Confidential Containers Public Preview on Azure Red Hat OpenShift

Melanie_Kraintz

Microsoft

Nov 06, 2024

Discover how Confidential Containers on Azure Red Hat OpenShift enables secure cloud workloads with hardware-level memory encryption

We are thrilled to announce the public preview of Confidential Containers on Azure Red Hat OpenShift (ARO), an open source initiative that enables cloud-native confidential computing by leveraging Trusted Execution Environments to protect containers and data. This groundbreaking feature represents a significant leap forward in containerized application security, directly addressing the critical concerns of organizations managing sensitive workloads in the cloud.

Confidential Containers protect data in use by encrypting data in memory and running workloads in a security-enhanced environment, leveraging Azure's Confidential Computing infrastructure with AMD SEV-SNP technology and Intel TDX instances. This ensures that even administrators or cloud providers cannot access or tamper with sensitive data and applications. For organizations using ARO, workloads benefit from Azure's robust security features combined with Red Hat's industry leading hybrid cloud application platform powered by Kubernetes.

The public preview, available for ARO version 4.15 and later, offers several key advantages:

Enhanced data protection through memory encryption and secure workload execution
Reduced risk of unauthorized access to workload data and secrets
More seamless compatibility with public cloud infrastructure while maintaining regulatory compliance
Easier deployment using familiar workflows and tools, without requiring extensive confidential computing expertise

ARO-specific capabilities include:

Integrated attestation and key broker services
Support for Azure confidential computing nodes with AMD SEV-SNP and Intex TDX instances
Built-in compliance with major regulatory standards
Automated platform and security updates
Integration with Azure monitoring and security services

As businesses accelerate their migration to cloud environments, this release marks a pivotal moment in cloud security innovation, enabling organizations to more confidently run sensitive workloads while maintaining higher levels of data protection and compliance.

What are Confidential Containers?

Confidential Containers in ARO leverage an innovative architecture that combines the flexibility of containerization with the security of confidential computing. This technology creates an environment with a strong security posture where sensitive applications can run with enhanced protection, safeguarding data, and code from unauthorized access.

As shown in the diagram, Confidential Containers in ARO utilize a unique architecture that separates confidential workloads from the main cluster. Let us explore how this system works:

Separate Confidential Environment: Unlike traditional containers that run directly on the ARO cluster nodes, confidential containers operate in a separate Confidential Virtual Machine (CVM), called a peer pod. This separation provides hardware-level isolation for sensitive workloads.
Red Hat OpenShift Integration: The ARO cluster runs the Red Hat OpenShift sandboxed containers Operator that manages the lifecycle of confidential containers. On each ARO worker node, a Kata runtime container uses a cloud-api-adapter to create and manage peer pods on confidential virtual machines (VMs).
Secure Communication: A tunnel is established between the Pod's Network Namespace on the ARO worker node and the peer pod, providing more secure communication between the main cluster and the confidential workload.
Attestation and Integrity: Before deploying a container image to the peer pod, a remote attestation agent initiates an attestation process. This verifies the integrity of the container image and the confidential environment, so that only trusted code is executed.
Confidential Execution: Within the peer pod, the container runs in a Trusted Execution Environment (TEE), which provides encrypted memory enclaves. This helps data remain protected not just at rest and in transit, but also during processing.
Zero-Trust Security Model: The architecture implements a zero-trust approach, protecting against unauthorized access from cloud operators and cluster administrators. Only verified and authenticated entities can interact with the confidential container. SREs cannot view/access the containers unless they've been verified.

Performance and Compatibility: Despite the advanced security measures, the system is optimized to minimize performance overhead. It maintains compatibility with standard container images, allowing organizations to secure their existing containerized applications with minimal modifications.

This architecture provides several key benefits:

Hardware-level Isolation: Leveraging Azure Confidential Computing infrastructure, confidential containers achieve a level of isolation not possible with software-based solutions alone.
Data Protection: Encryption of data in use, at rest, and in transit provides comprehensive protection for sensitive information.
Flexible Deployment: Organizations can run both regular and confidential containers on the same ARO cluster, applying enhanced security only where needed.
Scalability: The solution is designed to scale across ARO clusters, enabling secure deployments that can grow with organizational needs.

