Google LLC today introduced GKE Advanced, a heavily upgraded version of its cloud Kubernetes service with security and automation features aimed at the enterprise crowd.

Kubernetes is the leading open-source framework for running software container deployments. Containers, in turn, are emerging as enterprises’ tool of choice for building and deploying applications. The technology makes cloud services portable, allowing them to run unchanged on different types of infrastructure, while simplifying maintenance tasks such as patching.

GKE was originally designed as a service that allows companies to run Kubernetes without having to manually manage the underlying hardware. With GKE Advanced, Google is expanding that mission of easing day-to-day operations to additional areas, most notably security.

The service includes a tool called GKE Sandbox that can isolate certain containers from the rest of the deployment. It does so by limiting direct interactions between a container and the virtual machine on which it runs. This capability offers a niche but valuable benefit: it allows companies to cordon off any external components that their developers include in applications, for instance open-source code, to reduce the threat from undiscovered vulnerabilities.

GKE Sandbox “adds a second layer of defense at the pod layer, hardening your containerized applications without any code or config changes, or requiring you to learn a new set of controls,” Google Cloud product manager Jerzy Foryciarz explained in a blog post.

GKE Sandbox is joined by a second security feature dubbed Binary Authorization. The tool is essentially a sophisticated filter, automatically blocking new code from being added to a Kubernetes environment unless it has been signed off by an authorized developer.

The rest of the new features in GKE Sandbox focus largely on managing infrastructure resources. The service includes mechanisms that can automatically add or remove cloud instances based on demand, as well as provision extra processing power and memory for specific containers when needed.

Administrators can track hardware usage using an expanded set of monitoring features. According to Google, GKE Advanced can break down utilization by departments, customers and other business-centric categories to help companies find inefficiencies more easily.

GKE Advanced will be available alongside the original version of Google’s Kubernetes service, which has been renamed GKE Standard.

“GKE Advanced is financially backed by an SLA [service level agreement] that guarantees availability of 99.95% for regional clusters, providing peace of mind for mission-critical workloads,” Foryciarz added.

Image: Google