Anjuna Seaglass™ Operator for OpenShift Certified

When protecting sensitive data managed by a Pod in OpenShift, one can protect the data at rest by encrypting the data written to the persistent storage, and protecting the data in transit when sending data over the network.

However, when the data is used in the Pod’s memory, it cannot be both encrypted and used at the same time.
This means that if a malicious insider (either human or software) had access to the OpenShift Node, they could dump the Pod's memory and access all of its sensitive data. This includes accessing the secrets used to encrypt the data at rest and in transit.

Running the Pod in a Confidential Pod with the Anjuna Seaglass platform solves this problem. Anjuna Seaglass runs the Pod inside a Trusted Execution Environment, where the Pod memory is encrypted by the hardware so that no privileged human or software on the Pod can access this memory in the clear.

When running a Pod in OpenShift, the Pod may need to create trust with other Pods or with software running outside of the OpenShift cluster.
The standard way to create this trust is to identify with a token or credentials that could be easily read and stolen from the Pod disk or by providing a machine identity, a process name, or an IP that could be spoofed or reused.

Confidential Computing technology provides a mechanism called Remote Attestation, which provides an identity to the software via the Hardware—the Software Measurement.

When running a Pod as a Confidential Pod with the Anjuna Seaglass platform, a user can leverage the Remote Attestation to perform trusted authentication with the Confidential Pod, in a way that cannot be spoofed.
The Anjuna Policy Manager allows you to protect the first secret of a Confidential Pod and remove any secret from the Pod image or Kubernetes control plane that could be read by malicious insiders.