Protect data-in-use with Intel SGX hardware isolation for workloads such as blockchain and key management.
ACK-TEE is a cloud-native confidential computing platform built on Intel SGX 2.0. It isolates data and code in a Trusted Execution Environment (TEE) inaccessible to applications, the BIOS, OS, kernel, administrators, operators, cloud providers, and all hardware except the CPU.
Prerequisites
-
Activate Container Service and grant permissions to a RAM role
-
Understand the limitations.
Limitations
Item
Limit
Links for increasing quota limits/references
Costs
Your account must have a balance of at least CNY 100 and have completed real-name verification. Otherwise, you cannot create pay-as-you-go ECS instances and SLB instances.
Networks
ACK clusters support only VPCs.
Cloud resources
ECS
The pay-as-you-go and subscription billing methods are supported. After an ECS instance is created, you can change its billing method from pay-as-you-go to subscription in the ECS console.
Change the billing method of an ECS instance from pay-as-you-go to subscription
VPC route entries
By default, you can add at most 200 route entries to the VPC of an ACK cluster that runs Flannel. VPCs of ACK clusters that run Terway do not have this limit. If you want to add more route entries to the VPC of your ACK cluster, request a quota increase for the VPC.
Security groups
By default, you can create at most 100 security groups with each account.
SLB instances
By default, you can create at most 60 pay-as-you-go SLB instances with each account.
EIP
By default, you can create at most 20 EIPs with each account.
Step 1: Create an encrypted computing cluster
Log on to the ACK console. In the left navigation pane, click Clusters.
-
Click Cluster Templates, select Confidential Computing Cluster, and click Create.
-
On the ACK Managed Cluster page, configure the cluster.
Key parameters for an encrypted computing cluster. For all parameters, see ACK managed cluster parameters.
Parameter
Description
Confidential Computing
Enable encrypted computing.
Zone
Only instances in the following Instance Family support encrypted computing: security-enhanced compute-optimized c7t, security-enhanced general-purpose g7t, and security-enhanced memory-optimized r7t. Ensure the selected zone offers these types. See Overview of instance families that are available for purchase.
Skip creating a node pool in this step. For node pool parameters, see Step 2: Create an encrypted computing node pool.
Step 2: Create an encrypted computing node pool
On the ACK Clusters page, click the name of your cluster. In the left navigation pane, click .
-
Click Create Node Pool and configure the node pool.
Key parameters for an encrypted computing node pool. For all parameters, see Create a node pool.
Parameter
Description
Confidential Computing
Enable encrypted computing.
Container Runtime
Only containerd is supported.
Scaling Mode
When enabled, the node pool automatically scales out based on resource usage.
Instance-related parameters
Select a security-enhanced instance type: c7t (compute-optimized), g7t (general-purpose), or r7t (memory-optimized).
Remote attestation on these instances supports only DCAP, not legacy EPID. If your application uses EPID, migrate to DCAP.
Expected Number of Nodes
The initial number of nodes. Set to 0 to skip node creation.
Operating System
-
Cluster version 1.30 and later: Alibaba Cloud Linux 3.2104 LTS 64-bit (Container-optimized) or Alibaba Cloud Linux 3.2104 LTS 64-bit.
-
Cluster versions earlier than 1.30: Alibaba Cloud Linux 2.xxxx 64-bit UEFI Edition only.
Node Labels
Add labels to cluster nodes.
ECS Tags
Add tags to ECS instances.
After creation, the node pool Status changes to Active.
-
What to do next
After deployment, see Develop and build SGX 2.0 applications by using an SDK to build and deploy a sample SGX 2.0 application with the TEE-SDK.