Halaman ini menjelaskan tanggung jawab keamanan bersama untuk Google dan pelangganGoogle Cloud . Menjalankan aplikasi yang penting bagi bisnis di Google Kubernetes Engine (GKE) memerlukan banyak pihak untuk mengemban tanggung jawab yang berbeda-beda. Meskipun halaman ini bukan daftar lengkap, dokumen ini dapat membantu Anda memahami tanggung jawab Anda.
Dokumen ini ditujukan untuk
Spesialis keamanan yang menentukan, mengatur, dan menerapkan kebijakan serta prosedur
untuk melindungi data organisasi dari akses yang tidak sah. Untuk mempelajari lebih lanjut
peran umum dan contoh tugas yang kami referensikan dalam konten Google Cloud , lihat
Peran dan tugas pengguna GKE umum.
Hardening
dan
patching
sistem operasi node, seperti Container-Optimized OS atau
Ubuntu. GKE segera membuat patch apa pun ke image ini. Jika Anda mengaktifkan upgrade otomatis, atau menggunakan saluran rilis, update ini akan otomatis di-deploy. Ini adalah lapisan OS di bawah container Anda. Ini tidak sama dengan sistem operasi yang berjalan di container Anda.
Membangun dan mengoperasikan deteksi ancaman untuk ancaman khusus container ke dalam kernel dengan Deteksi Ancaman Container (harga terpisah dengan Security Command Center).
Hardening dan
patching
komponen node Kubernetes. Semua komponen yang dikelola GKE akan diupgrade secara otomatis saat Anda mengupgrade versi node GKE. Hal ini mencakup:
Hardening dan
patching
bidang kontrol. Bidang kontrol mencakup VM bidang kontrol, server
API, penjadwal, pengelola pengontrol,
penerbitan dan rotasi sertifikat TLS CA cluster, materi kunci root of trust,
pengautentikasi dan pemberi otorisasi IAM, konfigurasi
pencatatan audit, etcd, dan berbagai pengontrol lainnya. Semua komponen bidang kontrol Anda berjalan pada instance Compute Engine yang dioperasikan Google. Instance ini adalah tenant tunggal, yang berarti setiap instance menjalankan bidang kontrol dan komponennya hanya untuk satu pelanggan.
Menyediakan Google Cloud integrasi untuk Connect, Identity and Access Management, Cloud Audit Logs, Google Cloud Observability, Cloud Key Management Service, Security Command Center, dan lainnya.
Batasi dan catat akses administratif Google ke cluster pelanggan untuk tujuan dukungan kontrak dengan Transparansi Akses.
Tanggung jawab pelanggan
Mempertahankan workload Anda, termasuk kode aplikasi, file build, image container, data, Kebijakan kontrol akses berbasis peran (RBAC), IAM, serta container dan pod yang Anda jalankan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[],[],null,["[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page explains the shared security responsibilities for both Google and\nGoogle Cloud customers. Running a business-critical application on Google Kubernetes Engine (GKE) requires\nmultiple parties to have different responsibilities. Although this page is not an exhaustive\nlist, this document can help you understand your responsibilities.\n\nThis document is for Security specialists\nwho define, govern and implement policies and procedures\nto protect an organization's data from unauthorized access. To learn more about\ncommon roles and example tasks that we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nGoogle's responsibilities\n\n- Protecting the underlying infrastructure, including hardware, firmware, kernel, OS, storage, network, and more. This includes [encrypting data at rest by default](/security/encryption-at-rest/default-encryption), providing [additional customer-managed disk encryption](/kubernetes-engine/docs/how-to/using-cmek), [encrypting data in transit](/security/encryption-in-transit), using [custom-designed hardware](/docs/security/titan-hardware-chip), laying [private network cables](/about/locations#network-tab), protecting data centers from physical access, protecting the bootloader and kernel against modification using [Shielded Nodes](/kubernetes-engine/docs/how-to/shielded-gke-nodes), and following secure software development practices.\n- [Hardening](/container-optimized-os/docs/concepts/security) and [patching](/kubernetes-engine/docs/resources/security-patching) the nodes' operating system, such as Container-Optimized OS or Ubuntu. GKE promptly makes any patches to these images available. If you have auto-upgrade enabled, or are using a [release channel](/kubernetes-engine/docs/concepts/release-channels), these updates are automatically deployed. This is the OS layer underneath your container---it's not the same as the operating system running in your containers.\n- Building and operating threat detection for container-specific threats into the kernel with [Container Threat Detection](/security-command-center/docs/concepts-container-threat-detection-overview) (priced separately with Security Command Center).\n- Hardening and [patching](/kubernetes-engine/docs/resources/security-patching) Kubernetes node components. All GKE managed components are upgraded automatically when you upgrade GKE node versions. This includes:\n - [vTPM-backed trusted bootstrap mechanism for issuing kubelet TLS certificates](/kubernetes-engine/docs/how-to/shielded-gke-nodes) and auto-rotation of the certificates\n - Hardened kubelet configuration [following CIS benchmarks](/kubernetes-engine/docs/concepts/cis-benchmarks)\n - GKE metadata server for [Workload identity](/kubernetes-engine/docs/how-to/workload-identity)\n - GKE's native [Container Network Interface plugin and Calico for NetworkPolicy](/kubernetes-engine/docs/concepts/network-overview)\n - GKE Kubernetes storage integrations such as the [CSI driver](/kubernetes-engine/docs/how-to/persistent-volumes/gce-pd-csi-driver)\n - GKE [logging and monitoring agents](/stackdriver/docs/solutions/gke)\n- Hardening and [patching](/kubernetes-engine/docs/resources/security-patching) the control plane. The control plane includes the control plane VM, API server, scheduler, controller manager, [cluster CA, TLS certificate issuance and rotation, root-of-trust key material](/kubernetes-engine/docs/concepts/cluster-trust), IAM authenticator and authorizer, audit logging configuration, etcd, and various other controllers. All of your control plane components run on Google-operated Compute Engine instances. These instances are single tenant, meaning each instance runs the control plane and its components for only one customer.\n- Provide Google Cloud integrations for Connect, Identity and Access Management, Cloud Audit Logs, Google Cloud Observability, Cloud Key Management Service, Security Command Center, and others.\n- Restrict and log Google administrative access to customer clusters for contractual support purposes with [Access Transparency](/access-transparency).\n\nCustomer's responsibilities\n\n- Maintain your workloads, including your application code, build files, container images, data, Role-based access control (RBAC)/IAM policy, and containers and pods that you are running.\n- [Rotate your clusters credentials](/kubernetes-engine/docs/how-to/credential-rotation#overview).\n- Keep Standard node pools enrolled in [automatic upgrades](/kubernetes-engine/upgrades#automatic_node_upgrades).\n- In the following situations, manually upgrade your clusters and node pools to remediate vulnerabilities within your organization's patching timelines:\n - Auto-upgrades are postponed because of factors like maintenance policies.\n - You need to apply a patch before it becomes available in your selected release channel. For more information, see [Run patch versions from a newer channel](/kubernetes-engine/docs/concepts/release-channels#newer-patch-versions).\n- Monitor the cluster and applications and respond to any alerts and incidents using technologies such as the [security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard) and [Google Cloud Observability](/stackdriver/docs).\n- Provide Google with environmental details when requested for troubleshooting purposes.\n- Ensure Logging and Monitoring are enabled on clusters. *Without logs, support is available on a best-effort\n basis*.\n\nWhat's next\n\n- Read the GKE [Security overview](/kubernetes-engine/docs/concepts/security-overview)."]]
