Confidential Containers integrate trusted execution environments (TEEs) into Kubernetes via Kata Containers, providing hardware-backed workload isolation on OpenShift bare metal. Each pod runs inside a dedicated confidential VM (CVM), with remote attestation handled by the Red Hat build of Trustee. Key topics covered include pod bootstrap configuration via measured initdata, profile-driven attestation with TrusteeConfig, HashiCorp Vault integration as a KBS secrets backend, air-gapped SNP TEE support, NVIDIA confidential GPU attestation, in-guest image pull requirements and memory sizing, sealed secrets for post-attestation secret delivery, LUKS-based encrypted persistent storage inside the TEE, and the requirement for TLS termination within the TEE for ingress traffic. Future work includes encrypted container images in CRI-O, heterogeneous TEE cluster support, and signed sealed secrets.
Table of contents
Pod bootstrap configurationRemote attestation improvementsWorkload considerationsIn-guest confidential containers workload APIsPersistent storage for confidential containersIngress routes for confidential containersFuture improvementsSummary108 Impressions1 Comment