Quantum-Ready Kubernetes: How Do We Get There?

Quantum-Ready Kubernetes: How Do We Get There?

Speakers: Natalie Fischer, Product Manager, VMware by Broadcom; Nigel Jones, IBM Research; Thomas Koson, Chief PKI Officer, Keyfactor; Ricardo, Lead Platforms Infrastructure Team, CERN; Nikita, Principal Engineer, Broadcom (Moderator)

Conference: KubeCon EU

YouTube: https://www.youtube.com/watch?v=OAb54JRIS6M

Overview

This KubeCon EU panel delves into the complex and rapidly evolving intersection of quantum computing and Kubernetes. Moderated by Nikita from Broadcom, the discussion brought together experts from VMware, IBM Research, Keyfactor, and CERN to explore the pressing need to make the Kubernetes and cloud-native ecosystem "quantum-safe." While artificial intelligence (AI) currently dominates the technology conversation, the panelists underscored the critical importance of addressing quantum threats and opportunities now, before they become an insurmountable challenge. The core focus revolved around two major themes: fortifying existing cryptographic infrastructure against future quantum attacks and understanding how Kubernetes can effectively orchestrate emerging quantum workloads.

The talk highlights that quantum computing is no longer a purely theoretical pursuit but a developing field with real-world applications and services already in play. Panelists emphasized that the implications for cybersecurity, particularly asymmetric cryptography, are profound, necessitating a proactive and agile approach to cryptographic transitions. Concurrently, they explored the practicalities of integrating quantum processing into existing cloud-native architectures, demonstrating how Kubernetes is poised to become a foundational orchestration layer for hybrid classical-quantum computing environments. This article synthesizes their insights, offering a detailed technical perspective on the journey towards quantum readiness in the cloud-native world.

Background

▶ Watch: Introduction: Quantum computing's impact on Kubernetes (0:00)

The advent of quantum computing poses a significant existential threat to much of the cryptographic infrastructure underpinning modern digital security. As Thomas Koson, Chief PKI Officer at Keyfactor, succinctly put it, "almost all security in Kubernetes... relies on asymmetric cryptography," including mTLS (Mutual Transport Layer Security), digital signatures, JSON Web Tokens, and code signing. Algorithms like RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman form the bedrock of this security, yet they are vulnerable to sufficiently powerful quantum computers running Shor's algorithm. This algorithm can efficiently solve the mathematical problems (integer factorization and discrete logarithms) on which these widely used cryptographic schemes depend, rendering them insecure.

The urgency of this transition is not merely theoretical. Nigel Jones from IBM Research pointed out that the US government issued an announcement in 2022, mandating support for quantum computing by 2035. This directive has spurred significant research and development into Post-Quantum Cryptography (PQC), which refers to cryptographic algorithms designed to be secure against both classical and quantum computers. The National Institute of Standards and Technology (NIST) has been at the forefront of this effort, standardizing the first quantum-safe algorithms in August 2023. This standardization marks a critical turning point, moving PQC from academic research to practical implementation.

The panel acknowledged that while the "quantum hype" might not be as pervasive as the AI hype, the development of quantum systems is rapid. IBM, for example, already offers quantum services in the cloud, allowing early adopters to experiment. CERN, as Ricardo explained, has been engaged in quantum computing for several years, leading initiatives like the Open Quantum Institute in Europe and the Quantum Technology Initiative (now in Phase 2). These efforts focus not only on algorithm development and use-case identification but also on the practical challenges of managing and deploying quantum workloads efficiently and cost-effectively. The looming threat of "harvest now, decrypt later" attacks, where encrypted data is captured today with the intention of decrypting it once quantum computers are powerful enough, further underscores the immediate need for action, particularly for high-value, long-lived data.

Key Findings

▶ Watch: Quantum computing: Hype vs. real-world applications (2:10)

The panel discussion crystallized several key findings regarding the path to quantum-ready Kubernetes:

1. Hybrid Future: Quantum computing will not replace classical computing but will augment it. The future will be a hybrid world where specialized quantum processors handle specific computational tasks, while classical systems continue to manage the vast majority of operations, including pre-processing, post-processing, and orchestration. This necessitates seamless integration between classical and quantum environments.

