Fortanix Confidential Container on Azure Kubernetes Service

Introduction

In this article, we will describe the steps for Running Confidential Containers with Fortanix Runtime Encryption on Microsoft Azure Kubernetes Service (AKS).

Steps to Run Confidential Container on AKS

1. Create an Azure AKS cluster with SGX support using Azure CLI/Portal.
   For more details refer to the URL: https://github.com/Azure/aks-engine/blob/master/docs/topics/sgx.md#deploy-a-kubernetes-cluster.
    
2. Create a Confidential Container image for your container using the Fortnaix Enclave Manager Portal. You can use the Enclave Manager Console or REST APIs to create a confidential container image for your existing container.
   To create a Confidential container image using the Enclave Manager Console refer to the following URLs:
   • Create an Image: https://support.fortanix.com/hc/en-us/articles/360043529411-User-s-Guide-
   • Enclave Manager User Guide: https://support.fortanix.com/hc/en-us/sections/360008695591-User-Guide 
    
3. Configure the container registry on Fortanix Enclave Manager which stores the container images.
   For more details refer to the URL: https://support.fortanix.com/hc/en-us/articles/360048967971-User-s-Guide-Image-Registry#SettingMultipleAzureContainerRegistries.   
    
4. Run the Confidential Computing container image on the Azure AKS cluster. Following is a sample YAML file to run Confidential containers.
   For More details on scheduling Confidential Containers on Azure AKS refer to the URL: https://github.com/Azure/aks-engine/blob/master/docs/topics/sgx.md#scheduling-pods-to-tee-enabled-hardware.  
   Following is a sample YAML to run an example application on AKS:

   apiVersion: v1 
   kind: Pod 
   metadata: 
     name: app-sgx 
     labels: 
       app: app-sgx 
   spec: 
     restartPolicy: Never 
     containers: 
     - name: app-sgx 
       image: <banne01/convert:flask-sgx-dcap> 
       volumeMounts: 
       - name: dev-sgx 
         mountPath: /dev/sgx/enclave 
       securityContext: 
         privileged: true 
       ports: 
       - containerPort: 5000 
         name: http 
         protocol: TCP 
     volumes: 
     - name: dev-sgx 
       hostPath: 
         path: /dev/sgx/enclave 
         type: CharDevice