{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google har tilf\u00f8jet Kubernetes-support i Confidential Computing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: Nu kan Kubernetes k\u00f8re p\u00e5 Fortrolige VMs<\/a><\/noindex> fra Google.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Google meddelte i dag (08.09.2020, overs\u00e6tterens bem\u00e6rkning<\/em>) p\u00e5 arrangementet Cloud Next OnAir<\/a><\/noindex> om udvidelsen af sin produktlinje med lanceringen af en ny service.<\/p>\n

<\/p>\n

Confidential GKE-noder tilf\u00f8jer endnu st\u00f8rre fortrolighed til belastninger, der k\u00f8rer i Kubernetes. I juli blev det f\u00f8rste produkt under navnet Fortrolige VMs<\/a><\/noindex>, og i dag er disse virtuelle maskiner allerede tilg\u00e6ngelige for alle.<\/p>\n

<\/p>\n

Confidential Computing er en nyhed, der indeb\u00e6rer lagring af data i krypteret form under behandling. Det er det sidste led i k\u00e6den af datakryptering, da udbydere af cloud-tjenester allerede krypterer data ved ind- og udgang. Indtil for nylig m\u00e5tte data dekrypteres under behandling, og mange fagfolk ser dette som en tydelig svaghed i datakryptering.<\/p>\n

<\/p>\n

Initiativet Confidential Computing fra Google er baseret p\u00e5 et samarbejde med konsortiet Confidential Computing, en branchegruppe dedikeret til fremme af konceptet 'trustede udf\u00f8relsesmilj\u00f8er' (Trusted Execution Environments, TEEs). TEE er en beskyttet del af processoren, hvor indl\u00e6ste data og kode er krypteret, hvilket betyder, at andre dele af den samme processor ikke kan f\u00e5 adgang til denne information.<\/p>\n

<\/p>\n

Confidential VMs fra Google k\u00f8rer p\u00e5 N2D-virtuelle maskiner, der er drevet af AMD's anden generations EPYC-processorer, der bruger teknologien Secure Encrypted Virtualization, som muligg\u00f8r isolering af virtuelle maskiner fra hypervisoren, de k\u00f8rer p\u00e5. Der er garanti for, at data forbliver krypteret uanset deres brug: arbejdsbelastninger, analyser, anmodninger om tr\u00e6ning af modeller til kunstig intelligens. Disse virtuelle maskiner er designet til at im\u00f8dekomme behovene hos enhver virksomhed, der arbejder med f\u00f8lsomme data i regulerede omr\u00e5der, s\u00e5som finanssektoren.<\/p>\n

<\/p>\n

En eventuelt mere presserende nyhed er annonceringen om det kommende beta-testning af Confidential GKE-noder, som if\u00f8lge Google vil blive pr\u00e6senteret i den kommende version 1.18 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE er et administreret, produktionsklar milj\u00f8 til k\u00f8rsel af containere, der rummer dele af moderne applikationer, som kan k\u00f8res i flere compute-milj\u00f8er. Kubernetes er et open source orkestreringsv\u00e6rkt\u00f8j, der bruges til at administrere disse containere.<\/p>\n

<\/p>\n

Tilf\u00f8jelse af Confidential GKE-noder giver en h\u00f8jere grad af fortrolighed, n\u00e5r man k\u00f8rer GKE-klustre. Ved introduktionen af et nyt produkt inden for Confidential Computing \u00f8nskede vi at sikre et nyt niveau
\naf fortrolighed og b\u00e6rbarhed for containeriserede arbejdsbelastninger. Confidential GKE-noder fra Google er baseret p\u00e5 den samme teknologi som Confidential VMs, hvilket g\u00f8r det muligt for dig at kryptere data i hukommelsen ved hj\u00e6lp af en unik krypteringsn\u00f8gle for hver node, der genereres og styres af AMD EPYC-processoren. Disse noder vil anvende hardware-kryptering af hukommelsen baseret p\u00e5 AMD's SEV-funktion, hvilket betyder, at dine arbejdsbelastninger, der k\u00f8rer p\u00e5 disse noder, vil v\u00e6re krypterede under drift.<\/p><\/blockquote>\n

