Shipping modern cloud-native applications means juggling local sandboxes, secure supply chains, and emerging AI tooling. With Red Hat OpenShift 5 (based on upstream CRI-O 1.36 and Kubernetes 1.36), now generally available, we focused on clearing away friction for developers across the entire lifecycle.
Red Hat Developer Hub
Red Hat Developer Hub 2.1 extends support lifecycles, updates the upstream front end, and introduces AI-assisted workflows. Support coverage extends from 6 to 10 months alongside a 4-month release cadence, giving teams more time between upgrades. Red Hat Developer Hub adopts an upstream-aligned front-end system for simplified maintenance.
As of this release, the Red Hat Developer Lightspeed for Developer Hub plug-in is now the context-aware Red Hat Developer Hub intelligent assistant. The assistant supports the bring-your-own-knowledge protocol and deep context. Developers also gain access to a curated AI catalog plug-in, which provides a single discovery hub to safely evaluate and adopt validated AI assets. Developers can also invoke native Red Hat Developer Hub skills, trigger Model Context Protocol (MCP) actions, and control agents directly from the command line.
- Read the Red Hat Developer Hub 2.1 release notes.
Podman Desktop and Red Hat build of Podman Desktop
Podman Desktop receives a core engine upgrade with Podman 6 support, introducing unified machine listings across providers and built-in CA certificate syncing during machine initialization. A new dedicated secrets page in the UI lets developers create, inspect, and mount container secrets as files or environment variables. The updated dashboard displays system CPU, memory, and disk usage alongside clickable container ports.
For enterprise environments, a “managed-by” indicator highlights IT-locked settings, and automatic update checks can now be disabled for organizations that need controlled rollouts. These updates apply to both upstream Podman Desktop and Red Hat build of Podman Desktop.
Kaiden 0.4—a companion application to Podman Desktop—introduces local desktop sandboxing by deploying OpenShell to secure and govern AI coding agents. Using the Agent Client Protocol (ACP), Kaiden provides a consistent session experience—complete with persisted history, live thinking status, and file attachments—and supports a wide range of agents, including Codex, Claude Code, Goose, and Cursor. It supports running multiple OpenShell gateways side by side and applies the same shared governance and policy enforcement locally that OpenClaw Enterprise uses on the cluster.
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Spaces 3.31 brings cloud development enhancements directly into the web integrated development environment (IDE). The GitHub Copilot Chat plug-in is now bundled into the Code-OSS editor for native AI coding assistance. To simplify extension management, administrators can host and manage VS Code extensions in-cluster with a bundled OpenVSX server deployed through the CheCluster custom resource in Technology Preview. OpenShift Dev Spaces also adds support for external OpenID Connect (OIDC) identity providers and improves multicluster access by evaluating all assigned group memberships for a user.
- Read the Red Hat OpenShift Dev Spaces 3.31 release notes.
- Read the blog post on scaling OpenShift Dev Spaces in air-gapped environments.
Agentic AI and workload acceleration
Red Hat OpenShift 5 introduces expanded capabilities to run, serve, and protect AI workloads and specialized hardware across distributed clusters.
Model Context Protocol (MCP) server and gateway
Red Hat OpenShift 5 introduces foundational MCP capabilities to give AI agents safe, controlled access to platform resources. The MCP server for Red Hat OpenShift integrates with OAuth and OIDC identity providers, enforces Kubernetes role-based access control (RBAC), defaults to read-only access, and tags actions for audit logging. Through MCP, agents can safely inspect pipeline runs, query service mesh telemetry, or monitor virtualization resources—all governed by standard Kubernetes permissions.
To manage these interactions, the MCP gateway acts as a central control point that screens request and response traffic for personally identifiable information (PII), prompt injection, and unsafe content before it reaches MCP servers.
Smarter GPU management
Red Hat OpenShift 5 optimizes GPU and network device handling for enterprise AI/ML workloads through dynamic resource allocation (DRA). Partitionable devices allow a single GPU or network card to be split into logical slices for independent allocation, while consumable capacity lets workloads claim specific device portions—such as memory or bandwidth—through individual ResourceClaim requests. Pod status exposes real-time device health directly, complemented by device taints, tolerations, and binding conditions.
Additionally, Red Hat build of Kueue provides attribute-based GPU quota accounting, supports Elastic Ray jobs, manages Apache Spark batch workloads, and triggers cluster autoscaling based on queued demand.
Agent sandbox and AI workload protection
To safely run AI agents and untrusted code, Red Hat build of Agent Sandbox (in Technology Preview) provides short-lived, VM-isolated execution environments using sandboxed Kata containers. It includes pre-provisioned warm pools to eliminate startup delays for interactive agent sessions, along with a sandbox router for access to agent browsers, notebooks, and IDEs.
For sensitive models, Confidential AI provides hardware-backed CPU-to-GPU encryption on bare metal—including multi-GPU NVIDIA DGX B200 systems—to shield model weights and data in memory from infrastructure administrators.
