{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google p\u0159idal podporu Kubernetes do Confidential Computing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: Nyn\u00ed m\u016f\u017eete spustit Kubernetes na Tajn\u00e9 VM<\/a><\/noindex> od Google.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Spole\u010dnost Google dnes (08.09.2020, pozn. p\u0159ekladatele<\/em>) na akci Cloud Next OnAir<\/a><\/noindex> ozn\u00e1mila roz\u0161\u00ed\u0159en\u00ed sv\u00e9 produktov\u00e9 \u0159ady uveden\u00edm nov\u00e9 slu\u017eby.<\/p>\n

<\/p>\n

Uzly Confidential GKE p\u0159id\u00e1vaj\u00ed v\u00edce soukrom\u00ed z\u00e1t\u011b\u017e\u00edm spu\u0161t\u011bn\u00fdm v Kubernetes. V \u010dervenci byla uvedena prvn\u00ed produkt pod n\u00e1zvem Tajn\u00e9 VM<\/a><\/noindex>, a dnes jsou tyto virtu\u00e1ln\u00ed stroje ji\u017e dostupn\u00e9 v\u0161em.<\/p>\n

<\/p>\n

Confidential Computing je novinkou, kter\u00e1 p\u0159edpokl\u00e1d\u00e1 uchov\u00e1v\u00e1n\u00ed dat v \u0161ifrovan\u00e9 podob\u011b b\u011bhem jejich zpracov\u00e1n\u00ed. To je posledn\u00ed \u010dl\u00e1nek v \u0159et\u011bzci \u0161ifrov\u00e1n\u00ed dat, proto\u017ee poskytovatel\u00e9 cloudov\u00fdch slu\u017eeb ji\u017e \u0161ifruj\u00ed data p\u0159i vstupu a v\u00fdstupu. Do ned\u00e1vn\u00e9 doby bylo nutn\u00e9 data p\u0159i jejich zpracov\u00e1n\u00ed de\u0161ifrovat, a mnoz\u00ed odborn\u00edci vid\u00ed v tom jasnou mezeru v oblasti \u0161ifrov\u00e1n\u00ed dat.<\/p>\n

<\/p>\n

Iniciativa Confidential Computing od Google je zalo\u017eena na spolupr\u00e1ci s konsorciem Confidential Computing, pr\u016fmyslovou skupinou pro propagaci konceptu \"d\u016fv\u011bryhodn\u00fdch prost\u0159ed\u00ed pro vykon\u00e1v\u00e1n\u00ed\" (Trusted Execution Environments, TEEs). TEE je chr\u00e1n\u011bn\u00e1 \u010d\u00e1st procesoru, ve kter\u00e9 jsou nahran\u00e1 data a k\u00f3d \u0161ifrov\u00e1na, co\u017e znamen\u00e1, \u017ee k t\u011bmto informac\u00edm nemohou m\u00edt p\u0159\u00edstup jin\u00e9 \u010d\u00e1sti tohoto samotn\u00e9ho procesoru.<\/p>\n

<\/p>\n

Confidential VMs od Google b\u011b\u017e\u00ed na virtu\u00e1ln\u00edch stroj\u00edch N2D, spu\u0161t\u011bn\u00fdch na procesorech druh\u00e9 generace EPYC spole\u010dnosti AMD, kter\u00e9 vyu\u017e\u00edvaj\u00ed technologii Secure Encrypted Virtualization, umo\u017e\u0148uj\u00edc\u00ed isolaci virtu\u00e1ln\u00edch stroj\u016f od hypervizoru, na kter\u00e9m b\u011b\u017e\u00ed. Je zaru\u010deno, \u017ee data z\u016fst\u00e1vaj\u00ed \u0161ifrovan\u00e1 bez ohledu na jejich vyu\u017eit\u00ed: pracovn\u00ed z\u00e1t\u011b\u017ee, anal\u00fdzy, po\u017eadavky na \u0161kolen\u00ed model\u016f pro um\u011blou inteligenci. Tyto virtu\u00e1ln\u00ed stroje jsou navr\u017eeny tak, aby splnily pot\u0159eby jak\u00e9koli spole\u010dnosti, kter\u00e1 pracuje s citliv\u00fdmi daty v regulovan\u00fdch oblastech, nap\u0159\u00edklad v bankovn\u00edm sektoru.<\/p>\n

<\/p>\n

Mo\u017en\u00e1 je nejpal\u010div\u011bj\u0161\u00ed ozn\u00e1men\u00ed o nadch\u00e1zej\u00edc\u00edm beta testov\u00e1n\u00ed uzl\u016f Confidential GKE, kter\u00e9, podle Google, budou p\u0159edstaveny v nadch\u00e1zej\u00edc\u00ed verzi 1.18 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE je spravovan\u00e9, v\u00fdrobn\u011b p\u0159ipraven\u00e9 prost\u0159ed\u00ed pro spu\u0161t\u011bn\u00ed kontejner\u016f, ve kter\u00fdch jsou um\u00edst\u011bny \u010d\u00e1sti modern\u00edch aplikac\u00ed, kter\u00e9 lze spou\u0161t\u011bt v n\u011bkolika v\u00fdpo\u010detn\u00edch prost\u0159ed\u00edch. Kubernetes je n\u00e1stroj pro orchestrace s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem, kter\u00fd se pou\u017e\u00edv\u00e1 k \u0159\u00edzen\u00ed t\u011bchto kontejner\u016f.<\/p>\n

<\/p>\n

P\u0159id\u00e1n\u00ed uzl\u016f Confidential GKE zaji\u0161\u0165uje vy\u0161\u0161\u00ed \u00farove\u0148 d\u016fv\u011brnosti p\u0159i spu\u0161t\u011bn\u00ed cluster\u016f GKE. P\u0159i p\u0159id\u00e1v\u00e1n\u00ed nov\u00e9ho produktu do \u0159ady Confidential Computing jsme cht\u011bli zajistit novou \u00farove\u0148
\nd\u016fv\u011brnosti a p\u0159enositelnosti pro kontejnerizovan\u00e9 zat\u00ed\u017een\u00ed. Uzly Confidential GKE od Google jsou postaveny na stejn\u00e9 technologii jako Confidential VMs, umo\u017e\u0148uj\u00ed \u0161ifrov\u00e1n\u00ed dat v pam\u011bti pomoc\u00ed jedine\u010dn\u00e9ho kl\u00ed\u010de \u0161ifrov\u00e1n\u00ed pro ka\u017ed\u00fd uzel, kter\u00fd je vytv\u00e1\u0159en a spravov\u00e1n procesorem AMD EPYC. Tyto uzly budou pou\u017e\u00edvat hardwarov\u00e9 \u0161ifrov\u00e1n\u00ed pam\u011bti na z\u00e1klad\u011b funkce SEV od spole\u010dnosti AMD, co\u017e znamen\u00e1, \u017ee va\u0161e pracovn\u00ed zat\u00ed\u017een\u00ed prov\u00e1d\u011bn\u00e9 na t\u011bchto uzlech budou \u0161ifrov\u00e1na b\u011bhem zpracov\u00e1n\u00ed.<\/p><\/blockquote>\n

Sunil Potti a Eyal Manor, in\u017een\u00fd\u0159i cloudov\u00fdch technologi\u00ed, Google<\/em><\/p>\n

<\/p>\n

Na uzlech Confidential GKE mohou klienti nastavit clustry GKE tak, \u017ee uzlov\u00e9 pooly budou spu\u0161t\u011bny na virtu\u00e1ln\u00edch stroj\u00edch Confidential VMs. Jin\u00fdmi slovy \u2014 jak\u00e9koli pracovn\u00ed zat\u00ed\u017een\u00ed prov\u00e1d\u011bn\u00e9 na t\u011bchto uzlech bude \u0161ifrov\u00e1no b\u011bhem zpracov\u00e1n\u00ed dat.<\/p>\n

<\/p>\n

Mnoha podnik\u016fm je zapot\u0159eb\u00ed je\u0161t\u011b v\u011bt\u0161\u00ed d\u016fv\u011brnosti p\u0159i pou\u017e\u00edv\u00e1n\u00ed ve\u0159ejn\u00fdch cloudov\u00fdch slu\u017eeb, ne\u017e pro lok\u00e1ln\u00ed pracovn\u00ed zat\u00ed\u017een\u00ed, kter\u00e1 jsou spu\u0161t\u011bna na jejich vlastn\u00edch zdroj\u00edch, co\u017e je nezbytn\u00e9 pro ochranu p\u0159ed zlod\u011bji. Google Cloud zvy\u0161uje tuto \u00farove\u0148 roz\u0161\u00ed\u0159en\u00edm sv\u00e9 \u0159ady Confidential Computing, co\u017e u\u017eivatel\u016fm umo\u017e\u0148uje zajistit d\u016fv\u011brnost pro clustry GKE. A vzhledem k popularit\u011b Kubernetes je to kl\u00ed\u010dov\u00fd krok vp\u0159ed pro odv\u011btv\u00ed, kter\u00fd firm\u00e1m d\u00e1v\u00e1 v\u00edce mo\u017enost\u00ed pro bezpe\u010dn\u00e9 nasazen\u00ed aplikac\u00ed dal\u0161\u00ed generace ve ve\u0159ejn\u00e9m cloudu.<\/p><\/blockquote>\n

