[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-656292-105":3,"detail-sidebar-cat-0-en-105":80,"doc-detail-656292-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","c8s-a-confidential-kubernetes-architecture","C8s: A Confidential Kubernetes Architecture","","This paper introduces C8s, a confidential computing architecture for Kubernetes that delivers cryptographically rooted confidentiality, integrity, and verifiability for Kubernetes clusters under infrastructure operators. Guarantees are designed to be cryptographically provable to independent third-party verifiers. The architecture leverages hardware Trusted Execution Environments (TEEs) such as AMD SEV-SNP, Intel TDX, and NVIDIA Confidential Computing to create an attestation-rooted trust boundary for confidential VMs. It supports managed Kubernetes where the control plane cannot be attested, enabling protection of sensitive data, workloads, and AI assets.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/technology/","Technology",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/c8s-a-confidential-kubernetes-architecture/656292/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/c8s-a-confidential-kubernetes-architecture/656292.png","ImageObject",300,407,{"name":42,"@type":43},"Lucas Martin","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-30","2026-10-25",true,{"@type":52,"interactionType":53,"userInteractionCount":33},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"What problem does C8s address for sensitive workloads on Kubernetes?","Question",{"text":62,"@type":63},"C8s targets confidentiality gaps when sensitive inputs, outputs, and intermediate state must be protected from infrastructure operators and compute providers during execution on third-party clusters.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"How does C8s provide confidentiality and verifiability?",{"text":67,"@type":63},"C8s builds a trust boundary using hardware Trusted Execution Environments (TEEs) and cryptographic attestation so third parties can verify that expected trusted code processes the data.",{"name":69,"@type":60,"acceptedAnswer":70},"Which TEEs and managed Kubernetes scenarios does the architecture support?",{"text":71,"@type":63},"The paper describes compatibility with TEEs including AMD SEV-SNP, Intel TDX, and NVIDIA Confidential Computing, and with managed Kubernetes services such as Amazon EKS, Google GKE, and Microsoft AKS where the control plane cannot be attested.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},656292,1793052310,{"code":4,"msg":81,"data":82},"success",[83,87,91,95,100,104,109,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":84,"show_sort_weight":85,"slug":86},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":88,"show_sort_weight":89,"slug":90},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":92,"show_sort_weight":93,"slug":94},"Exam",70,"exam",{"id":96,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},5,"Comic",60,"comic",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":102,"slug":103},6,50,"technology",{"id":105,"doc_module":4,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},7,"Healthcare",40,"healthcare",{"id":110,"doc_module":4,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},8,"Research & Report",30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":96,"slug":129},19,"General","general",{"code":4,"msg":81,"data":131},{"doc_id":78,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":101,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":33,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":139,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":144,"read_time":145},8796095360427,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","arXiv :2604 .26974v1 [ cs .CR] 27 Apr 2026  \nC8s: A Confidential Kubernetes Architecture  \nAmean Asad∗ Patrick McClurg∗ João Andrade  \n[amean@confidential. ai](amean@confidential. ai) [patrick@confidential. ai](patrick@confidential. ai) [joao@confidential. ai](joao@confidential. ai)  \n[Confidential.ai](Confidential.ai)  \nApril 2026  \nAbstract  \nThis paper presents C8s, a confidential computing architecture for Kubernetes that provides cryptographically rooted confidentiality, integrity, and verifiability guarantees for Kubernetes clusters from infrastructure operators. These guarantees are cryptographically provable to any independent third party verifier. The architecture is built on hardware Trusted Execution Environments (TEEs), specifically AMD SEV-SNP, Intel TDX, and NVIDIA Confidential Computing support, to establish an attestation-rooted trust boundary around confidential VMs. This design is compatible with managed Kubernetes services such as Amazon EKS, Google GKE, and Microsoft AKS, where the control plane cannot be attested. Under this boundary, three groups gain guarantees that are absent from conventional deployments. Data and artifact owners can deploy sensitive workloads and proprietary artifacts on third-party infrastructure without risking exfiltration. Compute providers can offer execution services without revealing workloads to cloud operators. End users can submit requests that remain opaque to all parties except the attested TEE processing them. Representative workloads include AI inference, securing AI model weights, and training or fine-tuning on sensitive data.  \n1 Introduction  \n1.1 Motivation  \nRunning sensitive workloads on third-party infrastructure presents a three-sided confidentiality problem. Artifact owners invest substantial resources in proprietary assets such as trained model weights, curated datasets, cryptographic keys, or proprietary algorithms, and risk exfiltration when those assets are deployed on infrastructure they do not control. Compute providers running execution infrastructure need assurance that cloud providers cannot observe their workloads. End users submitting sensitive requests, in healthcare, legal, financial, and national security contexts, require guarantees that neither the compute provider nor the infrastructure operator can inspect their inputs or outputs.  \nToday, the dominant mitigation for all three concerns is contractual. Model providers sign licensing agreements restricting weight access. Cloud providers publish compliance certifications. Service providers implement access controls. None of these mechanisms are cryptographically rooted. A sufficiently privileged insider, such as a cloud engineer with hypervisor access, a  \n∗ Equal contribution.  \nKubernetes administrator with credentials, or a compromised node with root access, can read data from memory, intercept network traffic, or exfiltrate model weights from storage.  \nEncryption at rest and encryption in transit address portions of this problem but leave a fundamental gap during computation where data is plaintext in memory. Workloads, user data, and proprietary intellectual property all reside in memory cleartext, readable by any party with sufficient host access.  \nKubernetes is a dominant orchestration layer for workloads in production, and therefore a generalized confidential architecture at the cluster level targets a substantial fraction of existing deployed compute infrastructure. Rather than requiring workloads to be rewritten against a specialized confidential runtime, the approach here preserves the Kubernetes surface area that operators and developers already know, and any workload already running on a Kubernetes cluster can inherit these guarantees with minimal modification.  \nArtifact owner [weights, datasets, proprietary code]  \nDeploys  \n| Shared infrastructure |  |\n| --- | --- |\n| \u003Cbr>Cloud operator |  |\n| Kubernetes control plane |  |\n| All layers above network traffic, | can read plaintext ","cbCaibIasj2bJGKc","https://ap.wps.com/l/cbCaibIasj2bJGKc","pdf",553695,47,"English","# Abstract\n# Introduction\n## Motivation\n## Problem Statement\n## Scope\n# Background\n## Trusted Execution Environments","[{\"question\":\"What problem does C8s address for sensitive workloads on Kubernetes?\",\"answer\":\"C8s targets confidentiality gaps when sensitive inputs, outputs, and intermediate state must be protected from infrastructure operators and compute providers during execution on third-party clusters.\"},{\"question\":\"How does C8s provide confidentiality and verifiability?\",\"answer\":\"C8s builds a trust boundary using hardware Trusted Execution Environments (TEEs) and cryptographic attestation so third parties can verify that expected trusted code processes the data.\"},{\"question\":\"Which TEEs and managed Kubernetes scenarios does the architecture support?\",\"answer\":\"The paper describes compatibility with TEEs including AMD SEV-SNP, Intel TDX, and NVIDIA Confidential Computing, and with managed Kubernetes services such as Amazon EKS, Google GKE, and Microsoft AKS where the control plane cannot be attested.\"}]","C8s: A Confidential Kubernetes Architecture | PDF",1792967463,118]