Release Notes and Announcements
- Release Notes
- Announcements
- Release Notes
Product Introduction
Purchase Guide
- Purchase Instructions
- Purchase a TKE General Cluster
- Purchasing Native Nodes
- Purchasing a Super Node
Getting Started
Cluster Configuration
- General Cluster Overview
- Cluster Management
- Network Management
- Storage Management
- Node Management
- GPU Resource Management
- Remote Terminals
Application Configuration
- Workload Management
- Service and Configuration Management
- Component and Application Management
- Auto Scaling
- Container Login Methods
Observability Configuration
- Ops Observability
- Cost Insights and Optimization
Scheduler Configuration
- Scheduling Component Overview
- Resource Utilization Optimization Scheduling
- Business Priority Assurance Scheduling
- QoS Awareness Scheduling
Security and Stability
- TKE Security Group Settings
- Identity Authentication and Authorization
- Control Plane Security
- Application Security
- Cluster Security Enhancement Capability
Multi-cluster Management
- Planned Upgrade
- Backup Center
Cloud Native Service Guide
- Cloud Service for etcd
- TMP
- TKE Serverless Cluster Guide
- TKE Registered Cluster Guide
Use Cases
- Cluster
- Serverless Cluster
- Scheduling
- Security
- Service Deployment
- Network
- Release
- Logs
- Monitoring
- OPS
- Terraform
- DevOps
- Auto Scaling
- Containerization
- Cost Management
- Hybrid Cloud
- AI
Troubleshooting
API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Elastic Cluster APIs
- Resource Reserved Coupon APIs
- Cluster APIs
- Third-party Node APIs
- Relevant APIs for Addon
- Node Pool APIs
- Network APIs
- Node APIs
- Node Pool APIs
- TKE Edge Cluster APIs
- Cloud Native Monitoring APIs
- Scaling group APIs
- Super Node APIs
- Other APIs
- Data Types
- Error Codes
- TKE API 2022-05-01
FAQs
- TKE Standard Cluster
- TKE Serverless Cluster
- About OPS
- Hidden Danger Handling
- About Services
- Image Repositories
- About Remote Terminals
- Event FAQs
- Resource Management
Service Agreement
- TKE Service Level Agreement
- TKE Serverless Service Level Agreement
Contact Us
Glossary

