{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google pievienojusi atbalstu Kubernetes konfidenci\u0101laj\u0101 datu apstr\u0101d\u0113","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: Tagad var uzs\u0101kt Kubernetes uz Konfidenci\u0101las VM<\/a><\/noindex> no Google.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Google \u0161odien (08.09.2020, piez\u012bme tulkot\u0101jam<\/em>) pas\u0101kum\u0101 Cloud Next OnAir<\/a><\/noindex> pazi\u0146oja par savu produktu kl\u0101sta papla\u0161in\u0101\u0161anu, uzs\u0101kot jaunu pakalpojumu.<\/p>\n

<\/p>\n

Konfidenci\u0101lie GKE mezgli pievieno liel\u0101ku nosl\u0113pumain\u012bbu slodz\u0113m, kas tiek palaistas Kubernetes. J\u016blij\u0101 tika uzs\u0101kts pirmais produkts ar nosaukumu Konfidenci\u0101las VM<\/a><\/noindex>, bet \u0161odien \u0161\u012bs virtu\u0101l\u0101s ma\u0161\u012bnas jau ir pieejamas visiem.<\/p>\n

<\/p>\n

Konfidenci\u0101l\u0101 datu apstr\u0101de ir jaunin\u0101jums, kas paredz datu glab\u0101\u0161anu \u0161ifr\u0113t\u0101 veid\u0101 to apstr\u0101des laik\u0101. Tas ir p\u0113d\u0113jais posms datu \u0161ifr\u0113\u0161anas \u0137\u0113d\u0113, jo m\u0101ko\u0146u pakalpojumu sniedz\u0113ji jau \u0161ifr\u0113 datus to ievad\u0113 un izej\u0101. L\u012bdz nesenam laikam bija nepiecie\u0161ams at\u0161ifr\u0113t datus to apstr\u0101des laik\u0101, un daudzi eksperti saskata \u0161aj\u0101 ac\u012bmredzamu v\u0101jumu datu \u0161ifr\u0113\u0161an\u0101.<\/p>\n

<\/p>\n

Google konfidenci\u0101l\u0101s datu apstr\u0101des iniciat\u012bva balst\u0101s uz sadarb\u012bbu ar Konfidenci\u0101l\u0101s datu apstr\u0101des konsorciju, nozares grupu, kas veicina \"uzticamu izpildes vid\u0113m\" (Trusted Execution Environments, TEEs) koncepciju. TEE ir aizsarg\u0101ta procesora da\u013ca, kur\u0101 iel\u0101d\u0113tie dati un kods ir \u0161ifr\u0113ti, t\u0101d\u0113j\u0101di padarot to piek\u013cuvi neiesp\u0113jamu citiem \u0161\u012b pa\u0161a procesora elementiem.<\/p>\n

<\/p>\n

Google konfidenci\u0101l\u0101s VM darbojas uz N2D virtu\u0101laj\u0101m ma\u0161\u012bn\u0101m, kas darbojas AMD otr\u0101s paaudzes EPYC procesoros, izmantojot Secure Encrypted Virtualization tehnolo\u0123iju, kas \u013cauj izol\u0113t virtu\u0101l\u0101s ma\u0161\u012bnas no hipervizora, uz kura t\u0101s darbojas. Ir garantija, ka dati paliek \u0161ifr\u0113ti neatkar\u012bgi no to izmanto\u0161anas: darba slodzes, anal\u012btika, mode\u013cu apm\u0101c\u012bbas piepras\u012bjumi m\u0101ksl\u012bgajam intelektam. \u0160\u012bs virtu\u0101l\u0101s ma\u0161\u012bnas ir paredz\u0113tas, lai apmierin\u0101tu jebkuras uz\u0146\u0113muma, kas str\u0101d\u0101 ar konfidenci\u0101liem datiem regul\u0113taj\u0101s nozar\u0113s, piem\u0113ram, banku sektor\u0101, vajadz\u012bbas.<\/p>\n

