diff --git a/content/patterns/coco-pattern/_index.adoc b/content/patterns/coco-pattern/_index.adoc index db899b77d..b349936e2 100644 --- a/content/patterns/coco-pattern/_index.adoc +++ b/content/patterns/coco-pattern/_index.adoc @@ -24,7 +24,7 @@ include::modules/comm-attributes.adoc[] = About coco-pattern Confidential computing is a technology for securing data in use. It uses a https://en.wikipedia.org/wiki/Trusted_execution_environment[Trusted Execution Environment] provided within the hardware of the processor to prevent access from others who have access to the system. -https://confidentialcontainers.org/[Confidential containers] is a project to standardize the consumption of confidential computing by making the security boundary for confidential computing to be a Kubernetes pod. [Kata containers](https://katacontainers.io/) is used to establish the boundary via a shim VM. +https://confidentialcontainers.org/[Confidential containers] is a project to standardize the consumption of confidential computing by making the security boundary for confidential computing to be a Kubernetes pod. https://katacontainers.io/[Kata containers] is used to establish the boundary via a shim VM. A core goal of confidential computing is to use this technology to isolate the workload from both Kubernetes and hypervisor administrators. diff --git a/content/patterns/coco-pattern/coco-pattern-getting-started.adoc b/content/patterns/coco-pattern/coco-pattern-getting-started.adoc index 86fbcd1a2..2f71002de 100644 --- a/content/patterns/coco-pattern/coco-pattern-getting-started.adoc +++ b/content/patterns/coco-pattern/coco-pattern-getting-started.adoc @@ -42,7 +42,7 @@ Logging into azure once the pods have been provisioned will show that each of th === `oc exec` testing -In a OpenShift cluster without confidential containers, Role Based Access Control (RBAC), may be used to prevent users from execing into a container to mutate it. +In a OpenShift cluster without confidential containers, Role Based Access Control (RBAC), may be used to prevent users from using `oc exec` to access a container container to mutate it. However: 1. Cluster admins can always circumvent this capability