Cloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
summary
Confidential Containers runs each Kubernetes pod inside per-pod confidential micro-VMs built on Kata Containers and hardware enclaves (AMD SEV, Intel TDX, IBM implementations), measures firmware/kernel/agent via a new attestation agent, then contacts an off-cluster attestation/key-broker to get a decryption key so container images are pulled encrypted or signed and decrypted only inside the VM. A Kubernetes operator deploys the stack; project is near first release with secure-storage integration closing and contributors from Alibaba, IBM, Microsoft, AMD, Intel, Rivos and Red Hat.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:53Cloud threat model
- 3:12Use cases and benefits
- 6:00Protecting data in use
- 11:00Hardware requirements
- 13:42Confidential containers
- 16:40Kata containers integration
- 20:49Attestation process
- 25:10Verification workflow
- 29:03Security guarantees
- 32:04Project status and Q&A
related talks
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
38mConfidential Containers Explained
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
29mConfidential Containers: The Next Era of Cloud Data Security
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
50mConfidential Containers: Why, How, and Where Are We?
46mConfidential Cloud: Safeguarding Sensitive Data in K8s