AgentCube Add-on
With the rapid development of generative AI and large language model (LLM) applications, AI agent workloads are becoming important in cloud native environments. These workloads have unique characteristics: continuous interaction, state persistence, and intermittent long sessions. However, the existing workload management modes cannot meet the special requirements of AI agents.
- High cold start latency: Agent interactions typically require responses within milliseconds. However, the native Kubernetes pod startup process (scheduling, IP address assignment, image pull, and container startup) usually takes seconds or even minutes. In scenarios where the code interpreter or a temporary sub-agent needs to be frequently started, the latency of cold start is unacceptable to users.
- Low resource utilization: Agents are typically I/O-intensive workloads. In a session, the agent may spend 90% of the time waiting for the LLM to generate tokens or waiting for external tools to respond. If each agent exclusively occupies a pod on Kubernetes, a large number of CPU and memory resources will be idle during the waiting period and cannot be used by other tasks.
- Lack of status management: Kubernetes is naturally friendly to stateless workloads, but agents highly depend on context/memory. In native Kubernetes, pod restart means loss of memory data. Developers are forced to rebuild the context at the application layer by using external storage, which results in great complexity and network overhead.
- Security isolation: Advanced agents (such as Data Analyst) need to run untrusted code generated by LLMs. However, running rm -rf / in a common runC container is highly risky. Enterprise-class agent platforms urgently need a sandbox environment (such as MicroVM) that can be quickly started and provide strong isolation.
To address these challenges, CCE standard and Turbo clusters offer the AgentCube add-on based on AgentCube. AgentCube is a high-performance AI agent orchestration tool that natively supports and manages AI agent workloads on Kubernetes. It provides innovative capabilities such as fast startup, fast scheduling, native session management, and serverless auto scaling.
- As an open-source project, AgentCube is currently in Alpha and is not covered by CCE's official commercial support. Use AgentCube only in test environments. Be aware of key risks, including security and reliability (such as data security, system stability, and resource consumption).
- This feature is in initial rollout. Check the console for supported regions.
Function Introduction
AgentCube introduces two core CRDs to define agent workloads:
- AgentRuntime: defines the lifecycle, resource quotas, and persistence policies for long-session and complex conversational agents.
- CodeInterpreter: defines a short-task and high-frequency code execution environment that emphasizes "destruction after use" and ultimate security isolation.

Core functions:
- Fast startup
To eliminate the challenges of cold start, AgentCube implements the warm pool mechanism. The system pre-starts and suspends a group of MicroVM sandboxes with the basic environment. When an agent request arrives, AgentCube can allocate a pre-warmed sandbox to the session in milliseconds in "Claim-and-Go" mode, achieving near-zero startup latency.
- Fast scheduling
With Volcano's Agent Scheduler, AgentCube significantly improves the throughput and latency of agent scheduling.
- High throughput and low latency: For bursty agent traffic, optimistic concurrency control and simplified scheduling policies are used to significantly improve the scheduling TPS.
- Unified scheduling support: Volcano's Agent Scheduler can seamlessly work with the original Batch Scheduler. It coordinates potential scheduling conflicts between agents and traditional batch jobs while ensuring the overall resource utilization of the cluster and the SLA of key services.
- Native session management
AgentCube introduces session IDs as core routing identifiers to ensure the continuity of service contexts.
- Request routing: AgentCube Router can identify the x-agentcube-session-id in a request and automatically route it to the corresponding active sandbox.
- Automatic sandbox activation: When the sandbox corresponding to the current session is in the hibernation state, AgentCube Router can automatically activate the sandbox.
- Session-based end-to-end isolation
AgentCube automatically allocates an independent sandbox environment for each session to ensure complete isolation of compute, memory, and file systems, preventing cross-tenant data leakage.
For more information about AgentCube, see AgentCube.
Prerequisites
- A CCE standard or Turbo cluster v1.29 or later is available.
- Redis is deployed and accessible to AgentCube. You are advised to use Huawei Cloud DCS in the same VPC as the cluster. For details, see Buying a DCS Redis Instance.
Installing the Add-on
- Log in to the CCE console and click the cluster name to access the cluster console.
- In the navigation pane, choose Add-ons. Locate AgentCube on the right and click Install.
- On the Install Add-on page, configure the specifications.
Table 1 Parameters Parameter
Description
Example Value
redis.addr
Redis address, which is mandatory
<IP-address>:<port-number>
redis.password
Redis password, which is mandatory
None
agentSandbox.install
Whether to automatically install agent-sandbox. AgentCube depends on agent-sandbox when it is running. If this parameter is set to true, agent-sandbox will be automatically installed. If agent-sandbox has been manually installed in your cluster, set this parameter to false to skip installation.
true
agentSandbox.extensions
Whether to enable the extension controller of agent-sandbox
true
volcano.scheduler.enabled
Whether to install the Volcano agent-scheduler
false
router.service.type
Service access type of the agentcube-router component. If the Service needs to be accessed through a node, set this parameter to NodePort.
ClusterIP, NodePort
workloadmanager.service.type
Service access type of the workloadmanager component. If the Service needs to be accessed through a node, set this parameter to NodePort.
ClusterIP, NodePort
- Click Install. If the add-on is in the Running state, it means that the add-on has been installed.
Components
| Component | Description | Resource Type |
|---|---|---|
| workloadmanager | Lifecycle management for sandboxes and code interpreters | Deployment |
| agentcube-router | API gateway for request forwarding to sandbox pods | Deployment |
| volcano-agent-scheduler | Low-latency, high-throughput scheduling component | Deployment |
| agent-sandbox-controller | Agent sandbox management | Deployment |
The workloadmanager, agentcube-router, volcano-agent-scheduler, and agent-sandbox-controller components are deployed in the agentcube namespace.
If the add-on is uninstalled after being installed, the components and Services created in the agentcube namespace will be deleted, but the CRDs created by the add-on will not be deleted.
Use Cases
After the add-on is installed, you can use it by referring to the following examples.
Example 1: Using CodeInterpreter
- Create the code-interpreter-demo.yaml file.
apiVersion: runtime.agentcube.volcano.sh/v1alpha1 kind: CodeInterpreter metadata: name: my-codeinterpreter namespace: default spec: template: # runtimeClassName: kata # To use a secure container, set runtimeClassName to kata or kuasar-vmm. A node supporting secure runtime is required. # Use the PicoD image, which supports shell and Python code execution only. image: ghcr.io/volcano-sh/picod:latest # Resources resources: requests: cpu: "100m" memory: "128Mi" limits: cpu: "500m" memory: "512Mi" # Session configuration sessionTimeout: "15m" # The session times out after it is idle for 15 minutes. maxSessionDuration: "8h" # Maximum session duration: 8 hours # Key function: warm pool warmPoolSize: 5 # 5 pods will be warmed up (near-zero latency). - Deploy CodeInterpreter.
kubectl apply -f code-interpreter-demo.yaml
After the creation is complete, run the following command to check the status:
kubectl get codeinterpreter my-codeinterpreter -o yaml
- Verify the creation of the warm pool.
# View the created SandboxWarmPool. kubectl get sandboxwarmpool -n default # View the pods in the warm pool. kubectl get pods |grep my-codeinterpreter
- Create a test script (Python 3.11 or later must be installed locally).
- Create the test_codeinterpreter folder.
- Go to the test_codeinterpreter folder and run the following command to create a Python virtual environment:
python -m venv venv
- Activate the virtual environment (on Windows, run the .\venv\Scripts\activate command in PowerShell).
source venv/bin/activate
- Install the dependency.
pip install -r requirements.txt
- Run the test script.
- Set environment variables. (If you want to access the workload from outside the cluster, set the Service type of workloadmanager and agentcube-router to NodePort and bind an EIP to a CCE cluster node. Then, you can access the workload using the EIP and node port.)
- Linux:
export WORKLOAD_MANAGER_URL="http://addr:workloadmanager-service-nodeport" export ROUTER_URL="http://addr:agentcube-router-service-nodeport"
- Windows (in PowerShell):
$env:ROUTER_URL = "http://addr:agentcube-router-service-nodeport" $env:WORKLOAD_MANAGER_URL = "http://addr:workloadmanager-service-nodeport"
In the command, addr indicates the EIP, agentcube-router-service-nodeport indicates the node port configured for the Service of agentcube-router, and workloadmanager-service-nodeport indicates the node port configured for the Service of workloadmanager.
- Linux:
- Run the test.
python test_codeinterpreter.py
Output

CodeInterpreter typically runs AI-generated code. For security, execute it in a secure container runtime.
- Set environment variables. (If you want to access the workload from outside the cluster, set the Service type of workloadmanager and agentcube-router to NodePort and bind an EIP to a CCE cluster node. Then, you can access the workload using the EIP and node port.)
Example 2: Using AgentRuntime
- Create the test_agentruntime folder.
- Build an example agent image and push it to the image repository.
docker build -t my-agent-app:latest .
- Deploy AgentRuntime.
agent-runtime-demo.yaml file:
apiVersion: runtime.agentcube.volcano.sh/v1alpha1 kind: AgentRuntime metadata: name: my-agent-app namespace: default spec: targetPort: - pathPrefix: "/" port: 8080 protocol: "HTTP" podTemplate: labels: app: my-agent-app spec: # runtimeClassName: kata # To use a secure container, set runtimeClassName to kata or kuasar-vmm. A node supporting secure runtime is required. schedulerName: default-scheduler # If Volcano agent-scheduler is installed, set this parameter to agent-scheduler. containers: - name: my-agent-app image: {{agent image}} # Example agent image env: - name: WORKLOAD_MANAGER_URL value: http://workloadmanager.agentcube.svc.cluster.local:8080 - name: ROUTER_URL value: http://agentcube-router.agentcube.svc.cluster.local:8080 - name: CODEINTERPRETER_NAME # Name of the code interpreter value: my-codeinterpreter - name: CODEINTERPRETER_NAMESPACE value: default readinessProbe: httpGet: path: /health port: 8080 periodSeconds: 5 sessionTimeout: "15m" # The session times out after it is idle for 15 minutes. maxSessionDuration: "8h" # Maximum session duration: 8 hours status: {} - Deploy AgentRuntime and check its status.
kubectl apply -f agent-runtime-demo.yaml # Check the status. kubectl get agentruntime my-agent-app -oyaml
- Create a test script (Python 3.11 or later must be installed locally).
- Create the test_agentruntime folder. Create the test_agentruntime.py and requirements.txt files in the folder. The file content is as follows:
- test_agentruntime.py
from agentcube.agent_runtime import AgentRuntimeClient import os import time # Configure environment variables. ROUTER_URL = os.getenv('ROUTER_URL', 'http://agentcube-router.agentcube.svc.cluster.local:8080') AGENT_NAME = os.getenv('AGENT_NAME', 'my-agent-app') AGENT_NAMESPACE = os.getenv('AGENT_NAMESPACE', 'default') saved_session_id = "" def test_basic_invoke(): """Test the basic calling function.""" print("=== test basic invoke ===\n") # Create a client. agent_client = AgentRuntimeClient( agent_name=AGENT_NAME, namespace=AGENT_NAMESPACE, router_url=ROUTER_URL, verbose=True, timeout=500, connect_timeout=120.0 ) print(f"Session ID: {agent_client.session_id}\n") # Call for the first time (creates a new pod) print("first invoke (create new Pod): ") result = agent_client.invoke( payload={"prompt": "hello world!"}, ) print(f"response: {result}\n") # # Save the session ID. global saved_session_id saved_session_id = agent_client.session_id def test_session_reuse(): """Test session reuse""" print(f"=== test session reuse ===\n") # Use the original session ID. agent_client = AgentRuntimeClient( agent_name=AGENT_NAME, namespace=AGENT_NAMESPACE, router_url=ROUTER_URL, session_id=saved_session_id, # Session reused verbose=True, timeout=500, connect_timeout=120.0 ) print(f"reuse session ID: {agent_client.session_id}\n") # Call for the second time (reuses the existing pod) print("second invoke(reuse Pod):") result = agent_client.invoke( payload={"prompt": "How's the weather today?"}, ) print(f"response: {result}\n") def test_conversation(): """Test continuous conversation""" print("=== test conversation ===\n") agent_client = AgentRuntimeClient( agent_name=AGENT_NAME, namespace=AGENT_NAMESPACE, router_url=ROUTER_URL, verbose=True, timeout=500, connect_timeout=120.0 ) messages = [ "Introduce yourself", "What can you do?", "Write a Python function for me", ] for i, msg in enumerate(messages, 1): print(f"message {i}: {msg}") result = agent_client.invoke( payload={"prompt": msg}, ) print(f"response {i}: {result}\n") time.sleep(1) if __name__ == "__main__": test_basic_invoke() test_session_reuse() test_conversation() - requirements.txt
agentcube_sdk
- test_agentruntime.py
- Go to the test_agentruntime folder and run the following command to create a Python virtual environment:
python -m venv venv
- Activate the virtual environment (on Windows, run the .\venv\Scripts\activate command in PowerShell).
source venv/bin/activate
- Install the dependency.
pip install -r requirements.txt
- Create the test_agentruntime folder.
- Run the test script.
- Set environment variables. (To enable external access to the workload, configure the agentcube-router Service as NodePort and bind an EIP to a CCE cluster node. Access the workload using the EIP and NodePort.)
- Linux:
export ROUTER_URL="http://addr:agentcube-router-service-nodeport"
- Windows (in PowerShell):
$env:ROUTER_URL = "http://addr:agentcube-router-service-nodeport"
In the command, addr indicates the EIP, and agentcube-router-service-nodeport indicates the node port configured for the Service of agentcube-router.
- Linux:
- Run the test.
python test_agentruntime.py
Output

- Set environment variables. (To enable external access to the workload, configure the agentcube-router Service as NodePort and bind an EIP to a CCE cluster node. Access the workload using the EIP and NodePort.)
Change History
| Add-on Version | Supported Cluster Version | What's New |
|---|---|---|
| 1.0.3 | v1.29 v1.30 v1.31 v1.32 v1.33 v1.34 v1.35 | The AgentCube add-on is now available. |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot