Qin, Ant Group Putting an Invisible Shield on Kubernetes Secrets Agenda • K8s Secrets: Overview • TEE-based K8s Secrets Protection: Solution • Production Experience @ Ant Group • Demo • Summary & Plan Management Made Simple - Joe Chen, Ant Financial TEE-based Secrets Protection: Solution Confidential Computing A Trusted Execution Environment (TEE) is • a secure area protected by the processor (aka Enclave) Example: Intel SGX • Strong isolation • Encrypted memory • SW/HW attacks prevented TEE-based KMS Plugin [1] • Address performance & latency concerns • Reduce / minimize remote KMS interactions

secure and non-secure OSs based on hardware-assisted virtualization, trusted execution environment (TEE), and heterogeneous architectures. It utilizes the characteristics of each OS to meet the multi-objective architecture of MICA. OS 1 OS 2 OS 3 OS 4 Lifecycle management Bare metal Heterogeneous architectures TEE ... Embedded virtualization Lightweight container LibOs Cross-OS communication MICA Converged metal servers, embedded virtualization, lightweight containers, library operating system (LibOS), TEE, and heterogeneous architectures. This setup allows MICA to use the advantages of various technologies

pipes::stride pipes::partition pipes::tee pipes::tap21 pipes::transform INSIDE A PIPE22 BRANCHING OUT push_back results23 BRANCHING OUT push_back results tee push_back intermediaryResultspush_back _back intermediaryResults push_back results 24 tee auto const inputs = std::vector{1, 2, 3, 4, 5, 6}; auto intermediaryResults = std::vector{}; auto results = std::vector{}; inputs }) >>= pipes::tee(pipes::push_back(intermediaryResults)) >>= pipes::filter([](int i){ return i % 3 == 0; }) >>= pipes::push_back(results);68 10 12 25 tee auto const inputs = std::vector{1

percentile=99 --mysql-ignore-errors="all" --range_selects=off --rand-type=uniform --auto_inc=off run | tee oltp_read_only.master.txt sysbench oltp_point_select --mysql-host=${host-proxy} --mysql-port=3307 percentile=99 --mysql-ignore-errors="all" --range_selects=off --rand-type=uniform --auto_inc=off run | tee oltp_point_select.master.txt sysbench oltp_read_write --mysql-host=${host-proxy} --mysql-port=3307 percentile=99 --mysql-ignore-errors="all" --range_selects=off --rand-type=uniform --auto_inc=off run | tee oltp_read_write.master.txt sysbench oltp_write_only --mysql-host=${host-proxy} --mysql-port=3307 --

apt install samba • Next is to setup and configure Samba: $ sudo touch /etc/samba/smb.conf && sudo tee -a /etc/samba/smb.conf <tee -a ~/.wgetrc <tee /etc/wireguard/wgA.key $ sudo cat /etc/wireguard/wgA.key | wg pubkey | sudo tee /etc/wireguard/wgA.pub And the configuration on alpha will

you can calculate the values of the resistors needed for different types of attenuators: PI Tee Bridged Tee Resistive Splitter To use this tool, first select the type of attenuator you need, then enter

you can calculate the values of the resistors needed for different types of attenuators: PI Tee Bridged Tee Resistive Splitter To use this tool, first select the type of attenuator you need, then enter

you can calculate the values of the resistors needed for different types of attenuators: PI Tee Bridged Tee Resistive Splitter To use this tool, first select the type of attenuator you need, then enter

can calculate the values of the resistors needed for different types of attenuators: • PI • Tee • Bridged Tee • Resistive Splitter To use this tool, first select the type of attenuator you need, then

you can calculate the values of the resistors needed for different types of attenuators: PI Tee Bridged Tee Resistive Splitter To use this tool, first select the type of attenuator you need, then enter