Update docs for coco GA release

[a-mccarthy]

No description provided.

[github-actions]

Documentation preview

https://nvidia.github.io/cloud-native-docs/review/pr-365

[fitzthum]

A few comments on the attestation stuff.

[Copilot]

Pull request overview

Updates the documentation set to reflect the Confidential Containers (CoCo) GA / Reference Architecture release, including new pages and updated navigation/redirects to surface the new content.

Changes:

• Updated GPU Operator docs navigation and redirects to point to new Confidential Containers deployment content.
• Added new Confidential Containers documentation pages (deploy guide, attestation, licensing, supported platforms).
• Refreshed the Confidential Containers overview content to remove Early Access framing and expand details.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
repo.toml	Updates redirect rules related to Confidential Containers pages.
gpu-operator/index.rst	Adds a nav entry to the new GPU Operator Confidential Containers page.
gpu-operator/getting-started.rst	Minor formatting-only adjustment in a table row.
gpu-operator/confidential-containers-deploy.rst	New GPU Operator page linking out to the Confidential Containers RA docs.
confidential-containers/index.rst	Updates Confidential Containers landing page nav and cards for GA structure.
confidential-containers/overview.rst	Reworks overview content to GA/RA framing and expands sections.
confidential-containers/supported-platforms.rst	New supported platforms and component versions page.
confidential-containers/confidential-containers-deploy.rst	New end-to-end deployment guide for CoCo with GPU Operator + Kata.
confidential-containers/attestation.rst	New attestation configuration page (Trustee + NVIDIA verifier).
confidential-containers/licensing.rst	New licensing info page for NVIDIA Confidential Computing capability.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dcmiddle]

Suggested change

	Security Considerations
	Application Security Defects: Confidential Computing does not protect against threats within the confidential VM including vulnerabilities in the Application itself. Applications must still follow security best practices such as input validation.
	Control Plane: CoCo provides a number of protections to limit the influence of the K8s Control Plane. Applications may expose themselves to attack if they rely upon control plane managed configuration.
	Environment Variables and ConfigMaps: Unless provisioned as sealed secrets using Trustee, orchestrator-provided environment variables and ConfigMaps remain untrusted and susceptible to manipulation.
	Storage and Volume Mounts: Manipulating volume mounts can expose the workload to malicious untrusted host storage or deny access to required persistent data.
	Physical Attacks: Confidential Computing considers most physical attacks out of scope. Your kubernetes hosts should be in physically secure datacenters.
	Availability: Confidential Computing does not provide availability guarantees. Availability is achieved through replication which is a common aspect of k8s deployments.

[dcmiddle]

Suggested change

	Configuring only some GPUs on a node for Confidential Computing is not supported.
	Configuring only some GPUs on a node for Confidential Computing is not supported.
	CoCo provides its own virtualization based on Kata Containers. CoCo cannot run within an existing virtualized environment, i.e., nested virtualization is not supported. CoCo must be installed on the host not within a guest VM.

[a-mccarthy]

test

[a-mccarthy]

test

[chenopis]

Documentation Review — 13 findings (1 critical)

Critical issues must be resolved before merge.

Review generated with AI assistance.

[chenopis]

Low — Duplicate content: This same limitation note ("all GPUs on the host must be configured...") also appears verbatim in the Limitations section at line 213 below. Consider removing one instance to avoid duplication within the same page. (The note also appears in supported-platforms.rst, which is fine for cross-page emphasis.)

[dcmiddle]

nit

Suggested change

	When using NVIDIA Hopper nodes for multi-GPU passthrough, transition your relevant node's GPU Confidential Computing mode to ``ppcie`` mode by adding the ``nvidia.com/cc.mode=ppcie`` label.
	When using NVIDIA Hopper nodes for multi-GPU passthrough, transition your relevant node's GPU Confidential Computing mode to ``ppcie`` mode by applying the ``nvidia.com/cc.mode=ppcie`` label.

[dcmiddle]

HGX is a platform type which can have hopper or blackwell.

Suggested change

	- Enable Confidential Containers with multi-GPU passthrough on HGX GPUs.
	- Enable Confidential Containers with multi-GPU passthrough for Hopper GPUs.

[dcmiddle]

/Containers/Computing

The CC mode is the Confidential Computing mode of the GPU