Platform services and supply chain security
Enhancements across continuous integration, GitOps, service mesh, and modernization tooling help safeguard delivery pipelines.
Red Hat OpenShift Pipelines 1.24 and builds for Red Hat OpenShift 1.9
OpenShift Pipelines 1.24 introduces CEL-based routing to dynamically distribute PipelineRun workloads across clusters based on labels or event types. Metrics and tracing have transitioned to OpenTelemetry, and default network policies are enforced to restrict unauthorized cross-namespace pod traffic.
In builds for Red Hat OpenShift 1.9, default-deny network policies restrict operand access, and environment variables are sanitized to prevent code injection. To simplify continuous integration (CI) workflows, standalone builds for Red Hat OpenShift will consolidate into OpenShift Pipelines following version 1.10.
- Read the Red Hat OpenShift Pipelines 1.24 release notes.
- Read the builds for Red Hat OpenShift 1.9 release notes.
Red Hat OpenShift GitOps 1.22
OpenShift GitOps 1.22 introduces multistage environment promotions with automated health gating and source hydrator to pre-render Helm and Kustomize templates directly into Git for clear diff auditability. Both environment promotions and source hydrator are available in Technology Preview.
Now generally available, the Red Hat OpenShift console plug-in allows native management of Argo CD resources from the web console.
For security, source integrity policies enforce GnuPG commit signing to verify code before syncing to production. Multi-tenant teams can now run ApplicationSet resources in any namespace.
- Read the Red Hat OpenShift GitOps 1.22 release notes.
- Read the blog post on what's new in Red Hat OpenShift GitOps 1.22.
Red Hat OpenShift Service Mesh 3.5
Based on Istio 1.31, OpenShift Service Mesh 3.5 introduces sidecar-less ambient mode with multi-primary, multicluster topologies to support high availability across independent networks. Developers can also use AI-driven mesh assistance through Kiali integrated with the MCP server for Red Hat OpenShift and Red Hat OpenShift Lightspeed.
Migration toolkit for applications 8.3
Migration toolkit for applications 8.3 replaces the end-of-life migration toolkit for containers with full-lifecycle container migration.
Using composable CLI tools and standard Kustomize overlays, migration toolkit for applications 8.3 handles manifest transformation, API validation, and persistent volume claim (PVC) data transfers without relying on Velero. It also includes out-of-the-box generators to scaffold complete CI/CD and GitOps configurations for Java applications.
- Read the migration toolkit for applications 8.3 release notes.
- Read the blog post on agentic code modernization with migration toolkit for applications 8.3.
Red Hat Trusted Artifact Signer 1.5
Red Hat Trusted Artifact Signer 1.5 introduces a new operator API to support the operator lifecycle manager upgrade path, FIPS compliance across services, and an integrated console for managing trust roots, OIDC settings, and Rekor log searches.
For AI supply chains, it adds support for AI model signing and verification, keyless Sigstore signing for Kagenti AgentCards in Technology Preview, and AI-driven generators for creating Conforma (Rego) SBOM/SLSA compliance policies from plain language.
Developer usability and self-service
This release introduces simplified self-service diagnostics, customizable interface themes, and expanded authentication options.
Support log gather operator
The support log gather operator gives developers and nonprivileged users the ability to trigger must-gather log collection directly when troubleshooting or opening Red Hat support tickets. This reduces the need to escalate to cluster administrators while embedding safeguards to prevent privilege escalation. The operator automatically obfuscates confidential information before log upload and supports direct log transfers to linked support tickets.
Red Hat OpenShift console enhancements
The OpenShift web console introduces 3 UI themes—glass (a sleek modern design), high contrast, and traditional—giving users options for their preferred viewing experience, as outlined in the web console documentation. Developers can detach pod terminal sessions directly into the Cloud Shell drawer to keep sessions active while navigating other pages.
The console adds visual warnings for images not intended for multiple replicas, displays Prometheus GPU utilization metrics directly on node details pages, and updates its internal SDK to Helm 4 while supporting concurrent Helm 3 and 4 CLI streams.
Direct authentication with external OIDC identity providers
Red Hat OpenShift 5 allows clusters to use an external OIDC identity provider directly for token-based authentication in place of the built-in OAuth server. Developers can log in through the console or oc CLI using existing credentials from providers like Keycloak, Okta, Microsoft Entra ID, or GitLab. In addition, enhanced group management in Technology Preview addresses token truncation issues for users with large group memberships.
Get started with Red Hat OpenShift 5
Start your Red Hat OpenShift journey in the no-cost Developer Sandbox, or download Red Hat OpenShift directly.
Find resources for getting started with Red Hat OpenShift.
To explore guided tutorials and deeper architectures:
- Work through hands-on scenarios in Red Hat OpenShift interactive experiences
- Sharpen your skills with Red Hat OpenShift learning paths
- Check out the launch announcement on the Red Hat Blog
- Review the comprehensive Red Hat OpenShift 5 release notes
