Hardware memory encryption and protection for containers

1. A computer-implemented method for securing container workloads, the computer-implemented method comprising:

encrypting, by one or more processors, workload binaries of a workload;

uploading, by the one or more processors, the workload binaries to a software repository;

encrypting, by the one or more processors, a workload definition;

replacing, by the one or more processors, the workload definition with a mock workload definition;

referencing, by the one or more processors, the encrypted workload definition in the mock workload definition; and

submitting, by the one or more processors, the mock workload definition to a master node.

2. The computer-implemented method of claim 1 , further comprising:

building, by the one or more processors, the workload binaries of the workload.

3. The computer-implemented method of claim 1 , further comprising:

generating, by the one or more processors, the workload definition.

4. The computer-implemented method of claim 1 , further comprising:

generating, by the one or more processors, a set of virtual machine configuration parameters based on requirements of the workload; and

referencing, by the one or more processors, the set of virtual machine configuration parameters in the mock workload definition.

5. The computer-implemented method of claim 1 , wherein the workload binaries and the workload definition are encrypted with encryption keys accessible exclusively to a secure virtual machine.

6. The computer-implemented method of claim 4 , wherein the requirements of the workload are defined by a user through a user interface on a computing device.

7. The computer-implemented method of claim 4 , further comprising:

responsive to the master node selecting a worker node for the workload based on the set of virtual machine configuration parameters in the mock workload definition, launching, by the one or more processors, a secure virtual machine within the worker node;

decrypting, by the one or more processors, within the secure virtual machine, the workload definition;

downloading, by the one or more processors, within the secure virtual machine, the workload binaries from the software repository using the decrypted workload definition;

decrypting, by the one or more processors, within the secure virtual machine, the workload binaries;

replacing, by the one or more processors, within the secure virtual machine, the mock workload definition and mock workload binaries with the decrypted workload definition and decrypted workload binaries; and

executing, by the one or more processors, within the secure virtual machine, the workload.

8. A computer program product for securing container workloads, the computer program product comprising:

one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:

program instructions to encrypt workload binaries for a workload;

program instructions to upload the workload binaries to a software repository;

program instructions to encrypt a workload definition;

program instructions to replace the workload definition with a mock workload definition;

program instructions to reference the encrypted workload definition in the mock workload definition; and

program instructions to submit the mock workload definition to a master node.

9. The computer program product of claim 8 , further comprising:

program instructions to build the workload binaries of the workload.

10. The computer program product of claim 8 , further comprising:

program instructions to generate the workload definition.

11. The computer program product of claim 8 , further comprising:

program instructions to generate a set of virtual machine configuration parameters based on requirements of the workload; and

program instructions to reference the set of virtual machine configuration parameters in the mock workload definition.

12. The computer program product of claim 8 , wherein the workload binaries and the workload definition are encrypted with encryption keys accessible exclusively to a secure virtual machine.

13. The computer program product of claim 11 , wherein the requirements of the workload are defined by a user through a user interface on a computing device.

14. The computer program product of claim 11 , further comprising:

responsive to the master node selecting a worker node for the workload based on the set of virtual machine configuration parameters in the mock workload definition, program instructions to launch a secure virtual machine within the worker node;

program instructions to decrypt, within the secure virtual machine, the workload definition;

program instructions to download, within the secure virtual machine, the workload binaries from the software repository using the decrypted workload definition;

program instructions to decrypt, within the secure virtual machine, the workload binaries;

program instructions to replace, within the secure virtual machine, the mock workload definition and mock workload binaries with the decrypted workload definition and decrypted workload binaries; and

program instructions to execute, within the secure virtual machine, the workload.

15. A computer system for securing container workloads, the computer system comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:

program instructions to encrypt workload binaries for a workload;

program instructions to upload the workload binaries to a software repository;

program instructions to encrypt a workload definition;

program instructions to replace the workload definition with a mock workload definition;

program instructions to reference the encrypted workload definition in the mock workload definition; and

program instructions to submit the mock workload definition to a master node.

16. The computer system of claim 15 , further comprising:

program instructions to build the workload binaries of the workload.

17. The computer system of claim 15 , further comprising:

program instructions to generate the workload definition.

18. The computer system of claim 15 , further comprising:

program instructions to generate a set of virtual machine configuration parameters based on requirements of the workload; and

program instructions to reference the set of virtual machine configuration parameters in the mock workload definition.

19. The computer system of claim 15 , wherein the workload binaries and the workload definition are encrypted with encryption keys accessible exclusively to a secure virtual machine.

20. The computer system of claim 18 , further comprising:

responsive to the master node selecting a worker node for the workload based on the set of virtual machine configuration parameters in the mock workload definition, program instructions to launch a secure virtual machine within the worker node;

program instructions to decrypt, within the secure virtual machine, the workload definition;

program instructions to download, within the secure virtual machine, the workload binaries from the software repository using the decrypted workload definition;

program instructions to decrypt, within the secure virtual machine, the workload binaries;

program instructions to replace, within the secure virtual machine, the mock workload definition and mock workload binaries with the decrypted workload definition and decrypted workload binaries; and

program instructions to execute, within the secure virtual machine, the workload.