Agentic Zero Trust: at Rest, in Transit, and at Runtime
summary
Kubernetes K3s cluster with Kata containers and GPU passthrough runs self‑hosted vLLM on H100s behind an LLMD gateway; attack toolkit attempts reading host‑shared RAM, intercepting pod traffic with Hubble, and scraping H100 VRAM. Protecting runtime with Intel TDX and confidential GPU mode plus mTLS with Istio, Cilium, and Tetragon blocks the previously successful RAM, network and VRAM exfiltration. Demonstration shows attestation via SPIFFE/SPIRE and a deployed two‑GPU agent pipeline that prevents the tested exploits.
AI-written summary · about
chapters (15)
- 0:00Zero Trust data states
- 1:04Data in transit encryption
- 2:50Micro-segmentation with SPIFFE/SPIRE
- 3:51Security attestation
- 4:54Agents in Kubernetes with confidential computing
- 7:01Self-hosted inference with trusted execution
- 9:52Scoop Dreams breach scenario
- 13:44Secure architecture overview
- 15:33Runtime penetration testing
- 17:19Memory exploit mitigation
- 19:02In-transit exploit and mTLS
- 20:48GPU memory exploit mitigation
- 22:12Cluster-to-cluster agent patterns
- 23:16Workload and path attestation
- 24:41Recap and next steps
related talks
07mLightning Talk: Production-Grade AI Isolation: K0s + Kata Containers for Zero-Tru...
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
28mGPU sharing done right: Secrets, security, and scaling with Vault and vCluster
25mSecuring Untrusted Workloads with Kata Containers on Kubernetes - David Angot & Alex Price
33mDon't Peek Into my Container!
17mTrustworthy, Sovereign AI: Creating Resilient Spaces
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure