Kubernetes Confidential Containers Get Fortanix Attestation and Key Management

Kubernetes Confidential Containers Get Fortanix Attestation and Key Management - InfoQ

[BT](https://www.infoq.com/int/bt/ "bt")

InfoQ Software Architects' Newsletter

A monthly overview of things you need to know as an architect or aspiring architect.

View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

Close

Live Webinar and Q&A: Scaling OpenTelemetry: Managing Collectors, Configuration, and Cost (Nov 19, 2026)Save Your Seat

Close

Toggle Navigation

Facilitating the Spread of Knowledge and Innovation in Professional Software Development

English edition

• English edition
• Chinese edition
• Japanese edition
• French edition

[Write for InfoQ](https://www.infoq.com/write-for-infoq/ "Write for InfoQ")

Search

RegisterSign in

Unlock the full InfoQ experience

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources.

Log In

or

Don't have an InfoQ account?

Register

• Stay updated on topics and peers that matter to youReceive instant alerts on the latest insights and trends.
• Quickly access free resources for continuous learningMinibooks, videos with transcripts, and training materials.
• Save articles and read at anytimeBookmark articles to read whenever youre ready.

Logo - Back to homepage

NewsArticlesPresentationsPodcastsGuides

Topics

[Development](https://www.infoq.com/development/ "Development")

• [Java](https://www.infoq.com/java/ "Java")
• [Kotlin](https://www.infoq.com/kotlin/ "Kotlin")
• [.Net](https://www.infoq.com/dotnet/ ".Net")
• [C#](https://www.infoq.com/c_sharp/ "C#")
• [Swift](https://www.infoq.com/swift/ "Swift")
• [Go](https://www.infoq.com/golang/ "Go")
• [Rust](https://www.infoq.com/rust/ "Rust")
• [JavaScript](https://www.infoq.com/javascript/ "JavaScript")

Featured in Development

• #### Accelerating Performance by Incrementally Integrating Rust into Existing Codebase

Lily Mara explains how to avoid high-risk software rewrites through incremental FFI refactoring. She shares how engineering teams can replace Python bottlenecks with Rust via PyO3, demonstrating how to achieve dramatic function-level speedups, seamless integration testing, and meaningful infrastructure cost savings without microservice overhead.


All in developmentFollow Topic

[Architecture & Design](https://www.infoq.com/architecture-design/ "Architecture & Design")

• [Architecture](https://www.infoq.com/architecture/ "Architecture")
• [Enterprise Architecture](https://www.infoq.com/enterprise-architecture/ "Enterprise Architecture")
• [Scalability/Performance](https://www.infoq.com/performance-scalability/ "Scalability/Performance")
• [Design](https://www.infoq.com/design/ "Design")
• [Case Studies](https://www.infoq.com/Case_Study/ "Case Studies")
• [Microservices](https://www.infoq.com/microservices/ "Microservices")
• [Service Mesh](https://www.infoq.com/servicemesh/ "Service Mesh")
• [Patterns](https://www.infoq.com/DesignPattern/ "Patterns")
• [Security](https://www.infoq.com/Security/ "Security")

Featured in Architecture & Design

• #### The Evolution of Agentic Harnesses: From Chains to Graph to Code

Agentic LLM systems have moved from linear prompt chains to graph-based workflows and, more recently, code-executing harnesses. Chains are simple but fragile, graphs add branching, retries, and validation, and code harnesses verify outputs through execution. The article advises validating model outputs and choosing the least complex design that meets reliability, speed, and cost needs.


All in architecture-designFollow Topic

[AI Infrastructure](https://www.infoq.com/ai-ml-data-eng/ "AI Infrastructure")

• [Big Data](https://www.infoq.com/bigdata/ "Big Data")
• [Machine Learning](https://www.infoq.com/machinelearning/ "Machine Learning")
• [NoSQL](https://www.infoq.com/nosql/ "NoSQL")
• [Database](https://www.infoq.com/database/ "Database")
• [Data Analytics](https://www.infoq.com/data-analytics/ "Data Analytics")
• [Streaming](https://www.infoq.com/streaming/ "Streaming")

Featured in AI, ML & Data Engineering

• #### InfoQ AI, ML and Data Engineering Trends Report - 2026

This InfoQ Trends Report offers readers a comprehensive overview of emerging trends and technologies in the areas of AI, ML, and Data Engineering. This report summarizes the InfoQ editorial team’s and external guests' view on the current trends in AI and ML technologies and what to look out for in the next 12 months.


