The plan is calculated into a PCR of the Confidential VM's vTPM (and that is matched in the key release policy to the KMS While using the predicted plan hash for the deployment) and enforced by a hardened container runtime hosted within Just about every instance. The runtime monitors instructions through the Kubernetes Manage airplane, and makes