With the amount of new subnets being added it can be hard to get up to date information across all subnets, so data may be slightly out of date from time to time
With the amount of new subnets being added it can be hard to get up to date information across all subnets, so data may be slightly out of date from time to time
KubeTEE AI (Bittensor Subnet 90) is the AI Factory of the Bittensor network. Its core mission is to transform decentralised GPU clusters spread across the globe into a single, unified, confidential AI factory — one where AI training, inference, and data-processing workloads execute inside hardware-secured Trusted Execution Environments (TEE) and never leave that confidential boundary. Every job is protected at rest, in transit, and in use, with cryptographic proof that the exact expected code is what ran on your data.
Workloads are submitted as batch jobs to Armada — a CNCF Sandbox multi-cluster Kubernetes batch scheduler — which dispatches them across registered miner clusters. Each miner cluster is identified by a permanent Bittensor hotkey/coldkey pair and must run Intel TDX-compatible hardware with NVIDIA GPUs. Jobs execute as Kubernetes pods under a confidential runtimeClassName, hardware-isolated inside Kata Containers and attested via Confidential Containers (CoCo) with Trustee/KBS remote attestation. Production runtime classes are kata-qemu-nvidia-gpu-tdx-runtime-rs for GPU workloads and kata-qemu-tdx-runtime-rs for CPU-only jobs — both with guest debug disabled and attestation enforced.
The entire Kubernetes baseline runs on RKE2, which is FIPS-140-2 validated today (FIPS-140-3 is a Phase 3 target), and multi-cluster management is handled by Rancher Fleet with GitOps-based deployment. Miners earn Bittensor emissions for providing verified confidential compute; no attestation means no emissions — TEE compliance is enforced by the validator, not requested. Validators score miners on infrastructure readiness, TEE attestation health, Armada job-execution quality, uptime, and competitive pricing benchmarked against peer Bittensor compute subnets.
What sets SN90 apart from every other Bittensor compute subnet is its uncompromising security posture. A confidential pod is not a namespaced process on the host — it is a virtual machine with an encrypted, attested memory boundary. KubeTEE solved the hard engineering problems (multi-GPU NVSwitch passthrough, cold-start latency, CSI storage semantics, attestation-gated TLS, FIPS compliance) so that organisations running regulated or sensitive workloads can prove to auditors and customers that their data and models were never accessible to the infrastructure operator, the cloud provider, or any other party outside the TEE boundary.
KubeTEE AI (Bittensor Subnet 90) is the AI Factory of the Bittensor network. Its core mission is to transform decentralised GPU clusters spread across the globe into a single, unified, confidential AI factory — one where AI training, inference, and data-processing workloads execute inside hardware-secured Trusted Execution Environments (TEE) and never leave that confidential boundary. Every job is protected at rest, in transit, and in use, with cryptographic proof that the exact expected code is what ran on your data.
Workloads are submitted as batch jobs to Armada — a CNCF Sandbox multi-cluster Kubernetes batch scheduler — which dispatches them across registered miner clusters. Each miner cluster is identified by a permanent Bittensor hotkey/coldkey pair and must run Intel TDX-compatible hardware with NVIDIA GPUs. Jobs execute as Kubernetes pods under a confidential runtimeClassName, hardware-isolated inside Kata Containers and attested via Confidential Containers (CoCo) with Trustee/KBS remote attestation. Production runtime classes are kata-qemu-nvidia-gpu-tdx-runtime-rs for GPU workloads and kata-qemu-tdx-runtime-rs for CPU-only jobs — both with guest debug disabled and attestation enforced.
The entire Kubernetes baseline runs on RKE2, which is FIPS-140-2 validated today (FIPS-140-3 is a Phase 3 target), and multi-cluster management is handled by Rancher Fleet with GitOps-based deployment. Miners earn Bittensor emissions for providing verified confidential compute; no attestation means no emissions — TEE compliance is enforced by the validator, not requested. Validators score miners on infrastructure readiness, TEE attestation health, Armada job-execution quality, uptime, and competitive pricing benchmarked against peer Bittensor compute subnets.
What sets SN90 apart from every other Bittensor compute subnet is its uncompromising security posture. A confidential pod is not a namespaced process on the host — it is a virtual machine with an encrypted, attested memory boundary. KubeTEE solved the hard engineering problems (multi-GPU NVSwitch passthrough, cold-start latency, CSI storage semantics, attestation-gated TLS, FIPS compliance) so that organisations running regulated or sensitive workloads can prove to auditors and customers that their data and models were never accessible to the infrastructure operator, the cloud provider, or any other party outside the TEE boundary.
The KubeTEE AI Factory is an enterprise-grade confidential compute platform purpose-built for AI batch jobs. The core product thesis is simple: organisations running sensitive AI workloads — training, fine-tuning, inference, data processing — face an impossible choice between security, cost, and trust. Public cloud AI exposes data in memory and gives providers and insiders access. KubeTEE resolves all three tensions simultaneously: hardware TEE isolation enforced by Intel TDX/SGX and NVIDIA Confidential Computing, decentralised multi-cluster infrastructure removing single points of failure, and Bittensor incentives aligning miner behaviour with service quality.
The target customers are organisations with regulated or sensitive AI workloads: healthcare (HIPAA compliance, private patient data in training sets), finance (SOC2/PCI-DSS, proprietary models and trading data), and government (FedRAMP, classified or sensitive inference). These customers need verifiable compute — cryptographic attestation that their code ran in a genuine, unmodified TEE with no host-level visibility — not merely contractual assurances. KubeTEE provides a FIPS-validated RKE2 baseline, CoCo remote attestation, audit trails via Prometheus and Kubernetes events, and isolated namespaces for tenant separation.
The technical architecture is a layered stack. At the bottom: RKE2 Kubernetes clusters on Intel TDX-compatible nodes with NVIDIA H100/H200/B200/B300 GPUs. Above that: Kata Containers and Confidential Containers providing the TEE runtime boundary. Armada schedules batch jobs across miner clusters with fair-use queuing, gang scheduling, and preemption. The LiteLLM gateway at llm.kubetee.ai provides an OpenAI-compatible API surface — it runs inside its own TEE pod (kata-qemu-tdx-runtime-rs) with TLS passthrough terminating inside the guest, so even the API endpoint is attested. Models currently live on the staging cluster include Kimi-K3, GLM-5.2, and DeepSeek-V4-Flash-0731, with NVIDIA NeMo Microservices, NIM models, and AI Blueprints as first-class confidential job types. Every model is published in three serving configurations — low-latency (agentic tool-calling loops), balanced (general consumer), and high-throughput (overnight batch jobs) — so consumers match the serving profile to their workload.
The subnet’s incentive mechanism ties supply and demand together cleanly. On the supply side, miners earn SN90 Alpha emissions for providing attested confidential compute capacity. On the demand side, consumers pay Alpha or TAO at a published resources-price-per-hour (H100 $3/GPU/hr, H200 $3.50, B200 $6.50, B300 $8), dynamic with Armada queue depth. Spent Alpha is recycled to unissued supply and re-emitted through the protocol’s fixed emission split — a self-sustaining security budget for the network. Pricing is benchmarked live against Targon (SN4), Lium (SN51), and Chutes (SN64) so SN90 stays competitively priced without manual intervention. A multi-step CI/CD promotion pipeline (supply-chain CI → non-TEE baseline lane → TEE debug lane → production TEE with debug off and attestation enforced) ensures every workload reaching a miner cluster has been validated against the full confidential stack.
The KubeTEE AI Factory is an enterprise-grade confidential compute platform purpose-built for AI batch jobs. The core product thesis is simple: organisations running sensitive AI workloads — training, fine-tuning, inference, data processing — face an impossible choice between security, cost, and trust. Public cloud AI exposes data in memory and gives providers and insiders access. KubeTEE resolves all three tensions simultaneously: hardware TEE isolation enforced by Intel TDX/SGX and NVIDIA Confidential Computing, decentralised multi-cluster infrastructure removing single points of failure, and Bittensor incentives aligning miner behaviour with service quality.
The target customers are organisations with regulated or sensitive AI workloads: healthcare (HIPAA compliance, private patient data in training sets), finance (SOC2/PCI-DSS, proprietary models and trading data), and government (FedRAMP, classified or sensitive inference). These customers need verifiable compute — cryptographic attestation that their code ran in a genuine, unmodified TEE with no host-level visibility — not merely contractual assurances. KubeTEE provides a FIPS-validated RKE2 baseline, CoCo remote attestation, audit trails via Prometheus and Kubernetes events, and isolated namespaces for tenant separation.
The technical architecture is a layered stack. At the bottom: RKE2 Kubernetes clusters on Intel TDX-compatible nodes with NVIDIA H100/H200/B200/B300 GPUs. Above that: Kata Containers and Confidential Containers providing the TEE runtime boundary. Armada schedules batch jobs across miner clusters with fair-use queuing, gang scheduling, and preemption. The LiteLLM gateway at llm.kubetee.ai provides an OpenAI-compatible API surface — it runs inside its own TEE pod (kata-qemu-tdx-runtime-rs) with TLS passthrough terminating inside the guest, so even the API endpoint is attested. Models currently live on the staging cluster include Kimi-K3, GLM-5.2, and DeepSeek-V4-Flash-0731, with NVIDIA NeMo Microservices, NIM models, and AI Blueprints as first-class confidential job types. Every model is published in three serving configurations — low-latency (agentic tool-calling loops), balanced (general consumer), and high-throughput (overnight batch jobs) — so consumers match the serving profile to their workload.
