<p>I recently learned that Intel SGX processors are able to encrypt enclaves for persistent storage to disk. After this, I started to write my first SGX apps and now I am wondering if there is any opportunity to deploy them on Kubernetes?</p>

<p>Your question can be split into multiple steps:</p>
<ol>
<li>Having a Kubernetes cluster that exposes SGX to your apps</li>
</ol>
<p>You'll need Kubernetes nodes with SGX-capable CPUs. The way Kubernetes handles &quot;special devices&quot; as SGX is through <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/" rel="nofollow noreferrer">Device Plugins</a>. Multiple SGX device plugins exist for Kubernetes:</p>
<ul>
<li>Intel: <a href="https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/sgx_plugin/README.html" rel="nofollow noreferrer">https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/sgx_plugin/README.html</a></li>
<li>Azure: <a href="https://github.com/Azure/aks-engine/blob/master/docs/topics/sgx.md" rel="nofollow noreferrer">https://github.com/Azure/aks-engine/blob/master/docs/topics/sgx.md</a></li>
</ul>
<p>Once you've equipped a node with such a plugin, they provide you with a mechanism to expose the SGX device to your containers.</p>
<ol start="2">
<li>Building SGX apps for Kubernetes and accessing SGX resources</li>
</ol>
<p>You'll need to bundle your enclave into a container and write the Kubernetes resource definitions. The most common language for Cloud Native Applications is probably Go. There is a great example for a confidential microservice application based on the EdgelessRT Go runtime and SDK(link), which uses the Azure device plugin for exposing SGX to the containers: <a href="https://github.com/edgelesssys/emojivoto" rel="nofollow noreferrer">https://github.com/edgelesssys/emojivoto</a></p>
<ol start="3">
<li>Managing attestation, sealing, etc. for your SGX app</li>
</ol>
<p>Probably the most interesting point when deploying SGX apps on Kubernetes is SGX-specific orchestration. While Kubernetes handles all the general orchestration, SGX-specific task as remote-attestation, migration, and secrets management of your deployments need to be handled separately. The Marblerun service mesh addresses those tasks, namely:</p>
<ul>
<li>Attestation of your services: <a href="https://marblerun.sh/docs/features/attestation/" rel="nofollow noreferrer">https://marblerun.sh/docs/features/attestation/</a></li>
<li>Migration and Recovery: <a href="https://marblerun.sh/docs/features/recovery/" rel="nofollow noreferrer">https://marblerun.sh/docs/features/recovery/</a></li>
<li>Secrets Management:
<a href="https://marblerun.sh/docs/features/secrets-management/" rel="nofollow noreferrer">https://marblerun.sh/docs/features/secrets-management/</a></li>
</ul>
