{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google added support for Kubernetes in Confidential Computing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: N\u00fc\u00fcd saab Kubernetes'i k\u00e4ivitada Confidential VM-id<\/a><\/noindex> Google'ilt.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Google teatab t\u00e4na (08.09.2020, t\u00f5lkija m\u00e4rkus<\/em>) \u00fcritusel Cloud Next OnAir<\/a><\/noindex> uute teenuste k\u00e4ivitamisest.<\/p>\n

<\/p>\n

Confidential GKE s\u00f5lmed lisavad rohkem privaatsust Kubernetes'is k\u00e4itatavatele koormustele. Juulis k\u00e4ivitati esimene toode nimega Confidential VM-id<\/a><\/noindex>, ja t\u00e4na on need virtuaalsed masinad juba k\u00f5ikidele kergesti k\u00e4ttesaadavad.<\/p>\n

<\/p>\n

Confidential Computing on uuendus, mis eeldab andmete kr\u00fcptimist nende t\u00f6\u00f6tlemise ajal. See on viimase etapi kr\u00fcptimise kett, kuna pilveteenuse pakkujad kr\u00fcpteerivad andmeid juba sisse- ja v\u00e4ljaminekul. Kuni hiljutise ajani tuli andmeid t\u00f6\u00f6tlemise ajal dekr\u00fcpteerida ja paljud spetsialistid n\u00e4evad selles selget puuduj\u00e4\u00e4ki andmete kr\u00fcptimises.<\/p>\n

<\/p>\n

Google'i Confidential Computing algatus p\u00f5hineb koost\u00f6\u00f6l Confidential Computing konsortsiumiga, t\u00f6\u00f6stusgrupiga, mis edendab \"usaldusv\u00e4\u00e4rsete t\u00e4itmisringide\" (Trusted Execution Environments, TEEs) kontseptsiooni. TEE on kaitstud protsessori osa, kus laaditud andmed ja kood on kr\u00fcptitud, mis t\u00e4hendab, et teiste protsessori osadele sellele teabele ligip\u00e4\u00e4s on v\u00e4listatud.<\/p>\n

<\/p>\n

Google'i Confidential VM-id t\u00f6\u00f6tavad N2D virtuaalmasinatel, mis on k\u00e4ivitatud AMD teine \u200b\u200bgeneratsioon EPYC protsessoritel, mis kasutavad Secure Encrypted Virtualization tehnoloogiat, mis v\u00f5imaldab isoleerida virtuaalmasinad h\u00fcperviisorist, millel nad t\u00f6\u00f6tavad. Andmete kr\u00fcpteerimise s\u00e4ilitamine on tagatud olenemata nende kasutamisest: koormused, anal\u00fc\u00fcs, mudelite koolitamise p\u00e4ringud tehisintellekti jaoks. Need virtuaalsed masinad on loodud rahuldama igasuguste ettev\u00f5tete vajadusi, kes t\u00f6\u00f6tavad salajaste andmete kallal reguleeritud valdkondades, n\u00e4iteks panganduses.<\/p>\n

<\/p>\n

T\u00f5en\u00e4oliselt on k\u00f5ige olulisem kuulutus l\u00e4hitulevikus Confidential GKE s\u00f5lmede beetatestsimise kohta, mis, Google'i s\u00f5nul, esitatakse j\u00e4rgmises versioonis 1.18 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE on hallatav, tootmisvalmis keskkond konteinerite k\u00e4ivitamiseks, kus asuvad kaasaegsete rakenduste osad, mida saab k\u00e4itada mitmesugustes arvutus\u00fcmbritustes. Kubernetes on avatud l\u00e4htekoodiga orkestreerimise t\u00f6\u00f6riist, mida kasutatakse nende konteinerite haldamiseks.<\/p>\n

<\/p>\n

Confidential GKE s\u00f5lmede lisamine tagab GKE klastrite k\u00e4ivitamisel suurema konfidentsiaalsuse. Uue toote lisamisega Confidential Computing tooteportfelli soovisime pakkuda uut taset
\nkonfidentsiaalsusest ja kantavusest konteineriseeritud koormuste jaoks. Google'i Confidential GKE s\u00f5lmed p\u00f5hinevad samal tehnoloogial nagu Confidential VMs ning v\u00f5imaldavad teil kr\u00fcpteerida andmeid m\u00e4lu sees unikaalse kr\u00fcpteerimisv\u00f5tmega, mis genereeritakse ja mida haldab AMD EPYC protsessor. Sellised s\u00f5lmed kasutavad m\u00e4lu kr\u00fcpteerimist AMD SEV funktsiooni alusel, mis t\u00e4hendab, et teie koormused, mis t\u00f6\u00f6tavad sellistel s\u00f5lmedel, on t\u00f6\u00f6deldes kr\u00fcpteeritud.<\/p><\/blockquote>\n

