Your first confidential cluster

1. Check the target cluster

kubectl config current-context
kubectl version
kubectl get nodes -o wide
kubectl get nodes \
  -o custom-columns='NAME:.metadata.name,PODCIDR:.spec.podCIDR,PODCIDRS:.spec.podCIDRs'

Each row must have a pod CIDR in at least one of the two pod-range columns. Stop if any Node has neither and resolve its pod-range publication before generating the seed or preparing CDS. Supplying <POD_CIDR> in the CDS configuration does not satisfy this Node-field check.

Confirm the context names your prepared cluster, the server meets the version floor, and its confidential nodes are ready. --cvm-mode aks selects the Azure vTPM evidence path; --hardware-platform sev-snp selects its CPU TEE. The node list is a health check, not attestation of those nodes.

2. Create the operator credential and component seed

umask 077
openssl ecparam -name prime256v1 -genkey -noout -out operator.key
openssl ec -in operator.key -pubout -out operator.pub

c8s install --cvm-mode aks --hardware-platform sev-snp \
  --image-tag '<IMAGE_TAG>' --operator-keys operator.pub \
  --allowlist-seed-out component-seed.json

Keep operator.key private. Its public half will authorize policy writes through the measured CDS configuration. The installer's --operator-keys also supplies router verification keys; it does not configure the authority of an already running CDS.

The seed command reads your cluster and component registries, writes component-seed.json, and stops before installation. This file contains the component entries that the image allowlist must admit. Keep the image tag and install options unchanged through the final install.

3. Prepare and launch the external CDS

c8s cds config new --out cds-bootstrap --cluster-id first-cluster \
  --operator-keys operator.pub --allowlist-seed component-seed.json \
  --node-pins nodes-policy.json \
  --node-cidr '<NODE_CIDR>' --pod-cidr '<POD_CIDR>' --service-cidr '<SERVICE_CIDR>' \
  --image-manifest '<CDS_MANIFEST_JSON>' --platform sev-snp \
  --vcpus '<CDS_VCPU_COUNT>'

Use the prepared ranges, manifest, and vCPU count. Repeat a CIDR flag if your cluster has multiple ranges. first-cluster is the cluster identity you assign this configuration. The new directory contains cds-config.yaml and cds-pin.json; the pin binds the CDS image and the exact configuration bytes. Keep private keys and secrets out of this host-readable configuration.

Package the configuration as the VM's input disk:

mkdir cds-opkeydata
cp cds-bootstrap/cds-config.yaml cds-opkeydata/pubkey
sha256sum cds-opkeydata/pubkey
genisoimage -quiet -rock -joliet -volid opkeydata \
  -output cds-opkeydata.iso cds-opkeydata/

Launch the CDS with your prepared VM provisioning mechanism. Attach cds-opkeydata.iso, use the matching disk and IGVM from the approved build, set the selected vCPU count, and set HOST_DATA to the 32 raw bytes of the SHA-256 digest. sha256sum prints those bytes as the first 64 hexadecimal characters, followed by the filename. Follow your provisioner's launch instructions to encode those digest bytes in its input format; the filename is not part of HOST_DATA. The guest stages the configuration at /run/confai/operator-pubkey; CDS checks it against its own launch evidence before serving. Wait for the VM's network endpoint to become reachable before proceeding.

4. Verify CDS and retain the mesh CA

c8s cds verify 'https://<CDS_HOST>:8443' \
  --image-policy-file cds-bootstrap/cds-pin.json \
  --served-policy-file nodes-policy.json --operator-keys operator.pub && \
c8s cds ca --url 'https://<CDS_HOST>:8443' \
  --image-policy-file cds-bootstrap/cds-pin.json --out mesh-ca.pem

Replace <CDS_HOST> with the external VM endpoint. Require verification exit code 0; && prevents the CA read after any other verdict. Continue only after the CA command also succeeds. If verification cannot retrieve required collateral, resolve that failure first.

This checks three separate inputs: the CDS image and configuration, the intended node set it reports admitting, and the expected operator keys. The authenticated CA read saves mesh-ca.pem, the deployment anchor for certificates CDS issues. Keep it with your approved pins and compare later CA reads before replacing it.

5. Install and check the cluster components

c8s install --cvm-mode aks --hardware-platform sev-snp \
  --image-tag '<IMAGE_TAG>' --operator-keys operator.pub \
  --cds-address '<CDS_HOST>:8443' --cds-pin cds-bootstrap/cds-pin.json

Use the same image tag as the seed command. The installer checks the configured component seed and node subnets, then runs Helm with readiness waiting enabled. Require successful completion before checking the resulting objects:

kubectl get pods -n c8s-system
kubectl get pods -n c8s-router
kubectl get mutatingwebhookconfiguration c8s-pod-injector \
  -o jsonpath='{.webhooks[*].clientConfig.caBundle}'

Expect component pods to be ready and the webhook CA bundle to be nonempty. The operator, attestation API, and Node Resource Interface (NRI) image-policy installer/worker serve the cluster; the router runs in c8s-router. CDS remains in its external VM. Every newly admitted pod in a namespace matched by the webhook's namespaceSelector receives its own c8s-mesh endpoint, with NRI enforcing nftables packet rules. See the namespace coverage check before selecting an application namespace.

On managed nodes, validate the containerd changes and privileged node components through node-image upgrades. If installation fails, inspect the pods and events, correct the cause, and rerun the same pinned install command. Readiness establishes health; the next check establishes the router's attested identity.

6. Verify the router from your workstation

Identify the node hosting a ready router pod:

kubectl get pods -n c8s-router -o wide
kubectl get nodes -o wide

Match the router pod's NODE column to the node list. Set <ROUTER_ADDRESS> in the next command to that node's IP address reachable from your workstation. The default host port serves the router on TCP 443. If only an internal address is listed, use the private-network path prepared above. Stop and establish that path if the address is unreachable. Pod port-forwarding is not a substitute: packet rules reject root-owned sockets entering a pod's network namespace.

c8s verify 'https://<ROUTER_ADDRESS>:443' --kind lb \
  --server-name c8s-router.c8s-router.svc \
  --image-policy-file router-pin.json --mesh-ca mesh-ca.pem

Replace <ROUTER_ADDRESS> with the reachable router address. --server-name supplies the default certificate's DNS name even when connecting to an IP address. router-pin.json checks the router node's approved identity; mesh-ca.pem checks its deployment's issuing CA. The CDS image pin belongs to a different VM and cannot substitute for the router policy.

Require exit code 0 and inspect the verdict's warnings. Discovery binds the certificate to issuance-time evidence, so expect fresh: false: it does not contain a nonce from this verification attempt. The check also compares the live TLS serving certificate with the attested certificate. Its result covers this connection to one router replica at one instant. It does not verify an application's later connection or backend workload.

Exit 1 means invalid inputs, 2 means verification or policy failure, 3 means required evidence or network material was unavailable, and 4 means partial verification. None is a successful completion of this tutorial. See Verify a deployment for verdict fields and fresh route checks.