Updated on 2026-06-16 GMT+08:00

AgentCube Add-on

With the rapid development of generative AI and large language model (LLM) applications, AI agent workloads are becoming important in cloud native environments. These workloads have unique characteristics: continuous interaction, state persistence, and intermittent long sessions. However, the existing workload management modes cannot meet the special requirements of AI agents.

  • High cold start latency: Agent interactions typically require responses within milliseconds. However, the native Kubernetes pod startup process (scheduling, IP address assignment, image pull, and container startup) usually takes seconds or even minutes. In scenarios where the code interpreter or a temporary sub-agent needs to be frequently started, the latency of cold start is unacceptable to users.
  • Low resource utilization: Agents are typically I/O-intensive workloads. In a session, the agent may spend 90% of the time waiting for the LLM to generate tokens or waiting for external tools to respond. If each agent exclusively occupies a pod on Kubernetes, a large number of CPU and memory resources will be idle during the waiting period and cannot be used by other tasks.
  • Lack of status management: Kubernetes is naturally friendly to stateless workloads, but agents highly depend on context/memory. In native Kubernetes, pod restart means loss of memory data. Developers are forced to rebuild the context at the application layer by using external storage, which results in great complexity and network overhead.
  • Security isolation: Advanced agents (such as Data Analyst) need to run untrusted code generated by LLMs. However, running rm -rf / in a common runC container is highly risky. Enterprise-class agent platforms urgently need a sandbox environment (such as MicroVM) that can be quickly started and provide strong isolation.

To address these challenges, CCE standard and Turbo clusters offer the AgentCube add-on based on AgentCube. AgentCube is a high-performance AI agent orchestration tool that natively supports and manages AI agent workloads on Kubernetes. It provides innovative capabilities such as fast startup, fast scheduling, native session management, and serverless auto scaling.

  • As an open-source project, AgentCube is currently in Alpha and is not covered by CCE's official commercial support. Use AgentCube only in test environments. Be aware of key risks, including security and reliability (such as data security, system stability, and resource consumption).
  • This feature is in initial rollout. Check the console for supported regions.

Function Introduction

AgentCube introduces two core CRDs to define agent workloads:

  1. AgentRuntime: defines the lifecycle, resource quotas, and persistence policies for long-session and complex conversational agents.
  2. CodeInterpreter: defines a short-task and high-frequency code execution environment that emphasizes "destruction after use" and ultimate security isolation.

Core functions:

  • Fast startup

    To eliminate the challenges of cold start, AgentCube implements the warm pool mechanism. The system pre-starts and suspends a group of MicroVM sandboxes with the basic environment. When an agent request arrives, AgentCube can allocate a pre-warmed sandbox to the session in milliseconds in "Claim-and-Go" mode, achieving near-zero startup latency.

  • Fast scheduling

    With Volcano's Agent Scheduler, AgentCube significantly improves the throughput and latency of agent scheduling.

    • High throughput and low latency: For bursty agent traffic, optimistic concurrency control and simplified scheduling policies are used to significantly improve the scheduling TPS.
    • Unified scheduling support: Volcano's Agent Scheduler can seamlessly work with the original Batch Scheduler. It coordinates potential scheduling conflicts between agents and traditional batch jobs while ensuring the overall resource utilization of the cluster and the SLA of key services.
  • Native session management

    AgentCube introduces session IDs as core routing identifiers to ensure the continuity of service contexts.

    • Request routing: AgentCube Router can identify the x-agentcube-session-id in a request and automatically route it to the corresponding active sandbox.
    • Automatic sandbox activation: When the sandbox corresponding to the current session is in the hibernation state, AgentCube Router can automatically activate the sandbox.
  • Session-based end-to-end isolation

    AgentCube automatically allocates an independent sandbox environment for each session to ensure complete isolation of compute, memory, and file systems, preventing cross-tenant data leakage.

For more information about AgentCube, see AgentCube.

Prerequisites

  • A CCE standard or Turbo cluster v1.29 or later is available.
  • Redis is deployed and accessible to AgentCube. You are advised to use Huawei Cloud DCS in the same VPC as the cluster. For details, see Buying a DCS Redis Instance.

Installing the Add-on

  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. In the navigation pane, choose Add-ons. Locate AgentCube on the right and click Install.
  3. On the Install Add-on page, configure the specifications.

    Table 1 Parameters

    Parameter

    Description

    Example Value

    redis.addr

    Redis address, which is mandatory

    <IP-address>:<port-number>

    redis.password

    Redis password, which is mandatory

    None

    agentSandbox.install

    Whether to automatically install agent-sandbox. AgentCube depends on agent-sandbox when it is running. If this parameter is set to true, agent-sandbox will be automatically installed. If agent-sandbox has been manually installed in your cluster, set this parameter to false to skip installation.

    true

    agentSandbox.extensions

    Whether to enable the extension controller of agent-sandbox

    true

    volcano.scheduler.enabled

    Whether to install the Volcano agent-scheduler

    false

    router.service.type

    Service access type of the agentcube-router component. If the Service needs to be accessed through a node, set this parameter to NodePort.

