Kubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
summary
Explains three concrete deployment patterns: SGX enclaves (process-level, repack with Gramine or library OSes, worst for I/O and context switches), confidential VMs (AMD SEV‑SNP / Intel TDX—works today for lift‑and‑shift, measured runtime overhead ~2–10%), and confidential containers (CNCF prototypes, still immature). Shows tooling and case studies: open source orchestrator Marble Run for SGX, Constellation to shield whole clusters used by OCCRP, German electronic health record uses SGX in production, and monitoring/attestation remain the hard problems.
AI-written summary · about
chapters (8)
- 0:00Kubernetes and confidential computing
- 1:24Confidential computing fundamentals
- 8:06Threat model and use cases
- 15:53Hardware and trusted execution
- 22:13SGX enclaves in Kubernetes
- 26:48Confidential VMs in Kubernetes
- 31:24Key takeaways
- 34:15Q&A on monitoring
related talks
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
16mIntroduction to confidential computing
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
11mLightning Talk: Computing Confidentially in the Clouds
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments