Securing Kubernetes with Trusted Platform Module (TPM)
summary
Hardware TPM 2.0 stores keys that never leave the chip and signs kubelet CSRs with the built‑in endorsement key so masters can validate node identity; a proof‑of‑concept implements node bootstrap using the Kubernetes CSR API and prevents private‑key export by creating keys in the TPM. Secrets are sealed to TPM keys and PCR policies and unlocked at startup via the KMS plugin (demo PoC using go‑tpm and tpm2‑tools). Tamper‑evident audit logging via TPM audit registers and HMAC/AEAD is presented as a feasible design but remains theoretical.
AI-written summary · about
chapters (6)
- 0:00Start
- 3:46Trusted Platform Module (TPM) crash course
- 9:16Node trust bootstrap
- 10:56Enter X.509 CSRs and Certificates
- 16:30Solving the first secret problem
- 22:18Tamper-evident audit logs
related talks
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
27mSecuring TPM Secrets with TXT and Kernel Signatures
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
28mThe TPM as an everyday security tool
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux