base on Deploy and manage confidential containers on Kubernetes  # Contrast Contrast runs confidential container deployments on Kubernetes at scale. Contrast is based on the [Kata Containers](https://github.com/kata-containers/kata-containers) and [Confidential Containers](https://github.com/confidential-containers) projects. Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment. This works with unmodified containers in a lift-and-shift approach. Contrast currently targets the [CoCo preview on AKS](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview). <img src="docs/static/img/concept.svg" alt="Concept" width="80%"/> ## Goal Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges. Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow. ## Use cases * Increasing the security of your containers * Moving sensitive workloads from on-prem to the cloud with Confidential Computing * Shielding the code and data even from your own cluster administrators * Increasing the trustworthiness of your SaaS offerings * Simplifying regulatory compliance * Multi-party computation for data collaboration ## Features ### 🔒 Everything always encrypted * Runtime encryption: All Pods run inside AMD SEV-based Confidential VMs (CVMs). Support for Intel TDX will be added in the future. * PKI and mTLS: All pod-to-pod traffic can be encrypted and authenticated with Contrast's workload certificates. ### 🔍 Everything verifiable * Workload attestation based on the identity of your container and the remote-attestation feature of [Confidential Containers](https://docs.edgeless.systems/contrast/basics/confidential-containers) * "Whole deployment" attestation based on Contrast's [Coordinator attestation service](https://docs.edgeless.systems/contrast/components#the-coordinator) * Runtime environment integrity verification based runtime policies * Kata micro-VMs and single workload isolation provide a minimal Trusted Computing Base (TCB) ### 🏝️ Everything isolated * Runtime policies enforce strict isolation of your containers from the Kubernetes layer and the infrastructure. * Pod isolation: Pods are isolated from each other. * Namespace isolation: Contrast can be deployed independently in multiple namespaces. ### 🧩 Lightweight and easy to use * Install in Kubernetes cluster as a day-2 operation. * Compatible with managed Kubernetes. * Minimal DevOps involvement. * Simple CLI tool to get started. ## Documentation To learn more, see the [documentation](https://docs.edgeless.systems/contrast). You may want to start with one of the following sections. * [Getting started](https://docs.edgeless.systems/contrast/getting-started) * [Security benefits](https://docs.edgeless.systems/contrast/basics/security-benefits) * [Components](https://docs.edgeless.systems/contrast/components) ## Known limitations See the current list of [known limitations](https://docs.edgeless.systems/contrast/features-limitations) in the documentation. ## Upcoming Contrast features * Plugin for a key management service (KMS) for attestation/coordinator certificate-based key release * High availability (distributed Contrast Coordinator) ## Contributing See the [contributing guide](CONTRIBUTING.md). Please follow the [Code of Conduct](/CODE_OF_CONDUCT.md). ## Support * If something doesn't work, make sure to use the [latest release](https://github.com/edgelesssys/contrast/releases/latest) and check out the [known issues](https://github.com/edgelesssys/contrast/issues?q=is%3Aopen+is%3Aissue+label%3A%22known+issue%22). * Please file an [issue](https://github.com/edgelesssys/contrast/issues) to get help or report a bug. * Visit our [blog](https://www.edgeless.systems/blog/) for technical deep-dives and tutorials and follow us on [LinkedIn](https://www.linkedin.com/company/edgeless-systems) for news. * Edgeless Systems also offers [Enterprise Support](https://www.edgeless.systems/products/contrast/). ## License Contrast follows the open-core model. The core project is licensed under AGPLv3. The Enterprise Edition is licensed under BUSL-1.1. See the [LICENSE](LICENSE) file for details. ", Assign "at most 3 tags" to the expected json: {"id":"10389","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"