The subnet’s incentive mechanism ties supply and demand together cleanly. On the supply side, miners earn SN90 Alpha emissions for providing attested confidential compute capacity. On the demand side, consumers pay Alpha or TAO at a published resources-price-per-hour (H100 $3/GPU/hr, H200 $3.50, B200 $6.50, B300 $8), dynamic with Armada queue depth. Spent Alpha is recycled to unissued supply and re-emitted through the protocol’s fixed emission split — a self-sustaining security budget for the network. Pricing is benchmarked live against Targon (SN4), Lium (SN51), and Chutes (SN64) so SN90 stays competitively priced without manual intervention. A multi-step CI/CD promotion pipeline (supply-chain CI → non-TEE baseline lane → TEE debug lane → production TEE with debug off and attestation enforced) ensures every workload reaching a miner cluster has been validated against the full confidential stack.
KubeTEE AI was founded by Pierre, a veteran infrastructure architect known in the Bittensor community by that name. Pierre brings over 40 years of infrastructure architecture and deployment experience — dating from 1986 when he first installed Linux and Novell servers, through 1992 when he built one of the first internet service providers in Canada, and including large-scale cloud provider infrastructure management and internet distribution deployments in Morocco. His specialist areas are confidential computing, Kubernetes, networking, and kernel- and hardware-level security, and he has conducted multiple security audits for Fortune 500 companies.
Within the Bittensor ecosystem, Pierre has been a compute-subnet miner since February 2024 and has an unusually deep cross-subnet track record: he was the first to bring Confidential Computing nodes to Targon (Subnet 4), later helped Chutes (Subnet 64) onboard NVIDIA B200 and B300 nodes, and worked with the Lium (Subnet 51) team to deploy Confidential Computing on their stack. Beyond Bittensor, he was also the first to provide Confidential Computing infrastructure to Telegram Cocoon and Phala Network. He works directly with Intel and NVIDIA engineers on Kata and CoCo Containers, is an active contributor to both the Kata Containers and Confidential Containers open-source projects under the OpenInfra Foundation and CNCF, and is a member of the Confidential Computing Consortium (CCC). KubeTEE AI is registered with the NVIDIA Inception Program.
The corporate structure is deliberately split to align incentives: KubeTEE AI LTD is the subnet owner (holding the mechanism, IP, and 18% owner emission stream, with all dTAO conviction auto-locked on-chain in perpetuity); 1-HORIZON LTD is the miner operator entity, competing for the 41% miner share under identical rules as every external miner. The target state is a declining related-party share as external miners join — the on-chain evidence that the network is a real, functioning market and not a closed system.
KubeTEE AI was founded by Pierre, a veteran infrastructure architect known in the Bittensor community by that name. Pierre brings over 40 years of infrastructure architecture and deployment experience — dating from 1986 when he first installed Linux and Novell servers, through 1992 when he built one of the first internet service providers in Canada, and including large-scale cloud provider infrastructure management and internet distribution deployments in Morocco. His specialist areas are confidential computing, Kubernetes, networking, and kernel- and hardware-level security, and he has conducted multiple security audits for Fortune 500 companies.
Within the Bittensor ecosystem, Pierre has been a compute-subnet miner since February 2024 and has an unusually deep cross-subnet track record: he was the first to bring Confidential Computing nodes to Targon (Subnet 4), later helped Chutes (Subnet 64) onboard NVIDIA B200 and B300 nodes, and worked with the Lium (Subnet 51) team to deploy Confidential Computing on their stack. Beyond Bittensor, he was also the first to provide Confidential Computing infrastructure to Telegram Cocoon and Phala Network. He works directly with Intel and NVIDIA engineers on Kata and CoCo Containers, is an active contributor to both the Kata Containers and Confidential Containers open-source projects under the OpenInfra Foundation and CNCF, and is a member of the Confidential Computing Consortium (CCC). KubeTEE AI is registered with the NVIDIA Inception Program.
The corporate structure is deliberately split to align incentives: KubeTEE AI LTD is the subnet owner (holding the mechanism, IP, and 18% owner emission stream, with all dTAO conviction auto-locked on-chain in perpetuity); 1-HORIZON LTD is the miner operator entity, competing for the 41% miner share under identical rules as every external miner. The target state is a declining related-party share as external miners join — the on-chain evidence that the network is a real, functioning market and not a closed system.
