{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google a ad\u0103ugat suport pentru Kubernetes \u00een Confidential Computing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: Acum este posibil s\u0103 rula\u021bi Kubernetes pe VM-uri Confidentiale<\/a><\/noindex> de la Google.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Compania Google a anun\u021bat ast\u0103zi (08.09.2020, nota traduc\u0103torului<\/em>) la evenimentul Cloud Next OnAir<\/a><\/noindex> anun\u021b\u00e2nd extinderea liniei sale de produse prin lansarea unui nou serviciu.<\/p>\n

<\/p>\n

Noezii Confidential GKE adaug\u0103 mai mult\u0103 securitate sarcinilor de lucru rulate \u00een Kubernetes. \u00cen iulie a fost lansat primul produs numit VM-uri Confidentiale<\/a><\/noindex>, iar ast\u0103zi aceste ma\u0219ini virtuale sunt deja accesibile tuturor.<\/p>\n

<\/p>\n

Confidential Computing este o inova\u021bie care presupune stocarea datelor \u00een format criptat \u00een timpul proces\u0103rii acestora. Acesta este ultimul element din lan\u021bul de criptare a datelor, deoarece furnizorii de servicii cloud cripteaz\u0103 deja datele la intrare \u0219i la ie\u0219ire. P\u00e2n\u0103 de cur\u00e2nd, era necesar s\u0103 se decripteze datele \u00een timpul proces\u0103rii, iar mul\u021bi speciali\u0219ti v\u0103d aceasta ca pe o vulnerabilitate evident\u0103 \u00een domeniul cript\u0103rii datelor.<\/p>\n

<\/p>\n

Ini\u021biativa Confidential Computing de la Google se bazeaz\u0103 pe colaborarea cu consor\u021biul Confidential Computing, un grup industrial dedicat promov\u0103rii conceptului de \u00abmedii de execu\u021bie de \u00eencredere\u00bb (Trusted Execution Environments, TEEs). TEE este o parte protejat\u0103 a procesorului, \u00een care datele \u0219i codul \u00eenc\u0103rcate sunt criptate, ceea ce face imposibil accesul la aceste informa\u021bii din alte p\u0103r\u021bi ale aceluia\u0219i procesor.<\/p>\n

<\/p>\n

VM-urile Confidentiale de la Google func\u021bioneaz\u0103 pe ma\u0219ini virtuale N2D, rul\u00e2nd pe procesoare AMD EPYC de a doua genera\u021bie, folosind tehnologia Secure Encrypted Virtualization, care permite izolarea ma\u0219inilor virtuale de hypervizorul pe care ruleaz\u0103. Exist\u0103 o garan\u021bie c\u0103 datele r\u0103m\u00e2n criptate indiferent de utilizarea lor: sarcinile de lucru, analizele, cererile de antrenare a modelelor pentru inteligen\u021ba artificial\u0103. Aceste ma\u0219ini virtuale sunt concepute pentru a satisface nevoile oric\u0103rei companii care lucreaz\u0103 cu date sensibile \u00een domenii reglementate, cum ar fi sectorul bancar.<\/p>\n

<\/p>\n

Un anun\u021b poate mai urgent este despre testarea beta iminent\u0103 a nodurilor Confidential GKE, care, conform Google, vor fi prezentate \u00een viitorul release 1.18 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE este un mediu gestionat, gata de produc\u021bie pentru lansarea containerelor, \u00een care se afl\u0103 p\u0103r\u021bi ale aplica\u021biilor moderne care pot fi rulate \u00een mai multe medii de calcul. Kubernetes este un instrument de orchestrare open-source folosit pentru a gestiona aceste containere.<\/p>\n

<\/p>\n

Ad\u0103ugarea nodurilor Confidential GKE asigur\u0103 un nivel mai mare de confiden\u021bialitate la lansarea clusterelor GKE. Atunci c\u00e2nd am ad\u0103ugat un nou produs \u00een linia Confidential Computing, am dorit s\u0103 oferim un nou nivel
\nde confiden\u021bialitate \u0219i portabilitate pentru sarcini de lucru containerizate. Nodurile Confidential GKE de la Google sunt bazate pe aceea\u0219i tehnologie ca \u0219i VM-urile Confidential, permi\u021b\u00e2ndu-v\u0103 s\u0103 cripta\u021bi datele \u00een memorie cu ajutorul unei chei unice de criptare pentru fiecare nod, generat\u0103 \u0219i gestionat\u0103 de procesorul AMD EPYC. Aceste noduri vor utiliza criptarea hardware a memoriei pe baza func\u021biei SEV de la AMD, ceea ce \u00eenseamn\u0103 c\u0103 sarcinile dvs. de lucru rulate pe aceste noduri vor fi criptate \u00een timpul execu\u021biei.<\/p><\/blockquote>\n