    ClusterIP, NodePort

    workloadmanager.service.type

    Service access type of the workloadmanager component. If the Service needs to be accessed through a node, set this parameter to NodePort.

    ClusterIP, NodePort

  4. Click Install. If the add-on is in the Running state, it means that the add-on has been installed.

Components

Table 2 AgentCube components

Component

Description

Resource Type

workloadmanager

Lifecycle management for sandboxes and code interpreters

Deployment

agentcube-router

API gateway for request forwarding to sandbox pods

Deployment

volcano-agent-scheduler

Low-latency, high-throughput scheduling component

Deployment

agent-sandbox-controller

Agent sandbox management

Deployment

The workloadmanager, agentcube-router, volcano-agent-scheduler, and agent-sandbox-controller components are deployed in the agentcube namespace.

If the add-on is uninstalled after being installed, the components and Services created in the agentcube namespace will be deleted, but the CRDs created by the add-on will not be deleted.

Use Cases

After the add-on is installed, you can use it by referring to the following examples.

Example 1: Using CodeInterpreter

  1. Create the code-interpreter-demo.yaml file.

    apiVersion: runtime.agentcube.volcano.sh/v1alpha1
    kind: CodeInterpreter
    metadata:
      name: my-codeinterpreter
      namespace: default
    spec:
      template:
        # runtimeClassName: kata    # To use a secure container, set runtimeClassName to kata or kuasar-vmm. A node supporting secure runtime is required.
        # Use the PicoD image, which supports shell and Python code execution only.
        image: ghcr.io/volcano-sh/picod:latest
        # Resources
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
      # Session configuration
      sessionTimeout: "15m"      # The session times out after it is idle for 15 minutes.
      maxSessionDuration: "8h"   # Maximum session duration: 8 hours
      # Key function: warm pool
      warmPoolSize: 5    # 5 pods will be warmed up (near-zero latency).

  2. Deploy CodeInterpreter.

    kubectl apply -f code-interpreter-demo.yaml

    After the creation is complete, run the following command to check the status:

    kubectl get codeinterpreter my-codeinterpreter -o yaml

  3. Verify the creation of the warm pool.

    # View the created SandboxWarmPool.
    kubectl get sandboxwarmpool -n default
    # View the pods in the warm pool.
    kubectl get pods |grep my-codeinterpreter

  4. Create a test script (Python 3.11 or later must be installed locally).

    1. Create the test_codeinterpreter folder.
    2. Go to the test_codeinterpreter folder and run the following command to create a Python virtual environment:
      python -m venv venv
    3. Activate the virtual environment (on Windows, run the .\venv\Scripts\activate command in PowerShell).
      source venv/bin/activate
    4. Install the dependency.
      pip install -r requirements.txt

  5. Run the test script.

    1. Set environment variables. (If you want to access the workload from outside the cluster, set the Service type of workloadmanager and agentcube-router to NodePort and bind an EIP to a CCE cluster node. Then, you can access the workload using the EIP and node port.)
      • Linux:
        export WORKLOAD_MANAGER_URL="http://addr:workloadmanager-service-nodeport" 
        export ROUTER_URL="http://addr:agentcube-router-service-nodeport"
      • Windows (in PowerShell):
        $env:ROUTER_URL = "http://addr:agentcube-router-service-nodeport"
        $env:WORKLOAD_MANAGER_URL = "http://addr:workloadmanager-service-nodeport"

      In the command, addr indicates the EIP, agentcube-router-service-nodeport indicates the node port configured for the Service of agentcube-router, and workloadmanager-service-nodeport indicates the node port configured for the Service of workloadmanager.

    2. Run the test.
      python test_codeinterpreter.py

      Output

      CodeInterpreter typically runs AI-generated code. For security, execute it in a secure container runtime.

Example 2: Using AgentRuntime

  1. Create the test_agentruntime folder.

  2. Build an example agent image and push it to the image repository.

    docker build  -t my-agent-app:latest .

  3. Deploy AgentRuntime.

    agent-runtime-demo.yaml file:

    apiVersion: runtime.agentcube.volcano.sh/v1alpha1
    kind: AgentRuntime
    metadata:
      name: my-agent-app
      namespace: default
    spec:
      targetPort:
        - pathPrefix: "/"
          port: 8080
          protocol: "HTTP"
      podTemplate:
        labels:
          app: my-agent-app
        spec:
          # runtimeClassName: kata    # To use a secure container, set runtimeClassName to kata or kuasar-vmm. A node supporting secure runtime is required.
          schedulerName: default-scheduler    # If Volcano agent-scheduler is installed, set this parameter to agent-scheduler.
          containers:
            - name: my-agent-app
              image: {{agent image}}    # Example agent image
              env:
                - name: WORKLOAD_MANAGER_URL
                  value: http://workloadmanager.agentcube.svc.cluster.local:8080
                - name: ROUTER_URL
                  value: http://agentcube-router.agentcube.svc.cluster.local:8080
                - name: CODEINTERPRETER_NAME         # Name of the code interpreter
                  value: my-codeinterpreter
                - name: CODEINTERPRETER_NAMESPACE
                  value: default
              readinessProbe:
                httpGet:
                  path: /health
                  port: 8080
                periodSeconds: 5
      sessionTimeout: "15m"             # The session times out after it is idle for 15 minutes.
      maxSessionDuration: "8h"          # Maximum session duration: 8 hours
    status: {}