1. Urgent Cryptographic Transition: The shift to post-quantum cryptography (PQC) is imperative and cannot be delayed. Existing asymmetric cryptographic algorithms are fundamentally vulnerable to future quantum attacks, requiring a comprehensive update across all layers of the cloud-native stack, from TLS to digital signatures. NIST's standardization of PQC algorithms provides a crucial foundation for this transition.

1. Kubernetes as the Orchestration Hub: Kubernetes is expected to play an integral, even critical, role in managing and orchestrating quantum workloads. Its capabilities for container orchestration, resource management, and service integration make it a natural fit for handling the complex hybrid workflows involving quantum processors, despite the current physical separation of quantum hardware.

1. Challenges in Standardization and Integration: Significant challenges remain in the integration of quantum computing, particularly concerning the lack of standardization. This includes inconsistent APIs from quantum hardware providers, varied methods for defining and costing quantum workloads, and algorithms often being tailored to specific quantum devices. This fragmentation hinders broad adoption and efficient resource management.

1. Importance of Cryptographic Agility and Inventory: Organizations must develop cryptographic agility, enabling rapid switching of cryptographic primitives without extensive re-engineering. This is complemented by the need for a comprehensive cryptographic inventory, perhaps through C-SBOMs (Cryptography Bill of Materials), to understand current cryptographic usage and prioritize migration efforts effectively.

1. Community and Education are Key: Given the nascent stage of quantum readiness, active participation in open-source projects (like PQCA, OpenSSL) and educational initiatives is crucial. New contributors, even those without deep quantum expertise, can bring fresh perspectives and accelerate progress by highlighting complexities and improving documentation.

Technical Deep Dive

▶ Watch: US government mandate and practical industry applications (4:20)

The technical discussion during the panel covered two primary areas: the implementation of post-quantum cryptography within cloud-native environments and the practicalities of running quantum workloads on Kubernetes.

Post-Quantum Cryptography (PQC) Integration

The shift to PQC involves significant technical considerations. Thomas Koson highlighted that cryptographic agility is paramount, meaning projects "can't hardcode for RSA or EC anymore; it has to be configurable so it's easy to update." This requires software components to support multiple cryptographic algorithms and allow for dynamic selection.

Nigel Jones expanded on the active development in this area, mentioning the Post-Quantum Cryptography Association (PQCA), a Linux Foundation project. This association is working on high-assurance implementations of standard-track algorithms like ML-DSA (Module-Lattice-based Digital Signature Algorithm) and ML-KEM (Module-Lattice-based Key Encapsulation Mechanism). These lattice-based algorithms are among the primary candidates for quantum-safe asymmetric cryptography.

Key technical challenges with PQC algorithms include:

• Increased Key and Packet Sizes: PQC algorithms often generate larger keys and require larger packet sizes for operations like key exchange. As Nigel Jones noted, this "can increase resource sizes and CPU," potentially impacting performance, especially for "very small transactions or very high volume" applications. While for some applications this won't matter, for others, the impact could be substantial, requiring early testing.
• Hybrid Schemes: Many initial deployments of PQC are expected to use hybrid schemes. These combine traditional, well-understood cryptography (e.g., elliptic curves) with new quantum-safe algorithms. This approach offers a fallback to classical security if PQC algorithms are found to have unforeseen vulnerabilities, and it helps manage the performance implications of larger PQC primitives.
• Software Stack Updates: The transition requires widespread updates across the software stack. OpenSSL, a foundational cryptographic library, is a critical dependency. OpenSSL 3.5, for example, is anticipated to add support for some PQC algorithms, which will then "filter up through the stack" to applications and platforms that rely on it. This necessitates that project maintainers are aware of these dependencies and integrate PQC support into their components.
• TLS 1.3 as a Prerequisite: Thomas Koson identified TLS 1.3 as a prerequisite for quantum readiness. Its modern design and improved cryptographic agility make it a better foundation for incorporating new PQC algorithms compared to older TLS versions. Organizations still on TLS 1.2 or earlier face a significant uplift.

Running Quantum Workloads on Kubernetes

Ricardo from CERN provided concrete examples of how quantum computing is being applied and the role Kubernetes plays in these scenarios. CERN's initiatives, such as the Quantum Technology Initiative, focus on identifying use cases and managing quantum workloads efficiently.

