Constellation – An always encrypted Kubernetes engine

Hacker News

Hey HN, my colleagues and I have been working on Constellation for 1.5+ years. We open sourced it today under AGPLv3. It's a standalone Kubernetes engine/distribution that operations-wise is very much vanilla K8s (v1.24). Security-wise, it comes with some new concepts: It's designed to shield K8s clusters as a whole from the cloud. The goal is that not even the cloud provider and its employees can access any data in a cluster. Constellation basically ensures that all nodes in a cluster (1) run inside verified "Confidential VMs" and (2) encrypt all network traffic and storage. Confidential VMs are VMs that have the AMD SEV feature. Intel TDX and Arm Realms are similar. CVMs protect workloads against a compromised host and malicious admins. For this, CVMs remain encrypted at runtime in memory, are strongly isolated, and have cool remote attestation capabilities. This is also often referred to as "confidential computing". CVMs are currently available in Azure and GCP. Constellation comes with a Fedora CoreOS-based node image that is optimized for CVMs and protected with Sigstore. More info in the README/docs. What do you think? -Felix

Visit product View on Hacker NewsSep 13, 2022

Share card

Actual performance

14points

5comments

Made the leaderboard

Launch Intel predictions

Analyze your own launch →

Hacker NewsStrong engagement from HN community · Strong signals: open source, ide, io · Missing: https docs, excited, just released

71%71% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Product HuntOn track for Day 1 leaderboard · Strong signals: new, open · Missing: mac, agents, macos

67%67% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

55%55% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Strong signals: host · Missing: plus, platform, intuitive

46%46% predicted probability of success on AppSumo, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: way · Missing: mobile apps, ios, personal

43%43% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

22%22% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

2%2% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

Mattermost Deployment on Encrypted Kubernetes61%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Mattermost Deployment on Encrypted Kubernetes

Hacker News3

Kubernetes on RPI3 cluster45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Kubernetes on RPI3 cluster

Hacker News9

Graphite and StatsD Cluster on Kubernetes45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Graphite and StatsD Cluster on Kubernetes

Hacker News2

Configuring Kubernetes with Solvent53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Configuring Kubernetes with Solvent

Hacker News2

EKG – Healthchecks in a Sidecar on Kubernetes Deployments50%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

EKG – Healthchecks in a Sidecar on Kubernetes Deployments

Hacker News2

Clojure on Kubernetes Quickstart47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Clojure on Kubernetes Quickstart

Hacker News3

Kustomize, customization of kubernetes YAML configurations58%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Kustomize, customization of kubernetes YAML configurations

Hacker News2

Gravity – Kubernetes snapshots for on-premise deployments42%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Gravity – Kubernetes snapshots for on-premise deployments

Hacker News70

Kubernetes on Raspbian53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Kubernetes on Raspbian

Hacker News2

mkaas - Minikube on Kubernetes with CRDs53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

mkaas - Minikube on Kubernetes with CRDs

Hacker News2

Browse all products Analyze your launch