--- title: "Deploy Confidential AI with Fortanix and Rafay" slug: "deploy-confidential-ai-with-fortanix-and-rafay-1" updated: 2026-07-31T02:05:59Z published: 2026-07-31T02:05:59Z canonical: "support.fortanix.com/deploy-confidential-ai-with-fortanix-and-rafay-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy Confidential AI with Fortanix and Rafay ## 1.0 Introduction This article describes how to deploy Confidential AI workloads using **Fortanix Confidential Computing Manager (CCM)**, **Fortanix Data Security Manager (DSM)**, and **Rafay**. It combines the Fortanix attestation and key management capabilities with Rafay's infrastructure orchestration to securely deploy and run AI models and applications in trusted execution environments (TEEs). [full_demo.mp4](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/full_demo.mp4) ### 1.1 Core Components - Fortanix CCM is used for attestation and policy enforcement. - Fortanix DSM is used for key management and Secure Key Release (SKR). - Rafay is used to orchestrate Confidential AI deployments. ## 2.0 Prerequisites Before deploying Confidential AI workloads, configure the required Fortanix services and prepare the platform. The following prerequisites establish the trust relationship between Fortanix CCM and Fortanix DSM and prepare the infrastructure for confidential computing. - Access to Fortanix CCM. - Access to Fortanix DSM. - A Rafay account for Confidential AI orchestration. - A platform with an AMD SEV-SNP or Intel TDX-capable CPU with an NVIDIA GPU. ### 2.1 Configure Fortanix CCM Fortanix CCM is available as a solution within the Fortanix Armor platform. CCM enables you to manage confidential computing workloads, applications, and infrastructure through a centralized Fortanix Armor platform. Configure your Fortanix CCM environment as described in [*Configure Fortanix CCM*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1#40-configure-fortanix-ccm). **Secure Key Release (SKR)** enables Fortanix DSM to release cryptographic keys only after Fortanix CCM verifies that the Confidential Virtual Machine (CVM) is running in a trusted and attested environment. As part of this workflow, download the Zone CA certificate from Fortanix CCM and upload it to Fortanix DSM to establish trust between the two services. ### 2.2 Configure Fortanix DSM Fortanix DSM securely generates, stores, and manages cryptographic keys, certificates, and other secrets, such as passwords, API keys, and tokens. Configure your Fortanix DSM environment as described in [*Configure Fortanix DSM for Secure Key Release*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1#50-configure-fortanix-dsm). To enable **Secure Key Release**, upload the Zone CA certificate downloaded from Fortanix CCM when configuring Fortanix DSM. This allows DSM to verify attestation information from CCM and release cryptographic keys only to trusted Confidential VM workloads. ### 2.3 Create a Key Create the encryption key that will be used to encrypt and protect the model. This key is released only to trusted CVM workloads through Secure Key Release after successful attestation. *For detailed instructions, refer to* [*Encrypt and Decrypt the Model*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-ccm#70-encrypt-and-decrypt-the-model-using-sqdsm). ### 2.4 Configure the Platform for Confidential Computing - To enroll a compute node on a bare-metal AMD SEV-SNP platform, refer to [*Prerequisites*](/v1/docs/enroll-a-compute-node-bare-metal-amd-sev-snp-1#21-prerequisites). - To enroll a compute node on a bare-metal Intel TDX platform, refer to [*Prerequisites*](/v1/docs/enroll-a-compute-node-bare-metal-intel-tdx-1#21-prerequisites). ## 3.0 Deploy Confidential AI Using Confidential VM This section describes how to deploy Confidential AI workloads as a Confidential VM. For example, a proprietary AI model and its inference application can be packaged into a virtual machine and converted into a Confidential VM before deployment. The converted CVM is attested by Fortanix CCM, receives cryptographic keys from Fortanix DSM through Secure Key Release, and is deployed securely using Rafay. ### 3.1 Generate Join Token The **Fortanix Node Agent** software enables registration of compute nodes to CCM when installed on a compute node. It assists in the verification of Hardware and Platform software running on compute nodes and application attestation. When deploying through Rafay, the Fortanix Node Agent is installed and registered automatically using the Fortanix CCM Join Token. The Fortanix Node Agent runs on the compute node hosting the Confidential VM. During attestation, it communicates with Fortanix CCM, verifies the platform, and provides the application certificate to the Confidential VM after successful attestation. Generate a Fortanix CCM Join Token. The Join Token is required when configuring the Confidential VM SKU in Rafay to enable automatic registration of the Fortanix Node Agent. For detailed instructions, refer to [*Generate Join Token*](/v1/docs/enroll-a-compute-node-bare-metal-amd-sev-snp-1#30-generating-join-token). ### 3.2 Create the Confidential VM ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/create-vm.png) **Figure 1: Create CVM** Create and prepare the Confidential VM image, calculate its measurements, and prepare it for deployment by following the procedures in the referenced documentation below: 1. Prepare the Build Machine that will be used to generate the CVM image. *For detailed instructions, refer to* [*Prepare the Build Machine*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1#60-prepare-the-build-machine). 2. Containerize the application together with the encrypted model. The application must use CCM-issued attestation certificates to authenticate with DSM and decrypt the model at runtime inside the CVM. *For more information, refer to* [*Containerize the Model*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1#80-containerize-the-model). 