The plan is calculated into a PCR of your Confidential VM's vTPM (that's matched in the key release coverage about the KMS Using the predicted policy hash for that deployment) and enforced by a hardened container runtime hosted in Each and every occasion. The runtime monitors instructions from your Kubernetes Manage aircraft, and ensures that onl