{"id":94386,"date":"2020-09-16T07:43:35","date_gmt":"2020-09-16T05:43:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing"},"modified":"2020-09-16T07:43:35","modified_gmt":"2020-09-16T05:43:35","slug":"google-dobavil-podderzhku-kubernetes-v-confidential-computing","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","title":{"rendered":"Google pridalo podporu Kubernetes do Confidential Computing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

TL;DR<\/strong>: Teraz je mo\u017en\u00e9 spusti\u0165 Kubernetes na Confidential VMs<\/a><\/noindex> od Googlu.<\/p>\n

<\/p>\n

\"Google<\/p>\n

<\/a><\/noindex><\/p>\n

Spolo\u010dnos\u0165 Google dnes (08.09.2020, pozn. prekladate\u013ea<\/em>) na podujat\u00ed Cloud Next OnAir<\/a><\/noindex> ozn\u00e1mila roz\u0161\u00edrenie svojej produktovej rady uveden\u00edm novej slu\u017eby.<\/p>\n

<\/p>\n

Uzly Confidential GKE prid\u00e1vaj\u00fa viac d\u00f4vernosti na za\u0165a\u017eenia spusten\u00e9 v Kubernetes. V j\u00fali bol uveden\u00fd prv\u00fd produkt s n\u00e1zvom Confidential VMs<\/a><\/noindex>, a dnes s\u00fa tieto virtu\u00e1lne stroje u\u017e verejne dostupn\u00e9 v\u0161etk\u00fdm.<\/p>\n

<\/p>\n

Confidential Computing je novinka, ktor\u00e1 predpoklad\u00e1 uchov\u00e1vanie \u00fadajov v \u0161ifrovanej podobe po\u010das ich spracovania. Je to posledn\u00fd \u010dl\u00e1nok v re\u0165azci \u0161ifrovania \u00fadajov, ke\u010f\u017ee poskytovatelia cloudov\u00fdch slu\u017eieb u\u017e \u0161ifruj\u00fa \u00fadaje na vstupe a v\u00fdstupe. Do ned\u00e1vna bolo potrebn\u00e9 de\u0161ifrova\u0165 \u00fadaje po\u010das ich spracovania, a mnoh\u00ed odborn\u00edci v tom vidia jasn\u00fa medzeru v oblasti \u0161ifrovania \u00fadajov.<\/p>\n

<\/p>\n

Iniciat\u00edva Confidential Computing od Googlu je zalo\u017een\u00e1 na spolupr\u00e1ci s konsorciom Confidential Computing, priemyselnou skupinou na podporu konceptu \u00bbd\u00f4veryhodn\u00fdch prostred\u00ed vykon\u00e1vania\u00ab (Trusted Execution Environments, TEEs). TEE je chr\u00e1nen\u00e1 \u010das\u0165 procesora, v ktorej s\u00fa ulo\u017een\u00e9 \u00fadaje a k\u00f3d \u0161ifrovan\u00e9, \u010do znamen\u00e1, \u017ee in\u00e9 \u010dasti toho ist\u00e9ho procesora nemaj\u00fa pr\u00edstup k t\u00fdmto inform\u00e1ci\u00e1m.<\/p>\n

<\/p>\n

Confidential VMs od Googlu funguj\u00fa na virtu\u00e1lnych strojoch N2D, ktor\u00e9 be\u017eia na procesoroch druhej gener\u00e1cie EPYC od AMD, vyu\u017e\u00edvaj\u00facich technol\u00f3giu Secure Encrypted Virtualization, \u010do umo\u017e\u0148uje izolova\u0165 virtu\u00e1lne stroje od hyperv\u00edzora, na ktorom be\u017eia. Existuje z\u00e1ruka, \u017ee \u00fadaje zostan\u00fa \u0161ifrovan\u00e9 bez oh\u013eadu na ich pou\u017e\u00edvanie: pracovn\u00e9 za\u0165a\u017eenia, anal\u00fdzy, po\u017eiadavky na tr\u00e9ning modelov pre umel\u00fa inteligenciu. Tieto virtu\u00e1lne stroje s\u00fa navrhnut\u00e9 tak, aby vyhovovali potreb\u00e1m akejko\u013evek spolo\u010dnosti, ktor\u00e1 pracuje s citliv\u00fdmi \u00fadajmi v regulovan\u00fdch oblastiach, ako je bankov\u00fd sektor.<\/p>\n