Sunil Potti og Eyal Manor, cloud-teknologier, Google<\/em><\/p>\n

<\/p>\n

P\u00e5 Confidential GKE-noder kan kunder konfigurere GKE-klustre, s\u00e5 nodeture k\u00f8res p\u00e5 Confidential VMs. Med andre ord \u2014 alle arbejdsbelastninger, der k\u00f8rer p\u00e5 disse noder, vil v\u00e6re krypterede under databehandling.<\/p>\n

<\/p>\n

Mange virksomheder har brug for endnu mere fortrolighed ved brug af offentlige cloud-tjenester end for lokale arbejdsbelastninger, der k\u00f8rer p\u00e5 deres egne faciliteter, hvilket er n\u00f8dvendigt for at beskytte sig mod ondsindede akt\u00f8rer. Google Cloud, ved at udvide sin portef\u00f8lje af Confidential Computing, h\u00e6ver denne standard og giver brugerne mulighed for at sikre fortrolighed for GKE-klustre. Og i takt med Kubernetes' popularitet er dette et n\u00f8glefremskridt for branchen, som giver virksomhederne flere muligheder for sikkert at hoste n\u00e6ste generations applikationer i offentlige skyer.<\/p><\/blockquote>\n

Holger Mueller, analytiker, Constellation Research.<\/em><\/p>\n

<\/p>\n

N.B.<\/strong> Virksomheden lancerer en opdateret intensivkursus fra den 28.-30. september Kubernetes Basis<\/a><\/noindex> for dem, der stadig ikke kender Kubernetes, men \u00f8nsker at l\u00e6re om det og begynde at arbejde med det. Efter denne begivenhed den 14.-16. oktober lancerer vi en opdateret Kubernetes Mega<\/a><\/noindex> for erfarne Kubernetes-brugere, der er interesserede i at kende alle de seneste praktiske l\u00f8sninger i arbejdet med de nyeste versioner af Kubernetes og potentielle \"f\u00e6lder\". Vi vil Kubernetes Mega<\/a><\/noindex> i teori og praksis gennemg\u00e5 detaljerne i installation og konfiguration af et production-ready cluster (\"the-not-so-easy-way\"), mekanismerne for sikkerhed og fejltolerance for applikationer.<\/p><\/blockquote>\n

Desuden har Google meddelt, at deres Confidential VMs vil f\u00e5 nogle nye funktioner, da de bliver offentligt tilg\u00e6ngelige fra dags dato. For eksempel er der nu revisionsrapporter, der indeholder detaljerede logfiler for integritetskontrollen af AMD Secure Processor, som bruges til at generere n\u00f8gler for hver instans af Confidential VMs.<\/p>\n

<\/p>\n

Der er ogs\u00e5 tilf\u00f8jet flere kontrolelementer til at angive specifikke adgangsrettigheder, og Google har tilf\u00f8jet muligheden for at deaktivere enhver ikke-konfidential virtuel maskine i et angivet projekt. Desuden forbinder Google Confidential VMs med andre fortrolighedsmekanismer for at sikre sikkerheden.<\/p>\n

<\/p>\n

Du kan bruge en kombination af delte VPC'er med firewall-regler og organisatoriske politikbegr\u00e6nsninger for at sikre, at Confidential VMs kan udveksle data med andre Confidential VMs, selvom de k\u00f8rer i forskellige projekter. Derudover kan du anvende VPC Service Controls til at definere GCP-ressourceomr\u00e5derne for dine Confidential VMs.<\/p><\/blockquote>\n

Sunil Potti og Eyal Manor<\/em><\/p>\n

Kilde: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google har tilf\u00f8jet st\u00f8tte til Kubernetes i Confidential Computing | ProHoster","description":"TL;DR: Nu kan du k\u00f8re Kubernetes p\u00e5 Google Confidential VMs.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}