{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google lisas Kubernetes'ele toe Confidential Computing'i toega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: N\u00fc\u00fcd on v\u00f5imalik k\u00e4ivitada Kubernetes Confidential VM-id<\/a><\/noindex> Google'ilt.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Google teatas t\u00e4na (08.09.2020, t\u00f5lkija m\u00e4rk.<\/em>) \u00fcritusel Cloud Next OnAir<\/a><\/noindex> , et laiendab oma tooteportfelli uue teenuse k\u00e4ivitamisega.<\/p>\n

<\/p>\n

Confidential GKE s\u00f5lmed lisavad rohkem saladust Kuberneteses k\u00e4ivitatavatele koormustele. Juulis k\u00e4ivitati esimene toode nimega Confidential VM-id<\/a><\/noindex>, ja n\u00fc\u00fcd on need virtuaalsed masinad juba k\u00f5igile kergesti k\u00e4tte saadavad.<\/p>\n

<\/p>\n

Confidential Computing on uus funktsioon, mis v\u00f5imaldab andmete salvestamist kr\u00fcpteeritud kujul nende t\u00f6\u00f6tlemise ajal. See on viimase etapi kr\u00fcpteerimine, kuna pilveteenuse pakkujad kr\u00fcpteerivad andmed juba sisendil ja v\u00e4ljundil. Veel hiljuti tuli andmed t\u00f6\u00f6tlemise ajal dekr\u00fcpteerida, ja paljud eksperdid n\u00e4evad selles selget n\u00f5rkust andmete kr\u00fcpteerimises.<\/p>\n

<\/p>\n

Google'i Confidential Computing algatus p\u00f5hineb koost\u00f6\u00f6l Confidential Computing konsortsiumiga, mis on t\u00f6\u00f6stusgrupp, mille eesm\u00e4rk on edendada 'usaldusv\u00e4\u00e4rsete t\u00e4itmise keskkondade' (Trusted Execution Environments, TEEs) kontseptsiooni. TEE on protsessori kaitstud osa, kus laaditud andmed ja kood on kr\u00fcpteeritud, mis t\u00e4hendab, et teised protsessori osad ei saa sellele teabele ligip\u00e4\u00e4su.<\/p>\n

<\/p>\n

Google'i Confidential VM-id t\u00f6\u00f6tavad N2D virtuaalmasinatel, mis on k\u00e4ivitatud AMD teise p\u00f5lvkonna EPYC protsessoritel ning kasutavad Secure Encrypted Virtualization tehnoloogiat, mis v\u00f5imaldab virtuaalmasinate isoleerimist nende t\u00f6\u00f6tava h\u00fcpervihiku eest. Andmete kr\u00fcpteerimise garantii kehtib olenemata andmete kasutamisest: t\u00f6\u00f6koormused, anal\u00fc\u00fctika, mudelite koolitamise taotlused kunstlikule intellektile. Need virtuaalmasinad on loodud rahuldama igasuguste reguleeritud valdkondade, sealhulgas panganduse, salajaste andmete t\u00f6\u00f6tlemise vajadusi.<\/p>\n

<\/p>\n

T\u00f5en\u00e4oliselt on k\u00f5ige pakilisem teade tulevasest Confidential GKE s\u00f5lmede beetatestimisest, mis Google'i s\u00f5nul ilmub j\u00e4rgmises versioonis 1.18. Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE on hallatav, tootmiskeskkonda sobiv lahendus konteinerite k\u00e4itamiseks, kus asuvad kaasaegsete rakenduste osad, mida saab k\u00e4itada mitmes arvutustuumas. Kubernetes on avatud l\u00e4htekoodiga orkestreerimise t\u00f6\u00f6riist, mida kasutatakse nende konteinerite haldamiseks.<\/p>\n

<\/p>\n

Confidential GKE s\u00f5lmede lisamine tagab GKE klastrite k\u00e4itamisel suurema privaatsuse. Uue toote lisamisega Confidential Computing'i seerias tahtsime pakkuda uut taset.
\nkonteineriseeritud koormuste konfidentsiaalsuse ja \u00fclekandmise jaoks. Google'i Confidential GKE s\u00f5lmed p\u00f5hinevad samal tehnoloogial nagu Confidential VM-id, v\u00f5imaldades teil \u0161ifreerida andmeid m\u00e4lu sees, kasutades iga s\u00f5lme jaoks unikaalset kr\u00fcpteerimisv\u00f5tit, mida genereerib ja haldab AMD EPYC protsessor. Need s\u00f5lmed kasutavad hulgaliselt \u00fchte kindlat kr\u00fcpteerimist, mis p\u00f5hineb AMD SEV tehnoloogia funktsioonil, mis t\u00e4hendab, et teie t\u00f6\u00f6koormused, mis t\u00f6\u00f6tavad nende s\u00f5lmede peal, on t\u00f6\u00f6tamise ajal \u0161ifreeritud.<\/p><\/blockquote>\n

Sunil Potti ja Eyal Manor, Google'i pilvetehnoloogia insenerid<\/em><\/p>\n

<\/p>\n

Confidential GKE s\u00f5lmedes saavad kliendid seadistada GKE klastreid nii, et s\u00f5lme basseinid t\u00f6\u00f6tavad Confidential VMs virtuaalmasinates. Lihtsamalt \u00f6eldes \u2014 k\u00f5ik t\u00f6\u00f6koormused, mis t\u00f6\u00f6tavad nende s\u00f5lmede peal, on andmete t\u00f6\u00f6tlemise ajal \u0161ifreeritud.<\/p>\n

<\/p>\n

Paljude ettev\u00f5tete jaoks on avalike pilveteenuste kasutamisel vajalik suurem privaatsus kui kohalike t\u00f6\u00f6koormuste puhul, mis k\u00e4ivitatakse nende enda taristu peal, et end kurjategijate eest kaitsta. Google Cloud laiendab oma Confidential Computing tooteportfelli, t\u00f5stes privaatsuse standardit, pakkudes kasutajatele v\u00f5imalust tagada privaatsus GKE klastrites. Arvestades Kubernetes'e populaarsust, on see oluline samm edasi valdkonna jaoks, andes ettev\u00f5tetele rohkem v\u00f5imalusi j\u00e4rgmise p\u00f5lvkonna rakenduste turvaliseks majutamiseks avalikus pilves.<\/p><\/blockquote>\n

Holger Mueller, Constellation Research anal\u00fc\u00fctik.<\/em><\/p>\n

<\/p>\n

N.B.<\/strong> Meie ettev\u00f5te korraldab 28.\u201330. septembril uuendatud intensiivkursuse Kubernetes Baas<\/a><\/noindex> neile, kes ei tunne Kubernetes't, kuid soovivad tutvuda ja alustada t\u00f6\u00f6ga. P\u00e4rast seda \u00fcritust, 14.\u201316. oktoobril, korraldame uuendatud Kubernetes Mega<\/a><\/noindex> kogenud Kubernetes kasutajatele, kelle jaoks on oluline teada k\u00f5iki viimaseid praktilisi lahendusi Kubernetes'i viimaste versioonide t\u00f6\u00f6s ja v\u00f5imalikke \u201el\u00fcnki\u201c. Kubernetes Mega<\/a><\/noindex> uurime teooria ja praktika kaudu production-ready klastrite seadistamise ja konfigureerimise n\u00fcansse (\u00abthe-not-so-easy-way\u00bb), rakenduste turvameetmete ja t\u00f5rkeotsingu mehhanisme.<\/p><\/blockquote>\n

Lisaks teatas Google, et nende Confidential VMs saavad alates t\u00e4nasest avalikuks muutumisega m\u00f5ned uued v\u00f5imalused. N\u00e4iteks on saadaval auditiraportid, mis sisaldavad \u00fcksikasjalikke logisid AMD Secure Processor'i p\u00fcsivara terviklikkuse kontrollimiseks, mis on kasutatud v\u00f5tmete genereerimiseks iga Confidential VMs'i eksemplari jaoks.<\/p>\n

<\/p>\n

Lisaks on saadaval rohkem juhtimiselemente, et m\u00e4\u00e4rata konkreetsed juurdep\u00e4\u00e4su\u00f5igused, ning Google on lisanud v\u00f5imaluse deaktiveerida mis tahes mitte-salajane virtuaalmasin antud projektis. Samuti seob Google Confidential VMs teisi konfidentsiaalsuse tagamise mehhanisme, et tagada turvalisus.<\/p>\n

<\/p>\n

Saate kasutada \u00fchise VPC kombinatsiooni koos tulem\u00fc\u00fcri reeglite ja poliitika piirangutega, et tagada Confidential VM-de andmevahetus teiste Confidential VM-idega, isegi kui need t\u00f6\u00f6tavad erinevates projektides. Lisaks v\u00f5ite kasutada VPC teenuse kontrolle, et m\u00e4\u00e4rata GCP ressursside ulatus teie Confidential VM-ide jaoks.<\/p><\/blockquote>\n

Sunil Potti ja Eyal Manor<\/em><\/p>\n

Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google on lisanud Kubernetes'e toe Confidential Computing'ule | ProHoster","description":"TL;DR: N\u00fc\u00fcd on v\u00f5imalik k\u00e4ivitada Kubernetes Confidential VM-ides Google'i platvormil. Google teatas t\u00e4na (08.09.2020, t\u00f5lkija m\u00e4rkus) \u00fcritusel Cloud Next OnAir oma tooteportfelli laiendamisest uue teenuse k\u00e4ivitamisega. Confidential GKE s\u00f5lmed lisavad rohkem konfidentsiaalsust Kuberneteses t\u00f6\u00f6tavatele koormustele. Juulis k\u00e4ivitati esimene toode nimega Confidential VM, ja t\u00e4na need virtuaalsed masinad","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}