{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google je dodao podr\u0161ku za Kubernetes u Confidential Computing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: Sada mo\u017eete pokrenuti Kubernetes na Povjerljive VM-ove<\/a><\/noindex> od Googlea.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Tvrtka Google danas (08.09.2020., nap. prevoditelja<\/em>) na doga\u0111aju Cloud Next OnAir<\/a><\/noindex> objavila je pro\u0161irenje svog portfelja lansiranjem nove usluge.<\/p>\n

<\/p>\n

Povjerljivi GKE \u010dvori\u0107i dodaju vi\u0161e povjerljivosti teretima pokrenutima na Kubernetesu. U srpnju je lansiran prvi proizvod pod nazivom Povjerljive VM-ove<\/a><\/noindex>, a danas su ove virtualne ma\u0161ine ve\u0107 dostupne svima.<\/p>\n

<\/p>\n

Povjerljivo ra\u010dunalstvo \u2014 novost koja predvi\u0111a pohranu podataka u \u0161ifriranom obliku tijekom obrade. Ovo je posljednja karika u lancu \u0161ifriranja podataka, jer pru\u017eatelji usluga u oblaku ve\u0107 \u0161ifriraju podatke na ulazu i izlazu. Do nedavno, podaci su se morali de\u0161ifrirati tijekom obrade, a mnogi stru\u010dnjaci smatraju to o\u010ditom rupom u \u0161ifriranju podataka.<\/p>\n

<\/p>\n

Inicijativa Povjerljivo ra\u010dunalstvo od Googlea temelji se na suradnji s konzorzijem Povjerljivog ra\u010dunalstva, industrijskom grupom za promicanje koncepta 'pouzdanih izvr\u0161nih okru\u017eenja' (Trusted Execution Environments, TEEs). TEE je za\u0161ti\u0107eni dio procesora u kojem su u\u010ditani podaci i kod \u2014 \u0161ifrirani, \u0161to zna\u010di da druge dijelove istog procesora nemogu\u0107e pristupiti tim informacijama.<\/p>\n

<\/p>\n

Povjerljivi VM-ovi od Googlea rade na virtualnim ma\u0161inama N2D, pokrenutim na procesorima druge generacije EPYC tvrtke AMD, koji koriste tehnologiju Sigurnog \u0161ifriranog virtualiziranja, omogu\u0107uju\u0107i izolaciju virtualnih ma\u0161ina od hipervizora na kojem rade. Osigurana je \u0161ifriranost podataka bez obzira na njihovu upotrebu: radne optere\u0107enja, analitika, zahtjevi za obuku modela za umjetnu inteligenciju. Ove virtualne ma\u0161ine osmi\u0161ljene su kako bi zadovoljile potrebe svake tvrtke koja se bavi povjerljivim podacima u reguliranim podru\u010djima, poput bankarskog sektora.<\/p>\n

<\/p>\n

Mo\u017eda je aktualnija vijest o nadolaze\u0107em beta testiranju \u010dvorova Povjerljivog GKE, koji \u0107e, prema Googleu, biti predstavljeni u predstoje\u0107em izdanju 1.18 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE je upravljano, spremno za implementaciju okru\u017eenje za pokretanje kontejnera, u kojima se nalaze dijelovi modernih aplikacija koje se mogu pokretati u vi\u0161e ra\u010dunalnih okru\u017eenja. Kubernetes je alat za orkestraciju otvorenog koda koji se koristi za upravljanje ovim kontejnerima.<\/p>\n

<\/p>\n

Dodavanje Confidential GKE \u010dvorova osigurava ve\u0107u tajnost pri pokretanju GKE klastera. Kada smo dodali novi proizvod u liniju Confidential Computing, \u017eeljeli smo osigurati novi nivo
\ntajnosti i prenosivosti za kontejnerizirane radne optere\u0107enja. Confidential GKE \u010dvorovi od Google-a temelje se na istoj tehnologiji kao i Confidential VMs, omogu\u0107uju\u0107i vam \u0161ifriranje podataka u radnoj memoriji pomo\u0107u jedinstvenog klju\u010da \u0161ifriranja za svaki \u010dvor, koji se kreira i upravlja procesorom AMD EPYC. Ovi \u010dvorovi \u0107e koristiti hardversko \u0161ifriranje radne memorije temeljem funkcije SEV kompanije AMD, \u0161to zna\u010di da \u0107e va\u0161a radna optere\u0107enja, koja se izvr\u0161avaju na ovim \u010dvorovima, biti \u0161ifrirana tijekom rada.<\/p><\/blockquote>\n

Sunil Potti i Eyal Manor, in\u017eenjeri za cloud tehnologije, Google<\/em><\/p>\n

<\/p>\n

Na Confidential GKE \u010dvorovima klijenti mogu konfigurirati GKE klastere tako da \u0107e \u010dvorni stapci biti pokrenuti na vizualnim ma\u0161inama Confidential VMs. Drugim rije\u010dima \u2014 sve radne optere\u0107enja koja se izvr\u0161avaju na ovim \u010dvorovima bit \u0107e \u0161ifrirana tijekom obrade podataka.<\/p>\n

<\/p>\n

Mnogim tvrtkama potrebna je jo\u0161 ve\u0107a tajnost prilikom kori\u0161tenja javnih cloud usluga nego za lokalna radna optere\u0107enja pokretana na vlastitim resursima, \u0161to je potrebno za za\u0161titu od zlonamjernika. Google Cloud, pro\u0161iruju\u0107i svoju liniju Confidential Computing, podi\u017ee ovu razinu, pru\u017eaju\u0107i korisnicima mogu\u0107nost osiguranja tajnosti za GKE klastere. Uzimaju\u0107i u obzir popularnost Kubernetes-a \u2014 ovo je klju\u010dni korak naprijed za industriju, daju\u0107i tvrtkama ve\u0107e mogu\u0107nosti za sigurno hostovanje aplikacija sljede\u0107e generacije u javnom oblaku.<\/p><\/blockquote>\n

Holger Mueller, analiti\u010dar Constellation Research.<\/em><\/p>\n

<\/p>\n

Napomena.<\/strong> Na\u0161a firma pokre\u0107e a\u017euriranu intenzivnu obuku 28-30. rujna Kubernetes Osnovna<\/a><\/noindex> za one koji jo\u0161 ne znaju Kubernetes, ali \u017eele se upoznati i po\u010deti raditi s njim. A nakon ovog doga\u0111aja, od 14.-16. listopada, pokre\u0107emo a\u017eurirani Kubernetes Mega<\/a><\/noindex> program za iskusne korisnike Kubernetesa, kojima je va\u017eno znati sve najnovije prakti\u010dne rje\u0161enja u radu s Kubernetesom posljednjih verzija i mogu\u0107e 'zamke'. Na Kubernetes Mega<\/a><\/noindex> demonstracija, u teoriji i praksi, detalji instalacije i konfiguracije produkcijski spremnog klastera ('the-not-so-easy-way'), mehanizmi osiguranja sigurnosti i otpornosti aplikacija.<\/p><\/blockquote>\n

Osim toga, Google je najavio da \u0107e njegovi Confidential VMs dobiti nove mogu\u0107nosti, po\u0161to postaju javno dostupni od danas. Na primjer, uvedeni su izvje\u0161taji o reviziji koji sadr\u017ee detaljne dnevnike provjere integriteta AMD Secure Processora, koji se koristi za stvaranje klju\u010deva za svaki primjerak Confidential VMs.<\/p>\n

<\/p>\n

Tako\u0111er su dodani dodatni elementi kontrole za postavljanje specifi\u010dnih prava pristupa, a Google je omogu\u0107io isklju\u010divanje bilo koje javne virtualne ma\u0161ine unutar odre\u0111enog projekta. Tako\u0111er, Google povezuje Confidential VMs s drugim mehanizmima za osiguranje tajnosti radi pove\u0107anja sigurnosti.<\/p>\n

<\/p>\n

Mo\u017eete koristiti kombinaciju zajedni\u010dkih VPC-a s pravilima vatrozida i ograni\u010denjima politike organizacije kako biste osigurali da Confidential VMs mogu razmjenjivati podatke s drugim Confidential VMs, \u010dak i ako rade u razli\u010ditim projektima. Osim toga, mo\u017eete koristiti VPC Service Controls za postavljanje podru\u010dja resursa GCP za va\u0161e Confidential VMs.<\/p><\/blockquote>\n

Sunil Potti i Eyal Manor<\/em><\/p>\n

Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google je dodao podr\u0161ku za Kubernetes u Confidential Computing | ProHoster","description":"TL;DR: Sada je mogu\u0107e pokrenuti Kubernetes na Confidential VMs od Google-a.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}