With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves,
said Anuj Jaiswal, chief product officer at Fortanix, following the company’s rollout of support for Confidential Containers in its Confidential AI platform. The integration links Kubernetes workload attestation directly to encryption-key release, permitting workloads that clear security policies to decrypt sensitive data and models inside hardware-based trusted execution environments.
How Fortanix Pairs Kubernetes Workloads with Trusted Hardware
The platform architecture connects Kubernetes pod attestation to two core services managed by Fortanix. The Confidential Computing Manager verifies the environment, while the Data Security Manager releases encryption keys only after verification succeeds. According to technical documentation, the system can perform composite attestation, checking the processor and graphics processing unit together, though that capability relies on configuration.
The open-source Confidential Containers project, a Cloud Native Computing Foundation initiative that reached Incubating status in July 2026, shifts image pulling and unpacking directly into the confidential guest. An Attestation Agent collects hardware evidence while a Confidential Data Hub requests secrets. If attestation fails, keys remain inside the Data Security Manager, blocking the workload from decrypting protected models or data.
Intel TDX environments require specific GPU settings
Deployment guides for Intel TDX environments offer distinct GPU settings. A Required setting forces the Confidential Computing Manager to validate GPU evidence through NVIDIA’s attestation service, whereas an Ignored setting checks only that evidence is present and disregards the result. The Fortanix CoCo Helm chart does not configure host firmware or kernel settings, so administrators must complete those steps in advance.
Similar conditional secret delivery mechanisms exist within open-source Trustee components. Trustee separates evidence appraisal from resource authorization, using an attestation service to compare platform claims against reference values before a Key Broker Service applies user-defined policies. Microsoft provides another alternative via Azure Secure Key Release, which integrates Key Vault Premium and Managed HSM with Azure Attestation to release exportable keys rather than secrets or certificates.
Trust models leave some security gaps
The trust model requires administrators to trust the guest kernel and helper processes sitting inside the trust boundary. Hardware measurements typically cover the guest environment while container verification operates as a separate stage, and enclave applications can still expose dangerous external interfaces. Neither attestation nor the underlying architecture provides denial-of-service protection, guards against hardware side channels, or guarantees that an AI application handles data safely.
Recent release notes for the Confidential Computing Manager added application registration for AMD Secure Encrypted Virtualization-Secure Nested Paging and Intel Trust Domain Extensions. While Fortanix makes the integration available through its CoCo Helm chart and plans to release open-source plugins, the exact repositories and version numbers have not yet been disclosed.
Common Questions Regarding Confidential AI Integration
What specific hardware environments does the Fortanix integration support?
The platform supports deployments utilizing AMD Secure Encrypted Virtualization-Secure Nested Paging and Intel Trust Domain Extensions, alongside GPU attestation configurations for NVIDIA hardware.
How does the system handle key release if hardware attestation fails?
Keys remain securely stored within the Data Security Manager if the Confidential Computing Manager fails to verify the execution environment, preventing the workload from accessing protected models or data.
What is the role of the Confidential Computing Manager in this architecture?
The Confidential Computing Manager performs hardware-rooted attestation, verifying both the processor and graphics processing unit before authorizing the release of decryption keys.
Does the Fortanix Helm chart configure underlying host settings automatically?
No, the deployment guide notes that administrators must configure host firmware and kernel settings independently before installing the CoCo Helm chart.
Keep reading