Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Deploy Confidential Containers with NVIDIA GPU Operator
*******************************************************

This page describes how to deploy Confidential Containers using the NVIDIA GPU Operator.
For an overview of Confidential Containers, refer to :ref:`early-access-gpu-operator-confidential-containers-kata`.
For an overview of Confidential Containers, refer to :ref:`overview`.

.. note::

Expand Down
67 changes: 67 additions & 0 deletions confidential-containers/confidential-containers.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
.. _early-access-gpu-operator-confidential-containers-kata:

.. license-header
SPDX-FileCopyrightText: Copyright (c) 2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

.. headings # #, * *, =, -, ^, "

.. _confidential-containers-platform-support:

################
Platform Support
################

Refer to the *Confidential Computing Deployment Guide* at the https://docs.nvidia.com/confidential-computing website for information about supported NVIDIA GPUs, such as the NVIDIA Hopper H100, and specifically to https://docs.nvidia.com/cc-deployment-guide-snp.pdf for setup specific to AMD SEV-SNP machines.

The following topics in the deployment guide apply to a cloud-native environment:

* Hardware selection and initial hardware configuration, such as BIOS settings.
* Host operating system selection, initial configuration, and validation.

When following the cloud-native sections in above linked deployment guide, use Ubuntu 25.10 as host OS with its default kernel version and configuration.

The remaining configuration topics in the deployment guide do not apply to a cloud-native environment. NVIDIA GPU Operator performs the actions that are described in these topics.

For scope of this EA, the following is the validated support matrix. Any other combination has not been evaluated:

.. list-table::
:widths: 50 50
:header-rows: 1

* - Component
- Release
* - GPU Platform
- Hopper 100/200
* - GPU Driver
- R580 TRD 3
* - kata-containers/kata-containers
- 3.24.0
* - NVIDIA/gpu-operator
- v25.10.0 and higher

.. _limitations-and-restrictions:

Limitations and Restrictions
=============================

* Only the AMD platform using SEV-SNP is supported for Confidential Containers Early Access.
* GPUs are available to containers as a single GPU in passthrough mode only. Multi-GPU passthrough and vGPU are not supported.
* Support is limited to initial installation and configuration only. Upgrade and configuration of existing clusters to configure confidential computing is not supported.
* Support for confidential computing environments is limited to the implementation described on this page.
* NVIDIA supports the GPU Operator and confidential computing with the containerd runtime only.
* OpenShift is not supported in the Early Access release.
* NFD doesn't label all Confidential Container capable nodes as such automatically. In some cases, users must manually label nodes to deploy the NVIDIA Confidential Computing Manager for Kubernetes operand onto these nodes as described below.

Deployment and Configuration
=============================

For detailed instructions on deploying and configuring confidential containers with the NVIDIA GPU Operator, refer to the following guide:
29 changes: 29 additions & 0 deletions confidential-containers/index.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
.. license-header
SPDX-FileCopyrightText: Copyright (c) 2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

.. headings # #, * *, =, -, ^, "

.. toctree::
:caption: NVIDIA Confidential Computing
:titlesonly:
:hidden:

Overview <overview.rst>
Platform Support <confidential-containers.rst>
Deploy Confidential Containers with NVIDIA GPU Operator <confidential-containers-deploy.rst>


.. include:: overview.rst
Original file line number Diff line number Diff line change
@@ -1,26 +1,25 @@
.. _early-access-gpu-operator-confidential-containers-kata:
.. license-header
SPDX-FileCopyrightText: Copyright (c) 2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
SPDX-License-Identifier: Apache-2.0

****************************************************************************
Early Access: NVIDIA GPU Operator with Confidential Containers based on Kata
****************************************************************************
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

.. note::
http://www.apache.org/licenses/LICENSE-2.0

**Early Access Support**
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Early Access (EA) features are not supported in production environments and are not functionally complete. EA features provide a preview of upcoming product features, enabling customers to test functionality and provide feedback during the development process. These releases may not have complete documentation, and testing is limited. Additionally, API and architectural designs are not final and may change in the future.
.. headings # #, * *, =, -, ^, "

.. note::
Overview of NVIDIA Confidential Containers
==========================================

This EA release only supports the AMD platform using SEV-SNP.
Intel TDX support is planned for a future release.

.. _confidential-containers-nvidia-gpu-early-access:



Overview
========
.. _confidential-containers-overview:


NVIDIA GPUs power the training and deployment of Frontier Models—world-class Large Language Models (LLMs) that define the state of the art in AI reasoning and capability. As organizations adopt these models in regulated industries such as financial services, healthcare, and the public sector, protecting model intellectual property and sensitive user data becomes essential.
Expand Down Expand Up @@ -56,7 +55,6 @@ The following high-level flow and diagram show some fundamental concepts for CoC
* Kata agent starts containers in the Kata CVM.
* The confidential containers attestation agent exercises remote attestation based on the Remote ATtestation ProcedureS (RATS) model in concert with the Confidential Containers' Trustee solution. As part of this, the attestation agent transitions the GPU into the Ready state. Refer to the attestation section for more details.