<\/p>\n

Iesp\u0113jams, v\u0113l steidzam\u0101ka ir zi\u0146a par gaid\u0101mo beta test\u0113\u0161anu konfidenci\u0101lo GKE mezglu, kuri, p\u0113c Google teikt\u0101, tiks pied\u0101v\u0101ti gaid\u0101maj\u0101 1.18 versij\u0101 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE ir p\u0101rvald\u012bta, ra\u017eo\u0161anai gatava vide konteineru palai\u0161anai, kuros tiek izvietoti m\u016bsdienu lietojumprogrammu da\u013cas, kuras var darbin\u0101t vair\u0101kos skait\u013co\u0161anas vid\u0113s. Kubernetes ir atv\u0113rt\u0101 koda or\u0137estr\u0113\u0161anas r\u012bks, ko izmanto \u0161o konteineru p\u0101rvald\u012b\u0161anai.<\/p>\n

<\/p>\n

Confidential GKE mezglu pievieno\u0161ana nodro\u0161ina augst\u0101ku konfidencialit\u0101ti GKE klasteru palai\u0161an\u0101. Pievienojot jaunu produktu Confidential Computing s\u0113rij\u0101, m\u0113s v\u0113l\u0113j\u0101mies nodro\u0161in\u0101t jaunu l\u012bmeni
\nkonfidencialit\u0101tei un p\u0101rnesam\u012bbai konteineriz\u0113t\u0101m slodz\u0113m. Google Confidential GKE mezgli balst\u012bti uz t\u0101d\u0101m pa\u0161\u0101m tehnolo\u0123ij\u0101m k\u0101 Confidential VMs, \u013cauj jums \u0161ifr\u0113t datus operat\u012bvaj\u0101 atmi\u0146\u0101, izmantojot katram mezglam unik\u0101lu \u0161ifr\u0113\u0161anas atsl\u0113gu, ko izveido un p\u0101rvalda AMD EPYC procesors. \u0160\u0101di mezgli izmanto aparat\u016bras \u0161ifr\u0113\u0161anu operat\u012bvaj\u0101 atmi\u0146\u0101, pamatojoties uz AMD funkciju SEV, kas noz\u012bm\u0113, ka j\u016bsu slodzes, kas tiek izpild\u012btas \u0161\u0101dos mezglos, tiks \u0161ifr\u0113tas to darb\u012bbas laik\u0101.<\/p><\/blockquote>\n

Sunil Potti un Eyal Manor, Google m\u0101ko\u0146a tehnolo\u0123iju in\u017eenieri<\/em><\/p>\n

<\/p>\n

Confidential GKE mezglos klienti var konfigur\u0113t GKE klasterus t\u0101, lai mezglu baseini tiktu palaisti uz Confidential VMs. Vienk\u0101r\u0161\u0101k sakot \u2014 jebkuras slodzes, kas tiek veiktas \u0161\u0101dos mezglos, tiks \u0161ifr\u0113tas datu apstr\u0101des laik\u0101.<\/p>\n

<\/p>\n

Daudziem uz\u0146\u0113mumiem nepiecie\u0161ama v\u0113l liel\u0101ka konfidencialit\u0101te, izmantojot publiskos m\u0101ko\u0146u pakalpojumus, nek\u0101 lok\u0101l\u0101m slodz\u0113m, kas tiek palaistas uz vi\u0146u resursiem, lai pasarg\u0101tu sevi no \u013caunpr\u0101t\u012bgiem uzbrukumiem. Google Cloud papla\u0161inot savu Confidential Computing s\u0113riju, pace\u013c \u0161o lati\u0146u, nodro\u0161inot lietot\u0101jiem iesp\u0113ju garant\u0113t konfidencialit\u0101ti GKE klasteriem. \u0145emot v\u0113r\u0101 Kubernetes popularit\u0101ti \u2014 tas ir svar\u012bgs solis uz priek\u0161u nozarei, dodot uz\u0146\u0113mumiem vair\u0101k iesp\u0113ju dro\u0161i izvietot n\u0101kam\u0101s paaudzes lietojumprogrammas publisk\u0101 m\u0101ko\u0146os.<\/p><\/blockquote>\n

Holger Mueller, Constellation Research anal\u012bti\u0137is.<\/em><\/p>\n

<\/p>\n

Piez\u012bme.<\/strong> M\u016bsu uz\u0146\u0113mums no 28. l\u012bdz 30. septembrim r\u012bko atjaunotu intens\u012bvo kursu Kubernetes B\u0101ze<\/a><\/noindex> tiem, kas v\u0113l nezina Kubernetes, bet v\u0113las ar to iepaz\u012bties un s\u0101kt str\u0101d\u0101t. Un p\u0113c \u0161\u012b pas\u0101kuma no 14. l\u012bdz 16. oktobrim m\u0113s uzs\u0101kam atjaunotu Kubernetes Mega<\/a><\/noindex> kursu pieredz\u0113ju\u0161iem Kubernetes lietot\u0101jiem, kuriem svar\u012bgi uzzin\u0101t visus jaun\u0101kos praktiskos risin\u0101jumus, str\u0101d\u0101jot ar jaun\u0101kaj\u0101m Kubernetes versij\u0101m un iesp\u0113jamiem \u00abk\u0101rdin\u0101jumiem\u00bb. M\u0113s Kubernetes Mega<\/a><\/noindex> izskat\u012bsim teorij\u0101 un praks\u0113 ra\u017eo\u0161anai gatava klastera uzst\u0101d\u012b\u0161anas un konfigur\u0113\u0161anas smalkumus (\u00abthe-not-so-easy-way\u00bb), k\u0101 ar\u012b meh\u0101nismus, kas nodro\u0161ina dro\u0161\u012bbu un pieejam\u012bbu lietojumprogramm\u0101m.<\/p><\/blockquote>\n

Papildus Google pazi\u0146oja, ka t\u0101s Confidential VMs ieg\u016bs jaunas iesp\u0113jas, jo t\u0101s k\u013c\u016bst publiski pieejamas no \u0161odienas. Piem\u0113ram, ir pieejami auditi, kas satur detaliz\u0113tus \u017eurn\u0101lus par AMD Secure Processor, kas tiek izmantots atsl\u0113gu izveidei katram Confidential VMs instanc\u0113.<\/p>\n

<\/p>\n

Ir pieejami ar\u012b vair\u0101k kontroles r\u012bku, lai noteiktu specifiskas piek\u013cuves ties\u012bbas, un Google ir pievienojusi iesp\u0113ju atsl\u0113gt jebkuru neslepeno virtu\u0101lo ma\u0161\u012bnu nor\u0101d\u012btaj\u0101 projekt\u0101. Turkl\u0101t Google sasaista Confidential VMs ar citiem dro\u0161\u012bbas meh\u0101nismiem, lai nodro\u0161in\u0101tu dro\u0161\u012bbu.<\/p>\n

<\/p>\n

J\u016bs varat izmantot kop\u012bgas VPC kombin\u0101ciju ar ugunsmura noteikumiem un organiz\u0101cijas politikas ierobe\u017eojumiem, lai p\u0101rliecin\u0101tos, ka Confidential VMs var apmain\u012bties ar datiem ar citiem Confidential VMs, pat ja tie darbojas da\u017e\u0101dos projektos. Turkl\u0101t j\u016bs varat izmantot VPC Service Controls, lai noteiktu GCP resursu jomu j\u016bsu Confidential VMs.<\/p><\/blockquote>\n

Sunil Potti un Eyal Manor<\/em><\/p>\n

Avots: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google pievienoja Kubernetes atbalstu Confidential Computing | ProHoster","description":"TL;DR: Tagad varat palaist Kubernetes uz Google Confidential VMs.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}