Sealing Kubernetes with Confidential Clusters
summary
Describes a working Confidential Cluster Operator that automates node onboarding by issuing a UUID per node, calculating and storing baseline measurements, and using PCR-based attestation to gate key release for disk encryption. A new node registers, receives its UUID and ignition, proves PCR evidence to the Trustee/key-broker, gets the disk key, encrypts and reboots, then re‑attests to decrypt. Currently implemented for Azure with an Azure vTPM dependency, bootstrap-node attestation and multi-cloud support remain work in progress.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:05Agenda and overview
- 3:54What is confidential computing
- 5:41Attestation for trusted platforms
- 7:48Trusted execution clusters
- 8:52Operator components and lifecycle
- 10:41Trusted execution cluster operator
- 13:07Operator node onboarding
- 15:36Challenges and future steps
related talks
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
46mConfidential Cloud: Safeguarding Sensitive Data in K8s
23mAlways-encrypted, confidential Kubernetes with Constellation
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
33mCombining Confidential Computing and Cloud Native Security
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads