← Kubernetes, Slurm & GPU Scheduling / 31

expertNewNVIDIAGoogle CloudMicrosoft Azure

How would you configure Kubernetes to run a confidential GPU workload and prove that the pod is protected?

Follow provisioning from CPU TEE and GPU mode through passthrough, confidential guest runtime and release policy. Distinguish scheduling labels and readiness from cryptographic evidence.

Updated Nov 2026 · Learn how AI infrastructure works through explanations, worked examples and diagrams, then practise applying it to interview questions.

Follow provisioning from CPU TEE and GPU mode through passthrough, confidential guest runtime and release policy. Distinguish scheduling labels and readiness from cryptographic evidence.

The full answer is part of Premium. A free account includes more answers in each topic, but does not unlock this one.

20 answers per topic instead of 10, plus saved progress and bookmarks · no cardor unlock all 324 remaining answers · ₹2,000 / $25

The concepts behind this question

Use these concept explanations to review the ideas behind this question.

🚀 Inference & Serving🔒 Premium

Confidential InferenceConfidential inference keeps prompts, model state and responses inside an attested CPU/GPU boundary during execution. Its privacy claim depends on where requests decrypt, which code receives keys, and where plaintext can leave.

📐 AI Systems Design🔒 Premium

Remote Attestation and Key ReleaseAttestation supplies evidence about a running environment. A key-release policy must also bind freshness, approved software, every required device and the recipient channel before releasing a model or data key.

🗂️ Scheduling & Orchestration

Kubernetes GPU SchedulingKubernetes coordinates GPU discovery, scheduling and container access through several components. Understanding their separate roles makes allocation failures easier to diagnose.

🗂️ Scheduling & Orchestration🔒 Premium

Air-Gapped AI DeploymentsAn air-gapped AI deployment needs a controlled import path for software, models and trust material, plus local identity, time, storage and recovery services. Network isolation and confidential execution solve different problems.

Explore the full curriculum →

UP NEXT ON YOUR JOURNEY

Next in this trackDeploy a confidential inference service at an air-gapped site. What must work after the internet is disconnected?Closest to this topicGPU attestation fails after a driver update. How do you restore serving without bypassing the key-release policy?Closest to this topicWhat does the NVIDIA GPU Operator actually install on a node, and what is Node Feature Discovery doing underneath it?

FEDITOR'S NOTE

A RuntimeClass selects an installed handler. Neither its name nor a node label proves the CPU, GPU or loaded application is acceptable.

DISCUSSION · 0

No comments yet — be the first to share your approach.