Threat Model
What a confidential node protects, which components c8s trusts, and why launch measurements must be pinned.
c8s protects a confidential Kubernetes node from the infrastructure outside its TEE boundary. AMD SEV-SNP or Intel TDX hardware encrypts node memory and supplies evidence that a verifier can check. Pods on the same node share that boundary; c8s assumes a single tenant per node. The node kernel, kubelet, container runtime, and privileged node services remain part of the trusted computing base.
The cloud or bare-metal host can deny service, control networking, and observe metadata. It cannot read the node CVM's protected memory without breaking the hardware boundary. c8s does not claim hardware isolation between pods on one node; use separate confidential nodes for mutually distrusting tenants.
What c8s checks
| Gate | Enforcement |
|---|---|
| Node evidence | Attestation API and CDS verify hardware evidence |
| Workload image and command | Node NRI image-policy plugin checks the allowlist; CDS checks admitted sandbox images before issuing a certificate |
| Workload identity | Node admission inventory binds a process to its sandbox; CDS signs that identity into the certificate |
| Mesh traffic | RA-TLS mesh validates peer certificates against the mesh CA |
| Tenant pod privilege | Admission policy denies host namespaces and hostPath volumes for in-scope workloads |
The Kubernetes operator and webhook orchestrate workloads but do not mint certificates or forge hardware evidence. CDS holds the mesh CA key in memory. Ordinary Kubernetes Secrets, including image-pull credentials, are still visible to anyone with access to etcd and should not hold TEE-only application secrets.
Pin the measurement
By default, empty cds.measurements and ratlsMesh.measurements accept any genuine attested CVM. For production, set c8s install --measurements <LAUNCH_DIGEST> to pin the expected node image. TDX deployments should also pin the relevant RTMRs. See obtain launch measurements and verify a deployment.
The allowlist checks image digests and effective command lines, not every pod-spec field or the combination of containers running together. See limitations for the remaining gaps.