Confidential GKE Node로 클러스터를 만든 후 이 클러스터에 생성되는 모든 노드 풀은 컨피덴셜 노드만 사용할 수 있습니다. Confidential GKE Node가 사용 설정된 클러스터에서는 일반 노드 풀을 만들 수 없습니다. 또한 클러스터 수준에서 Confidential GKE Node를 사용 설정하면 개별 노드 풀에서 Confidential GKE Node를 중지할 수 없습니다.
Confidential GKE Node 워크로드에서 vTPM 실행
Google에서는 Confidential GKE Node 워크로드에서 vTPM을 실행할 수 있도록 Confidential GKE Node 클러스터에 적용할 DaemonSet를 제공합니다. 다음 명령어를 실행하여 DaemonSet를 배포합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-18(UTC)"],[],[],null,["# Run a vTPM in Confidential GKE Nodes workloads\n\n[Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page shows you how to use Virtual Trusted Platform Modules (vTPMs) with\nGoogle Kubernetes Engine (GKE) Standard workloads that run in\nConfidential GKE Nodes. vTPMs provide platform integrity along with\nother security features, such as remote attestation, secret sealing, and random\nnumber generation. On this page, you learn how to install a device plugin and\nmake vTPMs visible to GKE applications.\n\nThis page is intended for Security engineers who want to remotely access the\nsecurity features of vTPMs in GKE applications.\n\nBefore reading this page, ensure that you're familiar with the following\nfeatures:\n\n- [Confidential GKE Nodes](/kubernetes-engine/docs/how-to/confidential-gke-nodes)\n- [Shielded GKE Nodes](/kubernetes-engine/docs/how-to/shielded-gke-nodes)\n\nBefore you begin\n----------------\n\nBefore you start, make sure that you have performed the following tasks:\n\n- Enable the Google Kubernetes Engine API.\n[Enable Google Kubernetes Engine API](https://console.cloud.google.com/flows/enableapi?apiid=container.googleapis.com)\n- If you want to use the Google Cloud CLI for this task, [install](/sdk/docs/install) and then [initialize](/sdk/docs/initializing) the gcloud CLI. If you previously installed the gcloud CLI, get the latest version by running `gcloud components update`. **Note:** For existing gcloud CLI installations, make sure to set the `compute/region` [property](/sdk/docs/properties#setting_properties). If you use primarily zonal clusters, set the `compute/zone` instead. By setting a default location, you can avoid errors in the gcloud CLI like the following: `One of [--zone, --region] must be supplied: Please specify location`. You might need to specify the location in certain commands if the location of your cluster differs from the default that you set.\n\n### Limitations\n\nYou can make vTPMs visible to GKE applications only in\nConfidential GKE Nodes that use AMD SEV as the Confidential Computing\ntechnology. Intel TDX and AMD SEV-SNP aren't supported.\n\nAvailability\n------------\n\nYou can use Confidential GKE Nodes under the following conditions:\n\n- In zones and regions with\n [N2D instances](/compute/docs/general-purpose-machines#n2d_machines) or\n [C2D instances](/compute/docs/compute-optimized-machines#c2d_machine_types)\n available.\n\n- Node images using Container-Optimized OS with containerd ([`cos_containerd`](/kubernetes-engine/docs/concepts/using-containerd)).\n\nCreate a Confidential GKE Nodes cluster\n---------------------------------------\n\nYou can create a new cluster with Confidential GKE Nodes enabled by\nusing the gcloud CLI or the Google Cloud console. If you enable\nConfidential GKE Nodes at cluster level, all the nodes in the cluster\nbecome [Confidential VMs](/confidential-computing/confidential-vm/docs/about-cvm). \n\n### gcloud\n\nCreate a new cluster that uses AMD SEV as the Confidential Computing\ntechnology: \n\n gcloud container clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --machine-type=\u003cvar translate=\"no\"\u003eMACHINE_TYPE\u003c/var\u003e \\\n --confidential-node-type=SEV\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your new cluster.\n- \u003cvar translate=\"no\"\u003eMACHINE_TYPE\u003c/var\u003e: the machine type for your cluster's default node pool, which must be either the N2D or C2D machine type.\n\n### Console\n\n1. In the Google Cloud console, go to the **Create a Kubernetes cluster** page.\n\n [Go to Create a Kubernetes cluster](https://console.cloud.google.com/kubernetes/add)\n2. In the navigation menu, under **Cluster** , click **Security**.\n3. Select **Enable Confidential GKE Nodes**.\n4. In the confirmation dialog, click **Make changes**.\n5. In the **Type** menu, select **AMD SEV**.\n6. For configuring other sections of the cluster, follow the instructions in [Creating a regional cluster](/kubernetes-engine/docs/how-to/creating-a-regional-cluster).\n7. Click **Create**.\n\nAfter creating a cluster with Confidential GKE Nodes, any node pools\ncreated in this cluster can only use confidential nodes. You can't create\nregular node pools in clusters with Confidential GKE Nodes enabled. You\nalso can't disable Confidential GKE Nodes on individual node pools\nwhen you enable Confidential GKE Nodes at cluster level.\n\nRun a vTPM in Confidential GKE Nodes workloads\n----------------------------------------------\n\nTo run vTPM in Confidential GKE Nodes workloads, Google provides a\nDaemonSet to apply to the Confidential GKE Nodes clusters. Run the\nfollowing command to deploy the DaemonSet: \n\n kubectl create -f https://raw.githubusercontent.com/google/cc-device-plugin/main/manifests/cc-device-plugin.yaml\n\nConfigure Pods to see the vTPM\n------------------------------\n\nYou use a [resource limit](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to configure Pods to see\nvTPM. Specify the resource limit as 1 in a [Pod specification](https://v1-30.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#podspec-v1-core)\nusing the following key-value pair\n\n- Key: `google.com/cc`\n- Value: 1\n\nAn example of a Pod specification that uses vTPM: \n\n apiVersion: v1\n kind: Pod\n metadata:\n name: my-vtpm-pod\n spec:\n containers:\n - name: nginx\n image: nginx\n ports:\n - containerPort: 8080\n name: http\n resources:\n limits:\n google.com/cc: 1\n\nWhat's next\n-----------\n\n- Learn how to [remotely attest that workloads are running on Confidential VM](https://codelabs.developers.google.com/codelabs/vtpm-remote-attestation-and-sealing-on-confidential-gke-nodes)."]]