By separating confidential workloads into peer pods on dedicated CVMs, ARO provides a robust solution for running sensitive applications in the cloud. This approach combines the benefits of containerization and orchestration with the stringent security requirements of confidential computing, opening new possibilities for organizations dealing with sensitive data or operating in regulated industries.

Confidential Containers on ARO Use Cases

The applications for Confidential Containers span various industries. Here are some potential use cases that highlight the versatility of this technology:

Regulatory Compliance Exploration: Healthcare providers could explore using Confidential Containers to process and store patient data in compliance with HIPAA regulations. The hardware-level encryption and isolation helps keep sensitive medical information confidential, even in shared cloud environments.
Secure AI/ML Model Training: Financial institutions might investigate harnessing Confidential Containers to train sophisticated fraud detection models using sensitive customer transaction data. The security-enhanced environment could allow these organizations to utilize their valuable data assets for AI/ML purposes while mitigating the risk of exposing individual customer information.
Future Development: Secure DevOps Environments: As part of our roadmap for Confidential Containers on ARO, we are exploring the potential to enhance security throughout the software development lifecycle. In future releases, we aim to enable software companies to use Confidential Containers to isolate various stages of their CI/CD pipeline. This upcoming feature could provide robust security from initial development through to production deployment to help protect code and data at every step. While not available in the current public preview, this use case represents an exciting direction for the evolution of Confidential Containers on ARO.

Availability and Pricing

During this preview period, we are offering Confidential Containers on ARO at no additional cost beyond Azure compute and ARO charges. This means you can start exploring and testing Confidential Containers without incurring extra fees for the feature itself.

Regional Availability

Please note that availability may be subject to change as we continue to expand and refine this public preview. We recommend checking the Azure portal or documentation for the most up-to-date information on availability information on the Azure product by region page.

Exploring the Public Preview

To begin your journey with Confidential Containers on ARO, follow these steps:

Access your Azure Red Hat OpenShift cluster through Red Hat Hybrid Cloud Console
Navigate to our comprehensive documentation, which provides step-by-step guidance on enabling and configuring Confidential Containers.
Start your exploration in non-production environments to familiarize yourself with the features and capabilities without risking disruption to critical workloads.
Experiment with different workloads and configurations to understand how Confidential Containers can enhance your specific use cases.

Remember, as a Public Preview feature, Confidential Containers is designed for testing and evaluation. We advise against deploying them for production workloads or relying on them for actual data security at this stage. For more detailed information, please visit the Microsoft Confidential Containers on Azure Red Hat OpenShift official documentation found here.

See It in Action

Experience the power of Confidential Containers on ARO firsthand at these upcoming industry events:

KubeCon North America (November 12-15, 2024, Salt Lake City, UT):
Visit both the Microsoft OSS Communities booth #C4 and Red Hat booths for live demonstrations of Confidential Containers.
Engage with our experts to discuss how this technology can address your specific security challenges.
Microsoft Ignite (November 15-17, 2024, Chicago, IL):
Head to the Red Hat booth for an immersive demo of Confidential Containers running on Azure Red Hat OpenShift.
Witness how this technology secures AI workloads using high-performance GPUs, displaying both its security prowess and performance capabilities.
Don’t miss BRK228- What’s new in Linux: How we’re collaborating to help shape its future for more details on this announcement

Do not miss these opportunities to see Confidential Containers in action and explore how they could revolutionize your approach to cloud security.

Learn More

We encourage you to explore the possibilities of Confidential Containers on ARO. Documentation is available below from both Red Hat and Microsoft, providing information on the public preview implementation and technical specifications. These resources will be invaluable as you investigate how this public might integrate into future cloud security strategies.

Explore the potential future of cloud security with the Confidential Containers public preview on Azure Red Hat OpenShift. In an era where data protection is paramount, this technology offers a glimpse into innovative security measures that modern businesses may leverage in the future. Start your exploration of this innovative solution today!

Resources: