Fortanix Enhances Kubernetes Confidential Containers with Attestation and Key Management

Fortanix has announced support for Confidential Containers within its Confidential AI platform, integrating Kubernetes workload attestation with encryption-key release. This allows workloads that comply with security policies to decrypt models and sensitive data in hardware-based trusted execution environments (TEEs).

Confidential Containers (CoCo), a project under the Cloud Native Computing Foundation, operates Kubernetes pods inside confidential virtual machines that leverage TEEs. Unlike standard containers, which rely on the host operating system for isolation, confidential VMs use hardware protections to encrypt memory and limit access to workloads during execution. This approach safeguards data in use, not just data at rest or in transit, enabling teams to run sensitive workloads on shared infrastructure.

Fortanix’s technical overview outlines plugins that connect CoCo workloads to two services: the Confidential Computing Manager (CCM), which verifies the environment, and the Data Security Manager (DSM), which releases keys only after CCM verification. The company states that CCM can attest both the processor and graphics processing unit (GPU), contingent on configuration.

CoCo shifts image pulling and unpacking into the confidential guest environment. Its Attestation Agent gathers hardware evidence, while the Confidential Data Hub retrieves secrets post-verification. If attestation fails, keys remain in DSM, preventing the workload from decrypting protected models or data.

Anuj Jaiswal, Fortanix’s chief product officer, remarked, “With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves.” Fortanix claims that CCM and DSM operate in a clustered environment with 24/7 support, available as a hosted service, on-premises, or air-gapped.

Fortanix’s Intel TDX deployment guide specifies two GPU settings: `Required`, which mandates CCM to validate GPU evidence through NVIDIA’s attestation service, and `Ignored`, which only checks for the presence of evidence without evaluating the result. The guide also notes that the Fortanix CoCo Helm chart does not configure host firmware or kernel settings, which must be addressed beforehand.

Attestation and conditional secret delivery are already part of CoCo’s open-source Trustee components. Trustee separates evidence appraisal from resource authorization, with its attestation service comparing platform claims to reference values. The Key Broker Service then applies a user-defined policy before releasing secrets from local storage, a plugin, or an external key store. Successful attestation still requires policy authorization for the request.

Source: InfoQ