Cloud-Providers on Confidential Containers

Cloud Providers

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

This guide covers how to run Confidential Containers workloads across supported cloud and virtualization environments by using the Cloud API Adaptor (CAA) and the peer-pods runtime. This deployment model provides strong workload isolation without tying the Kubernetes worker nodes to a particular virtualization or confidential-computing technology. Because PodVMs are provisioned alongside the Kubernetes worker nodes rather than inside them, the worker nodes can themselves be virtual machines; bare-metal workers and nested virtualization are not required.

Alibaba Cloud (ACK)

Mon, 01 Jan 0001 00:00:00 +0000

This documentation will walk you through setting up CAA (a.k.a. Peer Pods) on Alibaba Cloud Container Service for Kubernetes (ACK) and Alibaba Cloud Elastic Compute Service (ECS). It explains how to deploy:

One worker for ACK Managed Cluster
CAA on that Kubernetes cluster
An Nginx pod backed by CAA pod VM on ECS

Note: Run the following commands from the following directory - src/cloud-api-adaptor

Note: Now Confidential Computing instances are available in some regions.

AWS (EKS)

Mon, 01 Jan 0001 00:00:00 +0000

This documentation will walk you through setting up CAA (a.k.a. Peer Pods) on AWS Elastic Kubernetes Service (EKS). It explains how to deploy:

A single worker node Kubernetes cluster using Elastic Kubernetes Service (EKS)
CAA on that Kubernetes cluster
An Nginx pod backed by CAA pod VM

Pre-requisites

Install Required Tools:

Install kubectl,
Install Helm,
Install aws CLI tool,
Install eksctl CLI tool,
Ensure that the tools curl, git and jq are installed.

AWS Preparation

Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (or AWS_PROFILE) and AWS_REGION for AWS CLI access

Note: As an alternative to static credentials, you can use IRSA (IAM Roles for Service Accounts) on EKS. With IRSA, the CAA pods authenticate via OIDC — no static AWS keys are stored in Kubernetes secrets. You still need AWS_REGION and temporary credentials for the cluster setup steps below.

Azure Kubernetes Service (AKS)

Mon, 01 Jan 0001 00:00:00 +0000

This documentation will walk you through setting up Cloud API Adaptor (CAA) (a.k.a. Peer Pods) on Azure Kubernetes Service (AKS).

It explains how to deploy:

A single worker node Kubernetes cluster using Azure Kubernetes Service (AKS),
CAA on that Kubernetes cluster,
A sample application deployed using CAA to verify that everything is working as expected.

Confidential Containers also supports using Azure Key Vault as a resource backend for Trustee. More info

Google Cloud Platform (GCP)

Mon, 01 Jan 0001 00:00:00 +0000

This documentation will walk you through setting up Cloud API Adaptor (CAA) (a.k.a. Peer Pods) on Google Kubernetes Engine (GKE).

It explains how to deploy:

A single worker node Kubernetes cluster using Google Kubernetes Engine (GKE),
CAA on that Kubernetes cluster,
A sample application deployed using CAA to verify that everything is working as expected.

Pre-requisites

Install Required Tools:

Install kubectl,
Install Helm,
Install gcloud CLI tool.

Google Cloud Project:

Ensure you have a Google Cloud project created,
Note the Project ID (export it as GCP_PROJECT_ID).

GCP Preparation

Set the environment variable GCP_PROJECT_ID to your Google Cloud project ID:
```
export GCP_PROJECT_ID="YOUR_PROJECT_ID"
```

Authenticate with Google Cloud and set the project:

gcloud auth login
gcloud config set project "${GCP_PROJECT_ID}"

Enable the GKE API:

gcloud services enable container.googleapis.com \
  --project="${GCP_PROJECT_ID}"

This API is required to create and manage the GKE cluster.

Set the region and cluster name:
```
export GCP_REGION="us-central1"
export CLUSTER_NAME="caa-gke"
```
Note

“us-central1” was chosen because supports Confidential VMs.
For a complete list of supported regions visit supported-configurations.