3. Create a Confidential VM image for the target platform. 1. [*Create a CVM Image for AMD SEV-SNP*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1#90-create-a-confidential-vm-image). 2. [*Create a CVM Image for Intel TDX*](/v1/docs/deploy-confidential-vm-applications-on-intel-tdx-using-fortanix-1#90-create-a-confidential-vm-image). 4. Calculate image measurements required for attestation. 1. [*Calculate Image Measurements for AMD SEV-SNP*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1#100-calculate-image-measurements). 2. [*Calculate Image Measurements for Intel TDX*](/v1/docs/deploy-confidential-vm-applications-on-intel-tdx-using-fortanix-1#100-calculate-image-measurements). ### 3.3 Register an Application Build in Fortanix CCM Register an application build in CCM using the Confidential VM image measurements. The application build registers the Confidential VM image with CCM and enables the Confidential VM to be attested during deployment. #### 3.3.1 Add Application in CCM *For detailed instructions on creating an AMD SEV-SNP application, refer to* [*Add AMD Application*](/v1/docs/users-guide-add-and-edit-an-application-1#80-add-amd-sevsnp-application). *For detailed instructions on creating an Intel TDX application, refer to* [*Add Intel TDX Application*](/v1/docs/users-guide-add-and-edit-an-application-1#70-intel-tdxapplication). #### 3.3.2 Register an Application Build in CCM *For detailed instructions on creating an AMD SEV-SNP application build, refer to* [*Create Image*](/v1/docs/users-guide-create-an-image-1#35-amd-sevsnp-applications). *For detailed instructions on creating an Intel TDX application build, refer to* [*Create Image*](/v1/docs/users-guide-create-an-image-1#34-intel-tdx-applications). After the application build is created, proceed to Section 3.4: Configure Rafay to deploy the Confidential VM containing the AI application and encrypted model. ### 3.4 Attestation and Secure Key Release Flow ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Fortanix with Rafay Integration.jpg) **Figure 2: Fortanix Attestation and Secure Key Release flow** When the Confidential VM is deployed, the Fortanix Attestation Client collects attestation evidence and sends it to the Fortanix Node Agent. The Node Agent submits the attestation request to Fortanix CCM. Upon successful verification, Fortanix CCM issues an application certificate through the Node Agent to the Confidential VM. The Confidential VM then authenticates with Fortanix DSM to obtain the encryption key through SKR. ### 3.5 Configure Rafay Controller After completing the Fortanix configuration and registering the Confidential VM image in Fortanix CCM, configure Rafay to deploy the Confidential VM. #### 3.5.1 Create a Rafay Organization Create a Rafay organization to manage the Confidential VM deployment. *For detailed instructions, refer to the* [*Rafay official documentation*](https://docs.rafay.co/providers/operations_console/). #### 3.5.2 Onboard a Compute Node (Server) > [!NOTE] > NOTE > > Before onboarding the compute node into Rafay: > > - Ensure that Confidential Computing (CC) mode is disabled. > - Ensure that the GPU is not bound to the `vfio-pci` driver, as Rafay requires access to the GPU through `nvidia-smi` to discover GPU information during onboarding. > - After the server has been successfully onboarded, **enable Confidential Computing mode** and **bind the GPU to the** `vfio-pci `**driver** before deploying Confidential VM workloads. > - Ensure that AMD SEV-SNP or Intel TDX is enabled and that the server meets the platform prerequisites described in [*Section 2.4: Configure the Platform for Confidential Computing*](/v1/docs/deploy-confidential-ai-with-fortanix-and-rafay-1#24-configure-the-platform-for-confidential-computing). Onboard the physical compute node (server) that will host the Confidential VM into Rafay. After the server is successfully onboarded and available, it can be used to deploy Confidential VM workloads. *For detailed instructions, refer to the* [*Rafay official documentation*](https://docs.rafay.co/aiml/gpupaas/csp/ops_nodeonboarding/). #### 3.5.3 Create a Confidential VM SKU (NCP/Admin) Create a Confidential VM SKU in Rafay by associating the Confidential VM image with the corresponding Fortanix CCM application. *For detailed instructions, refer to the* [*Rafay official documentation*](https://docs.rafay.co/aiml/gpupaas/administration/compute_profile/). When configuring the SKU, specify the Fortanix CCM connection details, including the **Fortanix CCM Endpoint**, **Application Domain**, and **Join Token**. Rafay uses the Join Token to automatically install and register the Fortanix Node Agent with Fortanix CCM on the compute node. #### 3.5.4 Deploy the Confidential VM (End User) Deploy the Confidential VM by selecting the appropriate Confidential VM SKU from the Rafay catalog. *For detailed instructions, refer to the* [*Rafay official documentation*](https://docs.rafay.co/aiml/gpupaas/users/vm/). #### 3.5.5 Verify the Confidential VM Deployment Verify that the Confidential VM deployment succeeded in Rafay. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image (125).png) **Figure 3: CVM deployed in rafay** ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image (126).png) **Figure 4: Rafay audit logs** #### 3.5.6 Verify Application Attestation After the Confidential VM is successfully deployed using Rafay, verify that the Confidential VM was successfully attested and that an application certificate was generated. 1. In the Fortanix CCM UI, navigate to the application details page. 2. Verify that the audit log contains a successful `REQUEST_APP_CERTIFICATE` event, indicating that the application certificate was generated following successful attestation. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/app-audit-logs.png) **Figure 5: Application audit logs** > [!NOTE] > NOTE > > Audit logs are available in the log management system configured for your Fortanix Armor deployment.