Show HN: Constellation – An always encrypted Kubernetes engine

[flxflx]

Hey HN,

my colleagues and I have been working on Constellation for 1.5+ years. We open sourced it today under AGPLv3. It's a standalone Kubernetes engine/distribution that operations-wise is very much vanilla K8s (v1.24). Security-wise, it comes with some new concepts: It's designed to shield K8s clusters as a whole from the cloud. The goal is that not even the cloud provider and its employees can access any data in a cluster. Constellation basically ensures that all nodes in a cluster (1) run inside verified "Confidential VMs" and (2) encrypt all network traffic and storage.

Confidential VMs are VMs that have the AMD SEV feature. Intel TDX and Arm Realms are similar. CVMs protect workloads against a compromised host and malicious admins. For this, CVMs remain encrypted at runtime in memory, are strongly isolated, and have cool remote attestation capabilities. This is also often referred to as "confidential computing".

CVMs are currently available in Azure and GCP. Constellation comes with a Fedora CoreOS-based node image that is optimized for CVMs and protected with Sigstore. More info in the README/docs.

What do you think?

-Felix

[goncalo-r]

Really cool project!

Are there any downsides - for example performance or operational overhead - of using Constellation over vanilla K8s?

[flxflx]

Thanks! There is some performance impact. How much depends on the workload. The impact comes from network, storage, and memory encryption. For most workloads the overhead should be rather small. We have a performance comparison with AKS and GKE: https://docs.edgeless.systems/constellation/overview/perform...

[styren]

Interesting project! What is your target audience for something like this?

[flxflx]

Thanks! Target audiences are: people running sensitive clusters on-prem for security reasons and wanting to move to the cloud. There's also regulation in Europe in the eHealth space that requires runtime encryption. Ultimately, I believe that keeping workloads always encrypted and verifiable can be valuable in many scenarios.

[jonathan_re]

congrats on the launch!