<\/p>\n

Mo\u017eno e\u0161te viac aktu\u00e1lny je ozn\u00e1menie o nadch\u00e1dzaj\u00facom beta testovan\u00ed uzlov Confidential GKE, ktor\u00e9, pod\u013ea Googlu, bud\u00fa predstaven\u00e9 v nadch\u00e1dzaj\u00facom vydan\u00ed 1.18 Google Kubernetes Engine<\/a><\/noindex> (GKE). GKE \u2014 spravovan\u00e9, pripraven\u00e9 na nasadenie prostredie pre sp\u00fa\u0161\u0165anie kontajnerov, v ktor\u00fdch s\u00fa umiestnen\u00e9 \u010dasti modern\u00fdch aplik\u00e1ci\u00ed, ktor\u00e9 je mo\u017en\u00e9 sp\u00fa\u0161\u0165a\u0165 v nieko\u013ek\u00fdch v\u00fdpo\u010dtov\u00fdch prostrediach. Kubernetes je n\u00e1stroj na orchestr\u00e1ciu s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom, ktor\u00fd sa pou\u017e\u00edva na spr\u00e1vu t\u00fdchto kontajnerov.<\/p>\n

<\/p>\n

Pridanie uzlov Confidential GKE poskytuje v\u00e4\u010d\u0161iu \u00farove\u0148 s\u00fakromia pri sp\u00fa\u0161\u0165an\u00ed klastrov GKE. Pri prid\u00e1van\u00ed nov\u00e9ho produktu do portf\u00f3lia Confidential Computing sme chceli zabezpe\u010di\u0165 nov\u00fa \u00farove\u0148
\ns\u00fakromia a prenosnosti pre kontajnerizovan\u00e9 za\u0165a\u017eenia. Uzly Confidential GKE od Google s\u00fa postaven\u00e9 na tej istej technol\u00f3gii ako Confidential VMs, umo\u017e\u0148uj\u00fa v\u00e1m \u0161ifrova\u0165 \u00fadaje v pam\u00e4ti pomocou jedine\u010dn\u00e9ho k\u013e\u00fa\u010da \u0161ifrovania pre ka\u017ed\u00fd uzol, ktor\u00fd je generovan\u00fd a spravovan\u00fd procesorom AMD EPYC. Tieto uzly bud\u00fa vyu\u017e\u00edva\u0165 hardv\u00e9rov\u00e9 \u0161ifrovanie pam\u00e4te na z\u00e1klade funkcie SEV od spolo\u010dnosti AMD, \u010do znamen\u00e1, \u017ee va\u0161e pracovn\u00e9 za\u0165a\u017eenia, ktor\u00e9 be\u017eia na t\u00fdchto uzloch, bud\u00fa za\u0161ifrovan\u00e9 po\u010das ich \u010dinnosti.<\/p><\/blockquote>\n

Sunil Potti a Eyal Manor, in\u017einieri pre cloudov\u00e9 technol\u00f3gie, Google<\/em><\/p>\n

<\/p>\n

Na uzloch Confidential GKE m\u00f4\u017eu klienti nastavi\u0165 klastre GKE tak, \u017ee pooly uzlov bud\u00fa spusten\u00e9 na virtu\u00e1lnych strojoch Confidential VMs. Jednoducho povedan\u00e9 \u2014 ak\u00e9ko\u013evek pracovn\u00e9 za\u0165a\u017eenia, ktor\u00e9 be\u017eia na t\u00fdchto uzloch, bud\u00fa \u0161ifrovan\u00e9 po\u010das spracovania \u00fadajov.<\/p>\n

<\/p>\n

Mnoh\u00fdm podnikom je potrebn\u00e9 e\u0161te viac s\u00fakromia pri vyu\u017e\u00edvan\u00ed verejn\u00fdch cloudov\u00fdch slu\u017eieb, ne\u017e pri miestnych pracovn\u00fdch za\u0165a\u017eeniach, ktor\u00e9 s\u00fa sp\u00fa\u0161\u0165an\u00e9 na ich infra\u0161trukt\u00fare, \u010do je potrebn\u00e9 na ochranu pred zl\u00fdmi akt\u00e9rmi. Google Cloud, roz\u0161iruj\u00faci svoju produktov\u00fa l\u00edniu Confidential Computing, zvy\u0161uje t\u00fato latku a umo\u017e\u0148uje pou\u017e\u00edvate\u013eom zaisti\u0165 s\u00fakromie pre klastre GKE. A vzh\u013eadom na popularitu Kubernetes je to k\u013e\u00fa\u010dov\u00fd krok vpred pre odvetvie, ktor\u00fd poskytuje firm\u00e1m viac mo\u017enost\u00ed na bezpe\u010dn\u00e9 umiestnenie aplik\u00e1ci\u00ed novej gener\u00e1cie vo verejnom cloude.<\/p><\/blockquote>\n

Holger Mueller, analytik Constellation Research.<\/em><\/p>\n

<\/p>\n

N.B.<\/strong> Na\u0161a spolo\u010dnos\u0165 28-30 septembra sp\u00fa\u0161\u0165a aktualizovan\u00fd intenz\u00edvny kurz Z\u00e1klady Kubernetes<\/a><\/noindex> pre t\u00fdch, ktor\u00ed e\u0161te nepoznaj\u00fa Kubernetes, ale chc\u00fa sa s n\u00edm obozn\u00e1mi\u0165 a za\u010da\u0165 pracova\u0165. A po tejto akcii 14\u201316 okt\u00f3bra sp\u00fa\u0161\u0165ame aktualizovan\u00fd Mega Kubernetes<\/a><\/noindex> pre pokro\u010dil\u00fdch pou\u017e\u00edvate\u013eov Kubernetes, ktor\u00ed chc\u00fa vedie\u0165 v\u0161etky najnov\u0161ie praktick\u00e9 rie\u0161enia pri pr\u00e1ci s posledn\u00fdmi verziami Kubernetes a mo\u017en\u00e9 \u201en\u00e1strahy\u201c. Na Mega Kubernetes<\/a><\/noindex> rozoberieme v te\u00f3rii a praxi nuansy in\u0161tal\u00e1cie a konfigur\u00e1cie clustera pripraven\u00e9ho na produkciu (\u201ethe-not-so-easy-way\u201c), mechanizmy zabezpe\u010denia a odolnosti aplik\u00e1ci\u00ed.<\/p><\/blockquote>\n

Okrem in\u00e9ho Google ozn\u00e1mil, \u017ee jeho Confidential VMs dostan\u00fa niektor\u00e9 nov\u00e9 funkcie, preto\u017ee sa od dne\u0161n\u00e9ho d\u0148a st\u00e1vaj\u00fa verejn\u00fdmi. Napr\u00edklad sa objavili spr\u00e1vy o audite obsahuj\u00face podrobn\u00e9 z\u00e1znamy o kontrole integrity firmv\u00e9ru AMD Secure Processor, ktor\u00fd sa pou\u017e\u00edva na generovanie k\u013e\u00fa\u010dov pre ka\u017ed\u00fd exempl\u00e1r Confidential VMs.<\/p>\n

<\/p>\n

Taktie\u017e pribudlo viac ovl\u00e1dac\u00edch prvkov na nastavenie konkr\u00e9tnych opr\u00e1vnen\u00ed a Google pridal mo\u017enos\u0165 vypn\u00fa\u0165 ak\u00fako\u013evek neverejn\u00fa virtu\u00e1lnu stroj na ur\u010denom projekte. Navy\u0161e Google prep\u00e1ja Confidential VMs s in\u00fdmi mechanizmami ochrany s\u00fakromia na zabezpe\u010denie bezpe\u010dnosti.<\/p>\n

<\/p>\n

M\u00f4\u017eete pou\u017ei\u0165 kombin\u00e1ciu zdie\u013ean\u00fdch VPC s pravidlami firewall a obmedzeniami v politike organiz\u00e1cie na zabezpe\u010denie, \u017ee Confidential VMs m\u00f4\u017eu zdie\u013ea\u0165 \u00fadaje s in\u00fdmi Confidential VMs, aj ke\u010f pracuj\u00fa v r\u00f4znych projektoch. Okrem toho m\u00f4\u017eete pou\u017ei\u0165 VPC Service Controls na ur\u010denie oblasti zdrojov GCP pre va\u0161e Confidential VMs.<\/p><\/blockquote>\n

Sunil Potti a Eyal Manor<\/em><\/p>\n

Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0435\u0433\u043e\u0434\u043d\u044f (08.09.2020, \u043f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430) \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0438 Cloud Next OnAir \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u0423\u0437\u043b\u044b Confidential GKE \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u043c \u0432 Kubernetes. \u0412 \u0438\u044e\u043b\u0435 \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Confidential VMs, \u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google pridal podporu Kubernetes do Confidential Computing | ProHoster","description":"TL;DR: Teraz m\u00f4\u017eete spusti\u0165 Kubernetes na Confidential VMs od Google.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 Kubernetes \u0432 Confidential Computing | ProHoster","og:description":"TL;DR: \u0422\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Kubernetes \u043d\u0430 Confidential VMs \u043e\u0442 Google.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/google-dobavil-podderzhku-kubernetes-v-confidential-computing","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-16T05:43:35+00:00","article:modified_time":"2020-09-16T05:43:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:27:34","updated":"2022-10-03 07:05:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=94386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/94387"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=94386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=94386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=94386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}