All in ai-ml-data-engFollow Topic

[Culture & Methods](https://www.infoq.com/culture-methods/ "Culture & Methods")

• [Agile](https://www.infoq.com/agile/ "Agile")
• [Diversity](https://www.infoq.com/diversity/ "Diversity")
• [Leadership](https://www.infoq.com/leadership/ "Leadership")
• [Lean/Kanban](https://www.infoq.com/lean/ "Lean/Kanban")
• [Personal Growth](https://www.infoq.com/personal-growth/ "Personal Growth")
• [Scrum](https://www.infoq.com/scrum/ "Scrum")
• [Sociocracy](https://www.infoq.com/sociocracy/ "Sociocracy")
• [Software Craftmanship](https://www.infoq.com/software_craftsmanship/ "Software Craftmanship")
• [Team Collaboration](https://www.infoq.com/team-collaboration/ "Team Collaboration")
• [Testing](https://www.infoq.com/testing/ "Testing")
• [UX](https://www.infoq.com/ux/ "UX")

Featured in Culture & Methods

• #### The Ladder Is Missing Rungs: Engineering Progression When AI Ate the Middle

Alasdair Allan discusses empirical research from METR and Anthropic on AI coding adoption. He explains the "supervision paradox," where reliance on AI tools disrupts junior skill development, risks institutional context loss, and threatens the long-term engineering pipeline needed to oversee autonomous systems effectively.


All in culture-methodsFollow Topic

DevOps

• [Infrastructure](https://www.infoq.com/infrastructure/ "Infrastructure")
• [Continuous Delivery](https://www.infoq.com/continuous_delivery/ "Continuous Delivery")
• [Automation](https://www.infoq.com/automation/ "Automation")
• [Containers](https://www.infoq.com/containers/ "Containers")
• [Cloud](https://www.infoq.com/cloud-computing/ "Cloud")
• [Observability](https://www.infoq.com/observability/ "Observability")

Featured in DevOps

• #### Wrangling Telemetry at Scale: A Guide to Self-Hosted Observability

Colin Douch shares battle-tested strategies for building and scaling self-hosted observability stacks. He explains how to effectively correlate metrics, structured logs, and distributed traces using open-source tooling like Prometheus, VictoriaMetrics, and Jaeger, while navigating the engineering trade-offs of avoiding SaaS vendor lock-in.


All in devopsFollow Topic

[Events](https://events.infoq.com/ "Events")

Helpful links

• [About InfoQ](https://www.infoq.com/about-infoq "About InfoQ")
• [InfoQ Editors](https://www.infoq.com/infoq-editors "InfoQ Editors")
• [Write for InfoQ](https://www.infoq.com/write-for-infoq "Write for InfoQ")
• [About C4Media](https://c4media.com/ "About C4Media")
• [Diversity](https://c4media.com/diversity "Diversity")

Choose your language

• [En](https://www.infoq.com/news/2026/10/k8s-confidential-containers/# "InfoQ English")
• 中文
• 日本
• Fr

Nov 12,2026 AI Engineering Certification Work through your production AI decisions with senior engineers from other companies. Apply their perspectives to challenges from your own work. **Online. Register Now.**

Nov 17,2026 High-Performing Teams Certification Compare team design, delivery flow, AI roles, and metrics with experienced practitioners. **Online. Register Now.**

Dec 15-16,2026 QCon AI New York Production AI across agents, context, evals, security, and infrastructure, from the senior engineers building it. **Register. Early bird ends Nov 10.**

Jul 8-9,2027 QCon AI Boston Learn from the decisions and trade-offs behind AI systems already running in production. **Registration open.**

[InfoQ Homepage](https://www.infoq.com/ "InfoQ Homepage")[News](https://www.infoq.com/news "News")Kubernetes Confidential Containers Get Fortanix Attestation and Key Management

[DevOps](https://www.infoq.com/Devops/ "DevOps")

QCon AI Boston (July 8-9, 2027): The AI prototype worked. What happens in production?

