Confidential Space

gcp Virtual machinegoogle-confidential-space

Attested workload on a hardened image over a Confidential VM, hidden from its own operator.

Provider: gcp
Kind: Virtual machine
Category: Compute
Official docs: https://cloud.google.com/confidential-computing/confidential-space/docs/confidential-space-overview

Properties · 4 set by this component

property	type	values	required	kind default	this component
attestation · component property	boolean	—	no	true	inherited
diskEncryption	boolean	—	no	—	▸ true
hardenedImage · component property	boolean	—	no	true	inherited
imageVariant · component property	enum	production \| debug	no	—	inherited
instances	integer	—	no	—	inherited
managed	boolean	—	no	false	▸ false
memoryEncryption · component property	boolean	—	no	true	inherited
memoryGib	integer	—	no	—	inherited
operatorDataAccess · component property	boolean	—	no	false	inherited
os	enum	linux \| windows \| aix \| ibm-i	no	linux	▸ linux
publicIp	boolean	—	no	—	inherited
sizeVcpu	integer	—	no	—	inherited
zoneRedundant	boolean	—	no	—	▸ false

Rules that apply · 1

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

Stateful node without zone redundancyerror

stateful-node-without-zone-redundancy

A stateful compute node pinned to exactly one availability zone disappears with that zone, and its state goes with it. Nodes inside a cell are exempt, because there the cell is deliberately single-zone and redundancy comes from the other cells.

— all of these hold:
— the node's `stateless` is false
— the node sits inside exactly 1 availability-zone group
— this does not hold:
— the node sits inside at least one cell group

Use it in a design

nodes:
  - { id: "confidential-space", component: "google-confidential-space" }

Other Virtual machine products · 60

Auto Scalingalibaba-auto-scalingalibabacloudvirtual-machine Elastic Compute Servicealibaba-ecsalibabacloudvirtual-machine Edge Node Servicealibaba-ensalibabacloudvirtual-machine Simple Application Serveralibaba-simple-application-serveralibabacloudvirtual-machine Amazon EC2aws-ec2awsvirtual-machine Amazon EC2 Auto Scalingaws-ec2-auto-scalingawsvirtual-machine Amazon EC2 Dedicated Hostsaws-ec2-dedicated-hostawsvirtual-machine Amazon Elastic VMware Serviceaws-evsawsvirtual-machine Amazon Lightsailaws-lightsailawsvirtual-machine AWS Nitro Enclavesaws-nitro-enclaveawsvirtual-machine Azure BareMetal Infrastructureazure-baremetal-infrastructureazurevirtual-machine Azure Compute Fleetazure-compute-fleetazurevirtual-machine Azure Dedicated Hostazure-dedicated-hostazurevirtual-machine Azure Data Science Virtual Machineazure-dsvmazurevirtual-machine Nutanix Cloud Clusters on Azureazure-nutanix-cloud-clustersazurevirtual-machine Azure Virtual Machinesazure-virtual-machineazurevirtual-machine Azure Virtual Machine Scale Setsazure-vm-scale-setazurevirtual-machine Azure VMware Solutionazure-vmware-solutionazurevirtual-machine Crusoe Cloud VMcrusoevirtual-machine Firecrackerfirecrackervirtual-machine Microsoft Hyper-Vhyper-vvirtual-machine KubeVirtkubevirtvirtual-machine Lambda Cloud instancelambda-labsvirtual-machine KVM with libvirtlibvirtvirtual-machine Nebius AI Cloud VMnebiusvirtual-machine Nutanix AHVnutanix-ahvvirtual-machine OpenStack Novaopenstack-novavirtual-machine oVirtovirtvirtual-machine Proxmox VEproxmoxvirtual-machine Runpod Podrunpodvirtual-machine Vast.ai instancevast-aivirtual-machine Generic virtual machinevirtual-machinevirtual-machine VMware vSpherevspherevirtual-machine XCP-ngxcp-ngvirtual-machine XenServerxenservervirtual-machine DigitalOcean Bare Metal GPUsdigitalocean-bare-metal-gpudigitaloceanvirtual-machine Dropletsdigitalocean-dropletdigitaloceanvirtual-machine Droplet Autoscale Pooldigitalocean-droplet-autoscaledigitaloceanvirtual-machine Bare Metal Solutiongoogle-bare-metal-solutiongcpvirtual-machine Cloud TPUgoogle-cloud-tpugcpvirtual-machine

and 20 more → Virtual machine page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Confidential Space: a workload that runs on a hardened image based on Container-Optimized OS on top
3# of a Confidential VM, so several parties can operate on each other's sensitive data without the
4# workload operator being able to read it ("Confidential Space overview"). That page states the image
5# runs on a Confidential VM with hardware isolation and remote attestation, that the workload is
6# verified before secrets are released to it, and that a debug variant of the image exists for testing.
7schemaVersion: "1"
8type: "component"
9id: "google-confidential-space"
10kind: "virtual-machine"
11provider: "gcp"
12docs: "https://cloud.google.com/confidential-computing/confidential-space/docs/confidential-space-overview"
13defaults:
14  managed: false
15  os: "linux"
16  diskEncryption: true
17  zoneRedundant: false
18properties:
19  imageVariant:
20    type: "enum"
21    values: ["production", "debug"]
22  hardenedImage:
23    type: "boolean"
24    default: true
25  attestation:
26    type: "boolean"
27    default: true
28  memoryEncryption:
29    type: "boolean"
30    default: true
31  operatorDataAccess:
32    type: "boolean"
33    default: false

The same page as markdown, for an agent: /catalogue/components/google-confidential-space.md