Kubernetes Pod specification

In addition to the build-time Confidential Pod Configuration file, the Anjuna Kubernetes Toolset recognizes a set of labels and annotations on the Kubernetes Pod specification. These control whether a Pod runs as an Anjuna Confidential Pod and how the Anjuna Confidential Pod’s underlying confidential VM (CVM) is created at deploy time.

This page describes the labels and annotations supported on the Pod specification.

When deploying a workload through a higher-level resource such as a Deployment, set these labels and annotations on the Pod template (.spec.template.metadata), not on the Deployment metadata.

Labels

anjuna.io/run-confidential

This label marks the Pod as managed by the Anjuna Kubernetes Toolset. When you set this label to "yes", the Anjuna runtime class runs the Pod as an Anjuna Confidential Pod, launching it inside a confidential VM instead of as a regular container.

You must set this label on any Pod that you want to run as an Anjuna Confidential Pod.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  labels:
    anjuna.io/run-confidential: "yes"
spec:
  ...

Annotations

cvm.anjuna.io/image — mandatory

This annotation specifies the URI of the Anjuna Confidential Pod image in the cloud service provider — that is, the CVM disk image built and uploaded with the anjuna-k8s-cli. The Anjuna Kubernetes Toolset uses this image as the disk of the confidential VM that runs the Pod.

This annotation is mandatory for every Anjuna Confidential Pod. If it is missing, the Pod fails to start.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  labels:
    anjuna.io/run-confidential: "yes"
  annotations:
    cvm.anjuna.io/image: "<confidential-pod-image-uri>"
spec:
  ...

cvm.anjuna.io/machine_type — optional

This annotation specifies the name of a VM machine size, as defined by the cloud service provider, to use when creating the confidential VM for the Pod. This annotation allows individual Anjuna Confidential Pods to select a machine size that suits their resource requirements.

On Azure, the requested machine size must be one of the VM sizes allowed in the Anjuna Cloud Adaptor configuration. See azure.instanceSizes for details on configuring the allowed VM sizes at install time.

If you omit this annotation, the Anjuna Cloud Adaptor creates the Anjuna Confidential Pod with its default machine size.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  labels:
    anjuna.io/run-confidential: "yes"
  annotations:
    cvm.anjuna.io/image: "<confidential-pod-image-uri>"
    cvm.anjuna.io/machine_type: "<vm-machine-size>"
spec:
  ...