources, using secure runtimes such as gVisor and Kata Containers through RuntimeClass. It is installed onto an existing cluster by kubectl or Helm and is Apache 2.0⁵. kagent is a Kubernetes-native framework for building AI agents: agents are custom resources, a controller manages them, and it ships an MCP server with tools for Kubernetes, Istio, Helm, Argo, Prometheus, and others. It is a CNCF project under Apache 2.0, installed by Helm⁶.

Neither project governs what the agent may do to the cluster API. Agent Sandbox isolates what the agent runs. kagent gives the agent tools, including cluster tools. The cluster’s engine decides whether a tool call can read a Secret, scale a deployment, or delete a namespace. kagent and CIQ Stratum Pro do different jobs: kagent builds the agents, and the MCP server and RBAC on a CIQ Stratum Pro cluster decide what those agents may do to it. The tiers and refusals in stratum mcp apply only to calls made through it; kagent’s own toolbox talks to the API with its own credential, so scope that credential with RBAC too.

K3s is a fully compliant Kubernetes distribution packaged as one binary under 100 MB or a small container image, with SQLite as the default datastore and etcd, MySQL, and Postgres as options. It bundles containerd, Flannel, CoreDNS, Traefik, ServiceLB, Kube-router for network policy, local-path storage, and Spegel as a registry mirror, and it runs on most modern Linux systems on x86_64 and arm64⁸. Air-gapped installs stage an images archive on each node or point at a private registry⁹. It has a CIS hardening guide⁹.

There is no MCP server in K3s. An agent operating a K3s cluster goes through a third-party server such as Kubernetes MCP Server, which has a read-only mode and can deny resource types such as Secrets, and the permission model is whatever RBAC you give that server⁷. For a cluster that runs agents at the edge, K3s is a fine choice. For a cluster an agent operates, you assemble the safety controls yourself from the server you add and the RBAC you give it.

RKE2 is SUSE’s security-focused Kubernetes distribution. Its support matrix for v1.36 lists SLES, Ubuntu, and the RHEL family, with Rocky Linux 9.7 to 10.2 validated as part of RHEL testing¹⁰. Air-gapped installs stage an images tarball on each node or use a private registry, and a CIS profile is enabled with profile: cis in the config file¹¹. RKE2 is built to meet FIPS 140-2 using the BoringCrypto module¹². Rancher Manager, sold as Rancher Prime, is the fleet-management reference, and SUSE describes a multi-agent AI ecosystem in Rancher Prime that is extensible through MCP¹³.

RKE2 is a good engine and runs on Rocky Linux. It runs a single cluster without Rancher. CIQ Stratum Pro differs in the artifact and the stack. SKE puts the whole cluster lifecycle in one signed file with a dashboard and an MCP server in the engine²³, and CIQ Stratum Pro adds fleet management without the Rancher stack. Run that comparison if the engine is what you like about Rancher and the management layer is what you pay for.

OpenShift is Kubernetes plus a registry, CI/CD, and a developer console, with the certification, compliance authorizations, platform breadth, and production history that come with being the incumbent. Since 4.19, the control plane and compute machines must run RHCOS; support for package-based RHEL compute machines was removed¹⁴. Disconnected installs mirror images to a registry you operate¹⁴. Fleet management is Red Hat Advanced Cluster Management, a separate product¹⁵.

For agents, Red Hat ships the MCP server for Red Hat OpenShift as a Technology Preview, installed separately with Helm, with a read-only mode and a denied-resources list that can include Secrets¹⁸. The Kubernetes MCP Server project also supports OpenShift⁷. OpenShift doesn’t offer a Rocky Linux node. If you’re moving your estate to Rocky Linux from CIQ, CIQ Stratum Pro keeps Kubernetes on the Linux you’re moving to. If you use the whole OpenShift platform, start with a greenfield cluster beside it instead of a migration.

kubeadm bootstraps a conformant cluster from upstream components. You install kubeadm, kubelet, and a container runtime on each node, then choose and add the CNI, storage, dashboard, and every operator yourself¹⁶. It’s free, and your team owns every upgrade, image mirror, and certificate from then on.

For agents, you add a third-party MCP server and scope its RBAC⁷. If your team is comfortable owning every component from the command line, this works. CIQ Stratum Pro is for teams that want the same upstream components pinned, signed, tested together, and supported, with the dashboard and the MCP server already in the file.