Skip to content

Commit ef4d3ef

Browse files
modular-magicianmodular-magician
authored
v1 Updates: Add tags, serviceAccountScopes, V100 GPU, ShieldedInstanc… (#4425) (#2897)
* v1 Updates: Add tags, serviceAccountScopes, V100 GPU, ShieldedInstanceConfig * Update shieldedVM parameters enableIntegrityMonitoring and enableVtpm to true * Add default value for ShieldedInstanceConfig Signed-off-by: Modular Magician <[email protected]>
1 parent 3f4b689 commit ef4d3ef

File tree

4 files changed

+227
-7
lines changed

4 files changed

+227
-7
lines changed

‎.changelog/4425.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
notebooks: added `tags`, `service_account_scopes`,`shielded_instance_config` to `google_notebooks_instance`
3+
```

‎go.sum‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,7 @@ github.com/hashicorp/terraform-json v0.8.0 h1:XObQ3PgqU52YLQKEaJ08QtUshAfN3yu4u8
348348
github.com/hashicorp/terraform-json v0.8.0/go.mod h1:3defM4kkMfttwiE7VakJDwCd4R+umhSQnvJwORXbprE=
349349
github.com/hashicorp/terraform-plugin-go v0.1.0 h1:kyXZ0nkHxiRev/q18N40IbRRk4AV0zE/MDJkDM3u8dY=
350350
github.com/hashicorp/terraform-plugin-go v0.1.0/go.mod h1:10V6F3taeDWVAoLlkmArKttR3IULlRWFAGtQIQTIDr4=
351+
github.com/hashicorp/terraform-plugin-go v0.2.1 h1:EW/R8bB2Zbkjmugzsy1d27yS8/0454b3MtYHkzOknqA=
351352
github.com/hashicorp/terraform-plugin-go v0.2.1/go.mod h1:10V6F3taeDWVAoLlkmArKttR3IULlRWFAGtQIQTIDr4=
352353
github.com/hashicorp/terraform-plugin-sdk/v2 v2.1.0 h1:Z5K9y5UGVQO7gvLFk6NMA/v1JZW/HLzJ/TTSoLkqQyY=
353354
github.com/hashicorp/terraform-plugin-sdk/v2 v2.1.0/go.mod h1:GP0lmw4Y+XV1OfTmi/hK75t5KWGGzoOzEgUBPGZ6Wq4=

‎google-beta/resource_notebooks_instance.go‎

Lines changed: 182 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,8 @@ machineType you have selected.`,
8383
Type: schema.TypeString,
8484
Required: true,
8585
ForceNew: true,
86-
ValidateFunc: validation.StringInSlice([]string{"ACCELERATOR_TYPE_UNSPECIFIED", "NVIDIA_TESLA_K80", "NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS", "TPU_V2", "TPU_V3"}, false),
87-
Description: `Type of this accelerator. Possible values: ["ACCELERATOR_TYPE_UNSPECIFIED", "NVIDIA_TESLA_K80", "NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS", "TPU_V2", "TPU_V3"]`,
86+
ValidateFunc: validation.StringInSlice([]string{"ACCELERATOR_TYPE_UNSPECIFIED", "NVIDIA_TESLA_K80", "NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS", "NVIDIA_TESLA_A100", "TPU_V2", "TPU_V3"}, false),
87+
Description: `Type of this accelerator. Possible values: ["ACCELERATOR_TYPE_UNSPECIFIED", "NVIDIA_TESLA_K80", "NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS", "NVIDIA_TESLA_A100", "TPU_V2", "TPU_V3"]`,
8888
},
8989
},
9090
},
@@ -217,13 +217,13 @@ Format: projects/{project_id}/global/networks/{network_id}`,
217217
Type: schema.TypeBool,
218218
Optional: true,
219219
ForceNew: true,
220-
Description: `the notebook instance will not register with the proxy..`,
220+
Description: `The notebook instance will not register with the proxy..`,
221221
},
222222
"no_public_ip": {
223223
Type: schema.TypeBool,
224224
Optional: true,
225225
ForceNew: true,
226-
Description: `no public IP will be assigned to this instance.`,
226+
Description: `No public IP will be assigned to this instance.`,
227227
},
228228
"no_remove_data_disk": {
229229
Type: schema.TypeBool,
@@ -250,6 +250,58 @@ the same project, but you must have the service account user
250250
permission to use the instance. If not specified,
251251
the Compute Engine default service account is used.`,
252252
},
253+
"service_account_scopes": {
254+
Type: schema.TypeList,
255+
Optional: true,
256+
ForceNew: true,
257+
Description: `Optional. The URIs of service account scopes to be included in Compute Engine instances.
258+
If not specified, the following scopes are defined:
259+
- https://www.googleapis.com/auth/cloud-platform
260+
- https://www.googleapis.com/auth/userinfo.email`,
261+
Elem: &schema.Schema{
262+
Type: schema.TypeString,
263+
},
264+
},
265+
"shielded_instance_config": {
266+
Type: schema.TypeList,
267+
Computed: true,
268+
Optional: true,
269+
ForceNew: true,
270+
Description: `A set of Shielded Instance options. Check [Images using supported Shielded VM features]
271+
Not all combinations are valid`,
272+
MaxItems: 1,
273+
Elem: &schema.Resource{
274+
Schema: map[string]*schema.Schema{
275+
"enable_integrity_monitoring": {
276+
Type: schema.TypeBool,
277+
Optional: true,
278+
ForceNew: true,
279+
Description: `Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the
280+
boot integrity of the instance. The attestation is performed against the integrity policy baseline.
281+
This baseline is initially derived from the implicitly trusted boot image when the instance is created.
282+
Enabled by default.`,
283+
Default: true,
284+
},
285+
"enable_secure_boot": {
286+
Type: schema.TypeBool,
287+
Optional: true,
288+
ForceNew: true,
289+
Description: `Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs
290+
authentic software by verifying the digital signature of all boot components, and halting the boot process
291+
if signature verification fails.
292+
Disabled by default.`,
293+
},
294+
"enable_vtpm": {
295+
Type: schema.TypeBool,
296+
Optional: true,
297+
ForceNew: true,
298+
Description: `Defines whether the instance has the vTPM enabled.
299+
Enabled by default.`,
300+
Default: true,
301+
},
302+
},
303+
},
304+
},
253305
"subnet": {
254306
Type: schema.TypeString,
255307
Computed: true,
@@ -259,6 +311,15 @@ the Compute Engine default service account is used.`,
259311
Description: `The name of the subnet that this instance is in.
260312
Format: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id}`,
261313
},
314+
"tags": {
315+
Type: schema.TypeList,
316+
Optional: true,
317+
ForceNew: true,
318+
Description: `The Compute Engine tags to add to runtime.`,
319+
Elem: &schema.Schema{
320+
Type: schema.TypeString,
321+
},
322+
},
262323
"vm_image": {
263324
Type: schema.TypeList,
264325
Optional: true,
@@ -355,12 +416,24 @@ func resourceNotebooksInstanceCreate(d *schema.ResourceData, meta interface{}) e
355416
} else if v, ok := d.GetOkExists("service_account"); !isEmptyValue(reflect.ValueOf(serviceAccountProp)) && (ok || !reflect.DeepEqual(v, serviceAccountProp)) {
356417
obj["serviceAccount"] = serviceAccountProp
357418
}
419+
serviceAccountScopesProp, err := expandNotebooksInstanceServiceAccountScopes(d.Get("service_account_scopes"), d, config)
420+
if err != nil {
421+
return err
422+
} else if v, ok := d.GetOkExists("service_account_scopes"); !isEmptyValue(reflect.ValueOf(serviceAccountScopesProp)) && (ok || !reflect.DeepEqual(v, serviceAccountScopesProp)) {
423+
obj["serviceAccountScopes"] = serviceAccountScopesProp
424+
}
358425
acceleratorConfigProp, err := expandNotebooksInstanceAcceleratorConfig(d.Get("accelerator_config"), d, config)
359426
if err != nil {
360427
return err
361428
} else if v, ok := d.GetOkExists("accelerator_config"); !isEmptyValue(reflect.ValueOf(acceleratorConfigProp)) && (ok || !reflect.DeepEqual(v, acceleratorConfigProp)) {
362429
obj["acceleratorConfig"] = acceleratorConfigProp
363430
}
431+
shieldedInstanceConfigProp, err := expandNotebooksInstanceShieldedInstanceConfig(d.Get("shielded_instance_config"), d, config)
432+
if err != nil {
433+
return err
434+
} else if v, ok := d.GetOkExists("shielded_instance_config"); !isEmptyValue(reflect.ValueOf(shieldedInstanceConfigProp)) && (ok || !reflect.DeepEqual(v, shieldedInstanceConfigProp)) {
435+
obj["shieldedInstanceConfig"] = shieldedInstanceConfigProp
436+
}
364437
installGpuDriverProp, err := expandNotebooksInstanceInstallGpuDriver(d.Get("install_gpu_driver"), d, config)
365438
if err != nil {
366439
return err
@@ -445,6 +518,12 @@ func resourceNotebooksInstanceCreate(d *schema.ResourceData, meta interface{}) e
445518
