Using Confidential GKE Nodes

Standard

---

Beta

This product or feature is covered by the Pre-GA Offerings Terms of the Google Cloud Terms of Service. Pre-GA products and features may have limited support, and changes to pre-GA products and features may not be compatible with other pre-GA versions. For more information, see the launch stage descriptions.

This page shows you how to use the Confidential Google Kubernetes Engine Nodes feature. Confidential GKE Nodes provides encryption-in-use for your workloads.

Overview

Confidential GKE Nodes is built on top of Compute Engine Confidential VM, which encrypts the memory contents of VMs in-use. Clusters with Confidential GKE Nodes enabled enforce the use of Confidential VM for all of your nodes. This means that your nodes, including the workloads running on them, are encrypted in-use. For visibility over your control plane, use Access Transparency.

There is no additional cost to deploy Confidential GKE Nodes, other than the cost of Compute Engine Confidential VM. However, Confidential GKE Nodes might generate slightly more log data on startup than standard nodes. For information on logs pricing, see Pricing for Google Cloud's operations suite.

Availability

Confidential GKE Nodes is available in the following situations:

• Confidential GKE Nodes is available in the Regular and Rapid release channels for GKE versions 1.18.6-gke.1600 and later.
• Confidential GKE Nodes is available in zones and regions with N2D instances available.
• Confidential GKE Nodes can be used with Container-Optimized OS and containerd on Container-Optimized OS (cos_containerd).
• Confidential GKE Nodes enforces the use of Confidential VM in your node pools.
• Confidential VM is only available on N2D instances of Compute Engine.

Before you begin

Before you start, make sure you have performed the following tasks:

• Ensure that you have enabled the Google Kubernetes Engine API.
Enable Google Kubernetes Engine API
• Ensure that you have installed the Cloud SDK.

Set up default gcloud settings using one of the following methods:

• Using gcloud init, if you want to be walked through setting defaults.
• Using gcloud config, to individually set your project ID, zone, and region.

Using gcloud init

If you receive the error One of [--zone, --region] must be supplied: Please specify location, complete this section.

1. Run gcloud init and follow the directions:

   gcloud init

   If you are using SSH on a remote server, use the --console-only flag to prevent the command from launching a browser:

   gcloud init --console-only

2. Follow the instructions to authorize gcloud to use your Google Cloud account.
3. Create a new configuration or select an existing one.
4. Choose a Google Cloud project.
5. Choose a default Compute Engine zone for zonal clusters or a region for regional or Autopilot clusters.

Note: You can override these default settings in gcloud commands using the --project, --zone, and --region flags.

Using gcloud config

• Set your default project ID:

  gcloud config set project PROJECT_ID

• If you are working with zonal clusters, set your default compute zone:

  gcloud config set compute/zone COMPUTE_ZONE

• If you are working with Autopilot or regional clusters, set your default compute region:

  gcloud config set compute/region COMPUTE_REGION

• Update gcloud to the latest version:

  gcloud components update

Note: You can override these default settings in gcloud commands using the --project, --zone, and --region flags.

Enabling Confidential GKE Nodes in a new cluster

You can create a new cluster with Confidential GKE Nodes enabled by using gcloud tool or Google Cloud Console.

gcloud

When creating a new cluster, specify the --enable-confidential-nodes option in the gcloud command-line tool:

gcloud beta container clusters create CLUSTER_NAME \
  --release-channel=RELEASE_CHANNEL \
  --machine-type N2D_MACHINE_TYPE \
  --enable-confidential-nodes

Replace the following:

• CLUSTER_NAME: the name of your new cluster.

• RELEASE_CHANNEL: the release channel must be either regular or rapid.

• N2D_MACHINE_TYPE: the machine type for your cluster's default node pool, which must be an N2d machine type.

Console

1. Go to the Google Kubernetes Engine page in the Cloud Console.

   Go to Google Kubernetes Engine

2. Click Create.

3. In the Standard section, click Configure.

4. From the navigation pane, under Cluster, click Security.

5. Select the Enable Confidential GKE Nodes checkbox.

6. Configure your cluster as desired.

7. Click Create.

See Creating a cluster for more details about creating clusters.

After creating a cluster with Confidential GKE Nodes, any node pools created in this cluster can only be confidential nodes.

Verifying that Confidential GKE Nodes are enabled

You can verify that your cluster is using Confidential GKE Nodes with the gcloud command-line tool or Google Cloud Console.

gcloud

Describe the cluster:

gcloud beta container clusters describe CLUSTER_NAME

If Confidential GKE Nodes is enabled, the output of the command will include these lines:

confidentialNodes:
  enabled: true

Console

1. Go to the Google Kubernetes Engine page in Cloud Console.

   Go to Google Kubernetes Engine

2. Click the name of the cluster you want to inspect.

3. Under Security, in the Confidential GKE Nodes field, verify that Confidential GKE Nodes is Enabled.

To validate the confidentiality of your nodes, you can view launch attestation events for individual nodes in Compute Engine logs. For more information, see Validating Confidential VM using Cloud Monitoring.

Running applications on Confidential GKE Nodes

Google's approach to confidential computing is to enable an effortless lift and shift for existing applications. GKE workloads that you run today can run on Confidential GKE Nodes without code changes.

Optionally, if you want to declaratively express that your workloads must only run on clusters with Confidential GKE Nodes, you can use the cloud.google.com/gke-confidential-nodes node selector. Here's an example Pod spec that uses this selector:

apiVersion: v1
kind: Pod
spec:
  containers:
  - name: my-confidential-app
    image: us-docker.pkg.dev/myproject/myrepo/my-confidential-app
    nodeSelector: cloud.google.com/gke-confidential-nodes:true

Limitations

Consider the following limitations before enabling Confidential GKE Nodes on a new cluster:

• You cannot enable Confidential GKE Nodes on existing clusters.
• You cannot disable Confidential GKE Nodes after it is enabled on a cluster.
• Confidential GKE Nodes is not compatible with GPUs.
• Confidential GKE Nodes is not compatible with sole tenant nodes.
• Currently, you cannot add local SSDs or persistent disks when Confidential GKE Nodes is enabled.
• Only Container-Optimized OS nodes are supported. Ubuntu and Windows nodes are not supported.
• Confidential VM for control plane (master) nodes is not supported.

What's next

• Learn more about Confidential VM.
• Learn more about node images.
• Learn more about Google Cloud encryption at rest.
• Learn more about Google Cloud encryption in transit.
• Learn more about customer-managed encryption keys (CMEK).
• Learn more about application-layer secrets encryption.