  4. Deploy AgentRuntime and check its status.

    kubectl apply -f agent-runtime-demo.yaml
    # Check the status.
    kubectl get agentruntime my-agent-app -oyaml

  5. Create a test script (Python 3.11 or later must be installed locally).

    1. Create the test_agentruntime folder.
      Create the test_agentruntime.py and requirements.txt files in the folder. The file content is as follows:
      • test_agentruntime.py
        from agentcube.agent_runtime import AgentRuntimeClient
        import os
        import time
        
        # Configure environment variables.
        ROUTER_URL = os.getenv('ROUTER_URL', 'http://agentcube-router.agentcube.svc.cluster.local:8080')
        AGENT_NAME = os.getenv('AGENT_NAME', 'my-agent-app')
        AGENT_NAMESPACE = os.getenv('AGENT_NAMESPACE', 'default')
        
        saved_session_id = ""
        
        def test_basic_invoke():
            """Test the basic calling function."""
            print("=== test basic invoke ===\n")
        
            # Create a client.
            agent_client = AgentRuntimeClient(
                agent_name=AGENT_NAME,
                namespace=AGENT_NAMESPACE,
                router_url=ROUTER_URL,
                verbose=True,
                timeout=500,
                connect_timeout=120.0
            )
        
            print(f"Session ID: {agent_client.session_id}\n")
        
            # Call for the first time (creates a new pod)
            print("first invoke (create new Pod): ")
            result = agent_client.invoke(
                payload={"prompt": "hello world!"},
            )
            print(f"response: {result}\n")
        
            # # Save the session ID.
            global saved_session_id
            saved_session_id = agent_client.session_id
        
        def test_session_reuse():
            """Test session reuse"""
            print(f"=== test session reuse ===\n")
        
            # Use the original session ID.
            agent_client = AgentRuntimeClient(
                agent_name=AGENT_NAME,
                namespace=AGENT_NAMESPACE,
                router_url=ROUTER_URL,
                session_id=saved_session_id, # Session reused
                verbose=True,
                timeout=500,
                connect_timeout=120.0
            )
        
            print(f"reuse session ID: {agent_client.session_id}\n")
        
            # Call for the second time (reuses the existing pod)
            print("second invoke(reuse Pod):")
            result = agent_client.invoke(
                payload={"prompt": "How's the weather today?"},
            )
            print(f"response: {result}\n")
        
        def test_conversation():
            """Test continuous conversation"""
            print("=== test conversation ===\n")
        
            agent_client = AgentRuntimeClient(
                agent_name=AGENT_NAME,
                namespace=AGENT_NAMESPACE,
                router_url=ROUTER_URL,
                verbose=True,
                timeout=500,
                connect_timeout=120.0
            )
        
            messages = [
                "Introduce yourself",
                "What can you do?",
                "Write a Python function for me",
            ]
        
            for i, msg in enumerate(messages, 1):
                print(f"message {i}: {msg}")
                result = agent_client.invoke(
                    payload={"prompt": msg},
                )
                print(f"response {i}: {result}\n")
                time.sleep(1)
        
        if __name__ == "__main__":
            test_basic_invoke()
            test_session_reuse()
            test_conversation()
      • requirements.txt
        agentcube_sdk
    2. Go to the test_agentruntime folder and run the following command to create a Python virtual environment:
      python -m venv venv
    3. Activate the virtual environment (on Windows, run the .\venv\Scripts\activate command in PowerShell).
      source venv/bin/activate
    4. Install the dependency.
      pip install -r requirements.txt

  6. Run the test script.

    1. Set environment variables. (To enable external access to the workload, configure the agentcube-router Service as NodePort and bind an EIP to a CCE cluster node. Access the workload using the EIP and NodePort.)
      • Linux:
        export ROUTER_URL="http://addr:agentcube-router-service-nodeport"
      • Windows (in PowerShell):
        $env:ROUTER_URL = "http://addr:agentcube-router-service-nodeport"

      In the command, addr indicates the EIP, and agentcube-router-service-nodeport indicates the node port configured for the Service of agentcube-router.

    2. Run the test.
      python test_agentruntime.py

      Output

Change History

Table 3 AgentCube updates

Add-on Version

Supported Cluster Version

What's New

1.0.3

v1.29

v1.30

v1.31

v1.32

v1.33

v1.34

v1.35

The AgentCube add-on is now available.