Create a TDX confidential VM node pool in an ACK cluster

How it works

Intel® TDX provides hardware-assisted isolation and encryption for ECS instances, protecting runtime data such as CPU registers, memory, and interrupt injections from unauthorized access.

TDX confidential VM node pools integrate with ACK standard scaling and management. Existing applications can migrate to a TDX-enabled node pool without code changes.

See Intel® Trust Domain Extensions (Intel® TDX).

Use cases

TDX confidential VM node pools suit workloads that require hardware-enforced data isolation:

• Financial risk control: protect transaction processing and risk scoring data at runtime

• Healthcare data privacy: isolate patient data during analysis and inference

• AI-Generated Content (AIGC) and Large Language Model (LLM) inference and fine-tuning: protect model weights and training data in use

• Confidential databases: enforce hardware-level isolation for database processes

• Big data applications: process sensitive datasets with hardware-backed guarantees

Intel® TDX and Intel® Advanced Matrix Extensions (AMX) provide end-to-end security for model inference workloads.

Supported configurations

The following constraints apply to TDX confidential VM node pools:

See Known issues and functionality limits.

Prerequisites

Before you begin, make sure you have:

• An ACK Pro cluster in the China (Beijing) region. See Create an ACK managed cluster.

• Access to the ACK and ECS consoles

Step 1: Create a node pool

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the cluster name. In the left-side navigation pane, choose Nodes Node Pools.

3. In the upper-right corner, click Create Node Pool. Set the following parameters and click Confirm Order. Under Advanced Options (Optional), add a node label for pod scheduling. All parameters are described in Create and manage a node pool.

   Parameter	Setting
   vSwitch	Select a vSwitch in Zone I
   Auto Scaling	Disabled (default)
   Instance Type	g8i.xlarge or larger
   Expected Nodes	0 (default)
   Operating System	Alibaba Cloud Linux 3.2104 LTS 64-bit

   Label key	Label value
   nodepool-label	tdx-vm-pool

Step 2: Create a TDX-enabled ECS instance

Creating a TDX-enabled ECS instance follows the standard process (Create an instance on the Custom Launch tab) with two parameter differences:

1. Log on to the ECS console. In the left-side navigation pane, choose Instances Images Instances.

2. In the top navigation bar, select the region and resource group.

3. Click Create Instance and set the following parameters:

   Parameter	Setting
   Network and zone	Select Beijing Zone I. Requires ecs.g8i.xlarge or larger.
   Image	Select Confidential VM, then select Alibaba Cloud Linux 3.2104 LTS 64-bit.

4. Complete the remaining configuration and create the instance.

(Optional) Step 3: Verify TDX status on the ECS instance

Log on to the ECS instance and run these commands to verify TDX is active.

1. Verify TDX is enabled:

   lscpu | grep -i tdx_guest

   Expected output when TDX is enabled:

   

2. Verify the TDX driver is installed:

   ls -l /dev/tdx_guest

   Expected output when the TDX driver is installed:

   

Step 4: Add the ECS instance to the node pool

1. In the ACK console, click Clusters, then click the cluster name. In the left-side navigation pane, choose Nodes Node Pools.

2. In the Actions column, choose More Add Existing Node.

3. On the Select Existing ECS Instance page, set Mode to Auto, select the ECS instance from Step 2, and complete the configuration. See Add existing ECS instances.

Step 5: Deploy an application

Deploy a pod to the TDX-enabled node pool. The nodeSelector field targets the node label from Step 1 to schedule the pod on a TDX-enabled node.

Next steps

• Known issues and functionality limits for TDX confidential computing

• Create and manage a node pool

• Add existing ECS instances