Kubernetes Confidential Containers Get Fortanix Attestation and Key Management

Oct 31, 2026 2 min read

by

• Mark Silvester

Follow Head of Platform & Security

#### Follow us on

Youtube 232K FollowersLinkedin 26K FollowersInstagram NewRSS 19K ReadersX 57.1k FollowersFacebook 21K LikesBluesky New

Log in to listen to this article

Audio ready to play

Audio 2

0:00 0:00

Normal 1.25x 1.5x

Like

• Reading list

Fortanix has announcedsupport for Confidential Containers in its Confidential AI platform. The integration connects Kubernetes workload attestation to encryption-key release, so workloads that meet security policy can decrypt models and sensitive data inside hardware-based trusted execution environments (TEEs).

Confidential Containers (CoCo), a Cloud Native Computing Foundation project, runs Kubernetes pods inside confidential virtual machines backed by hardware-based trusted execution environments (TEEs). Unlike ordinary containers, whose isolation depends largely on the host operating system, confidential VMs use hardware protections to encrypt memory and restrict access to the workload while it runs. This helps protect data in use, not just data at rest or in transit, and can let teams run sensitive workloads on shared infrastructure. Those protections still depend on trusting the guest software and configuring attestation and key release correctly.

Fortanix's technical overview describes plugins connecting CoCo workloads to two services: Confidential Computing Manager (CCM), which verifies the environment, and Data Security Manager (DSM), which releases keys only to environments CCM has verified. The company says CCM can attest the processor and graphics processing unit (GPU) together, a check that depends on configuration.

CoCo moves image pulling and unpacking into the confidential guest. Its Attestation Agent collects hardware evidence, and its Confidential Data Hub obtains secrets after verification. In Fortanix's described workflow, keys stay in DSM if attestation fails, so the workload cannot decrypt protected models or data.

Fortanix chief product officer Anuj Jaiswal said in the announcement: "With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves." Fortanix says CCM and DSM run clustered, with 24x7 support, as a hosted service, on-premises or air-gapped.

Fortanix's Intel TDX deployment guide offers two GPU settings: Required makes CCM validate GPU evidence through NVIDIA's attestation service; Ignored checks only that evidence is present and disregards the result. The guide also notes that the Fortanix CoCo Helm chart does not configure host firmware or kernel settings, which must be completed beforehand.

Attestation and conditional secret delivery already exist in CoCo's open-source Trustee components. Trustee separates evidence appraisal from resource authorisation. Its attestation service compares platform claims with reference values, then its Key Broker Service applies a user-defined policy before releasing secrets from local storage, a plugin or an external key store. A successful attestation still requires that policy to authorise the request. Trustee also accepts GPU evidence bound to the processor's attestation report.

Microsoft's Azure Secure Key Release offers a managed alternative in Key Vault Premium and Managed HSM, integrated with Azure Attestation. It releases exportable keys, not secrets or certificates.

The pod's guest kernel and helper processes sit inside the trust boundary, so teams must trust them too. CoCo's trust model explains that hardware measurements usually cover the guest environment, with container verification forming a separate stage. It also warns that an enclave application can still expose a dangerous external interface and excludes denial-of-service protection and hardware side channels. Attestation does not establish that an AI application handles data safely.

Fortanix says CoCo support is available now, and its deployment guide documents installing the Fortanix CoCo Helm chart. The announcement also says Fortanix is developing open-source plugins for CoCo, without naming repositories or versions. CCM's 17 September release notes added CoCo application registration for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel Trust Domain Extensions (TDX).

About the Author

#### Mark Silvester

Mark Silvester is Head of Platform & Security working at Griffiths Waite, a software consultancy based in Birmingham, UK. Responsible for platform strategy, with a focus on delivering innovative solutions for enterprise clients. Areas of interest include cloud-native technologies, DevOps practices, and the practical application of AI in engineering and architecture.

Show more Show less

#### This content is in the DevOps topic

Follow Topic

##### Related Topics:

• Development### Development

Followers: 4178

Follow Topic

• Architecture & Design### Architecture & Design

Followers: 10439

Follow Topic

• DevOps### DevOps

Followers: 5154

Follow Topic

• Application Security### Application Security

Followers: 92

Follow Topic

• Kubernetes### Kubernetes

Followers: 494

Follow Topic

• Containers### Containers

Followers: 1350

Follow Topic

• Cloud Native Computing Foundation### Cloud Native Computing Foundation

Followers: 50

Follow Topic

* #### Popular in DevOps

• ##### Developer behind the AI-Built Adobe Clones Says They Are “Not Anywhere Close to Ready"

