Confidential Cloud: Safeguarding Sensitive Data in K8s
summary
Claims that hardware-backed runtime encryption and remote attestation integrate with Kubernetes to protect data in use, with Constellation offering cluster-wide confidential VMs and confidential containers isolating individual pods inside VMs. Open-source tools Contrast and Continuum AI handle attestation, credential delivery, and confidential GPU (NVIDIA H100) use. Reported performance impact is single-digit overhead, and deployed examples include German electronic health records, hospital GPU workloads, and end-to-end encrypted LLM hosting.
AI-written summary · about
chapters (11)
- 0:00Confidential Cloud Computing intro
- 3:21What is Confidential Computing
- 8:01Protecting data in use
- 13:49Hardware isolation with TDX and SEV
- 20:00Three levels of Confidential Computing
- 24:14Confidential Computing in K8s
- 28:29Isolating K8s clusters with Constellation
- 33:06Isolating containers with Confidential Containers
- 37:41Confidential Computing use cases
- 41:11Summary and next steps
- 42:17Q&A on encryption
related talks
23mAlways-encrypted, confidential Kubernetes with Constellation
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
29mConfidential Containers: The Next Era of Cloud Data Security
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
33mCombining Confidential Computing and Cloud Native Security