Support & requirements matrix¶
What is actually supported and tested today, what is simulated-only, and what is not supported. "Supported" means the software behaves as specified and was exercised — it is never a claim that a hardware security property is proven.
Toolchain / build requirements (tested versions)¶
| Tool | Version | Notes |
|---|---|---|
| Rust (stable) | 1.93.0 | pinned via xila-guard-core/rust-toolchain.toml |
| Go | 1.26.1 | xila-guard-k8s (controller / scheduler / webhook) |
| Container runtime | podman 4.9.3 (docker-compat) | Docker should also work; kind uses KIND_EXPERIMENTAL_PROVIDER=podman |
| kind | 0.31.0 | node image Kubernetes 1.35.0 (M3 / in-cluster); 0.27 used earlier |
| Helm | 4.1.4 | chart lint / template / install |
| kubectl | 1.36.0 (client) | compatible with 1.35 clusters |
| make / git / jq | GNU Make 4.3 / git 2.43 / jaq 2.3 (jq-compatible) | — |
| Host OS | Linux (dev host: WSL2) | cgroup v2 required for the Kubernetes 1.35 kind clusters |
Supply-chain scanners (optional, for make supply-chain): syft, grype, trivy,
osv-scanner, cargo-deny, govulncheck, go-licenses.
Kubernetes support¶
| Component | Supported Kubernetes | Basis / limit |
|---|---|---|
| Client / contract libs | 1.35 line | k8s.io/* v0.35.3, controller-runtime v0.23.0 |
| Observe (controller, CRDs, webhook schema checks) | Tested on 1.35; likely works on controller-runtime 0.23's range (~1.31–1.35), but only 1.35 is tested | CRDs use apiextensions.k8s.io/v1; admission uses AdmissionReview v1 |
| Enforce — scheduler plugin | Kubernetes 1.35.x ONLY | Built from k8s.io/kubernetes v1.35.3; a skewed apiserver (e.g. 1.32) does not serve resource.k8s.io/v1 (DRA GA in 1.35) and the scheduler's informers never sync |
| Enforce — admission webhook | 1.16+ (AdmissionReview v1); tested on 1.35 | failurePolicy: Fail, namespace-scoped |
Note
Pin one Kubernetes version per deployment; the enforcement scheduler and the cluster node image must match (1.35).
Hardware support (NVIDIA)¶
| Capability | Status | Detail |
|---|---|---|
| Basic discovery (UUID, model, PCI, driver, VBIOS) | Supported, validated on real hardware | NVIDIA GeForce RTX 3070 (Ampere, consumer), driver 616.56, via WSL2 nvidia-smi (read-only, bounded) |
| MIG mode + child enumeration + per-instance slice sizing | Implemented; SIMULATED-only | Parsed from nvidia-smi -L / mig -lgi/-lci; validated via the lab simulator (A100 profile). No real MIG-capable card tested |
| time-slicing / MPS | Implemented via admin config | Resolved from a GPU-operator device-plugin sharing ConfigMap (admin_inventory), not device-measured; unknown without it |
| GPU attestation | SIMULATED-only (opt-in) | RATS-shaped verifier + simulated verifier (sim: id, no real crypto); enforcement never accepts it. Real attestation needs a confidential-computing GPU (H100 / H200 / Blackwell-class) + a real verifier (e.g. NVIDIA NRAS) |
| GPUs inside Kubernetes demos | Not used — CPU-only | All kind demos request NO nvidia.com/gpu and install no device plugin; discovery runs on the host, not in-cluster |
| Non-NVIDIA vendors | Not supported | The data model is vendor-neutral, but no adapter exists |
| Confidential computing / vGPU / RDMA / NVLink isolation / residual-state clearing | Not supported | Out of scope; each needs its own threat model + validated hardware |
Opt-in features (default-off; nothing changes unless enabled)¶
| Feature | How to enable | Status |
|---|---|---|
| Enforcement (scheduler + fail-closed webhook + RBAC) | Helm enforcement.enabled=true |
Experimental; lab-simulated over mock (acceptMock=true). Production profile rejects mock |
| Remote attestation (RATS) | Cargo feature attestation-sim; context acceptedAttestationVerifiers |
Simulated verifier only; sim: ids never accepted by enforcement; real verifiers plug in as trait impls |
| SPIFFE / mTLS collector identity | Cargo feature mtls; Helm identity.enabled (+ identity.spire.install for BYO SPIRE) |
Server-verified per-node identity bound to node UID (from the cert, never the body); rejects spoof / replay / untrusted. In-cluster demo uses real SPIRE |
Performance (measured, not an SLA)¶
Latency benchmark (make bench, release build) on a 12th Gen i5-12600K (16 vCPU):
| Workload | p50 | p95 | p99 |
|---|---|---|---|
100-node /evaluate sweep |
4.25 ms | 5.96 ms | 6.41 ms |
/evaluate-batch (100 candidates) |
1.9 ms | — | — |
| pure evaluator | ~6 µs / node | — | — |
That is ~15–24× under the project's 100 ms engineering target. The harness prints
its machine + build profile and warns on debug, so published numbers are
reproducible and falsifiable — a target, never an SLA.
Explicit non-claims (never silently pass)¶
Danger
- Admission does not select a physical GPU; the scheduler evaluates node-scope policy, not a specific allocated device (device binding needs an allocation hook).
mock/admin_inventoryevidence is not attestation; telemetry is not isolation proof; a simulated attestation result is never real evidence.- No defense against a malicious host administrator; the prototype trusts the host kernel, GPU driver, API server, and configured administrator.
- Unknown / unsupported / stale / untrusted evidence is never treated as satisfied.
For the per-decision reasoning, see the policy model and threat model.