Always-encrypted, confidential Kubernetes with Constellation
summary
Constellation is an open-source Kubernetes distribution that wraps entire clusters in runtime-encrypted clusters using Confidential VMs (currently AMD SEV, planned Intel TDX and Arm CCA), enforces a read-only root via unified kernel images and Mverity, and stores etcd on encrypted, integrity-protected disks whose keys live only in VM memory. Cluster join and recovery use cluster-wide remote attestation and mTLS, images are mkosi-based and signed with Sigstore, networking uses Cilium with WireGuard and storage uses CSI plugins plus Rook/Ceph; demo runs GitLab end-to-end.
AI-written summary · about
chapters (8)
- 0:00Introduction to confidential Kubernetes
- 1:11Use cases and requirements
- 5:07Concept of Constellation
- 7:14Boot process and measured VMs
- 11:30Cluster initialization and scaling
- 13:58Day two operations and integration
- 15:46Network and storage security
- 20:46Conclusion and next steps
related talks
46mConfidential Cloud: Safeguarding Sensitive Data in K8s
33mCombining Confidential Computing and Cloud Native Security
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
38mConfidential Containers Explained
29mConfidential Containers: The Next Era of Cloud Data Security
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
17mSealing Kubernetes with Confidential Clusters