# Red Hat 日跟踪 · 2026-09-10
> 日期：2026-09-10（Asia/Shanghai）。原料：archive/2026-09-10/redhat/。上一日成功日跟踪 2026-09-09。`docs.redhat.com` 相关页仍常 403。

## 摘要
- **新稿 · Red Hat AI 3.5: Scaling and governing AI agents in production（博客日 2026-09-09）**：围绕生产 agent 的信任/控制/构建/计量四问；含 AI Model Catalog GA、EvalHub GA、priority-aware serving / controlled deployments GA、vLLM CPU/NVMe KV offload GA、hosted control planes on OpenShift Virtualization、llm-d 分布式推理在 CoreWeave CKS / Azure AKS GA（EKS TP）、Responses API + built-in RAG GA、Agent templates GA、MaaS showback TP、GPU-as-a-Service dashboard GA 等。偏 **OpenShift AI / agent-hosting / inference**，**非 HCI/OSV 新品版本叙事**。
- **新稿 · Beyond container boundaries: Kernel-level agent security in OpenShift AI 3.5**：OpenShell agent sandboxing 为 **Developer Preview**；Landlock LSM + seccomp + network namespace + OPA L4/L7；与 NeMo Guardrails / Garak / 签名 agent harness 组成纵深。文中「77% organizations… agents in production」「Shadow AI +$670,000」等为引用/IDC 口径——**未独立核实**。
- **新稿 · Rafay × Red Hat Sovereign AI Cloud as a Service 联合参考架构**：电信 / 主权云 / NeoCloud；OpenShift + ACM Hosted Control Planes + OSV + RH AI + Rafay SKU Studio / Self-Service / Token Factory。架构中心蓝图，非新 SKU。同主题亦写入 `rafay` 日跟踪。
- **新稿 · Red Hat sponsors the OpenClaw Foundation**：赞助 OpenClaw 自治 agent 框架基金会；AgentOps「BYOA」；与 OpenShell 联动叙事。OpenClaw Foundation 宣布于 **July**，本稿为赞助/战略说明。
- **新稿 · Accelerating post-quantum security migration with Red Hat Certificate System**：RHCS **11** 原生 ML-DSA / ML-KEM；对接 RHEL Global Crypto Policies 与 Ansible PQC Discovery。偏 PKI/密码现代化，非虚拟化主卖点。
- **新稿 · The Lightwell reality check**：强调 Lightwell 补丁火龙须先现代化 CI/CD；Webinar 系列自 **2026-09-23**。安全供应链旁注，非 HCI。
- **续档仍有效**：Context wall / BlueField GA on AI Factory、Gartner 容器管理 MQ Leader（非 HCI）、OSV 首年免费、Secrets TP、MTV×VDDK（见 VMware 侧 TechTarget 新确认）。

## 原文摘录

### [Red Hat AI 3.5: Scaling and governing AI agents in production](https://www.redhat.com/en/blog/red-hat-ai-35-scaling-and-governing-ai-agents-production) · 新稿（博客日 2026-09-09）
- 归档：`redhat/red-hat-ai-3-5-scaling-and-governing-ai-agents-in-production-0f281ed9.txt`
- URL：https://www.redhat.com/en/blog/red-hat-ai-35-scaling-and-governing-ai-agents-production
> Moving beyond isolated development sandboxes requires answering 4 questions before scaling: Can we trust it? Can we control it? Can we build on it? Can we measure it? Red Hat AI 3.5 provides the tools to answer all 4.
> For organizations that require stronger isolation between tenants, Red Hat AI now officially supports running hosted control planes on Red Hat OpenShift Virtualization…
> … distributed inference reaches GA on CoreWeave CKS and Microsoft Azure AKS, while Amazon EKS joins in technology preview.
> Sign up for the What’s new, What’s next session happening on September 22, 2026