Sunil Potti \u0219i Eyal Manor, ingineri \u00een tehnologia cloud, Google<\/em><\/p>\n

<\/p>\n

Pe nodurile Confidential GKE, clien\u021bii pot configura clustere GKE astfel \u00eenc\u00e2t grupurile de noduri s\u0103 fie lansate pe ma\u0219ini virtuale Confidential VMs. Cu alte cuvinte, toate sarcinile de lucru rulate pe aceste noduri vor fi criptate \u00een timpul proces\u0103rii datelor.<\/p>\n

<\/p>\n

Multe companii au nevoie de un nivel \u0219i mai mare de confiden\u021bialitate atunci c\u00e2nd folosesc servicii cloud publice dec\u00e2t pentru sarcinile de lucru locale, rulate pe infrastructura proprie, pentru a se proteja de atacatori. Google Cloud \u00ee\u0219i extinde linia de produse Confidential Computing, ridic\u00e2nd acest standard, oferind utilizatorilor posibilitatea de a asigura confiden\u021bialitatea pentru clustere GKE. Av\u00e2nd \u00een vedere popularitatea Kubernetes, acesta este un pas important \u00eenainte pentru industrie, oferind companiilor mai multe op\u021biuni pentru g\u0103zduirea \u00een siguran\u021b\u0103 a aplica\u021biilor de genera\u021bie urm\u0103toare \u00een cloudul public.<\/p><\/blockquote>\n

Holger Mueller, analist Constellation Research.<\/em><\/p>\n

<\/p>\n

N.B.<\/strong> Compania noastr\u0103 va organiza un intensiv actualizat \u00een perioada 28-30 septembrie Kubernetes Baza<\/a><\/noindex> pentru cei care nu \u0219tiu Kubernetes, dar doresc s\u0103-l cunoasc\u0103 \u0219i s\u0103 \u00eenceap\u0103 s\u0103 lucreze cu el. Dup\u0103 acest eveniment, \u00een perioada 14\u201316 octombrie, vom lansa un Kubernetes Mega<\/a><\/noindex> pentru utilizatorii experimenta\u021bi Kubernetes, care este important s\u0103 \u0219tie toate solu\u021biile practice recente \u00een utilizarea versiunilor recente de Kubernetes \u0219i posibilele \"capcane\". La Kubernetes Mega<\/a><\/noindex> vom analiza \u00een teorie \u0219i practic\u0103 subtilit\u0103\u021bile instal\u0103rii \u0219i configur\u0103rii unui cluster preg\u0103tit pentru produc\u021bie (\"the-not-so-easy-way\"), mecanismele de asigurare a securit\u0103\u021bii \u0219i disponibilit\u0103\u021bii aplica\u021biilor.<\/p><\/blockquote>\n

\u00cen plus, Google a declarat c\u0103 ma\u0219inile virtuale Confiden\u021biale vor primi noi func\u021bionalit\u0103\u021bi, deoarece devin accesibile publicului \u00eencep\u00e2nd de ast\u0103zi. De exemplu, au ap\u0103rut rapoarte de audit, care con\u021bin jurnale detaliate de verificare a integrit\u0103\u021bii procesorului AMD Secure, folosit pentru a crea chei pentru fiecare instan\u021b\u0103 a ma\u0219inilor virtuale Confiden\u021biale.<\/p>\n

<\/p>\n

De asemenea, au fost ad\u0103ugate mai multe elemente de control pentru a stabili drepturi specifice de acces, iar Google a ad\u0103ugat posibilitatea de a dezactiva orice ma\u0219in\u0103 virtual\u0103 non-confiden\u021bial\u0103 \u00eentr-un anumit proiect. De asemenea, Google conecteaz\u0103 ma\u0219inile virtuale Confiden\u021biale cu alte mecanisme de asigurare a confiden\u021bialit\u0103\u021bii pentru a asigura securitatea.<\/p>\n

<\/p>\n

Pute\u021bi utiliza o combina\u021bie de VPC-uri publice cu reguli de firewall \u0219i restric\u021bii ale politicilor organiza\u021bionale pentru a v\u0103 asigura c\u0103 ma\u0219inile virtuale Confiden\u021biale pot schimba date cu alte ma\u0219ini virtuale Confiden\u021biale, chiar dac\u0103 acestea ruleaz\u0103 \u00een proiecte diferite. \u00cen plus, pute\u021bi utiliza VPC Service Controls pentru a defini zona de resurse GCP pentru ma\u0219inile dvs. virtuale Confiden\u021biale.<\/p><\/blockquote>\n

Sunil Potti \u0219i Eyal Manor<\/em><\/p>\n

Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google a ad\u0103ugat suport pentru Kubernetes \u00een Confiden\u021bial Computing | ProHoster","description":"TL;DR: Acum pute\u021bi rula Kubernetes pe ma\u0219inile virtuale Confiden\u021biale de la Google.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}