.. _key-software-components-gpu-operator:

Key Software Components of the NVIDIA GPU Operator
===================================================
Expand Down Expand Up @@ -109,60 +107,4 @@ You can configure all the worker nodes in your cluster for running GPU workloads
* NVIDIA VFIO Manager
* Node Feature Discovery

This configuration can be controlled through node labelling as described in :ref:`confidential-containers-deploy`.

.. _supported-platforms:

Supported Platforms
===================

Refer to the *Confidential Computing Deployment Guide* at the https://docs.nvidia.com/confidential-computing website for information about supported NVIDIA GPUs, such as the NVIDIA Hopper H100, and specifically to https://docs.nvidia.com/cc-deployment-guide-snp.pdf for setup specific to AMD SEV-SNP machines.

The following topics in the deployment guide apply to a cloud-native environment:

* Hardware selection and initial hardware configuration, such as BIOS settings.
* Host operating system selection, initial configuration, and validation.

When following the cloud-native sections in above linked deployment guide, use Ubuntu 25.10 as host OS with its default kernel version and configuration.

The remaining configuration topics in the deployment guide do not apply to a cloud-native environment. NVIDIA GPU Operator performs the actions that are described in these topics.

For scope of this EA, the following is the validated support matrix. Any other combination has not been evaluated:

.. list-table::
:widths: 50 50
:header-rows: 1

* - Component
- Release
* - GPU Platform
- Hopper 100/200
* - GPU Driver
- R580 TRD 3
* - kata-containers/kata-containers
- 3.24.0
* - NVIDIA/gpu-operator
- v25.10.0 and higher

.. _limitations-and-restrictions:

Limitations and Restrictions
=============================

* Only the AMD platform using SEV-SNP is supported for Confidential Containers Early Access.
* GPUs are available to containers as a single GPU in passthrough mode only. Multi-GPU passthrough and vGPU are not supported.
* Support is limited to initial installation and configuration only. Upgrade and configuration of existing clusters to configure confidential computing is not supported.
* Support for confidential computing environments is limited to the implementation described on this page.
* NVIDIA supports the GPU Operator and confidential computing with the containerd runtime only.
* OpenShift is not supported in the Early Access release.
* NFD doesn't label all Confidential Container capable nodes as such automatically. In some cases, users must manually label nodes to deploy the NVIDIA Confidential Computing Manager for Kubernetes operand onto these nodes as described below.

Deployment and Configuration
=============================

For detailed instructions on deploying and configuring confidential containers with the NVIDIA GPU Operator, refer to the following guide:

.. toctree::
:maxdepth: 2

confidential-containers-deploy
This configuration can be controlled through node labelling as described in :ref:`Deploy Confidential Containers with NVIDIA GPU Operator <confidential-containers-deploy>`.
7 changes: 7 additions & 0 deletions confidential-containers/versions1.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
[
{
"preferred": "true",
"url": "../1.0.0",
"version": "1.0.0"
}
]
2 changes: 1 addition & 1 deletion gpu-operator/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
:hidden:

KubeVirt <gpu-operator-kubevirt.rst>
Confidential Containers <confidential-containers.rst>
Confidential Containers <https://docs.nvidia.com/datacenter/cloud-native/confidential-containers/latest/index.html>

.. toctree::
:caption: Specialized Networks
Expand Down
13 changes: 13 additions & 0 deletions repo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ project_build_order = [
"gpu-telemetry",
"openshift",
"gpu-operator",
"confidential-containers",
"edge",
"kubernetes",
"partner-validated",
Expand Down Expand Up @@ -201,6 +202,18 @@ build_by_default = false
output_format = "linkcheck"


[repo_docs.projects.confidential-containers]
docs_root = "${root}/confidential-containers"
project = "confidential-containers"
name = "NVIDIA GPU Operator - Confidential Containers"
version = "25.10"
copyright_start = 2020

[repo_docs.projects.confidential-containers.builds.linkcheck]
build_by_default = false
output_format = "linkcheck"


[repo_docs.projects.openshift]
docs_root = "${root}/openshift"
project = "gpu-operator-openshift"
Expand Down
1 change: 1 addition & 0 deletions review/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -28,3 +28,4 @@ Refer to the following URLs for the review HTML:
* `NVIDIA GPU Operator on Red Hat OpenShift Container Platform <./openshift/latest/index.html>`__
* `NVIDIA GPUs and Edge Computing <./edge/latest/index.html>`__
* `Partner-Validated Configurations <./partner-validated/latest/index.html>`__
* `NVIDIA Confidential Containers <./confidential-containers/latest/index.html>`__