A Confidential Cluster is a Kubernetes cluster designed so that the cloud or infrastructure operator — including hypervisor administrators, datacenter staff, and anyone who can access the underlying hardware — is entirely outside the trusted computing base. It achieves this by running every Kubernetes node, including control plane nodes, as a Confidential VM, and by extending the confidential boundary to cover not just individual workloads but the cluster’s network traffic, persistent storage, and control plane state. The goal is that a workload owner can cryptographically verify the entire cluster before trusting it, and that no privileged party outside the cluster’s own CVMs can read or tamper with workload data, cluster secrets, or etcd contents.
Control Groups (cgroups) is a Linux kernel mechanism, introduced in 2.6.24 (2008), that organises processes into a hierarchy of named groups and uses controllers to account for and limit each group’s consumption of CPU time, memory, I/O bandwidth, and process count. Every container runtime in existence — Docker, containerd, CRI-O, Podman — uses cgroups to enforce the resource limits declared in a container spec (--memory, --cpus, requests.memory, limits.cpu). Every systemd service on a modern Linux system runs in its own cgroup slice. Without cgroups, a container or service could consume all available memory, CPU, or file descriptors, starving other workloads on the same host. The current production version is cgroups v2 (also written cgroupv2, unified hierarchy), stable since kernel 4.5 and the default on all major distributions since RHEL 9, Ubuntu 21.10, and Fedora 31.
cert-manager is a CNCF graduated project that brings PKI lifecycle management into Kubernetes as a first-class controller, eliminating the manual processes — CSR generation, CA submission, secret rotation, renewal tracking — that cause certificate-related outages in clusters that manage TLS manually. Its premise is that X.509 certificates should be declared as Kubernetes resources with the same GitOps-friendly, reconciliation-driven lifecycle as any other workload configuration: an operator declares the desired certificate, cert-manager continuously ensures that a valid, non-expired certificate matching that declaration exists and is stored in a Kubernetes Secret, and renews it automatically before expiry. The default renewal threshold is two-thirds of the certificate’s validity period, so a certificate with a 90-day lifetime is renewed at 60 days without operator intervention.
