[MUSIC PLAYING]
IBRAHIM DAMLAJ: Welcome to the "Google Cloud Security
Showcase," a special web series where
we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Ibrahim, and I'm a product manager
on GKE security.
Today we'll be walking through how you can protect data
with confidential GKE nodes.
Encryption is an important component of any data
protection strategy and can be used to protect data
in three states, at rest, which is encryption while the data is
being stored, in transit, which is encryption
while data is being transferred from one workbook to another,
and in use, which is encryption while the data is
being processed.
Confidential computing is a breakthrough technology
which encrypts data in use while it is being processed.
Confidential computing environments
keep data encrypted in memory and elsewhere
outside the central processing unit.
We introduced Confidential VMs as a first member
of the confidential computing family earlier this year.
Using the AMD secure encrypted virtualization feature,
Confidential VMs keep memory encrypted
with a dedicated per-VM instance key that
is generated and managed by the AMD EPYC processor,
while offering comparable computation
performance to unencrypted tasks run on the same hardware.
These keys are generated by the AMD secure processor
during VM creation and reside solely within it,
making them unavailable to Google or any other VM
running on the host.
With Confidential VMs, customers can
benefit from runtime protection of their sensitive workloads
without having to change their applications.
This makes transition to a Confidential VM seamless,
making lift and shift a breeze.
Confidential GKE Nodes is the second member
of the confidential computing family.
And it's is built on top of Confidential VMs
and provides runtime memory encryption
for the nodes running your containers.
When bringing confidential computing to GKE,
we wanted to stay true to all of the principles of Google's
confidential computing approach, simple to deploy,
simple to use, and no code changes required.
And now let's see a connection.
Confidential GKE Nodes is a simple cluster toggle
that configures your GKE cluster to use Confidential
VMs in its node [INAUDIBLE].
Your nodes and the workloads running on top of them
are encrypted and use.
To create a cluster with Confidential GKE Nodes enabled,
it's as simple as adding this toggle on cluster creation.
We'll create the cluster.
After a few minutes, the cluster is created.
Applications you run today on GKE
can run on Confidential GKE Nodes with no code change
is needed.
So let's try to deploy a container from Google Container
Registry, say that Google Cloud is seeking.
And there it is.
It's running, and I didn't need to modify it.
Just to make sure, let's validate
that our nodes are, in fact, running on Confidential VMs.
Our Confidential GKE Nodes generate the same launch
attestation report event as Confidential VMs in Cloud Audit
Logging.
So let's take a look at them.
First we navigate to our cluster,
then over to the nodes, and pick a node.
Navigate over to the underlying VM instance
and open Cloud Logging for this instance.
Now we'll check for the attestation report event.
And there it is.
As you can see, with a simple flag,
we were able to get the benefit of runtime memory
encryption in GKE without having to make changes
to our application.
Thank you for watching.
Please visit cloud.google.com/security
to learn more.
[MUSIC PLAYING]