IBM Secure Execution for RedHat CoreOS
summary
IBM Secure Execution brings z15/LinuxONE III hardware confidentiality to Red Hat CoreOS as an OCP 4.12 Tech Preview, isolating VM memory and CPU state from the hypervisor and other guests. The build produces an encrypted SD-boot image containing kernel and initramfs, enforces DM‑Verity and LUKS for root and boot integrity and disk encryption, protects ignition with GPG keys and a Universal build key for cloud booting, and automates SD‑boot re‑creation on kernel updates; users must provide host keys for target mainframes.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:24Secure Execution technology
- 2:49How Secure Execution protects VMs
- 4:41Cloud deployment challenges
- 5:27OpenShift CoreOS integration goals
- 6:12Building CoreOS with Secure Execution
- 8:41Universal key encryption
- 9:25Ignition config protection
- 10:28Security UX adjustments
- 11:10Secure Execution availability
related talks
25mAttestation and Confidential Dump for IBM Secure Execution on Linux
50mEnabling Hardware Security Modules for Confidential Computing
35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefs
53mSecure Embedded Linux Product - A Success Story
44mWhat is Red Hat CoreOS?
24mCan You Create a Secure IoT Platform Using a Common Linux Distro?
46mVerifiable End To End Secure OCI Native Machines
48mFedora CoreOS: architectural walkthrough