live wire
▸INTEGRATION · Apache Camel exposes incident and web search as parallel tools for a local agentApache Camel▸AI · Red Hat makes confidential GPU AI GA and previews VM-isolated Agent Sandbox (Aug. 4)Red Hat Blog▸SECURITY · Red Hat fixes Important MariaDB GIS memory-corruption flaw in Hardened ImagesRed Hat Product Security▸SECURITY · Red Hat restores CVE pages after a CWE dependency outage; monitoring continuesRed Hat status▸PLATFORM · Red Hat implements a fix for docs.redhat.com degradation and begins monitoringRed Hat status▸AI · vLLM combines PCP, DCP and host-memory offload to serve 1M-token GLM-5.3 contextsvLLM▸AI · vLLM ships day-zero MiniMax-M3.1-Flash support across NVIDIA and AMD GPUsvLLM▸SECURITY · Red Hat revokes compromised eMudhra certificates across RHEL and OpenShift trust storesRed Hat Product Security▸SECURITY · Red Hat rates PHP2Shell request-handling flaws Important; fixes are rolling outRed Hat Product Security▸AI · IBM maps GPU observability and FinOps controls across OpenShift clustersIBM Community▸IDENTITY · Red Hat shows Data Grid authentication through Keycloak 26 on OpenShiftRed Hat Developer▸AI · Red Hat layers tenant isolation, tool authorization and rate limits onto MCP gatewaysRed Hat Developer▸DATA · Red Hat maps direct LDAP and LDAPS authentication for Data Grid on OpenShiftRed Hat Developer▸PLATFORM · OpenShift Service Mesh 3.4.3 restores strict enforcement of OpenShift TLS cipher profilesRed Hat release notes▸INTEGRATION · Apache Camel exposes incident and web search as parallel tools for a local agentApache Camel▸AI · Red Hat makes confidential GPU AI GA and previews VM-isolated Agent Sandbox (Aug. 4)Red Hat Blog▸SECURITY · Red Hat fixes Important MariaDB GIS memory-corruption flaw in Hardened ImagesRed Hat Product Security▸SECURITY · Red Hat restores CVE pages after a CWE dependency outage; monitoring continuesRed Hat status▸PLATFORM · Red Hat implements a fix for docs.redhat.com degradation and begins monitoringRed Hat status▸AI · vLLM combines PCP, DCP and host-memory offload to serve 1M-token GLM-5.3 contextsvLLM▸AI · vLLM ships day-zero MiniMax-M3.1-Flash support across NVIDIA and AMD GPUsvLLM▸SECURITY · Red Hat revokes compromised eMudhra certificates across RHEL and OpenShift trust storesRed Hat Product Security▸SECURITY · Red Hat rates PHP2Shell request-handling flaws Important; fixes are rolling outRed Hat Product Security▸AI · IBM maps GPU observability and FinOps controls across OpenShift clustersIBM Community▸IDENTITY · Red Hat shows Data Grid authentication through Keycloak 26 on OpenShiftRed Hat Developer▸AI · Red Hat layers tenant isolation, tool authorization and rate limits onto MCP gatewaysRed Hat Developer▸DATA · Red Hat maps direct LDAP and LDAPS authentication for Data Grid on OpenShiftRed Hat Developer▸PLATFORM · OpenShift Service Mesh 3.4.3 restores strict enforcement of OpenShift TLS cipher profilesRed Hat release notes
upstreambeat.ai
guideAI

Red Hat quickstart gives Azure Red Hat OpenShift a live support agent

The reference deployment lets an agent inspect current Azure resource state through MCP while OPA, read-only credentials and audit logs constrain its reach.

By The News Desk· Oct 23, 2026the quick take — two AI hosts go live when you do

Red Hat has extended its agentic-partners-integration quickstart with a support agent for Microsoft Azure Red Hat OpenShift. The reference implementation connects an AI agent to Microsoft's Azure MCP Server so it can investigate live resource health, metrics and recommendations instead of answering only from documentation or training data.

Live inspection behind policy gates

The new Azure Red Hat OpenShift branch adds two components to the existing multi-agent demo: a containerized proxy for the Microsoft Azure MCP Server, and a partner agent that discovers and invokes its tools.

A request first passes through a central manager that authenticates the user with Keycloak and applies Open Policy Agent rules. A routing agent can then delegate the work to one of four domain agents covering Kubernetes, networks, software or Azure Red Hat OpenShift. Only the Azure-focused agent receives access to the MCP server and live Azure management-plane data.

The agent uses a discover-then-execute loop. It opens an MCP session, lists available operations, gives the user's question and tool definitions to the language model, invokes selected tools and feeds the structured results back into the model. That process can repeat across services before the agent produces an answer.

Red Hat's example starts with an OOMKilled workload. The agent checks cluster availability, discovers relevant monitoring operations, examines memory utilization and retrieves Azure Advisor recommendations. Its answer can therefore correlate the current condition of the affected resources rather than rely on a generic troubleshooting script.

The demo limits the blast radius

The default service principal receives Azure's Reader role, allowing inspection but not infrastructure creation, modification or deletion. Red Hat recommends scoping production credentials to specific resource groups. OPA checks the user's department permissions against an agent's capabilities before requests reach it, while A2A and MCP calls are logged so operators can trace which agent ran, which tools it invoked and what arguments it supplied.

Each domain agent also runs in an independent container and communicates with the orchestrator through an A2A HTTP contract. That separation lets a partner implement an agent in another language or framework without sharing application code with the rest of the system.

Two deployment paths

Teams can install the quickstart's Helm chart on OpenShift 4.12 or later using prebuilt images. The article also walks through deploying the Azure MCP Server from the MCP catalog in OpenShift AI 3.5.1. That catalog and its lifecycle operator are Technology Preview features and require explicit feature flags.

The important part is not the support-chat interface. The quickstart demonstrates an enterprise agent pattern in which infrastructure access is a separate, discoverable service; identity and policy precede every delegation; and the agent begins with read-only credentials. It is a useful starting point, not a claim that an unsupervised support bot is ready to operate a production cloud.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk