aster.cloud aster.cloud
  • /
  • Platforms
    • Public Cloud
    • On-Premise
    • Hybrid Cloud
    • Data
  • Architecture
    • Design
    • Solutions
    • Enterprise
  • Engineering
    • Automation
    • Software Engineering
    • Project Management
    • DevOps
  • Programming
    • Learning
  • Tools
  • About
  • /
  • Platforms
    • Public Cloud
    • On-Premise
    • Hybrid Cloud
    • Data
  • Architecture
    • Design
    • Solutions
    • Enterprise
  • Engineering
    • Automation
    • Software Engineering
    • Project Management
    • DevOps
  • Programming
    • Learning
  • Tools
  • About
aster.cloud aster.cloud
  • /
  • Platforms
    • Public Cloud
    • On-Premise
    • Hybrid Cloud
    • Data
  • Architecture
    • Design
    • Solutions
    • Enterprise
  • Engineering
    • Automation
    • Software Engineering
    • Project Management
    • DevOps
  • Programming
    • Learning
  • Tools
  • About
  • Cloud-Native
  • Software Engineering

What Can Confidential Computing Do For The Kubernetes Community?

  • aster_cloud
  • September 2, 2022
  • 3 minute read

After working 5 years with cloud native technologies to enable key & certificate management in automotive enterprise security, I was amazed to discover how many Confidential Computing (CC) use cases are possible today. When joining Edgeless Systems, I learned that many problems I have met in the past, could have been solved with CC technologies, but I was not aware of the available solutions.

This piece will present you with an overview, so you know which tools are available to solve your Kubernetes security and data privacy challenges.


Partner with aster.cloud
for your next big idea.
Let us know here.



From our partners:

CITI.IO :: Business. Institutions. Society. Global Political Economy.
CYBERPOGO.COM :: For the Arts, Sciences, and Technology.
DADAHACKS.COM :: Parenting For The Rest Of Us.
ZEDISTA.COM :: Entertainment. Sports. Culture. Escape.
TAKUMAKU.COM :: For The Hearth And Home.
ASTER.CLOUD :: From The Cloud And Beyond.
LIWAIWAI.COM :: Intelligence, Inside and Outside.
GLOBALCLOUDPLATFORMS.COM :: For The World's Computing Needs.
FIREGULAMAN.COM :: For The Fire In The Belly Of The Coder.
ASTERCASTER.COM :: Supra Astra. Beyond The Stars.
BARTDAY.COM :: Prosperity For Everyone.

What is Confidential Computing?

The goal of Confidential Computing is to reduce the Trusted Compute Base (TCB) by creating a Trusted Execution Environment (TEE). This is achieved through a combination of memory isolation (encryption & integrity protection) and remote attestation, enforced by the CPU and its special instructions available on latest hardware generations. These new features complete the trifecta of encryption at rest, encryption in transit, and now also encryption in use.

Confidential computing protects our data in use and adds verifiability.
CC enables encryption in use and verifiability

In the past we’ve used TEEs such as Hardware Security Modules (HSMs), Trusted Platform Modules (TPMs) or smartcards, but these were expensive, limited in hardware resources, hard to program, or a mix of these.

Confidential Computing provides us with two new primitives: Confidential Virtual Machines (CVMs) & Enclaves.

CVMs are as easy to program as a classical virtual machine but are fully isolated from the Cloud Service Provider (CSP) and allow us to remotely verify their state.

Enclaves are more secure, but harder to program than CVMs. Enclaves are isolated processes which do not require an operating system, and therefore are also able to remove the OS vendor from the trusted compute base. This increases the complexity when developing apps for Enclaves, but developer friendly SDKs, such as EGo, are available.

Read More  Introduction To HTTP Chaos In LitmusChaos

How can we use these innovative technologies?

Remote Kubernetes-Node Attestation

Both Intel TDX & AMD SEV supply means to create confidential virtual machines. Offerings in Azure and Google Cloud make it as easy as choosing a different machine type or enabling a flag, to start using confidential machines.

Using these allows us to remove both the Hypervisor & Cloud Service Provider from the Trusted Compute Base.

The trusted compute base of an AMD-SEV SNP confidential virtual machine.
Trusted compute base of an AMD-SEV SNP CVM

A Kubernetes cluster built using CVMs protects us from the cloud provider that cannot gain access to our K8s nodes anymore. Additionally, it also protects us from any malware affecting the cloud provider’s network or cloud management software!

Secure & Verifiable Build Systems using Enclaves

Intel SGX enables our application to request the creation of an Enclave directly from the Hardware. Both data & code can be encrypted and are only ever decrypted in the protected Enclave. This allows us to carry out secure computations in a fully isolated environment.

App and CPU work together to create an Intel SGX Enclave.
Creation of Intel SGX Enclave

Supply chain attacks have increased over the last couple of years. The most popular attack was on SolarWind’s build system, but also crypto miners in NPM packages have received their fair share of news coverage.

One article by Wired from 2021 details which problems the industry is facing when adopting secure build systems: “Keeping tabs on proprietary systems […] is challenging because security tools need to foster transparency and validation without exposing competitive secrets or intellectual property”.

To foster transparency, the cloud native community has adopted Software Bill of Materials (SBOMs) and to enable validation projects like Sigstore and SLSA are improving the integrity of our artifacts.

Read More  Kubernetes Tooling For TechOps And Support (Local Kubernetes Clusters)

Still, using a SaaS offering for a secure build system is still limited by the fact that Intellectual Property (IP) would be exposed to the SaaS vendor as well as infrastructure provider. A build system based on Enclaves would allow users to verify the build system and be sure that no code or data is available to any service provider.

Conclusion

CVMs & Enclaves provide us with the choice to use a more secure environment to carry out computations and protect our data. Using Confidential Virtual Machines should be the default today — especially for sensitive, but also for non-sensitive workloads.

If you want to learn more about Confidential Computing, follow Edgeless Systems on LinkedIn and Twitter, and star our OSS projects on GitHub.

 

Guest post originally published on the Edgeless Systems blog by Fabian Kammel, Senior Security Engineer
This is a summary of the talk I gave at the Kubernetes Community Days (KCD) Berlin 2022. Both, the slides and a recording are available.

Source CNCF


For enquiries, product placements, sponsorships, and collaborations, connect with us at [email protected]. We'd love to hear from you!

Our humans need coffee too! Your support is highly appreciated, thank you!

aster_cloud

Related Topics
  • CNCF
  • Confidential Computing
  • Intel® SGX
  • Kubernetes
You May Also Like
View Post
  • Cloud-Native
  • Platforms

Tencent Unveils Hunyuan, Its Proprietary Large Foundation Model On Tencent Cloud

  • September 7, 2023
Cloud
View Post
  • Cloud-Native
  • Computing
  • Platforms

InfluxData Announces InfluxDB Clustered to Deliver Time Series Analytics for On-Premises and Private Cloud Deployments

  • September 6, 2023
View Post
  • Cloud-Native
  • Computing
  • Engineering
  • Platforms

Farewell EC2-Classic, It’s Been Swell

  • September 4, 2023
View Post
  • Software Engineering
  • Technology

Introducing Code Llama, A State-Of-The-Art Large Language Model For Coding

  • August 25, 2023
Google Cloud Next 2023
View Post
  • Cloud-Native
  • Computing
  • Platforms

10 Must-Attend Sessions For Data Professionals At Google Cloud Next ‘23

  • August 23, 2023
View Post
  • Cloud-Native
  • Computing
  • Technology

How IBM And Cloudflare Are Collaborating To Mitigate Bot-Based Security Threats

  • August 16, 2023
Redis logo
View Post
  • Data
  • Platforms
  • Software Engineering

Redis 7.2 Sets New Standard For Developers To Harness The Power Of Real-Time Data

  • August 15, 2023
View Post
  • Software
  • Software Engineering

End-to-End Secure Evaluation of Code Generation Models

  • August 11, 2023

Stay Connected!
LATEST
  • 1
    Nvidia H100 Tensor Core GPUs Come To Oracle Cloud
    • September 24, 2023
  • 2
    Combining AI With A Trusted Data Approach On IBM Power To Fuel Business Outcomes
    • September 21, 2023
  • 3
    Start Your Ubuntu Confidential VM With Intel® TDX On Google Cloud
    • September 20, 2023
  • Microsoft and Adobe 4
    Microsoft And Adobe Partner To Deliver Cost Savings And Business Benefits
    • September 20, 2023
  • Coffee | Laptop | Notebook | Work 5
    First HP Work Relationship Index Shows Majority of People Worldwide Have an Unhealthy Relationship with Work
    • September 20, 2023
  • 6
    Oracle Expands Distributed Cloud Offerings to Help Organizations Innovate Anywhere
    • September 20, 2023
  • 7
    Huawei Connect 2023: Accelerating Intelligence For Shared Success
    • September 20, 2023
  • 8
    Huawei Releases Data Center 2030, Leading Innovation and Development of New Data Centers
    • September 20, 2023
  • Penguin 9
    How To Find And Fix Broken Packages On Linux
    • September 19, 2023
  • Volkswagen 10
    Volkswagen Races Toward Next-Gen Automotive Manufacturing Leadership With Google Cloud And T-Systems
    • September 19, 2023
about
Hello World!

We are aster.cloud. We’re created by programmers for programmers.

Our site aims to provide guides, programming tips, reviews, and interesting materials for tech people and those who want to learn in general.

We would like to hear from you.

If you have any feedback, enquiries, or sponsorship request, kindly reach out to us at:

[email protected]
Most Popular
  • 1
    VMware Scales Multi-Cloud Security With Workforce Identity Federation
    • September 18, 2023
  • Intel Innovation 2
    Intel Innovation 2023
    • September 15, 2023
  • 3
    Microsoft And Oracle Expand Partnership To Deliver Oracle Database Services On Oracle Cloud Infrastructure In Microsoft Azure
    • September 14, 2023
  • 4
    Real-Time Ubuntu Is Now Available In AWS Marketplace
    • September 12, 2023
  • 5
    IBM Brings Watsonx To ESPN Fantasy Football With New Waiver Grades And Trade Grades
    • September 13, 2023
  • /
  • Technology
  • Tools
  • About
  • Contact Us

Input your search keywords and press Enter.