The world’s most
secure Kubernetes

Constellation is available on Azure, AWS, and GCP through their respective marketplaces. It also integrates with STACKIT and supports any OpenStack-based cloud. Currently, Azure offers the most comprehensive feature support, followed by AWS and GCP. With this setup, you can create self-managed Constellation clusters billed on a pay-per-use basis (hourly, per vCPU) through your cloud account, with direct support from Edgeless Systems.

Yes, Constellation can run on-premises but requires a “cloud operating system” like OpenStack. It does not support bare-metal setups. Additionally, it requires Confidential Virtual Machines (CVMs) based on AMD SEV or Intel TDX.

Constellation is a CNCF-certified distribution and serves as an alternative to Kubernetes distributions like OpenShift, Rancher/RKE, and Tanzu. It can also be used alongside "meta-orchestration" tools like Rancher or Portainer to enhance management capabilities.

Constellation is open-source and available under the GNU Affero General Public License v3.0. The community edition is free for testing and is available to NGOs. However, companies require an enterprise license for production use, which includes support and additional features, such as KMIP integration. Pricing follows a per vCPU, per year model, with specific offers available upon request. Constellation is also accessible through the AWS, Azure, GCP, and STACKIT marketplaces, allowing for self-managed clusters billed on a pay-per-use basis.

There is no hard stop when you reach your quota limit; however, exceeding it would violate the licensing agreement. We urge you to inform us and increase your quota to remain compliant.

Constellation is a Kubernetes distribution that isolates entire clusters, providing a standard Kubernetes and DevOps experience. It is best suited for organizations looking to use third-party infrastructure or operate in high-security environments. With Constellation, the complexities of confidential computing are managed for you, allowing users to focus on their applications without dealing with underlying security details.

Contrast is a platform designed for confidential containers, providing isolation for individual workloads. It is intended for users who want to integrate confidential computing with managed Kubernetes offerings, handle multi-party use cases, or restrict access to application data from their own administrators. With Contrast, users are required to define a manifest for their applications, allowing for precise control over their setup.

If your goal is to shield an entire Kubernetes cluster with minimal changes, Constellation is likely the better choice. However, if you need more granular control over workloads and are comfortable writing app-specific manifests, Contrast provides this flexibility.

Yes, Constellation has undergone penetration testing, primarily conducted by our customers and their contractors. Typically, larger clients perform their own assessments. We welcome inquiries regarding individual evaluation options and are happy to discuss them upon request.

You don't need to modify your application to deploy on Constellation. Existing applications can be migrated to Constellation without changes to their code or architecture, while ensuring all data remains encrypted and secure from the underlying infrastructure.

Yes, Constellation seamlessly integrates with tools like Infrastructure-as-Code (IaC), GitOps, service meshes, and security tooling. You can utilize Constellation's Terraform Provider to set up infrastructure using IaC tools such as Terraform, facilitating integration into GitOps workflows with tools like Argo CD or Flux. As a CNCF-certified Kubernetes distribution, Constellation is compatible with standard Kubernetes tooling, allowing for the deployment of service meshes like Istio and integration with various security tools within the cluster. This ensures a smooth integration into existing DevOps and SecOps pipelines while leveraging Constellation's confidential computing capabilities.

In Constellation, keys are securely stored and managed within trusted execution environments (TEEs) to ensure robust data protection. Memory encryption keys are handled exclusively by the CPU and hardware, preventing access from any software layer, including Constellation components. For network encryption, Constellation uses Cilium’s WireGuard-based encryption, with keys dynamically generated and rotated within the TEE. Additionally, persistent volume encryption can utilize Constellation’s integrated Key Management Service (KMS) within the TEE or integrate with an external Key Management System (KMS) or Hardware Security Module (HSM) to securely store the master encryption key.