What Cisco’s Fortanix CoCo test means for Kubernetes

Fortanix announced support for CNCF Confidential Containers (CoCo) in Fortanix Confidential AI on October 18, 2026, and described it as available now. Cisco’s design guide, updated October 14, labels the integration public preview and reports a working test on one Intel TDX worker.

How CoCo controls access to an encrypted workload

Confidential Containers runs a Kubernetes pod inside a lightweight virtual machine based on Kata Containers. The virtual machine runs within a trusted execution environment (TEE), a hardware-protected area intended to keep workload data isolated while it is in use. Kubernetes is the container orchestration platform; CoCo supplies the confidential runtime for the pod.

In the Cisco-described flow, the model owner encrypts the container image layers and keeps the credentials used to build them. The host, hypervisor, Kubernetes control plane and image registry sit outside the design’s confidentiality trust boundary. Fortanix Confidential Computing Manager (CCM) checks hardware and software measurements, then establishes the workload’s identity. Attestation is the process of checking those measurements against policy.

After a successful check, CCM issues a short-lived workload certificate. The guest uses it to authenticate to Fortanix Data Security Manager (DSM), which applies key permissions and releases the decryption key for an approved workload. Changed measurements or insufficient permissions block key release. The builder credential cannot unwrap, decrypt or export that key, and is not copied to the host. When CCM policy requires GPU attestation, the flow also checks GPU evidence.

Cisco’s test used one TDX worker and one H100-NVL

Cisco reports that an encrypted, GPU-enabled container started and served traffic in a validation using one TDX worker and one confidential container. The server was a Cisco UCS C240 M8 with two Intel Xeon 6 6530P processors and one NVIDIA H100-NVL GPU in confidential-computing mode, passed through to the TDX guest.

The tested software stack included Kubernetes v1.36.4, containerd 2.2.1, CoCo chart 0.21.0 and NVIDIA GPU Operator v26.3.1. These versions identify Cisco’s tested build, rather than a general compatibility matrix.

What Cisco’s validation qualifies

Cisco’s report describes a functional result for that single-worker configuration. It says multi-node operation, availability and AI performance require additional qualification. The guide also says application security and compatibility remain relevant, and that AMD SEV-SNP was not verified in this deployment.

For infrastructure teams, the reported setup gives a concrete point of comparison for hardware and software, while its one-worker scope leaves cluster-scale behavior and performance outside the validation. Cisco labels the integration public preview; Fortanix’s announcement uses the wording “available now.”

Kubernetes and CoCo are separate CNCF projects

Kubernetes is a graduated project of the Cloud Native Computing Foundation (CNCF), and became the foundation’s first graduated project on March 6, 2018. CoCo is a separate CNCF project used here to run confidential Kubernetes workloads.