Confidential AI ･ Workload annotations

Every pod annotation the c8s admission webhook reads — the opt-in, certificate and SAN overrides, secret and volume requests, nginx reload, and discovery output — plus the container, volume, and RuntimeClass names c8s reserves.

The c8s admission webhook reads these annotations off a pod template and injects accordingly. All of them are namespaced confidential.ai/. Only the first is required; setting any other without it is rejected at admission.

Opt in

Annotation	Default	Effect
`confidential.ai/cw`	— (required)	The workload id, not a boolean. Opts the pod into injection, is mirrored as a pod label so the operator-managed headless Service can select it, and derives the Service name `c8s-<value>` and the certificate SAN `c8s-<value>.<namespace>.svc`.
`confidential.ai/c8s-injected`	—	Stamped by the webhook after a successful mutation so re-invocation is a no-op. Do not set it yourself.

The value is an identity, not a flag.

confidential.ai/cw: my-inference yields the Service c8s-my-inference, which is what tls-lb dials over the RA-TLS mesh. A value like "true" would only produce a Service named c8s-true. Use a stable name that is a valid DNS-1035 label once prefixed with c8s-; an id that cannot form one yields no Service at all.

Certificate

The injected c8s-cert sidecar writes the pod's mesh leaf. These override where and how.

Annotation	Default	Effect
`confidential.ai/c8s-san`	derived from the cw id	Override the DNS SAN `get-cert` requests. For workloads adopted into c8s whose clients already dial an existing Service name.
`confidential.ai/c8s-cert-volume`	`c8s-certs`	Name of the volume the cert is written to.
`confidential.ai/c8s-cert-dir`	`/etc/c8s/certs`	Directory the cert and key land in.
`confidential.ai/c8s-cert-file`	`tls.crt`	Certificate filename.
`confidential.ai/c8s-key-file`	`tls.key`	Private-key filename.
`confidential.ai/c8s-renew-interval`	`6h`	Renewal interval for the issued certificate. A Go duration.

Secrets and volumes

Annotation	Default	Effect
`confidential.ai/c8s-secrets`	—	Comma-separated `NAME=/store/path` pairs. Injects the `c8s-secret` fetcher sidecar and the `c8s-secrets` volume. See Use application secrets.
`confidential.ai/c8s-secret-dir`	`/run/c8s/secrets`	Where the secret files land.
`confidential.ai/c8s-volumes`	—	Comma-separated `NAME=/store/path` pairs. `NAME` selects the node device by its `c8s-vol-<NAME>` serial. Injects the `c8s-volume` sidecar. See Create an encrypted volume.
`confidential.ai/c8s-volume-dir`	`/run/c8s/volumes`	Where opened volumes are mounted, one directory each.

Both are rejected at admission under Pod-as-CVM — the node-side machinery they need does not exist inside a per-pod guest.

nginx reload

For a workload that must be signalled when its certificate is renewed.

Annotation	Default	Effect
`confidential.ai/c8s-reload-nginx`	`false`	Reload nginx after a certificate is written.
`confidential.ai/c8s-reload-watch-paths`	—	Additional paths to watch for change.
`confidential.ai/c8s-reload-watch-volume`	—	Volume holding the watched paths.
`confidential.ai/c8s-reload-watch-mount-path`	—	Where that volume is mounted.

Discovery output

For a pod that publishes its own attestation discovery document.

Annotation	Default	Effect
`confidential.ai/c8s-discovery-out`	—	Path the discovery document is written to.
`confidential.ai/c8s-discovery-volume`	—	Volume it is written to.
`confidential.ai/c8s-discovery-mount-path`	—	Where that volume is mounted.
`confidential.ai/c8s-discovery-cds-cert-url`	—	URL the document advertises for the CDS certificate.
`confidential.ai/c8s-discovery-mesh-ca-url`	—	URL the document advertises for the mesh CA bundle.
`confidential.ai/c8s-discovery-public-tls-mode`	`cds`	`cds` or `webpki` — which certificate the front door serves publicly.

get-cert process identity

Annotation	Default	Effect
`confidential.ai/c8s-get-cert-run-as-user`	`65532`	`runAsUser` for the injected container.
`confidential.ai/c8s-get-cert-run-as-group`	`65532`	`runAsGroup`.
`confidential.ai/c8s-get-cert-run-as-non-root`	`true`	`runAsNonRoot`.
`confidential.ai/c8s-get-cert-verbose`	`false`	Verbose `get-cert` logging.

The cluster-wide defaults behind these are set at install with the --webhook-get-cert-* flags — see the CLI reference.

Reserved names

A pod that declares any of these itself is rejected at admission. They are reserved because the webhook rebuilds them on every call, so a pre-declared one would either be silently replaced or let a host-authored spec choose where released plaintext lands.

Name	Kind	What it is
`c8s-cert`	container	the `get-cert` sidecar that obtains the mesh leaf
`c8s-cert-wait`	container	the gate that blocks the workload until the first cert is written
`c8s-secret`	container	the secret fetcher
`c8s-volume`	container	the encrypted-volume fetcher
`c8s-certs`	volume	default destination for the mesh leaf
`c8s-secrets`	volume	memory-backed, mounted read-only into every container
`c8s-volume-<NAME>`	volume	one per requested volume, default-medium `emptyDir`
`c8s-workload-claims`	volume	the admission inventory's socket directory

The c8s-secrets volume must be a memory-backed emptyDir if pre-declared at all; a c8s-volume-<NAME> must be a default-medium emptyDir. A hostPath or PVC in either position is refused — it would write released plaintext to storage the host reads. See Reserved containers and volumes.

RuntimeClasses

Injected under --cvm-mode=pod, selected by the cluster's --hardware-platform and by whether the pod requests an nvidia.com/* resource. These are a fixed contract with the RuntimeClasses the chart installs and with the kata-enforcement policy — a custom class is rejected.

RuntimeClass	Selected when
`kata-qemu-snp`	SEV-SNP, no GPU
`kata-qemu-snp-nvidia`	SEV-SNP, pod requests a GPU
`kata-qemu-tdx`	Intel TDX, no GPU
`kata-qemu-tdx-nvidia`	Intel TDX, pod requests a GPU
`kata-qemu`	VM-isolated but not confidential