Combining Confidential Computing and Cloud Native Security
summary
Shows a working constellation confidential cluster that runs on confidential VMs and produces a single attestable cluster identity; uses the Constellation CLI verify command to check measured cluster state. Demonstrates a Tecton pipeline guarded by tecton pipeline attestation so steps run only when the verifier returns success, and extracts a base64 signature of the task run which is checked with cosign-signed provenance. Adds Kyverno policies and Grype scans to enforce image signatures and vulnerability thresholds.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:35Confidential VMs
- 3:34Who is using it?
- 7:07Base: Confidential Kubernetes Nodes
- 8:01Confidential Clusters
- 10:21Protection against infrastructure based threats
- 11:58Tool Fatigue & First Principles
- 12:43The Stack
- 13:53Tekton: Cloud Native CI/CD
- 14:27Constellation Quickstart
- 28:49Getting Started Tutorial
- 29:38Summary
related talks
46mConfidential Cloud: Safeguarding Sensitive Data in K8s
40mDon’t Trust Opaque Clouds, Cryptographically Verify Instead!
23mAlways-encrypted, confidential Kubernetes with Constellation
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
45mConfidential Computing: Protecting Customer Data in the Cloud
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing