Container security

Secure your container environment on GCP, GKE, or Anthos.

Overview

Containerization allows development teams to move fast, deploy software efficiently, and operate at an unprecedented scale. As enterprises create more containerized workloads, security must be integrated at each stage of the build-and-deploy life cycle. Learn how to secure any container environment you run on GCP—whether that's Google Kubernetes Engine or Anthos—in three critical areas.

Infrastructure security

Infrastructure security means that your container management platform provides the right security features. Kubernetes includes security features to protect your identities, secrets, and network, and Google Kubernetes Engine uses native GCP functionality—like Cloud IAM, Cloud Audit Logging, and Virtual Private Clouds—and GKE-specific features like application layer secrets encryption and workload identity to bring the best of Google security to your workloads.

Software supply chain

Securing the software supply chain means that container images are safe to deploy. This is how you make sure your container images are vulnerability free and that the images you build aren't modified before they're deployed.

Runtime security

Runtime security allows you to identify a container acting maliciously in production and take action to protect your workload.

Running containers allows you to adopt a fundamentally different security model

Simpler patch management and immutability

Containers are meant to be immutable, so you deploy a new image in order to make changes. You can simplify patch management by rebuilding your images regularly, so the patch is picked up the next time a container is deployed. Get the full picture of your environment with regular image security reviews.

Smaller surface of attack

Containers are meant to run on a much smaller host OS than for a VM, as more is packaged into the application directly. This minimal host OS reduces the potential surface of attack for your workload.

Resource and workload isolation

Containers provide an easy way to isolate resources, such as storage volumes, to certain processes using cgroups and namespaces. With technologies like GKE Sandbox, you can logically isolate workloads in a sub-VM sandbox, separate from other applications.

Infrastructure security

Container infrastructure security is about ensuring that your developers have the tools they need to securely build containerized services. These capabilities are typically built into the container orchestrator, like Kubernetes. If you use Google Kubernetes Engine, this functionality is surfaced natively, in addition to other features of Google Cloud.

Identity and authorization

On Google Kubernetes Engine, use Cloud IAM to manage access to your projects and role-based access control (RBAC) to manage access to your clusters and namespaces.

Audit logging

In Kubernetes, API audit logs are automatically captured. On Google Kubernetes Engine, Cloud Audit Logging records API audit logs automatically for you.

Networking

On Google Kubernetes Engine, create a network policy to manage pod-to-pod communications in your cluster. Use private clusters for private IPs and include Google Kubernetes Engine resources in a shared VPC.

Compliance

Google Kubernetes Engine features many compliance certifications, including ISO 27001, ISO 27017, ISO 27108, HIPAA, and PCI-DSS.

Minimal host OS

Google Kubernetes Engine uses Container-Optimized OS (COS) by default, an OS purpose-built and optimized for running containers. COS is maintained by Google in open source.

Automatically upgraded components

On GKE, masters are automatically patched to the latest Kubernetes version, and you can use node auto-upgrade to keep your security up to date by automatically applying the latest patches for your nodes.

Customer-managed encryption keys

Users in regulated industries may need to be in control of the keys used to encrypt data stored in GKE. With customer-managed encryption keys, you can pick a key from Cloud KMS to protect your GKE persistent disk.

Application layer secrets encryption

By default, Kubernetes secrets are stored in plaintext. GKE encrypts these secrets on disk and monitors this data for insider access. But that alone might not be enough to protect those secrets from a malicious application in your environment. Application layer secrets encryption protects secrets with envelope encryption, with a key you manage in Cloud KMS.

Workload Identity

Your containerized application probably needs to connect to other services, like a database, to fulfill its duties. To do so, your application first needs to authenticate to them. Workload Identity uses a Google-managed service account to share credentials for authentication, following the principles of least privilege for application authentication.

Managed SSL certs

In GKE, HTTPS load balancers need to be associated with an SSL certificate. You can obtain, manage, and renew these certificates yourself, or have Google automatically obtain, manage and renew those certificates for you—saving you the burden of renewing (or forgetting to renew) them yourself.

KUBERNETES ENGINE - Google Cloud Platform

Reliable, efficient, and secured way to run Kubernetes clusters

Containerized Application Management at Scale:-

• Google Kubernetes Engine (GKE) is a managed, production-ready environment for deploying containerized applications. It brings our latest innovations in developer productivity, resource efficiency, automated operations, and open source flexibility to accelerate your time to market.

• Launched in 2015, Kubernetes Engine builds on Google's experience of running services like Gmail and YouTube in containers for over 12 years. Kubernetes Engine allows you to get up and running with Kubernetes in no time, by completely eliminating the need to install, manage,and operate your own Kubernetes clusters.

Deploy a Wide Variety of Applications

Kubernetes Engine enables rapid application development and iteration by making it easy to deploy, update, and manage your applications and services. Kubernetes Engine isn't just for stateless applications either; you can attach persistent storage, and even run a database in your cluster. Simply describe the compute, memory, and storage resources your application containers require, and Kubernetes Engine provisions and manages the underlying cloud resources automatically. Support for hardware accelerators makes it easy to run Machine Learning, General Purpose GPU, High-Performance Computing, and other workloads that benefit from specialized hardware accelerators.

Operate Seamlessly with High Availability

Control your environment from the built-in Kubernetes Engine dashboard in Google Cloud console. Use routine health checks to detect and replace hung, or crashed, applications inside your deployments. Container replication strategies, monitoring, and automated repairs help ensure that your services are highly available and offer a seamless experience to your users. Google Site Reliability Engineers (SREs) constantly monitor your cluster and its compute, networking, and storage resources so you don't have to, giving you back time to focus on your applications.

Scale Effortlessly to Meet Demand

Go from a single machine to thousands: Kubernetes Engine autoscaling allows you to handle increased user demand for your services, keeping them available when it matters most. Then, scale back in the quiet periods to save money, or schedule low-priority batch jobs to use up spare cycles. Kubernetes Engine helps you get the most out of your resource pool.

Run Securely on Google's Network

Connect to and isolate clusters no matter where you are with fine-grained network policies using Global Virtual Private Cloud (VPC) in Google Cloud. Use public services behind a single global anycast IP address for seamless load balancing. Protect against DOS and other types of edge attacks on your containers.

Move Freely between On-premises and Clouds

Kubernetes Engine runs Certified Kubernetes ensuring portability across clouds and on-premises. There's no vendor lock-in: you're free to take your applications out of Kubernetes Engine and run them anywhere Kubernetes is supported, including on your own on-premises servers. You can tailor integrations such as monitoring, logging, and CI/CD using Google Cloud Platform (GCP) and third party solutions in the ecosystem.

Migrate existing VMs directly into containers

Use Migrate for Anthos to move and convert workloads directly into containers in Google Kubernetes Engine (GKE). Target workloads can include physical servers and VMs running on-premises, in Compute Engine, or in other clouds, giving you the flexibility to transform your existing infrastructure with ease. Best of all, Migrate for Anthos is available at no additional cost and it does not require an Anthos subscription.

KUBERNETES ENGINE FEATURES:

Identity & Access Management

Control access in the cluster with your Google accounts and role permissions.

Hybrid Networking

Reserve an IP address range for your cluster, allowing your cluster IPs to coexist with private network IPs via Google Cloud VPN.

Security and Compliance

Kubernetes Engine is backed by Google security team of over 750 experts and is both HIPAA and PCI DSS 3.1 compliant.

Integrated Logging & Monitoring

Enable Stackdriver Logging and Stackdriver Monitoring with simple checkbox configurations, making it easy to gain insight into how your application is running.

Auto Scale

Automatically scale your application deployment up and down based on resource utilization (CPU, memory).

Auto Upgrade

Automatically keep your cluster up to date with the latest release version of Kubernetes. Kubernetes release updates are quickly made available within Kubernetes Engine.

Auto Repair

When auto repair is enabled, if a node fails a health check Kubernetes Engine initiates a repair process for that node.

Resource Limits

Kubernetes allows you to specify how much CPU and memory (RAM) each Container needs, which is used to better organize workloads within your cluster.

Container Isolation

Use GKE Sandbox for a second layer of defense between containerized workloads on Google Kubernetes Engine (GKE) for enhanced workload security.

Stateful Application Support

Kubernetes Engine isn't just for 12-factor apps. You can attach persistent storage to containers, and even host complete databases.

Docker Image Support

Kubernetes Engine supports the common Docker container format.

Fully Managed

Kubernetes Engine clusters are fully managed by Google Site Reliability Engineers (SREs), ensuring your cluster is available and up-to-date.

OS Built for Containers

Kubernetes Engine runs on Container-Optimized OS, a hardened OS built and managed by Google.

Private Container Registry

Integrating with Google Container Registry makes it easy to store and access your private Docker images.

Fast Consistent Builds

Use Google Cloud Build to reliably deploy your containers on Kubernetes Engine without needing to setup authentication.

Workload Portability, on-premises and cloud

Kubernetes Engine runs Certified Kubernetes, enabling workload portability to other Kubernetes platforms across clouds and on-premises.

GPU support

Kubernetes Engine supports GPU and makes it easy to run ML, GPGPU, HPC, and other workloads that benefit from specialized hardware accelerators.

Built-in dashboard

Cloud Console offers useful dashboards for your project's clusters and their resources. You can use these dashboards to view, inspect, manage, and delete resources in your clusters.

For Training:-

http://www.halcyon.net.in/gcp.php

CLOUD DATA TRANSFER

Whether you are in Denver, Colorado or Denmark, whether you have 50 Gigabytes or 50 Petabytes of data, whether you have access to a T1 line or a 10 Gbps network connection, Google offers solutions to meet your unique data transfer needs and get your data on the cloud quickly and securely.

Online Transfer

Use your network to move data to Google Cloud Storage.

Cloud Storage Transfer Service

Transfer your data from one cloud to another.

Transfer Appliance

Securely capture, ship, and upload your data to Google Cloud Storage using the Transfer Appliance 100 TB or 480 TB models.

BigQuery Data Transfer Service

Schedule and automate data transfers from your SaaS applications to Google BigQuery.

Choose the Right Service

Data Center Migration

The data you create and store on-premises takes relentless focus and significant resources to manage it cost-effectively, securely, and reliably. As organizations face exponential growth of their data many are turning to the cloud to scale with them in their efforts. For your structured and unstructured data sets, whether they are small and frequently accessed or huge and rarely referenced, Google offers solutions to migrate that data quickly to Google Cloud Storage , BigQuery or Dataproc.

Decommission Tape Libraries and Infrastructure

Many organizations accumulate vast libraries of magnetic tape as they copy data for backup, archival or disaster recovery purposes. While critical in the event of a disaster, data on tape does not provide any value to your users and requires cumbersome infrastructure to maintain. Working with our many partners, you can easily transfer data from tape to Google Cloud Storage. Once in Google Cloud you can generate new insights with advanced analytics, discover it more easily for regulatory and legal purposes and apply machine learning.

Machine Learning

Once transferred to Google Cloud Storage or BigQuery your data is accessible via our Google Cloud Dataflow processing service for machine learning projects. Google Cloud Machine Learning Engine is a managed service that enables you to easily build machine learning models, that work on any type of data, of any size. Create your model with the powerful TensorFlow framework that powers many Google products, from Google Photos to Google Cloud Speech. Build models of any size with our managed scalable infrastructure. Your trained model is immediately available for use with our global prediction platform that can support thousands of users and TBs of data.

Content Storage and Delivery

If you need to serve users around the world with the highest availability, Google offers multi-regional setups designed for video streaming and frequently accessed content like web sites and images. For analytics and batch processing, regional setups are available to meet the unique requirements of those workloads. For content-rich use cases like these you can choose a data transfer option that will have minimal impact on your network while moving large amounts of data.

Backup and Archival

With increased frequency of cloud outages you need to ensure your data is always available. Using our data transfer services you can easily backup data from another cloud storage provider to Google Cloud Storage. You can ensure your data is retained cost-effectively by taking advantage of ultra low-cost, highly-durable and highly available archival storage offered through Google’s Nearline and Coldline storage classes. Object lifecycle management enables this automatically, transitioning data from one storage class to the next depending on your business’s cost and availability needs at the time.