[CNCF LFX Proposal] KubeEdge Enable RuntimeClass and Confidential Containers on KubeEdge

### CNCF Project

KubeEdge

### Term

2026 Term 3 (Sep-Nov)

### Program Name

Enable RuntimeClass and Confidential Containers on KubeEdge

### Program Description

## Description

KubeEdge does not yet provide complete RuntimeClass support for workloads running on edge nodes. This prevents users from selecting alternative runtime handlers such as Kata Containers and limits the use of confidential or hardware-isolated workloads at the edge.

Kubernetes RuntimeClass provides a standard way for a Pod to select a runtime handler through `spec.runtimeClassName`. This project will implement and validate the missing end-to-end RuntimeClass workflow in KubeEdge, covering resource synchronization, edge-side caching, runtime handler resolution, error handling, restart recovery, and cloud-edge reconnection.

The first stage will validate RuntimeClass with Kata Containers in a reproducible KubeEdge environment. After the basic workflow is completed, the project will integrate and validate a Confidential Containers runtime. Intel TDX or another supported confidential computing platform may be used when suitable infrastructure and community support are available.

The project focuses on RuntimeClass and confidential workload enablement. It does not require developing a new container runtime, rebuilding the Confidential Containers stack, or implementing a complete attestation service.

## Expected Outcome

* Study the upstream Kubernetes RuntimeClass workflow and identify missing KubeEdge integration points.
* Build a reproducible KubeEdge and Kata Containers test environment.
* Submit a design proposal covering RuntimeClass synchronization, edge caching, handler resolution, compatibility, failure handling, and recovery.
* Synchronize required RuntimeClass resources from the Kubernetes control plane to edge nodes.
* Enable edge Pods to use `spec.runtimeClassName`.
* Ensure Edged selects the corresponding CRI runtime handler.
* Handle missing, invalid, or unavailable RuntimeClass handlers with clear status and events.
* Preserve RuntimeClass behavior after EdgeCore restart and temporary cloud-edge disconnection.
* Validate at least one alternative runtime using Kata Containers.
* Migrate or add the manifests, configuration, RBAC, and certificate settings required by the selected runtime.
* Add unit tests and end-to-end tests for synchronization, runtime selection, failures, restart, and reconnection.
* Provide deployment manifests, validation scripts, architecture documentation, and troubleshooting guidance.
* Validate a Confidential Containers workload when suitable infrastructure is available.
* Optional: validate remote attestation and protected secret delivery on Intel TDX or another supported platform.
* Publish a technical blog or user guide for secure edge workloads on KubeEdge.

### Technologies

Go, Kubernetes, KubeEdge, RuntimeClass, Containerd, Container Runtime Interface, Kata Containers, Confidential Containers, Linux, Confidential Computing

### Skills same as Technologies?

- [x] Yes, the required skills are the same as the technologies listed above.

### Required/Desirable Skills

_No response_

### Mentors

Hongbing Zhang | @HongbingZhang | hongbing.zhang@daocloud.io | hongbing.zhang
Shelley Bao | @Shelley-BaoYue | baoyue2@huawei.com | yue

### Upstream Issue URL

https://github.com/kubeedge/kubeedge/issues/7106

### Application Prerequisites

- [x] Resume
- [x] Cover Letter
- [ ] School Enrollment Verification
- [ ] Participation Permission from school or employer
- [ ] Coding Challenge
- [ ] Custom Prerequisite (fill in details below)

### Coding Challenge URL

_No response_

### Custom Prerequisite Name

_No response_

### Custom Prerequisite Description

_No response_

### Custom Prerequisite — File Upload

- [ ] Yes — completion of this task requires the mentee to submit a file.

---
**LFX program:** [CNCF - KubeEdge: Enable RuntimeClass and Confidential Containers on KubeEdge (2026 Term 3)](https://mentorship.lfx.linuxfoundation.org/project/ef5b6ae6-99be-42e0-aeae-897684b0e9c8)

Start with the linked upstream KubeEdge issue and the upstream Kubernetes RuntimeClass workflow, then identify the KubeEdge integration points around Edged, resource synchronization, edge caching, and CRI handler resolution. Define the design and validate it with a reproducible Kata Containers environment, covering failures, restart recovery, reconnection, manifests, and tests before attempting Confidential Containers.

Written by the indexing model from the issue text.