Rafay and Fortanix Bring Confidential AI Inside Kubernetes Pods

Pushing Confidential AI Down to the Pod

Confidential AI has mostly lived at the virtual machine level. Rafay Systems and Fortanix want to push it down to the Kubernetes pod, where AI teams actually ship their work. That's a meaningful move, and it's less about new technology than about where the boundary sits. A VM-level boundary wraps an entire machine and everything running on it. A pod-level boundary sits much closer to the unit engineers actually deploy, which is why the companies frame this as a shift toward where AI work already happens.

The two companies announced the joint offering on Thursday in Sunnyvale, Calif., as KubeCon + CloudNativeCon North America 2026 wrapped up. The Rafay Platform now orchestrates workloads running on CNCF Confidential Containers (CoCo) alongside Fortanix Confidential AI, giving neoclouds, sovereign AI clouds and enterprises a way to sell confidential AI as a service. Timing an announcement to a major Kubernetes conference isn't an accident. The audience there already thinks in terms of clusters and operations, and that's exactly the audience this product has to win.

How the Pieces Fit Together

CoCo, an incubating CNCF project built on Kata Containers, runs each pod inside its own lightweight confidential virtual machine. The CPU encrypts memory, and on supported hardware the GPUs sit inside the trust boundary too. That GPU piece is the part that matters most for AI, since much of the sensitive computation happens on accelerators. Covering them is where many confidential computing setups run into trouble.

Fortanix Confidential Computing Manager handles composite attestation across CPU and GPU trusted execution environments, along with firmware and software components. Attestation is the mechanism by which a workload proves what it's running on before anything gets handed to it. Fortanix Data Security Manager then releases encryption keys only to environments that pass. Fail attestation, and the keys stay locked and the workload can't reach sensitive data. That's the core promise, and it's sharper than the usual "your data is encrypted" line, because it ties access to verified state rather than to a password or a network rule.

What does this mean if you're running inference for customers? The question stops being whether your provider says they're secure. It becomes whether they can show you a measurement, and whether you can check that measurement yourself. That's a higher bar, and it's the right one.

Turning Confidential Clusters Into a Product

Rafay handles the operating layer, and that's where the service model comes from. Rafay blueprints install the Fortanix CoCo add-ons and keep them synchronized across every confidential cluster. Operators onboard GPU infrastructure once, then give each customer an isolated tenant. That sounds mundane. It's actually the part that decides whether a security feature becomes a product or stays a lab exercise. A cluster that drifts out of configuration is a cluster where the attestation story gets harder to tell.

Administrators package a confidential workload as a SKU in Rafay SKU Studio, and end users launch it on demand from the Rafay Developer Hub, with no support ticket required. Policy, access controls and quotas apply across tenants and clusters. The SKU model will be familiar to anyone who has bought cloud capacity. The new part is attaching a confidentiality guarantee to the thing being sold. Quotas and policy matter as much as encryption here, because a provider selling confidential capacity still has to stop one tenant from starving another. (And this is the part most people overlook: the boring plumbing is what makes the security promise repeatable across customers instead of a one-off engineering project.)

"With Confidential Containers, that model now reaches the Kubernetes pod, where AI teams already ship their workloads," said Mohan Atreya, chief product officer at Rafay. Anuj Jaiswal, chief product officer at Fortanix, said model owners, enterprises and operators each want assurance that the others can't see what they own, adding that "Fortanix Confidential AI releases keys only to attested workloads." Two product leaders making parallel points suggests the partnership rests on a shared customer problem rather than a loose feature overlap. That's the better sign.

Availability

Rafay support for CoCo-based deployments with Fortanix Confidential AI is available now, alongside the existing confidential VM integration. Fortanix first announced Confidential AI support for CoCo on Oct. 19. Existing VM integration means customers aren't forced to pick one model over the other, at least on paper.

The companies point to research from Fortanix and Atomik Research showing that while 93% of AI leaders understand traditional encryption doesn't protect data while AI processes it, only half can fully verify that protection during inference. Roughly nine in ten know the gap exists. Only about half can prove they're closing it. The research comes from one of the companies involved, so treat it as a pitch with data attached rather than neutral measurement. The underlying point still holds for anyone who has tried to audit an inference stack.

That gap is the real pitch. Confidentiality is easy to promise and hard to prove, and attestation gives operators something concrete to show customers. Here's the thing, though: a verifiable claim is only useful if the people checking it know what they're looking at.

What Happens Next

The next thing to watch is whether neoclouds start listing attested AI SKUs in their catalogs, because that's when this stops being a demo. Security teams in this category typically take a long time to accept a new trust anchor, and they'll want to inspect the measurements themselves rather than take a vendor's word for them. That's healthy skepticism, and it will slow adoption.

Kubernetes-level confidentiality also inherits the complexity of the cluster it runs in. Every add-on, firmware version and tenant policy becomes part of what gets attested, which means operational discipline matters as much as the cryptography. If you're working in this space, the practical question is how much of your fleet you can keep in a verifiable state without a team of specialists watching it. Promising, if it holds up. Unproven, for now.