### [Beyond container boundaries: Kernel-level agent security in Red Hat OpenShift AI 3.5](https://www.redhat.com/en/blog/beyond-container-boundaries-kernel-level-agent-security-red-hat-openshift-ai-35)
- 归档：`redhat/beyond-container-boundaries-kernel-level-agent-security-in-red-hat-ope-42e5502f.txt`
- URL：https://www.redhat.com/en/blog/beyond-container-boundaries-kernel-level-agent-security-red-hat-openshift-ai-35
> Today, Red Hat OpenShift AI 3.5 ships OpenShell agent sandboxing as a Developer Preview…
> Layer 0 — Kernel isolation: OpenShell sandboxing. Three independent enforcement layers—Landlock LSM, seccomp filters, and network namespace isolation—are each backed by the Linux kernel.
> 77% of organizations now have AI agents running in production.… Shadow AI incidents cost, on average, $670,000 more than standard security incidents.（引用口径，**未独立核实**）

### [Rafay and Red Hat publish joint reference architecture for sovereign AI cloud as a service](https://www.redhat.com/en/blog/rafay-and-red-hat-publish-joint-reference-architecture-sovereign-ai-cloud-service)
- 归档：`redhat/rafay-and-red-hat-publish-joint-reference-architecture-for-sovereign-a-a699b154.txt`
- URL：https://www.redhat.com/en/blog/rafay-and-red-hat-publish-joint-reference-architecture-sovereign-ai-cloud-service
> Red Hat has published Sovereign AI Cloud as a Service, a joint reference architecture built with Rafay for telecommunications providers, sovereign cloud operators, and NeoClouds…
> Where containers alone are not sufficient, Red Hat OpenShift Virtualization delivers a full virtual machine (VM) boundary on the same platform…
> Rafay Token Factory adds a metered, multi-tenant billing and API layer on top of Red Hat AI's vLLM and llm-d capabilities…

### [Red Hat sponsors the OpenClaw Foundation…](https://www.redhat.com/en/blog/red-hat-sponsors-openclaw-foundation-advance-open-future-production-ai-agents)
- 归档：`redhat/red-hat-sponsors-the-openclaw-foundation-to-advance-an-open-future-for-58722be6.txt`
- URL：https://www.redhat.com/en/blog/red-hat-sponsors-openclaw-foundation-advance-open-future-production-ai-agents
> In July, the OpenClaw Foundation was announced with Red Hat joining as a sponsor…
> This philosophy drives the core principle of our AgentOps strategy for Red Hat AI: bring your own agent (BYOA).

### [Accelerating post-quantum security migration with Red Hat Certificate System](https://www.redhat.com/en/blog/accelerating-post-quantum-security-migration-red-hat-certificate)
- 归档：`redhat/accelerating-post-quantum-security-migration-with-red-hat-certificate--499287e6.txt`
- URL：https://www.redhat.com/en/blog/accelerating-post-quantum-security-migration-red-hat-certificate
> With Red Hat Certificate System 11… It natively supports standard-compliant quantum-resistant algorithms, including ML-DSA for digital signatures (FIPS-204) and ML-KEM for key encapsulation (FIPS-203).

### [The Lightwell reality check](https://www.redhat.com/en/blog/lightwell-reality-check)
- 归档：`redhat/the-lightwell-reality-check-d408af36.txt`
- URL：https://www.redhat.com/en/blog/lightwell-reality-check
> A clearinghouse service alone won’t magically fix your security posture.… Lightwell is a data firehose… If your internal deployment processes aren't built to handle that flow, a firehose will only flood your environment…
> … webinar series "The blueprint for scalable enterprise security in the age of AI," kicking off on September 23, 2026…

## 对基础档案的影响
- **最近动态追加**：RH AI 3.5（agent 治理/计量，博客日 09-09）；OpenShell DP；Rafay×RH 主权 AI 云参考架构；OpenClaw 基金会赞助；RHCS 11 PQC；Lightwell reality check。
- Context wall / BlueField / 容器 MQ / OSV 首年免费维持；MTV×VDDK 风险因 TechTarget 官方确认而权重上升（见 vmware 日跟踪）。