PCC Device Plugin Description

다운로드

포커스 모드

폰트 크기

마지막 업데이트 시간: 2026-10-23 16:19:17

AI 번역

Component Introduction
pcc-device-plugin is a confidential computing device plugin provided by TKE. It automatically exposes the AMD SEV-SNP hardware device (/dev/sev-guest) and the PCC communication Socket (/var/run/pcc) on the node to business containers. The component is implemented based on the Kubernetes Device Plugin framework and deployed as a DaemonSet on native nodes with confidential computing enabled. It allows Pods to obtain access to confidential computing devices through standard resource requests, enabling automated scheduling and resource isolation for confidential computing workloads.
Kubernetes Objects Deployed in a Cluster
Kubernetes Object Name
Type
Requesting Resources
Associated Namespace
pcc-device-plugin
DaemonSet
CPU: 100m,Memory: 200Mi
kube-system
Limits
Only native nodes are supported. The node instance type must be an instance with AMD SEV-SNP enabled, such as the SA5 series.
The node must have the tke.cloud.tencent.com/pcc-device-plugin: "true" tag, which is automatically injected when confidential computing is enabled for the node pool.
The node must have both the /dev/sev-guest device and the /var/run/pcc directory. If either is missing, the component cannot start.
By default, each node supports up to 16 confidential computing containers running simultaneously. You can adjust this limit with the --resource-count parameter.
Each container receives the same /dev/sev-guest device mount. Device exclusivity or sharding is not supported.
Usage
Installing Components
1. Log in to the TKE console and select Cluster in the left sidebar.
2. On the cluster management page, click the target cluster ID to go to the cluster details page.
3. In the left sidebar, choose Component Management to go to the Component List page.
4. On the Component List page, click Create. On the Create Component page, select pcc-device-plugin.
5. Click Complete.
Note:
Before installation, ensure that the cluster contains native nodes with confidential computing enabled (SA5 series) and that the nodes have the tke.cloud.tencent.com/pcc-device-plugin: "true" tag.
Using Business Pods
After the component is installed, a business container can obtain confidential computing devices by declaring tke.cloud.tencent.com/pcc-device: 1 in resources.limits:
apiVersion: v1
kind: Pod
metadata:
  name: confidential-app
spec:
  nodeSelector:
    tke.cloud.tencent.com/pcc-device-plugin: "true"
  containers:
  - name: app
    image: my-confidential-app:latest
    resources:
      limits:
        tke.cloud.tencent.com/pcc-device: 1
After the container starts, it automatically receives the following mounts:
/dev/sev-guest: AMD SEV-SNP device node (read/write permission).
/var/run/pcc: PCC communication Socket directory (read/write permission).
How It Works
pcc-device-plugin runs as a DaemonSet and performs the following process after startup:
1. Device detection: Checks whether /dev/sev-guest and /var/run/pcc exist on the node, and exits if either is missing.
2. Resource registration: Registers the extended resource tke.cloud.tencent.com/pcc-device with kubelet and reports the virtual device list (16 by default).
3. Response allocation: When a Pod requests the resource, the kubelet calls the Allocate API, and the plugin mounts the device and Socket for the container.
4. Automatic recovery: Monitors the kubelet Socket directory through inotify and automatically re-registers when the kubelet restarts, requiring no manual intervention.
Command Line Arguments
Parameter
Default Value
Description
--pcc-device
/dev/sev-guest
PCC device node path.
--pcc-socket-path
/var/run/pcc
PCC communication Socket path, mounted into the container as a hostPath.
--resource-name
tke.cloud.tencent.com/pcc-device
Name of the extended resource registered with kubelet.
--resource-count
16
Number of virtual devices declared on the node, which is the maximum number of concurrent confidential computing containers per node.
--v
0
Log verbosity level. DaemonSet passes 1 by default.
Troubleshooting
Symptom
Possible cause
Troubleshooting method
Pod remains Pending, with the message "Insufficient tke.cloud.tencent.com/pcc-device".
Plugin not running or not registered successfully.
Run kubectl -n kube-system get ds pcc-device-plugin to check the DaemonSet status, and view the plugin logs to confirm whether "Registered device plugin with Kubelet" is output.
The plugin is in CrashLoopBackOff, and the logs report "detect device /dev/sev-guest failed".
Node is not an SEV-SNP instance.
Run ls /dev/sev-guest on the node to confirm that the device exists. This plugin should not be scheduled on non-confidential computing instance types.
The plugin is in CrashLoopBackOff, and the logs report "detect socket path /var/run/pcc failed".
The /var/run/pcc directory is not created on the node.
Run ls /var/run/pcc on the node to confirm that the directory exists.
After the business Pod starts, /dev/sev-guest cannot be read from or written to.
The DaemonSet lacks privileged permissions.
Check whether securityContext.privileged is set to true in the DaemonSet configuration.
After kubelet restarts, the Pod cannot be scheduled to this resource.
inotify monitoring not effective.
Check whether "inotify: ...kubelet.sock created, restarting." appears in the plugin logs. Under normal conditions, the plugin automatically re-registers.
Verify whether the resource is registered successfully:
kubectl describe node <node-name> | grep -A5 "Allocatable:"
# You should see:
#   tke.cloud.tencent.com/pcc-device:  16
﻿

도움말 및 지원

문제 해결에 도움이 되었나요?

더 자세한 내용은 문의하기 또는 티겟 제출 을 통해 문의할 수 있습니다.

피드백

tencent cloud

Tencent Kubernetes Engine

PCC Device Plugin Description

Component Introduction

Kubernetes Objects Deployed in a Cluster

Limits

Usage

Installing Components

Using Business Pods

How It Works

Command Line Arguments

Troubleshooting

도움말 및 지원

Kubernetes Object Name	Type	Requesting Resources	Associated Namespace
pcc-device-plugin	DaemonSet	CPU: 100m,Memory: 200Mi	kube-system

Parameter	Default Value	Description
--pcc-device	/dev/sev-guest	PCC device node path.
--pcc-socket-path	/var/run/pcc	PCC communication Socket path, mounted into the container as a hostPath.
--resource-name	tke.cloud.tencent.com/pcc-device	Name of the extended resource registered with kubelet.
--resource-count	16	Number of virtual devices declared on the node, which is the maximum number of concurrent confidential computing containers per node.
--v	0	Log verbosity level. DaemonSet passes 1 by default.

Symptom	Possible cause	Troubleshooting method
Pod remains Pending, with the message "Insufficient tke.cloud.tencent.com/pcc-device".	Plugin not running or not registered successfully.	Run `kubectl -n kube-system get ds pcc-device-plugin` to check the DaemonSet status, and view the plugin logs to confirm whether "Registered device plugin with Kubelet" is output.
The plugin is in CrashLoopBackOff, and the logs report "detect device /dev/sev-guest failed".	Node is not an SEV-SNP instance.	Run `ls /dev/sev-guest` on the node to confirm that the device exists. This plugin should not be scheduled on non-confidential computing instance types.
The plugin is in CrashLoopBackOff, and the logs report "detect socket path /var/run/pcc failed".	The /var/run/pcc directory is not created on the node.	Run `ls /var/run/pcc` on the node to confirm that the directory exists.
After the business Pod starts, /dev/sev-guest cannot be read from or written to.	The DaemonSet lacks privileged permissions.	Check whether securityContext.privileged is set to true in the DaemonSet configuration.
After kubelet restarts, the Pod cannot be scheduled to this resource.	inotify monitoring not effective.	Check whether "inotify: ...kubelet.sock created, restarting." appears in the plugin logs. Under normal conditions, the plugin automatically re-registers.