feat: confidential compute

[cloud-j-luna]

Adds per-pod attestation sidecar support for confidential compute workloads using AMD SEV-SNP and Intel TDX, with NVIDIA GPU confidential compute (VFIO passthrough). Tenants request CC via the existing confidential-compute: true placement attribute, no SDL version bump required. The provider automatically selects the appropriate Kata runtime class (kata-qemu-snp, kata-qemu-nvidia-gpu-snp, kata-qemu-tdx, kata-qemu-nvidia-gpu-tdx), applies CC-specific node selectors, switches GPU resources to nvidia.com/pgpu for VFIO, and injects an attestation sidecar into the pod via a fail-closed mutating admission webhook. The sidecar serves an HTTP endpoint inside the Kata VM that collects raw hardware-signed attestation reports (configfs-tsm or /dev/sev-guest) and returns them as is, the provider never produces, inspects or signs attestation evidence. Tenants verify reports independently against trusted parties.

New provider REST endpoints (GET /attestation/directory and POST /lease/.../attestation/quote) and a lease-attestation CLI command enable the full attestation flow. Tenants can opt out of sidecar injection via params.attestation.enabled: false in the SDL.

Local development is supported with CONFIDENTIAL_COMPUTE=true a single variable that configures Kind with mock runtime handlers, node labels, and a mock TEE provider that produces synthetic reports with correct nonce echo for end-to-end testing without hardware.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 97e6ff6a-d63d-41fa-9880-a039263582f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/confidential-compute

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}