Chapter 2. New features and enhancements

Azure integrity-protected pod VM image

A Red Hat-created image is now enabled by default for sandboxed containers and Confidential Containers running on Azure, enhancing the security of container and VM images.

Google Cloud now supports binding resource tags to pod VM instances.

Users can set tags via the TAGS field in the peer-pods-cm ConfigMap. Tags must exist at the project level before they can be applied.

Confidential Containers on Azure

This release enables General Availability (GA) support for running Confidential Containers on all Azure confidential VM types (Intel TDX, AMD SEV-SNP) in self-managed OpenShift clusters. This allows OpenShift sandboxed containers (Kata-based pods) to run in hardware-isolated CVMs with memory encryption, verified through remote attestation using the Red Hat build of Trustee, with support for sealed secrets provisioning inside the CVM after successful attestation.