} else if v, ok := d.GetOkExists("labels"); !isEmptyValue(reflect.ValueOf(labelsProp)) && (ok || !reflect.DeepEqual(v, labelsProp)) {
446519
obj["labels"] = labelsProp
447520
}
521+
tagsProp, err := expandNotebooksInstanceTags(d.Get("tags"), d, config)
522+
if err != nil {
523+
return err
524+
} else if v, ok := d.GetOkExists("tags"); !isEmptyValue(reflect.ValueOf(tagsProp)) && (ok || !reflect.DeepEqual(v, tagsProp)) {
525+
obj["tags"] = tagsProp
526+
}
448527
metadataProp, err := expandNotebooksInstanceMetadata(d.Get("metadata"), d, config)
449528
if err != nil {
450529
return err
@@ -565,9 +644,15 @@ func resourceNotebooksInstanceRead(d *schema.ResourceData, meta interface{}) err
565644
if err := d.Set("service_account", flattenNotebooksInstanceServiceAccount(res["serviceAccount"], d, config)); err != nil {
566645
return fmt.Errorf("Error reading Instance: %s", err)
567646
}
647+
if err := d.Set("service_account_scopes", flattenNotebooksInstanceServiceAccountScopes(res["serviceAccountScopes"], d, config)); err != nil {
648+
return fmt.Errorf("Error reading Instance: %s", err)
649+
}
568650
if err := d.Set("accelerator_config", flattenNotebooksInstanceAcceleratorConfig(res["acceleratorConfig"], d, config)); err != nil {
569651
return fmt.Errorf("Error reading Instance: %s", err)
570652
}
653+
if err := d.Set("shielded_instance_config", flattenNotebooksInstanceShieldedInstanceConfig(res["shieldedInstanceConfig"], d, config)); err != nil {
654+
return fmt.Errorf("Error reading Instance: %s", err)
655+
}
571656
if err := d.Set("state", flattenNotebooksInstanceState(res["state"], d, config)); err != nil {
572657
return fmt.Errorf("Error reading Instance: %s", err)
573658
}
@@ -601,6 +686,9 @@ func resourceNotebooksInstanceRead(d *schema.ResourceData, meta interface{}) err
601686
if err := d.Set("labels", flattenNotebooksInstanceLabels(res["labels"], d, config)); err != nil {
602687
return fmt.Errorf("Error reading Instance: %s", err)
603688
}
689+
if err := d.Set("tags", flattenNotebooksInstanceTags(res["tags"], d, config)); err != nil {
690+
return fmt.Errorf("Error reading Instance: %s", err)
691+
}
604692
if err := d.Set("create_time", flattenNotebooksInstanceCreateTime(res["createTime"], d, config)); err != nil {
605693
return fmt.Errorf("Error reading Instance: %s", err)
606694
}
@@ -752,6 +840,10 @@ func flattenNotebooksInstanceServiceAccount(v interface{}, d *schema.ResourceDat
752840
return v
753841
}
754842

843+
func flattenNotebooksInstanceServiceAccountScopes(v interface{}, d *schema.ResourceData, config *Config) interface{} {
844+
return v
845+
}
846+
755847
func flattenNotebooksInstanceAcceleratorConfig(v interface{}, d *schema.ResourceData, config *Config) interface{} {
756848
if v == nil {
757849
return nil
@@ -788,6 +880,35 @@ func flattenNotebooksInstanceAcceleratorConfigCoreCount(v interface{}, d *schema
788880
return v // let terraform core handle it otherwise
789881
}
790882

883+
func flattenNotebooksInstanceShieldedInstanceConfig(v interface{}, d *schema.ResourceData, config *Config) interface{} {
884+
if v == nil {
885+
return nil
886+
}
887+
original := v.(map[string]interface{})
888+
if len(original) == 0 {
889+
return nil
890+
}
891+
transformed := make(map[string]interface{})
892+
transformed["enable_integrity_monitoring"] =
893+
flattenNotebooksInstanceShieldedInstanceConfigEnableIntegrityMonitoring(original["enableIntegrityMonitoring"], d, config)
894+
transformed["enable_secure_boot"] =
895+
flattenNotebooksInstanceShieldedInstanceConfigEnableSecureBoot(original["enableSecureBoot"], d, config)
896+
transformed["enable_vtpm"] =
897+
flattenNotebooksInstanceShieldedInstanceConfigEnableVtpm(original["enableVtpm"], d, config)
898+
return []interface{}{transformed}
899+
}
900+
func flattenNotebooksInstanceShieldedInstanceConfigEnableIntegrityMonitoring(v interface{}, d *schema.ResourceData, config *Config) interface{} {
901+
return v
902+
}
903+
904+
func flattenNotebooksInstanceShieldedInstanceConfigEnableSecureBoot(v interface{}, d *schema.ResourceData, config *Config) interface{} {
905+
return v
906+
}
907+
908+
func flattenNotebooksInstanceShieldedInstanceConfigEnableVtpm(v interface{}, d *schema.ResourceData, config *Config) interface{} {
909+
return v
910+
}
911+
791912
func flattenNotebooksInstanceState(v interface{}, d *schema.ResourceData, config *Config) interface{} {
792913
return v
793914
}
@@ -832,6 +953,10 @@ func flattenNotebooksInstanceLabels(v interface{}, d *schema.ResourceData, confi
832953
return v
833954
}
834955

956+
func flattenNotebooksInstanceTags(v interface{}, d *schema.ResourceData, config *Config) interface{} {
957+
return v
958+
}
959+
835960
func flattenNotebooksInstanceCreateTime(v interface{}, d *schema.ResourceData, config *Config) interface{} {
836961
return v
837962
}
@@ -856,6 +981,10 @@ func expandNotebooksInstanceServiceAccount(v interface{}, d TerraformResourceDat
856981
return v, nil
857982
}
858983

984+
func expandNotebooksInstanceServiceAccountScopes(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
985+
return v, nil
986+
}
987+
859988
func expandNotebooksInstanceAcceleratorConfig(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
860989
l := v.([]interface{})
861990
if len(l) == 0 || l[0] == nil {
@@ -890,6 +1019,51 @@ func expandNotebooksInstanceAcceleratorConfigCoreCount(v interface{}, d Terrafor
8901019
return v, nil
8911020
}
8921021

1022+
func expandNotebooksInstanceShieldedInstanceConfig(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
1023+
l := v.([]interface{})
1024+
if len(l) == 0 || l[0] == nil {
1025+
return nil, nil
1026+
}
1027+
raw := l[0]
1028+
original := raw.(map[string]interface{})
1029+
transformed := make(map[string]interface{})
1030+
1031+
transformedEnableIntegrityMonitoring, err := expandNotebooksInstanceShieldedInstanceConfigEnableIntegrityMonitoring(original["enable_integrity_monitoring"], d, config)
1032+
if err != nil {
1033+
return nil, err
1034+
} else if val := reflect.ValueOf(transformedEnableIntegrityMonitoring); val.IsValid() && !isEmptyValue(val) {
1035+
transformed["enableIntegrityMonitoring"] = transformedEnableIntegrityMonitoring
1036+
}
1037+
1038+
transformedEnableSecureBoot, err := expandNotebooksInstanceShieldedInstanceConfigEnableSecureBoot(original["enable_secure_boot"], d, config)
1039+
if err != nil {
1040+
return nil, err
1041+
} else if val := reflect.ValueOf(transformedEnableSecureBoot); val.IsValid() && !isEmptyValue(val) {
1042+
transformed["enableSecureBoot"] = transformedEnableSecureBoot
1043+
}
1044+
1045+
transformedEnableVtpm, err := expandNotebooksInstanceShieldedInstanceConfigEnableVtpm(original["enable_vtpm"], d, config)
1046+
if err != nil {
1047+
return nil, err
1048+
} else if val := reflect.ValueOf(transformedEnableVtpm); val.IsValid() && !isEmptyValue(val) {
1049+
transformed["enableVtpm"] = transformedEnableVtpm
1050+
}
1051+
1052+
return transformed, nil
1053+
}
1054+
1055+
func expandNotebooksInstanceShieldedInstanceConfigEnableIntegrityMonitoring(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
1056+
return v, nil
1057+
}
1058+
1059+
func expandNotebooksInstanceShieldedInstanceConfigEnableSecureBoot(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
1060+
return v, nil
1061+
}
1062+
1063+
func expandNotebooksInstanceShieldedInstanceConfigEnableVtpm(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
1064+
return v, nil
1065+
}
1066+
8931067
func expandNotebooksInstanceInstallGpuDriver(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
8941068
return v, nil
8951069
}
@@ -953,6 +1127,10 @@ func expandNotebooksInstanceLabels(v interface{}, d TerraformResourceData, confi
9531127
return m, nil
9541128
}
9551129

1130+
func expandNotebooksInstanceTags(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
1131+
return v, nil
1132+
}
1133+
9561134
func expandNotebooksInstanceMetadata(v interface{}, d TerraformResourceData, config *Config) (map[string]string, error) {
9571135
if v == nil {
9581136
return map[string]string{}, nil

‎website/docs/r/notebooks_instance.html.markdown‎

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -199,13 +199,26 @@ The following arguments are supported:
199199
permission to use the instance. If not specified,
200200
the Compute Engine default service account is used.
201201

202+
* `service_account_scopes` -
203+
(Optional)
204+
Optional. The URIs of service account scopes to be included in Compute Engine instances.
205+
If not specified, the following scopes are defined:
206+
- https://www.googleapis.com/auth/cloud-platform
207+
- https://www.googleapis.com/auth/userinfo.email
208+
202209
* `accelerator_config` -
203210
(Optional)
204211
The hardware accelerator used on this instance. If you use accelerators,
205212
make sure that your configuration has enough vCPUs and memory to support the
206213
machineType you have selected.
207214
Structure is documented below.
208215

216+
* `shielded_instance_config` -
217+
(Optional)
218+
A set of Shielded Instance options. Check [Images using supported Shielded VM features]
219+
Not all combinations are valid
220+
Structure is documented below.
221+
209222
* `install_gpu_driver` -
210223
(Optional)
211224
Whether the end user authorizes Google Cloud to install GPU driver
@@ -256,11 +269,11 @@ The following arguments are supported:
256269

257270
* `no_public_ip` -
258271
(Optional)
259-
no public IP will be assigned to this instance.
272+
No public IP will be assigned to this instance.
260273

261274
* `no_proxy_access` -
262275
(Optional)
263-
the notebook instance will not register with the proxy..
276+
The notebook instance will not register with the proxy..
264277

265278
* `network` -
266279
(Optional)
@@ -277,6 +290,10 @@ The following arguments are supported:
277290
Labels to apply to this instance. These can be later modified by the setLabels method.
278291
An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
279292

293+
* `tags` -
294+
(Optional)
295+
The Compute Engine tags to add to runtime.
296+
280297
* `metadata` -
281298
(Optional)
282299
Custom metadata to apply to this instance.
@@ -301,12 +318,33 @@ The `accelerator_config` block supports:
301318
* `type` -
302319
(Required)
303320
Type of this accelerator.
304-
Possible values are `ACCELERATOR_TYPE_UNSPECIFIED`, `NVIDIA_TESLA_K80`, `NVIDIA_TESLA_P100`, `NVIDIA_TESLA_V100`, `NVIDIA_TESLA_P4`, `NVIDIA_TESLA_T4`, `NVIDIA_TESLA_T4_VWS`, `NVIDIA_TESLA_P100_VWS`, `NVIDIA_TESLA_P4_VWS`, `TPU_V2`, and `TPU_V3`.
321+
Possible values are `ACCELERATOR_TYPE_UNSPECIFIED`, `NVIDIA_TESLA_K80`, `NVIDIA_TESLA_P100`, `NVIDIA_TESLA_V100`, `NVIDIA_TESLA_P4`, `NVIDIA_TESLA_T4`, `NVIDIA_TESLA_T4_VWS`, `NVIDIA_TESLA_P100_VWS`, `NVIDIA_TESLA_P4_VWS`, `NVIDIA_TESLA_A100`, `TPU_V2`, and `TPU_V3`.
305322

306323
* `core_count` -
307324
(Required)
308325
Count of cores of this accelerator.
309326

327+
The `shielded_instance_config` block supports:
328+
329+
* `enable_integrity_monitoring` -
330+
(Optional)
331+
Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the
332+
boot integrity of the instance. The attestation is performed against the integrity policy baseline.
333+
This baseline is initially derived from the implicitly trusted boot image when the instance is created.
334+
Enabled by default.
335+
336+
* `enable_secure_boot` -
337+
(Optional)
338+
Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs
339+
authentic software by verifying the digital signature of all boot components, and halting the boot process
340+
if signature verification fails.
341+
Disabled by default.
342+
343+
* `enable_vtpm` -
344+
(Optional)
345+
Defines whether the instance has the vTPM enabled.
346+
Enabled by default.
347+
310348
The `vm_image` block supports:
311349

312350
* `project` -

0 commit comments

Comments
 (0)