Specific applications at CERN include:

• Beam Calibration: Calibrating proton beams in large particle accelerators is a complex, real-time task. Quantum algorithms have been explored and validated for this purpose, demonstrating tangible benefits.
• Quantum Machine Learning (QML): QML is being investigated for data analysis, particularly for events like Higgs boson analysis. The challenge often lies in the "dimensionality of the problem not being adapted to the current hardware we have for quantum computers." This leads to hybrid classical-quantum scenarios, where traditional machine learning algorithms perform dimensionality reduction, and quantum algorithms handle the subsequent, more specialized steps.

From a platform perspective, the integration of these hybrid workflows into Kubernetes is crucial:

• Hybrid Orchestration: Kubernetes is essential for orchestrating these complex workflows, managing the classical pre-processing and post-processing steps alongside the quantum computations. This involves delegating parts of the analysis to remote quantum computers, fetching results, and integrating them back into the classical analysis pipeline.
• Remote Quantum Computers: Quantum computers are not typically located on-site and are accessed remotely, often via cloud services. This necessitates a High-Performance Computing (HPC)-like model where workloads are sent to remote quantum devices, and results are fetched back. Kubernetes' capabilities in managing distributed workloads and external service integrations are vital here.
• Provider Perspective: Nigel Jones emphasized that for providers offering quantum services, Kubernetes is "critical." The actual quantum computation is a small part of the overall service. Kubernetes manages the "lot of pre-processing, there's a lot of post-processing that occurs, there's a lot of control... whether it's CI/CD process, whether it's logging, whether it's authentication." This mirrors how Kubernetes became the de facto orchestrator for AI/ML workloads, adapting to new computational paradigms without reinventing the entire cloud-native stack.

Orchestration Challenges

Despite Kubernetes' flexibility, integrating quantum computing presents unique challenges, as highlighted by Ricardo:

• Multicluster/Hybrid Deployments: The remote nature of quantum hardware exacerbates existing issues in multicluster and hybrid cloud deployments. The interfaces provided by quantum hardware are not standardized, differing significantly between providers.
• Lack of Standardization in Workload Definition and Costing: There is "no standard across for defining units of computation across the different quantum computers." This makes procuring resources and understanding costs extremely difficult.
• Device-Specific Algorithms: Many quantum algorithms are "suited to specific devices" or specific implementations, leading to vendor lock-in and complicating workload portability and scheduling.
• Scarcity of Hardware: Similar to the current scarcity of GPUs for AI, quantum computers are rare and expensive resources, making access and time allocation a significant challenge.

These technical hurdles underscore the need for continued research, standardization efforts, and community collaboration to make quantum computing truly accessible and manageable within cloud-native ecosystems.

Demo / Proof of Concept

▶ Watch: Quantum's impact on Kubernetes security and cryptography (5:40)

While the panel discussed various real-world applications and tools, no live demonstration or specific proof of concept was performed during the session. However, Nigel Jones mentioned Kiskit, an open-source toolkit for developing quantum applications, which is widely available and allows users to experiment with quantum programming. Kiskit is an example of an open-source tool that can be used to develop quantum applications that work with multiple quantum backends. The panelists encouraged interested individuals to explore such toolkits to gain practical experience with quantum computing concepts and algorithms.

Defensive Implications

▶ Watch: Community and open-source efforts in post-quantum cryptography (7:50)

The insights from the panel provide clear directives for cybersecurity defenders and platform engineers preparing for the quantum era. The primary defensive implication is the urgent need for a strategic and comprehensive transition to post-quantum cryptography (PQC).

1. Conduct a Cryptographic Inventory with C-SBOMs: The first critical step is to understand what cryptographic algorithms are currently in use across all systems, applications, and data. Nigel Jones emphasized the importance of a C-SBOM (Cryptography Bill of Materials), an augmentation of the traditional SBOM that provides detailed information about cryptographic usage. This inventory is essential for identifying vulnerabilities and prioritizing migration efforts.

1. Prioritize Data Based on Risk and Lifespan: Not all data requires immediate PQC protection. Defenders must assess the risk of "harvest now, decrypt later" attacks, focusing on high-value data with a long lifetime (e.g., sensitive personal data, intellectual property, state secrets) that could still be valuable in 5-10 years. Shorter-lived data may not require the same immediate attention. This risk-based approach allows for a phased and pragmatic migration strategy.

