Dev tools · September 13, 2022
Constellation – An always encrypted Kubernetes engine
Hey HN, my colleagues and I have been working on Constellation for 1.5+ years. We open sourced it today under AGPLv3. It's a standalone Kubernetes engine/distribution that operations-wise is very much vanilla K8s (v1.24). Security-wise, it comes with some new concepts: It's designed to shield K8s clusters as a whole from the cloud. The goal is that not even the cloud provider and its employees can access any data in a cluster. Constellation basically ensures that all nodes in a cluster (1) run inside verified "Confidential VMs" and (2) encrypt all network traffic and storage.…
In plain words
Constellation is a Kubernetes distribution designed to protect entire clusters from cloud provider access. It runs on confidential virtual machines with encrypted memory and encrypts all network traffic and storage, ensuring data remains private even from cloud infrastructure administrators. The platform operates as standard Kubernetes operationally while adding security layers through hardware-based isolation and encryption. It is intended for organizations requiring strong data privacy guarantees in cloud environments.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
Hey HN, my colleagues and I have been working on Constellation for 1.5+ years. We open sourced it today under AGPLv3. It's a standalone Kubernetes engine/distribution that operations-wise is very much vanilla K8s (v1.24). Security-wise, it comes with some new concepts: It's designed to shield K8s clusters as a whole from the cloud. The goal is that not even the cloud provider and its employees can access any data in a cluster. Constellation basically ensures that all nodes in a cluster (1) run inside verified "Confidential VMs" and (2) encrypt all network traffic and storage. Confidential VMs are VMs that have the AMD SEV feature. Intel TDX and Arm Realms are similar. CVMs protect workloads against a compromised host and malicious admins. For this, CVMs remain encrypted at runtime in memory, are strongly isolated, and have cool remote attestation capabilities. This is also often referred to as "confidential computing". CVMs are currently available in Azure and GCP. Constellation comes with a Fedora CoreOS-based node image that is optimized for CVMs and protected with Sigstore. More info in the README/docs. What do you think? -Felix
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, September 2022
the whole month →- IM
Life & fun · 2022 · dogbunnypuzzle.com
- IM
A couple of years ago, I had an interesting idea. What if there was a marketplace where all the underlying tech was open-source? The order management system, the storefront, customer support, etc. The marketplace would simply connect to the seller’s infra instead of locking them in. If, for some reason, the seller is removed from the marketplace, their software stays with them and they can continue accepting orders directly. This model can be used to disrupt any marketplace from AirBNB to UberEats: building tech for home renters and restaurants and later, leveraging that to build a competing…
Dev tools · 2022 · openship.org
