GKE Hypercluster: Kubernetes TEEs for AI at Scale
summary
GKE Hypercluster splits each Kubernetes node into an untrusted parent and a minimal sealed VM that runs measured, attested workloads with zero operator shells; a CRI proxy forwards pod requests and a launcher agent enforces per-workload T policies and verifies container signatures from CI/CD. It uses attested COS/AOS, Titan root of trust, Shielded VMs/TDX and supports confidential GPUs/TPUs, a shim VPC for pod networking, and a 1:64 parent-to-sealed-VM mapping that reduces control-plane load; the product is available now.
AI-written summary · about
chapters (12)
- 0:00GKE Hypercluster for AI
- 1:05Confidential compute for AI
- 3:37Decoupled linked runner model
- 5:23CR proxy for Kubernetes and sealed VMs
- 6:49Pod networking in sealed VMs
- 7:54Three-network model for AI
- 9:41Trusted execution in sealed VM
- 15:04Preventing malicious scheduling
- 17:34Attestation for secrets
- 20:26Scaling decoupled architecture
- 21:33Minimizing TCB and zero access
- 22:15Q&A
related talks
40mUnlocking Kubernetes Intelligence: Deploying AI Foundation Mode...
14m"Peer Pods": a confidential computing approach
30mK8s meets confidential computing - the different ways of scaling sensitive workloads
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
07mLightning Talk: Production-Grade AI Isolation: K0s + Kata Containers for Zero-Tru...
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure
29mConfidential Containers: The Next Era of Cloud Data Security
31mDeclarative Underlays: Scaling Purpose-Built Infrastructure(Clusters)...