Welcoming OpenShell to the CNCF: Open Governance to Secure Agentic AI | CNCF

Enroll your company as a CNCF End User and save more than $10K in training and conference costs
Posted on November 10, 2026 by Jonathan Bryce (CNCF), Ali Golshan (NVIDIA)
CNCF projects highlighted in this post
Today at KubeCon + CloudNativeCon North America, the Cloud Native Computing Foundation (CNCF) welcomes OpenShell as a Sandbox project. NVIDIA has contributed OpenShell, an open source runtime for securing and governing autonomous AI agents, to the foundation’s community-led home.
As organizations put AI agents to work, they need to give agents real capability without giving them unchecked access to data, secrets, or networks. This requires enforcement outside of the agents, right within the infrastructure that the agents run on.
OpenShell does exactly that: it manages and monitors agent behavior, provides and enforces policy-based boundaries for what it can do. OpenShell is adopting Cedar, another CNCF project, as its policy language. It’s a great example of CNCF projects building on one another.
Why this belongs in the cloud native community
Agents are becoming part of cloud native infrastructure, and the layer that governs them should be shared, vendor-neutral, and open to everyone who depends on it. OpenShell already reflects that spirit. Core contributors from NVIDIA, Red Hat, Docker, and Canonical have worked on the project since its inception. Their early involvement, alongside many additional organizations adopting OpenShell shows broad industry agreement on the need for dependable controls for agentic systems.
“Open source is the foundation of enterprise trust. As agents become part of cloud native infrastructure, the controls around them need to be open, auditable, and built together with the ecosystem. Bringing OpenShell to the CNCF puts governance of the project in the hands of the community. Red Hat has always believed that innovation thrives where collaboration is open, and we’re excited to help steward OpenShell alongside NVIDIA and the broader ecosystem.”
— Chris Wright, Chief Technology Officer and Senior Vice President of Global Engineering, Red Hat
Contributing OpenShell to the CNCF as a neutral foundation is a natural next step to expand and grow the OpenShell project. It has adopted the CNCF Code of Conduct, runs a public RFC process, and follows a governance model with explicit vendor-neutrality commitments. By contributing OpenShell alongside partners and maintainers from across the industry, NVIDIA aims to make secure AI available to all, under the same open governance model that supports other CNCF projects.
Built for an ecosystem
No two organizations run agents the same way. They use different infrastructure, secret stores, inference providers, and governance practices, and those choices change over time. OpenShell is designed to fit this variety through well-defined extension points for providers, compute, governance and approval workflows, policy enforcement, isolation, and credential management. Teams can adopt it incrementally and swap in what they already run. It also gives vendors, integrators, and end users clear places to contribute.
What changes, and what doesn’t
OpenShell is moving from NVIDIA’s GitHub repository to a neutral organization, ai-openshell. Working groups and special interest groups will form around integrated components and cross-cutting topics such as observability.
The core engineering efforts from NVIDIA will continue, while we welcome contributions from other interested parties.
Whether your organization already uses OpenShell or is just exploring it, contributing is the best way to shape its future. Areas where help is especially welcome include:
Contributors, end users, and people who are both are welcome. We look forward to building the future of open agent governance together.
Subscribe for updates, event info, webinars, and the latest community news
By submitting this form, I consent to receive marketing emails from the LF and its projects regarding their events, training, research, developments, and related announcements. I understand that I can unsubscribe at any time using the links in the footers of the emails I receive. Privacy Policy.
Copyright © 2026 The Linux Foundation®. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. Linux is a registered trademark of Linus Torvalds. Privacy Policy and Terms of Use.
Cookie Settings Accessibility Statement Submit an issue with this page