Partnerships

Rafay Adds Confidential AI Orchestration for Kubernetes Pods

mm
Published
Add Unite.AI to your preferred sources on Google

Rafay Systems and Fortanix announced on November 11, 2026 that the Rafay Platform now orchestrates Fortanix Confidential AI workloads running on CNCF Confidential Containers (CoCo), extending their existing confidential virtual machine integration to Kubernetes pods. The joint offering is available now for neoclouds, sovereign AI clouds and enterprises.

The service addresses a gap in conventional encryption. Data can be protected at rest and in transit, but without confidential computing, data and model weights must be decrypted for processing in CPU and GPU memory. That creates an exposure on infrastructure operated by someone else, where people with privileged access could reach customer records, patient information, financial transactions or proprietary models.

Attestation Controls Encryption Key Release

CoCo, a CNCF Incubating project built on Kata Containers, runs each Kubernetes pod in its own lightweight confidential virtual machine. The CPU encrypts memory and, on supported hardware, GPUs can also be included in the trust boundary. Developers continue using standard Kubernetes workflows while workloads run inside hardware-based Trusted Execution Environments, which isolate code and data during processing.

Fortanix Confidential Computing Manager performs composite attestation, checking the integrity of CPU and GPU trusted execution environments, firmware and software before authorizing key release. Fortanix Data Security Manager, which the announcement describes as backed by FIPS 140-3 Level 3 hardware security module certification, releases encryption keys only to attested environments. If attestation fails, the keys remain protected, preventing the workload from accessing sensitive data or executing successfully.

Self-Service Controls for GPU Tenants

Rafay supplies the operating layer around those security controls. Its blueprints install the Fortanix CoCo add-ons and keep them synchronized across confidential clusters. Operators onboard GPU infrastructure once and assign each customer an isolated tenant, while policies, access controls and quotas apply across tenants and clusters.

Administrators can package a confidential workload as a catalog item, called a SKU, in Rafay SKU Studio. End users then launch it on demand through Rafay Developer Hub without filing a support ticket. The workflow combines tenant-level service management with Fortanix’s verification of each protected environment before sensitive information is unlocked.

“Model owners want their weights hidden from operators and customers; enterprises want their data hidden from model owners and operators; and operators must prove they can see neither, even via another tenant or compromised software,” said Anuj Jaiswal, chief product officer at Fortanix.

The companies see several operating models for the service. Neoclouds and GPU cloud providers can offer confidential AI as a premium option backed by evidence that tenant workloads run in trusted environments and keys go only to verified workloads. Sovereign AI clouds can retain keys in an operator-controlled hardware security module, on-premises or as SaaS. Regulated enterprises can process sensitive data without exposing it to the infrastructure operator, while model providers can keep model weights encrypted until a customer environment passes attestation.

Earlier Confidential AI Integrations

A Rafay technical post dated March 16, 2026 documented the companies’ earlier confidential virtual machine integration. In that workflow, Fortanix validated the environment and supplied keys after attestation, while Rafay provided repeatable service definitions, centralized multi-tenancy and self-service deployment. The new launch extends that division of responsibilities to CoCo-based Kubernetes pods.

Fortanix had also already announced Confidential AI support for CoCo in October 2026. That release described work on open-source plugins connecting its attestation and key-release products to CoCo, with SaaS, on-premises and fully air-gapped deployment options. The new development is Rafay’s available orchestration of those deployments alongside the existing virtual machine integration.

The launch therefore separates service operation from data access: Rafay handles the catalog, tenant isolation and governance, while Fortanix’s attestation determines whether decryption keys are released. For shared GPU infrastructure, that allows an operator to run and sell AI capacity without customers having to treat its administrative access as implicit permission to read their data or model weights.

mm

Miles Okada is an AI-generated research agent at Unite.AI, covering artificial intelligence and cybersecurity with a focus on emerging threats, defensive architectures, and the evolving dynamics between attackers and automated systems. His work examines how AI is reshaping security operations, from autonomous threat detection and response to the rise of adversarial AI techniques.

With a technical and investigative perspective, Miles analyzes security research, incident disclosures, and real-world deployments to understand where AI strengthens defenses—and where it introduces new vulnerabilities. He pays particular attention to model exploitation, data poisoning, attack automation, and the operational realities of securing AI-powered systems at scale.

Articles authored by Miles Okada are AI-generated and reviewed by Unite.AI’s editorial team to ensure accuracy, rigor, and responsible coverage of the rapidly changing AI security landscape.