Sunil Potti ja Eyal Manor, Google'i pilvetehnoloogia insenerid<\/em><\/p>\n

<\/p>\n

Confidential GKE s\u00f5lmedes saavad kliendid kohandada GKE klastreid nii, et s\u00f5lmepoolsed basseinid t\u00f6\u00f6tavad Confidential VMs virtuaalmasinatel. Lihtsalt \u00f6eldes - k\u00f5ik t\u00f6\u00f6kohustused, mis t\u00f6\u00f6tavad sellistel s\u00f5lmedel, on andmete t\u00f6\u00f6tlemise ajal kr\u00fcpteeritud.<\/p>\n

<\/p>\n

Paljudele ettev\u00f5tetele on avalike pilveteenuste kasutamisel vajalik rohkem konfidentsiaalsust kui kohalike koormuste k\u00e4itamisel oma infrastruktuuris, et end k\u00fcberkurjategijate eest kaitsta. Google Cloud laiendab oma Confidential Computing tooteportfelli, t\u00f5stes latu ja pakkudes kasutajatele v\u00f5imalust tagada konfidentsiaalsus GKE klastrite jaoks. Arvestades Kubernetes'e populaarsust, on see oluline edusamm t\u00f6\u00f6stuses, mis annab ettev\u00f5tetele rohkem v\u00f5imalusi j\u00e4rgmise p\u00f5lvkonna rakenduste turvaliseks majutamiseks avalikus pilves.<\/p><\/blockquote>\n

Holger Mueller, Constellation Research'i anal\u00fc\u00fctik.<\/em><\/p>\n

<\/p>\n

M\u00e4rkus.<\/strong> Meie ettev\u00f5te korraldab 28.-30. septembril uuendatud intensiivkursuse Kubernetes P\u00f5hi<\/a><\/noindex> nendele, kes ei tunne Kuberneteset, kuid soovivad sellega tutvuda ja alustada t\u00f6\u00f6d. P\u00e4rast seda \u00fcritust, 14.\u201316. oktoobril, k\u00e4ivitame uuendatud Kubernetes Mega<\/a><\/noindex> kogenud Kubernetes'i kasutajatele, kelle jaoks on oluline teada k\u00f5iki viimaseid praktilisi lahendusi Kubernetes'e uusimate versioonide kasutamisel ja v\u00f5imalikke \u201ekurja\u201d kohti. Meie Kubernetes Mega<\/a><\/noindex> kaevame teoorias ja praktikas v\u00e4lja tootmisvalmiduse klastri installimise ja konfigureerimise n\u00fcansid (\u201ethe-not-so-easy-way\u201d), rakenduste turvalisuse ja j\u00e4tkusuutlikkuse tagamise mehhanismid.<\/p><\/blockquote>\n

Lisaks teatas Google, et nende Confidential VMs saavad alates t\u00e4nasest m\u00f5ned uued funktsioonid, kui need muutuvad avalikuks. N\u00e4iteks on saadaval auditiaruanded, mis sisaldavad \u00fcksikasjalikke logisid AMD Secure Processori, mida kasutatakse iga Confidential VM-i v\u00f5tmete genereerimiseks, terviklikkuse kontrollimise kohta.<\/p>\n

<\/p>\n

Samuti on saadaval rohkem juhtsemeid konkreetsete juurdep\u00e4\u00e4su\u00f5iguste m\u00e4\u00e4ramiseks, ning Google on lisanud v\u00f5imaluse keelata mis tahes mitte-confidential virtuaalmasin m\u00e4\u00e4ratud projekti raames. Lisaks \u00fchendab Google Confidential VM-id teiste konfidentsiaalsuse tagamise mehhanismidega turvalisuse tagamiseks.<\/p>\n

<\/p>\n

Saate kasutada \u00fchiseid VPC-sid koos tulem\u00fc\u00fcrireeglite ja poliitikapiirangutega, et tagada Confidential VM-ide andmevahetus, isegi kui need t\u00f6\u00f6tavad erinevates projektides. Lisaks saate kasutada VPC Service Controls'i, et m\u00e4\u00e4rata GCP resursside ulatust oma Confidential VM-idele.<\/p><\/blockquote>\n

Sunil Potti ja Eyal Manor<\/em><\/p>\n

Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google lisas Kubernetes'e toe Confidential Computing'u jaoks | ProHoster","description":"TL;DR: N\u00fc\u00fcd on v\u00f5imalik k\u00e4ivitada Kubernetes Google'i Confidential VM-ides.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}