1. Embrace Cryptographic Agility: Future-proofing systems requires cryptographic agility. As Thomas Koson highlighted, applications and platforms must move away from hardcoding specific algorithms like RSA or ECC. Instead, they need to be designed with configurable cryptographic primitives, allowing for easy updates and switching to new PQC algorithms as they mature or if existing ones are compromised. This involves adopting flexible cryptographic libraries and protocols.

1. Modernize Infrastructure to TLS 1.3: A foundational step for cryptographic agility is ensuring that TLS 1.3 is widely adopted. TLS 1.3 offers enhanced security and improved cryptographic flexibility compared to older versions, making it a more suitable base for integrating PQC algorithms. Organizations still relying on older TLS versions face a significant upgrade effort.

1. Engage with Open-Source PQC Development: Defenders and developers should actively participate in and monitor open-source projects focused on PQC, such as the Post-Quantum Cryptography Association (PQCA) and the integration efforts within projects like OpenSSL (e.g., OpenSSL 3.5). Contributing to these efforts, even through documentation or testing, can accelerate the availability of robust PQC implementations.

1. Prepare Kubernetes for Hybrid Workloads: For organizations planning to leverage quantum computing, platform engineers must prepare Kubernetes to orchestrate hybrid classical-quantum workloads. This involves understanding how to integrate remote quantum services, manage data flow between classical and quantum environments, and adapt scheduling primitives to accommodate specialized quantum resources. Addressing the lack of standardization in quantum hardware APIs will be a key challenge.

1. Educate Teams on Quantum Threats and PQC: Building internal expertise is crucial. Teams need to understand the fundamentals of quantum computing, the specific threats it poses to current cryptography, and the principles of PQC. This education will foster a proactive security culture capable of navigating the complex transition ahead.

Key Takeaways

• Quantum Augments, Not Replaces: Quantum computing will not entirely replace classical systems but will serve as a powerful augmentation, tackling specialized computational problems within a hybrid classical-quantum architecture.
• PQC Transition is Urgent: The shift to Post-Quantum Cryptography (PQC) is a critical and immediate imperative to secure data against future quantum attacks, particularly for high-value, long-lived information.
• Kubernetes as the Orchestration Layer: Kubernetes is poised to become the foundational platform for orchestrating complex hybrid quantum workloads, managing everything from pre- and post-processing to control, CI/CD, and authentication for quantum services.
• Cryptographic Agility is Essential: Organizations must prioritize cryptographic agility by designing systems that can easily update and switch cryptographic algorithms, moving away from hardcoded implementations to configurable primitives.
• Standardization is Key for Adoption: The lack of standardization in quantum hardware interfaces, workload definitions, and costing models presents significant challenges to integrating quantum computing at scale, requiring collaborative industry efforts.
• Proactive Community Engagement: Active participation in open-source PQC initiatives (e.g., PQCA, OpenSSL) and advocating for a dedicated CNCF forum for quantum discussions are crucial for accelerating quantum readiness in the cloud-native ecosystem.

About the Speaker(s)

The panel featured a diverse group of experts at the forefront of quantum computing and cloud-native technologies:

• Nikita (Moderator): A Principal Engineer at Broadcom with extensive experience in the Kubernetes space, who has developed a keen interest in quantum computing and moderated this discussion.
• Natalie Fischer: A Product Manager at VMware by Broadcom, working alongside Nikita on the Kubernetes area stack, contributing expertise on cloud-native product development.
• Nigel Jones: An expert from IBM Research, deeply involved in post-quantum cryptography and quantum services, as well as the intersection with AI. He provided insights into PQC standardization and IBM's quantum offerings.
• Thomas Koson: The Chief PKI Officer at Keyfactor, bringing 30 years of experience in cybersecurity, Public Key Infrastructure (PKI), and open source. He emphasized the fundamental threat of quantum computing to current asymmetric cryptography.
• Ricardo: Leads the Platforms Infrastructure team at CERN, responsible for cloud-native and machine learning deployments. He is now actively involved in managing quantum computing, sharing real-world use cases and the challenges of integrating quantum workloads into existing infrastructure.