KubeTEE is currently in Phase 0 — Early Access. The Kata + CoCo TEE runtime classes are live on Intel TDX H200 and B200 nodes; the Bittensor validator (v1) is built, tested with 35 tests, and scoring miners live on Finney; the LiteLLM gateway at llm.kubetee.ai serves confidential inference for GLM-5.2 and DeepSeek-V4-Flash-0731; and a successful competitive-distillation eval proof-of-concept with Albedo (SN97) ran 100 samples on 2026-08-09. Active Phase 0 work includes deploying two US production clusters (one East Coast, one West Coast), standing up the Armada multi-cluster batch scheduler across miner clusters, completing the confidential model catalogue (Kimi-K3, embedding models, judge/retrieval models), and integrating KubeTEE as a provider for SN28 (SayGM) as a first-class inference demand channel.
Phase 1 — Expansion introduces permissionless miner onboarding (self-service, demand-driven — new capacity added to match proven consumption), on-chain collateral bonding, international cluster expansion, and moving the Armada scheduler itself into Kata + CoCo TEE pods with attestation-gated TLS on the scheduler control channel. Validator scoring expands to include fresh TEE attestation, Armada job metrics, and infrastructure health alongside the current infrastructure-readiness gate. Phase 1 also ships Apache Airflow and Metaflow connectors for multi-step confidential AI pipelines, and the Jobs MCP server — enabling autonomous AI agents, human chat clients (Claude, Cursor), and pipeline orchestrators to browse the job catalogue, receive a validator-aligned price quote, submit to Armada, and track attestation evidence, all through a single conversational interface at llm.kubetee.ai/mcp.
Phase 2 layers USDC-on-BASE billing and automated USDC→TAO→Alpha recycling on top of the Alpha/TAO resources-per-hour model from Phase 0, completing the DePIN subsidy trajectory where external consumption revenue progressively funds the miner budget. Phase 3 expands the job-type catalogue, adds multi-architecture TEE support (AMD SEV-SNP beyond Intel TDX), targets FIPS-140-3 on the existing FIPS-140-2 validated RKE2 baseline, and graduates the NVIDIA NIM Operator’s experimental Kata Sandbox and Dynamo paths to production-grade confidential deployments — work KubeTEE is actively pursuing with the NVIDIA NIM Operator and Kata Containers teams.
KubeTEE is currently in Phase 0 — Early Access. The Kata + CoCo TEE runtime classes are live on Intel TDX H200 and B200 nodes; the Bittensor validator (v1) is built, tested with 35 tests, and scoring miners live on Finney; the LiteLLM gateway at llm.kubetee.ai serves confidential inference for GLM-5.2 and DeepSeek-V4-Flash-0731; and a successful competitive-distillation eval proof-of-concept with Albedo (SN97) ran 100 samples on 2026-08-09. Active Phase 0 work includes deploying two US production clusters (one East Coast, one West Coast), standing up the Armada multi-cluster batch scheduler across miner clusters, completing the confidential model catalogue (Kimi-K3, embedding models, judge/retrieval models), and integrating KubeTEE as a provider for SN28 (SayGM) as a first-class inference demand channel.
Phase 1 — Expansion introduces permissionless miner onboarding (self-service, demand-driven — new capacity added to match proven consumption), on-chain collateral bonding, international cluster expansion, and moving the Armada scheduler itself into Kata + CoCo TEE pods with attestation-gated TLS on the scheduler control channel. Validator scoring expands to include fresh TEE attestation, Armada job metrics, and infrastructure health alongside the current infrastructure-readiness gate. Phase 1 also ships Apache Airflow and Metaflow connectors for multi-step confidential AI pipelines, and the Jobs MCP server — enabling autonomous AI agents, human chat clients (Claude, Cursor), and pipeline orchestrators to browse the job catalogue, receive a validator-aligned price quote, submit to Armada, and track attestation evidence, all through a single conversational interface at llm.kubetee.ai/mcp.
Phase 2 layers USDC-on-BASE billing and automated USDC→TAO→Alpha recycling on top of the Alpha/TAO resources-per-hour model from Phase 0, completing the DePIN subsidy trajectory where external consumption revenue progressively funds the miner budget. Phase 3 expands the job-type catalogue, adds multi-architecture TEE support (AMD SEV-SNP beyond Intel TDX), targets FIPS-140-3 on the existing FIPS-140-2 validated RKE2 baseline, and graduates the NVIDIA NIM Operator’s experimental Kata Sandbox and Dynamo paths to production-grade confidential deployments — work KubeTEE is actively pursuing with the NVIDIA NIM Operator and Kata Containers teams.