Hi everyone.
Following is today's meeting summary:

Use case #1: K8S CI/CD pipeline with kata containers


  • The team is still working to define the goal and scope.

  • We should have updates for the next meeting 


Use case #2: Confidential computing 


  • Samuel presented slides

  • We got good feedback from RH, IBM and Intel, still pending feedback from AMD

  • Discussing the topic of service mesh and encrypted containers - what happens when someone pushes a sidecar into the pod? What happens if that sidecar just prints all the memory to somewhere else :-)...

  • Idea would be to encrypt the side car as well, not guaranteeing what’s inside but yes regarding what you are getting

  • This does not violate our threat model which is focusing on knowing exactly what we are running

  • Christophe discussed the topic of the performance cost of using encrypted memory such as extra disk space - the user should decide if he wants to encrypted everything or only the top layers

  • Smauel pointed out that encrypting only the upper layers would not be strong enough - If your workload runs on a fedora and you only encrypted your workload, the fedora could have been hacked and added a bunch of backdoors 

  • For IBM the goal is to work with full encryption before talking about sharing

  • The SEV also has a number of issues regarding density as it is so maybe the additional sharing would not save much - max 512 VMs

  • Note that we are talking about SEV per pod (with a kata VM behind)

  • We discussed virtio-fs and DAX and the fact that it can’t work with encrypted memory since you don’t want anything to be shared 

  • We want to expand the problem statement and scope not only to fully encrypted images but also signed images 


Use case #3: Performance isolation (Tao) 


  • Working on best practices for the networking path

  • Later on will do the same for the IO path 

  • The question is what and how to do in the kata code (for now it’s hacks on the side) - they would like to see an open source implementation for this


Action items:


  • Samuel to share his slides

  • Tao will share a slide on the next meeting helping understand the interface the performance use case are focusing on 



Meeting notes:

https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#

Thanks.