--- title: GKE networking dataplane for large agentic AI workloads description: GKE Dataplane V2 addresses a network identity bottleneck that can affect large agentic AI workloads running on Kubernetes. Research labs often demand up to one... canonical: https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GKE networking dataplane for large agentic AI workloads | daily.dev og:description: GKE Dataplane V2 addresses a network identity bottleneck that can affect large agentic AI workloads running on Kubernetes. Research labs often demand up to one... og:url: https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg og:image: https://api.daily.dev/og/posts/t3QkZJOYG.png og:image:alt: GKE networking dataplane for large agentic AI workloads og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GKE networking dataplane for large agentic AI workloads **[Google Cloud](https://daily.dev/sources/gcp)** · 4 min read · 0 upvotes · 0 comments ## Summary GKE Dataplane V2 addresses a network identity bottleneck that can affect large agentic AI workloads running on Kubernetes. Research labs often demand up to one million concurrent code-execution sandboxes, and sophisticated workloads can approach Cilium's cluster-wide limit of 65,536 network identities. GKE addresses this by migrating high-cardinality metadata from labels to annotations and adding Cilium label exclusion filters, so identical agent types share one identity. GKE provides 300 sandboxes per second at sub-second latency for fully isolated agents, and in benchmark validation Agent Substrate sustained 500 activations per second across 200,000 agents with less than 500 ms suspend and resume latency. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does Cilium hit a 65,536 identity limit with high-cardinality pod labels like agent IDs or timestamps? Cilium's network dataplane maps pod labels to a numeric security identity, and GKE Dataplane V2 provisions a distinct identity per unique label set. Agentic workloads generate highly unique labels per pod (agent-id, timestamps, claim-uid), so each pod can trigger a new identity, pushing clusters toward Cilium's cluster-wide cap of 65,536 identities. _Teams scaling Kubernetes clusters for AI agents can track dataplane fixes like this on daily.dev._ ### How do I avoid exhausting Cilium network identities when running many Kubernetes pods with unique labels? Move high-cardinality fields such as agent-id, timestamps, or claim-uid from pod Labels to Annotations, since GKE Dataplane V2 calculates identities from labels, not annotations. Alternatively, apply Cilium label exclusion filters via the cilium-config-emergency-override ConfigMap in kube-system, using rules like '!agents.x-k8s.io/sandbox-name-hash' or '!timestamp' to exclude dynamic labels from identity calculation. _Engineers debugging identity scaling limits in Kubernetes networking can find fixes like this on daily.dev._ ### What sandbox provisioning performance can GKE Agent Substrate achieve for large-scale AI agent workloads? In benchmark validation running 200,000 agents, GKE Agent Substrate sustained 500 activations per second at under 500 milliseconds suspend and resume latency. Separately, GKE Dataplane V2 optimizations enable 300 fully isolated sandboxes per second at sub-second latency, and a customer orchestrated spikes of over 30,000 sandboxes on a single cluster. _Developers evaluating infrastructure for agentic AI workloads can compare benchmarks like these on daily.dev._ ## Similar posts on daily.dev - [Google Announces GKE Agent Sandbox and Hypercluster at Next '26, Positioning Kubernetes as AI Agent](https://daily.dev/posts/google-announces-gke-agent-sandbox-and-hypercluster-at-next-26-positioning-kubernetes-as-ai-agent-cfmrtqf9a) · InfoQ · 0 upvotes · 0 comments - [Kubernetes won the container decade. Google’s Agent Substrate wants the next one.](https://daily.dev/posts/kubernetes-won-the-container-decade-google-s-agent-substrate-wants-the-next-one--htft1i3hx) · The New Stack · 3 upvotes · 0 comments - [What’s new in GKE at Next ‘26](https://daily.dev/posts/what-s-new-in-gke-at-next-26-082dwhthn) · Google Cloud · 0 upvotes · 0 comments - [Why sandboxing your agent is not enough](https://daily.dev/posts/why-sandboxing-your-agent-is-not-enough-m5nc5kdyk) · CNCF · 13 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#ai-agents](https://daily.dev/tags/ai-agents), [#kubernetes](https://daily.dev/tags/kubernetes), [#gke](https://daily.dev/tags/gke), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GKE networking dataplane for large agentic AI workloads","url":"https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg"},"datePublished":"2026-10-28T16:11:49.601Z","dateModified":"2026-10-28T16:23:05.299Z","description":"GKE Dataplane V2 addresses a network identity bottleneck that can affect large agentic AI workloads running on Kubernetes. Research labs often demand up to one...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3bbe999ad59e1f7c2c7364a046bd2005?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3bbe999ad59e1f7c2c7364a046bd2005?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,ai-agents,kubernetes,gke,cilium","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"GKE networking dataplane for large agentic AI workloads"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/gke-networking-dataplane-for-large-agentic-ai-workloads-t3qkzjoyg#faq","mainEntity":[{"@type":"Question","name":"Why does Cilium hit a 65,536 identity limit with high-cardinality pod labels like agent IDs or timestamps?","acceptedAnswer":{"@type":"Answer","text":"Cilium's network dataplane maps pod labels to a numeric security identity, and GKE Dataplane V2 provisions a distinct identity per unique label set. Agentic workloads generate highly unique labels per pod (agent-id, timestamps, claim-uid), so each pod can trigger a new identity, pushing clusters toward Cilium's cluster-wide cap of 65,536 identities. Teams scaling Kubernetes clusters for AI agents can track dataplane fixes like this on daily.dev."}},{"@type":"Question","name":"How do I avoid exhausting Cilium network identities when running many Kubernetes pods with unique labels?","acceptedAnswer":{"@type":"Answer","text":"Move high-cardinality fields such as agent-id, timestamps, or claim-uid from pod Labels to Annotations, since GKE Dataplane V2 calculates identities from labels, not annotations. Alternatively, apply Cilium label exclusion filters via the cilium-config-emergency-override ConfigMap in kube-system, using rules like '!agents.x-k8s.io/sandbox-name-hash' or '!timestamp' to exclude dynamic labels from identity calculation. Engineers debugging identity scaling limits in Kubernetes networking can find fixes like this on daily.dev."}},{"@type":"Question","name":"What sandbox provisioning performance can GKE Agent Substrate achieve for large-scale AI agent workloads?","acceptedAnswer":{"@type":"Answer","text":"In benchmark validation running 200,000 agents, GKE Agent Substrate sustained 500 activations per second at under 500 milliseconds suspend and resume latency. Separately, GKE Dataplane V2 optimizations enable 300 fully isolated sandboxes per second at sub-second latency, and a customer orchestrated spikes of over 30,000 sandboxes on a single cluster. Developers evaluating infrastructure for agentic AI workloads can compare benchmarks like these on daily.dev."}}]} ```