Cloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
summary
Describes Confidential Containers, a project that isolates Kubernetes pods by running each pod in its own confidential micro-VM using the Kata Containers stack. Explains how those micro-VMs use hardware Confidential Computing features from Intel, AMD and IBM, and details key components such as the Attestation Agent and Rust crates for container image management that enable attestation, verification, and encrypted-memory workloads. Reviews the project architecture and outlines the roadmap and future plans.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:23What is Confidential Computing
- 3:27Why use it
- 7:17Memory and CPU protection
- 9:21Workload attestation
- 13:53Trust model
- 16:23Hardware implementations
- 23:57Cloud deployment
- 27:51Node vs pod approach
- 31:01Kata Containers with CC
- 35:34Confidential Containers status
- 37:44Q&A
related talks
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
38mConfidential Containers Explained
50mConfidential Containers: Why, How, and Where Are We?
29mConfidential Containers: The Next Era of Cloud Data Security- 40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
46mConfidential Cloud: Safeguarding Sensitive Data in K8s