• ##### Cloudflare Reclaims 100 TB of RAM by Optimizing Consistent Hashing

• ##### eMudhra Intermediate CA Compromise

• ##### Netflix Titus Adds Single-Tenant VM Isolation for Containers

• ##### Cloudflare Opens Quicksilver to Customers as Workers KV Instant, Inside a 1 MB Envelope

* #### Related Sponsors

• ##### AI Security Playbook: Move Faster with AI, Without Compromising Security

• ##### Gartner® Magic Quadrant™ for AI-Augmented Code Modernization Tools

• ##### Scaling AI Adoption in Engineering (By O'Reilly) - Download Now

• ##### The IIoT PostgreSQL Performance Envelope

• ##### AI's Physical Constraints: How AI Rewired the Data Center

• #### Related Sponsor

PostgreSQL Built for Time-Series Scale

Handle massive time-series data with PostgreSQL, without sacrificing performance. Discover how Tiger Data delivers high-speed ingest, fast queries, and scalable storage. [Learn More](https://www.infoq.com/url/f/bfd089cf-67a6-48f0-a0df-b45228da036b/).

Related Content

• ##### Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for Kubernetes

Oct 21, 2026

• ##### OpenTelemetry Makes Kubernetes Attributes Processor Stable as Observability Schema Matures

Oct 06, 2026

• ##### Cloudflare Fixes Cross-Tenant Data Exposure in Containers

Oct 05, 2026

• ##### Two Misconfigurations That Caused Spark OOM Failures on Kubernetes

Jun 03, 2026 

• ##### Netflix Treats GPU Reliability as a Distributed Systems Problem

Oct 30, 2026

• ##### Netflix Titus Adds Single-Tenant VM Isolation for Containers

Oct 30, 2026

• ##### Uber Moves beyond CPU Cores with Performance-Aware Scheduling for Stateful Workloads

Oct 27, 2026

• ##### Readyon Builds Four Layer Tenant Isolation for Multi Tenant Amazon EKS

Oct 26, 2026

• ##### Istio 1.31 Adds Agentgateway Waypoints and Moves Release Artifacts off Google Cloud

Oct 03, 2026

Related Sponsors

• #### Understanding Postgres Performance Limits for Analytics on Live Data

Stop the PostgreSQL optimization treadmill. Discover why indexes, tuning, partitioning, and replicas can deliver diminishing returns—and how MVCC, row storage, and WAL create architectural limits for high-frequency time-series workloads.

• Sponsored by


Related Content

• Icon##### Exploding GPUs and the AI Infrastructure Challenge

Oct 16, 2026 

• ##### CircleCI Makes Machine Runner Orchestrator Generally Available

Oct 09, 2026

• Icon##### Fixing the AI Infra Scale Problem by Stuffing 1M Sandboxes in a Single Server

Sep 09, 2026 

• Icon##### How to Run on Three Clouds at Once, and When Not to

Sep 11, 2026 

• Icon##### Enchant Your AI and APIs with eBPF Magic 🪄

Aug 21, 2026 

• ##### The Technology Adoption Curve, Twenty Years On

Jun 08, 2026 

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

• Development

• ##### [OpenBSD 8.0 Brings Expanded Hardware Support, Security Enhancements, and Virtualization Improvements](https://www.infoq.com/news/2026/10/openbsd-8-released/ "OpenBSD 8.0 Brings Expanded Hardware Support, Security Enhancements, and Virtualization Improvements")

• ##### [Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs](https://www.infoq.com/news/2026/10/google-pagebreak-security-agent/ "Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs")

• ##### [Bug0 Releases QA Agent to Automate Regression Testing with Cached Playwright Replays](https://www.infoq.com/news/2026/10/bug0-agent-testing-cached-replay/ "Bug0 Releases QA Agent to Automate Regression Testing with Cached Playwright Replays")

• Architecture & Design

• ##### [DoorDash Cuts Grocery Reorder Latency from 16 to 2 Seconds with AI Agents](https://www.infoq.com/news/2026/10/doordash-ai-grocery-reorder/ "DoorDash Cuts Grocery Reorder Latency from 16 to 2 Seconds with AI Agents")

• ##### [Airbnb Cuts Recommendation Staleness from 2 Days to Seconds with Chronon](https://www.infoq.com/news/2026/10/airbnb-chronon-recommendation/ "Airbnb Cuts Recommendation Staleness from 2 Days to Seconds with Chronon")

• ##### [How Anthropic Redesigned Source Control for AI-Driven Development](https://www.infoq.com/news/2026/10/anthropic-source-control/ "How Anthropic Redesigned Source Control for AI-Driven Development")

• Culture & Methods

• ##### [The Ladder Is Missing Rungs: Engineering Progression When AI Ate the Middle](https://www.infoq.com/presentations/ai-software-engineering-pipeline/ "The Ladder Is Missing Rungs: Engineering Progression When AI Ate the Middle")

• ##### [How to Make Artificial Intelligence More Environmentally Sustainable](https://www.infoq.com/news/2026/10/AI-environmentally-sustainable/ "How to Make Artificial Intelligence More Environmentally Sustainable")

• ##### [AI is an Amplifier: Scale High Performance, Not Dysfunction](https://www.infoq.com/presentations/dora-ai-adoption-engineering-performance/ "AI is an Amplifier: Scale High Performance, Not Dysfunction")

• AI, ML & Data Engineering

• ##### [InfoQ AI, ML and Data Engineering Trends Report - 2026](https://www.infoq.com/articles/ai-ml-data-engineering-trends-2026/ "InfoQ AI, ML and Data Engineering Trends Report - 2026")

• ##### [AI, ML, and Data Engineering InfoQ Trends Report 2026](https://www.infoq.com/podcasts/ai-ml-data-engineering-trends-2026/ "AI, ML, and Data Engineering InfoQ Trends Report 2026")

• ##### [QCon AI New York 2026 Program Committee Picks: Agent Identity, Context Costs, and Open-Source Infere](https://www.infoq.com/news/2026/10/qcon-ai-newyork-2026-pc-picks/ "QCon AI New York 2026 Program Committee Picks: Agent Identity, Context Costs, and Open-Source Infere")

• DevOps

• ##### [Kubernetes Confidential Containers Get Fortanix Attestation and Key Management](https://www.infoq.com/news/2026/10/k8s-confidential-containers/ "Kubernetes Confidential Containers Get Fortanix Attestation and Key Management")

• ##### [LocalStack for Azure Enters Public Preview with Security Settings Stored but Not Enforced](https://www.infoq.com/news/2026/10/localstack-azure-preview/ "LocalStack for Azure Enters Public Preview with Security Settings Stored but Not Enforced")

• ##### [Netflix Treats GPU Reliability as a Distributed Systems Problem](https://www.infoq.com/news/2026/10/netflix-gpu-distributed-systems/ "Netflix Treats GPU Reliability as a Distributed Systems Problem")

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

• Get a quick overview of content published on a variety of innovator and early adopter technologies
• Learn what you don’t know that you don’t know
• Stay up to date with the latest information from the topics you are interested in

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

#### Building AI systems for production? Test your approach against the decisions and trade-offs of senior practitioners running agents, evals, model serving, and AI-assisted engineering in production. See what worked, what failed, and what they would do differently. Bring those lessons back to your team to make better-informed architecture and delivery decisions. **REGISTER NOW** QCon AI New York · December 15–16, 2026

#### Events

• ##### Online InfoQ AI Engineering Certification

November 12, 2026

• ##### Online InfoQ AI Engineering Certification

November 13, 2026

• ##### Online InfoQ High-Performing Teams Certification

November 17, 2026

• ##### QCon San Francisco

November 16-20, 2026

• ##### QCon AI New York

December 15-16, 2026

• ##### Online InfoQ AI Engineering Certification

January 9, 2027

• ##### Online InfoQ Architect Certification

January 22, 2027

• ##### QCon London 2027

April 13-16, 2027

• ##### QCon AI Boston

July 8-9, 2027

#### Follow us on

Youtube 232K FollowersLinkedin 26K FollowersInstagram NewRSS 19K ReadersX 57.1k FollowersFacebook 21K LikesBluesky New

#### Stay in the know

The InfoQ PodcastEngineering Culture PodcastThe Software Architects' Newsletter

General Feedback [[email protected]](mailto:[email protected]) Advertising [[email protected]](mailto:[email protected]) Editorial [[email protected]](mailto:[email protected]) Marketing [[email protected]](mailto:[email protected])

InfoQ.com and all content copyright © 2006-2026 C4Media Inc.

Privacy Notice, Terms And Conditions, Cookie Policy, Cookie settings

Close

[BT](https://www.infoq.com/int/bt/ "bt")