[Feature] Support Confidential Compute workloads using Intel SGX enclaves on Azure Linux as the AKS container host operating system
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
We have a Confidential Computing workload that uses the Intel Software Guard Extensions (SGX). We run the workload on AKS clusters with a node pool backed by Confidential Compute 'DC' type VMs. We use the [Confidential Computing add-on for AKS](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-addon) to add the Intel SGX driver to the Linux kernel running on the AKS container host. This is currently available only for the Ubuntu version 18.04. This operating system has a large footprint and is already dated. We are evaluating Azure Linux as the base operating system image for AKS cluster nodes. This Confidential Computing add-on for AKS does not currently appear to support this AKS container host operating system. The lack of Confidential Computing support blocks us from changing to Azure Linux.
**Describe the solution you'd like**
Ideally, the Azure Linux AKS container host image contains Intel SGX device driver out of the box, node initialization detects the DC type VM and inserts the kernel module automatically. The SGX devices are available to pods running on that node. I don't mind installing the [Intel Device Plugins Operator](https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/operator/README.html) to provide the Kubernetes-layer support. This solution would not require the AKS add-on.
**Describe alternatives you've considered**
Alternatively, support Azure Linux in the Confidential Computing add-on for AKS.
**Additional context**
I found an article from 2022 that CBL-Mariner now allows building and installing kernel support for Intel SGX,. Even if this is possible to do, we would like to avoid creating and maintaining custom AKS container host images.
Contributor guide
Assessment
This issue has not been assessed yet.