Scalable Confidential Computing on Kubernetes with Marblerun
summary
Marblerun is a Kubernetes control plane that actually provisions and attests enclave-backed containers, issues TLS credentials only after mutual attestation, and injects secrets into enclaves — demo uses the Linkerd emoji-photo app packaged with the Go library and runs three enclaves defined in a ~130-line JSON manifest. Current implementation targets Intel-style enclaves on Azure, terminates mTLS inside CPU enclaves so proxies cannot exfiltrate keys, provides automatic secret injection, and manifest (~130 lines) declares 3 enclave fingerprints.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:23MARBLERUN?
- 1:07WHY IS THIS COOL?
- 1:42JUST HOW
- 2:01CONFIDENTIAL COMPUTING!
- 3:21AVAILABILITY
- 3:43HOW TO CREATE A CONFIDENTIAL DEPLOYMENT?
- 4:23HOW TO MESH CONFIDENTIAL SERVICES?
- 5:40FROM 10,000 FT
- 7:35EXAMPLE: EMOJIVOTO
- 8:53SUMMARY
- 9:39NEXT STEPS
related talks
42mScalable Confidential Computing on Kubernetes with Marblerun
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing- 40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
39mConfidential computing with Go
38mConfidential Containers Explained