"Peer Pods": a confidential computing approach
summary
Claims that Confidential Containers plus cloud IaaS APIs can deliver Peer Pods as independent TEE-backed VMs so Kubernetes avoids expensive bare metal. Implementation uses Kata Containers extensions, a cloud API adapter daemonset, a mutating webhook and provider VMs (Intel TDX / AMD SEV / IBM Secure Execution). Demo on IBM Cloud spins up pod VM nginx, pulls image via image RS through the kata agent, startup is slower but succeeds, overhead example shown as 0.25 CPU and 350 MB.
AI-written summary · about
chapters (5)
- 0:00Confidential computing needs
- 2:31Introducing peer pods
- 5:10Opportunities and benefits
- 7:03Architecture and components
- 8:30Peer pod demo
related talks
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
38mConfidential Containers Explained
29mConfidential Containers: The Next Era of Cloud Data Security
50mConfidential Containers: Why, How, and Where Are We?
27mTrust No One: Bringing Confidential Computing to Containers
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes