Trusted Launch enabled nodes are now generally available
on AKS. Trusted launch
improves the security of generation 2 virtual machines (VMs) by protecting
against advanced and persistent attack techniques. It enables administrators to
deploy AKS nodes, which contain the underlying virtual machines, with verified
and signed bootloaders, OS kernels, and drivers. By using secure and measured
boot, administrators gain insights and confidence of the entire boot chain's
integrity.
Trusted launch is composed of
several coordinated infrastructure technologies that can be enabled
independently. Each technology provides another layer of defense against
sophisticated threats.
- vTPM - Trusted launch introduces a virtualized version of a hardware
Trusted
Platform Module (TPM), compliant with the
TPM 2.0 specification. It serves as a dedicated secure vault for keys and
measurements.
- Secure Boot - At the root of trusted launch is Secure Boot for your VM.
This mode, which is implemented in platform firmware, protects against the
installation of malware-based rootkits and boot kits.
Learn more.