Holger Mueller, analytik spole\u010dnosti Constellation Research.<\/em><\/p>\n

<\/p>\n

N.B.<\/strong> Na\u0161e spole\u010dnost po\u0159\u00e1d\u00e1 od 28. do 30. z\u00e1\u0159\u00ed obnoven\u00fd intenzivn\u00ed kurz Z\u00e1klady Kubernetes<\/a><\/noindex> pro ty, kte\u0159\u00ed je\u0161t\u011b neznaj\u00ed Kubernetes, ale cht\u011bj\u00ed se s n\u00edm sezn\u00e1mit a za\u010d\u00edt pracovat. Po t\u00e9to akci, od 14. do 16. \u0159\u00edjna, spou\u0161t\u00edme obnoven\u00fd Mega Kubernetes<\/a><\/noindex> kurz pro pokro\u010dil\u00e9 u\u017eivatele Kubernetes, kte\u0159\u00ed cht\u011bj\u00ed zn\u00e1t v\u0161echna nejnov\u011bj\u0161\u00ed praktick\u00e1 \u0159e\u0161en\u00ed souvisej\u00edc\u00ed s posledn\u00edmi verzemi Kubernetes a mo\u017en\u00e9 'n\u00e1strahy'. Na Mega Kubernetes<\/a><\/noindex> kurzu se budeme v teorii a praxi zab\u00fdvat detaily instalace a konfigurace clusteru p\u0159ipraven\u00e9ho na produkci ('the-not-so-easy-way'), mechanismy zaji\u0161t\u011bn\u00ed bezpe\u010dnosti a odolnosti aplikac\u00ed.<\/p><\/blockquote>\n

Krom\u011b jin\u00e9ho Google ozn\u00e1mil, \u017ee jeho Confidential VMs z\u00edskaj\u00ed nov\u00e9 funkce, proto\u017ee se od dne\u0161n\u00edho dne st\u00e1vaj\u00ed ve\u0159ejn\u011b dostupn\u00fdmi. Nap\u0159\u00edklad se objevily zpr\u00e1vy o auditech, kter\u00e9 obsahuj\u00ed podrobn\u00e9 protokoly kontroly integrity firmwaru AMD Secure Processor, pou\u017e\u00edvan\u00e9ho k vytv\u00e1\u0159en\u00ed kl\u00ed\u010d\u016f pro ka\u017edou instanci Confidential VMs.<\/p>\n

<\/p>\n

Tak\u00e9 byly p\u0159id\u00e1ny dal\u0161\u00ed prvky pro nastaven\u00ed konkr\u00e9tn\u00edch p\u0159\u00edstupov\u00fdch pr\u00e1v a Google p\u0159idal mo\u017enost deaktivace jak\u00e9koli ve\u0159ejn\u00e9 virtu\u00e1ln\u00ed po\u010d\u00edta\u010de na zadan\u00e9m projektu. D\u00e1le Google propojuje Confidential VMs s jin\u00fdmi mechanismy zabezpe\u010den\u00ed pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti.<\/p>\n

<\/p>\n

M\u016f\u017eete vyu\u017e\u00edt kombinaci sd\u00edlen\u00fdch VPC s pravidly firewall a omezen\u00edmi organiza\u010dn\u00ed politiky pro zaji\u0161t\u011bn\u00ed, \u017ee Confidential VMs mohou sd\u00edlet data s jin\u00fdmi Confidential VMs, i kdy\u017e b\u011b\u017e\u00ed v r\u016fzn\u00fdch projektech. Krom\u011b toho m\u016f\u017eete vyu\u017e\u00edt VPC Service Controls k ur\u010den\u00ed rozsahu GCP zdroj\u016f pro va\u0161e Confidential VMs.<\/p><\/blockquote>\n

Sunil Potti a Eyal Manor<\/em><\/p>\n

Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google p\u0159idal podporu Kubernetes do Confidential Computing | ProHoster","description":"TL;DR: Nyn\u00ed je mo\u017en\u00e9 spustit Kubernetes na Confidential VMs od Google.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}