Google Cloud says GKE networking can support one million concurrent AI sandboxes

[Google Cloud] Google Cloud said in a blog post that as AI workflows shift from static requests to autonomous agents, demand for secure, high-density sandboxes is pushing conventional infrastructure to its architectural limits, with some research labs requiring up to one million concurrent code-execution sandboxes. According to Google Cloud, GKE Dataplane V2, powered by eBPF, maps pod labels to a numeric identity to enforce network security policies. To address slow pod creation caused by serial identity allocation for highly unique per-pod labels, the company said it separates identifying data from functional metadata, moving high-cardinality fields from Pod Labels to Annotations and calculating network identities from labels rather than annotations, bypassing per-pod identity generation. Google Cloud said Cilium label exclusion filters can further control identity counts. According to Google Cloud, a customer said it used Agent Substrate on GKE to orchestrate hundreds of thousands of secure environments across clusters and handle spikes of more than 30,000 sandboxes on a single cluster.