Attestation support for elastic cloud computing environments

One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving at an orchestrator a membership policy and a request for computation of a workload of a tenant according to the received membership policy, the membership policy providing a set of requirements that that are mandated for compute nodes supporting the workload of the tenant;
• selecting a set of one or more compute nodes to provide computation for the workload;
• providing the membership policy and attestations from the one or more selected compute nodes to a security manager;
• evaluating by the security manager the attestations for the one or more selected compute nodes against the membership policy, and, upon determining that the attestations for the one or more compute nodes meet the requirements of the membership policy, adding the one or more compute nodes to a group of compute nodes to provide computation for the workload;
• and
• providing the membership policy and an attestation for the security manager to the tenant for verification of the group of compute nodes.

A system comprising:

• one or more processors including one or more processing cores to process data;
• a memory for storage of data, including data for one or more secure operations;
• a plurality of compute nodes to provide computation;
• an orchestrator to receive a membership policy and a request for support of a workload of a tenant according to the received membership policy, the membership policy providing a set of requirements that that are mandated for compute nodes supporting the workload of the tenant, the orchestrator to select a set of one or more compute nodes of the plurality of compute nodes to provide computation for the workload;
• and
• a security manager to:
• receive the membership policy and receive attestations from the one or more selected compute nodes,
• evaluate the attestations for the one or more selected compute nodes against the membership policy,
• upon determining that the attestations for the one or more compute nodes meet the requirements of the membership policy, add the one or more compute nodes to a group of compute nodes to provide computation for the workload;
• and
• provide the membership policy and an attestation for the security manager to the tenant for verification of the group of compute nodes.