Kubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 11:00· Room 0E-1 (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Three practical patterns for confidential computing on Kubernetes: process enclaves via Intel SGX with language runtimes or Gramine, VM-level isolation using AMD SEV/SNP or Intel TDX for node-wide Constellation clusters, and per-pod VMs via a remote-hypervisor pattern implemented by confidential containers (nested preview on Azure). Orchestration helpers like Marble Run provide attestation, identity and config delivery. Production picks include Germany’s electronic health records on SGX and OCCRP on Constellation; measured overheads sit around 2–10% with I/O and context switches causing most slowdowns.
AI-written summary · about
chapters (8)
- 0:00Kubernetes and confidential computing
- 1:24Confidential computing fundamentals
- 8:06Threat model and use cases
- 15:53Hardware and trusted execution
- 22:13SGX enclaves in Kubernetes
- 26:48Confidential VMs in Kubernetes
- 31:24Key takeaways
- 34:15Q&A on monitoring
related talks
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
46mConfidential Cloud: Safeguarding Sensitive Data in K8s
11mLightning Talk: Computing Confidentially in the Clouds
16mIntroduction to confidential computing