# k8s confidential containers

Published articles for k8s confidential containers.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Kubernetes Confidential Containers Get Fortanix Attestation and Key Management

DevFeed: [Kubernetes Confidential Containers Get Fortanix Attestation and Key Management](<https://devfeed.tech/articles/kubernetes-confidential-containers-get-fortanix-attestation-and-key-management-109653.md>)

Original publisher: [Read original article](<https://www.infoq.com/news/2026/10/k8s-confidential-containers/>)

Author: Mark Silvester

Published: 2026-10-31T08:18:00Z

Content type: news

Language: en

Sources: [InfoQ](<https://devfeed.tech/sources/infoq.md>)

Topics: [Confidential Computing](<https://devfeed.tech/topics/confidential-computing.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [virtualization](<https://devfeed.tech/topics/virtualization.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-workloads](<https://devfeed.tech/tags/ai-workloads.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [architecture-design](<https://devfeed.tech/tags/architecture-design.md>), [attestation](<https://devfeed.tech/tags/attestation.md>), [azure](<https://devfeed.tech/tags/azure.md>), [cloud-native-computing-foundation](<https://devfeed.tech/tags/cloud-native-computing-foundation.md>), [confidential-containers](<https://devfeed.tech/tags/confidential-containers.md>), [containers](<https://devfeed.tech/tags/containers.md>), [decryption-key](<https://devfeed.tech/tags/decryption-key.md>), [development](<https://devfeed.tech/tags/development.md>), [devops](<https://devfeed.tech/tags/devops.md>), [fortanix](<https://devfeed.tech/tags/fortanix.md>), [gpu](<https://devfeed.tech/tags/gpu.md>), [integration](<https://devfeed.tech/tags/integration.md>), [k8s-confidential-containers](<https://devfeed.tech/tags/k8s-confidential-containers.md>), [key](<https://devfeed.tech/tags/key.md>), [key-management](<https://devfeed.tech/tags/key-management.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [management](<https://devfeed.tech/tags/management.md>), [news](<https://devfeed.tech/tags/news.md>), [offer](<https://devfeed.tech/tags/offer.md>), [protection](<https://devfeed.tech/tags/protection.md>), [release](<https://devfeed.tech/tags/release.md>), [settings](<https://devfeed.tech/tags/settings.md>), [upstream](<https://devfeed.tech/tags/upstream.md>), [verification](<https://devfeed.tech/tags/verification.md>)

### AI overview

Fortanix's Confidential Containers integration links Kubernetes workload attestation to key release: CoCo runs pods in hardware-backed confidential VMs, CCM verifies the environment, and DSM releases decryption keys only after successful verification. Fortanix says CCM can check processor and GPU evidence together, but GPU protection depends on configuration: `Required` validates GPU evidence through NVIDIA's service, while `Ignored` checks only that evidence is present. The Helm chart does not set host firmware or kernel settings, which must be prepared beforehand. CoCo's open-source Trustee also supports attestation-based secret release, separating evidence appraisal from policy authorization. Azure Secure Key Release is another managed option, but releases exportable keys rather than secrets or certificates. These controls do not establish that an AI application handles data safely; teams must also trust guest software and helper processes, and the described protections do not cover denial of service or hardware side channels.

### Source excerpt

Fortanix's CoCo integration connects workload attestation to decryption-key release for Kubernetes AI workloads. GPU-verification settings affect protection, while upstream Trustee and Azure Secure Key Release offer alternative routes to attestation-based key release. By Mark Silvester