Add RuntimeClass support for confidential workloads on KubeEdge

What would you like to be added/modified:

KubeEdge currently does not provide complete RuntimeClass support for workloads running on edge nodes.

This enhancement aims to enable end-to-end RuntimeClass support in KubeEdge and validate it with confidential container runtimes.

The proposed scope includes:

• Investigate the Kubernetes RuntimeClass workflow and identify missing components in KubeEdge.
• Support RuntimeClass resource synchronization from cloud side to edge nodes.
• Enable edge workloads to use spec.runtimeClassName.
• Ensure Edged can correctly select the configured container runtime handler.
• Validate RuntimeClass with alternative runtimes such as:
  • Kata Containers
  • Confidential Containers ecosystem runtimes

The implementation should consider:

• CloudCore
• EdgeCore
• MetaManager
• MetaServer
• Edged
• Container Runtime Interface integration

Optional validation may include confidential computing platforms such as Intel TDX when suitable infrastructure is available.

Why is this needed:

Confidential computing and workload isolation are becoming increasingly important for edge scenarios.

Kubernetes already provides RuntimeClass as the standard mechanism for selecting different runtime environments, but KubeEdge edge workloads currently cannot fully leverage this capability.

Supporting RuntimeClass will provide a foundation for secure and isolated workloads at the edge, enabling scenarios such as confidential containers, stronger workload isolation, and hardware-assisted security.

Expected outcome / acceptance criteria:

• RuntimeClass resource synchronization works between Kubernetes control plane and KubeEdge edge nodes.
• Edge workloads can specify and use RuntimeClass through spec.runtimeClassName.
• Alternative runtime handlers can be selected correctly on edge nodes.
• Missing or invalid RuntimeClass configurations are handled gracefully.
• Unit tests and end-to-end tests are added.
• Documentation is provided describing how to deploy RuntimeClass-based workloads on KubeEdge.
• Confidential container runtime validation is demonstrated when available.

References:

• #6334 v1.20 kubeedge do not support the runtimeclass
• #4416 RuntimeClass support discussion