You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,8 +11,8 @@ who_is_this_for: This Learning Path is for software developers who want to under
11
11
12
12
learning_objectives:
13
13
- Overview of Confidential Containers
14
-
- Understand how Trustee services are used for CCA realm attestation to unlock the confidential processing of data.
15
-
- Use an encrypted image to deploy a Confidential Containers in a CCA realm on an Armv9-A AEM Base Fixed Virtual Platform (FVP) that has support for RME extensions.
14
+
- Understand how Trustee services are used for CCA attestation to unlock the confidential processing of data.
15
+
- Use an encrypted image to deploy a Confidential Container in a CCA realm on an Armv9-A AEM Base Fixed Virtual Platform (FVP) that has support for RME extensions.
16
16
17
17
prerequisites:
18
18
- An AArch64 or x86_64 computer running Linux or macOS; you can use cloud instances - see the [Arm cloud service providers](/learning-paths/servers-and-cloud-computing/csp/)
Copy file name to clipboardExpand all lines: content/learning-paths/servers-and-cloud-computing/cca-kata/cca-kata.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,9 +16,9 @@ working to enable cloud native confidential computing by leveraging Trusted Exec
16
16
17
17
## Design overview
18
18
19
-
Confidential computing projects are largely defined by what is inside the enclave and what is not.
20
-
For Confidential Containers, the enclave contains the workload pod and helper processes and daemons that facilitate the workload pod.
21
-
Everything else, including the hypervisor, other pods, and the control plane, is outside of the enclave and untrusted.
19
+
Confidential computing projects are largely defined by what is inside the Trusted Execution Environment (TEE) and what is not.
20
+
For Confidential Containers, the TEE contains the workload pod and helper processes and daemons that facilitate the workload pod.
21
+
Everything else, including the hypervisor, other pods, and the control plane, is outside of the TEE and untrusted.
22
22
23
23
### Kata Containers
24
24
@@ -46,7 +46,7 @@ This is a simplified diagram showing the interaction of **containerd**, the **ny
46
46
Confidential Containers also provides components inside the guest and elsewhere to facilitate attestation.
47
47
Attestation is a crucial part of confidential computing and a direct requirement of many guest operations.
48
48
For example, to unpack an encrypted container image, the guest must retrieve a secret key.
49
-
Inside the guest the **confidential-data-hub** and **attestation-agent** handle operations involving secrets and attestation.
49
+
Inside the guest the **Confidential Data Hub (CDH)** and **Attestation Agent (AA)** handle operations involving secrets and attestation.
50
50
Again, these components are beyond the scope of traditional Kata deployments and are located in the ["guest components"](https://github.com/confidential-containers/guest-components) repository.
51
51
52
52
The CDH and AA use the KBS Protocol to communicate with an external, trusted entity.
0 commit comments