Leveraging hardware-based attestation to grant workloads access to confidential data

A non-transitory computer readable storage medium having stored thereon program code executable by a control plane element of a workload orchestration platform implemented in a virtualized environment, the program code causing the control plane element to execute a method comprising:

• attaching an encrypted virtual disk to a worker VM designated to execute a workload component of a workload, the encrypted virtual disk including data needed by the workload component for carrying out its processing;
• receiving, from the worker VM, a digital certificate assigned to the worker VM by a trust authority, the digital certificate including a digital signature signed by the trust authority and indicating that the trust authority has successfully validated the worker VM using hardware-based attestation;
• and
• verifying the digital certificate using a public key of the trust authority, wherein once the digital certificate verified, the worker VM retrieves a data decryption key and uses the data decryption key to decrypt the encrypted virtual disk.

A host system executing a control plane element of a workload orchestration platform implemented in a virtualized environment, the host system comprising:

• a processor;
• and
• a non-transitory computer readable medium having stored thereon program code that, when executed, causes the processor to:
• attach an encrypted virtual disk to a worker VM designated to execute a workload component of a workload, the encrypted virtual disk including data needed by the workload component for carrying out its processing;
• receive, from the worker VM, a digital certificate assigned to the worker VM by a trust authority, the digital certificate including a digital signature signed by the trust authority and indicating that the trust authority has successfully validated the worker VM using hardware-based attestation;
• and
• verify the digital certificate using a public key of the trust authority, wherein once the digital certificate verified, the worker VM retrieves a data decryption key and uses the data decryption key to decrypt the encrypted virtual disk.