Skip to content

Commit 85ce4b7

Browse files
modular-magicianmodular-magician
authored
Introduce confidential_instance_type into confidential_nodes config (#14190) (#23410)
[upstream:6dff3ea5f8bde7147ace81cad1cbcd20306bdc54] Signed-off-by: Modular Magician <[email protected]>
1 parent 0f57f4e commit 85ce4b7

9 files changed

+112
-52
lines changed

‎.changelog/14190.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
```release-note:enhancement
2+
container: added `confidential_nodes.confidential_instance_type` field to `google_container_cluster` resource
3+
```
4+
5+
```release-note:enhancement
6+
container: added `node_config.confidential_nodes.confidential_instance_type` field to `google_container_node_pool` resource
7+
```

‎google/services/container/node_config.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -808,6 +808,14 @@ func schemaNodeConfig() *schema.Schema {
808808
Required: true,
809809
Description: `Whether Confidential Nodes feature is enabled for all nodes in this pool.`,
810810
},
811+
"confidential_instance_type": {
812+
Type: schema.TypeString,
813+
Optional: true,
814+
ForceNew: true,
815+
DiffSuppressFunc: suppressDiffForConfidentialNodes,
816+
Description: `Defines the type of technology used by the confidential node.`,
817+
ValidateFunc: validation.StringInSlice([]string{"SEV", "SEV_SNP", "TDX"}, false),
818+
},
811819
},
812820
},
813821
},
@@ -1561,7 +1569,8 @@ func expandConfidentialNodes(configured interface{}) *container.ConfidentialNode
15611569
}
15621570
config := l[0].(map[string]interface{})
15631571
return &container.ConfidentialNodes{
1564-
Enabled: config["enabled"].(bool),
1572+
Enabled: config["enabled"].(bool),
1573+
ConfidentialInstanceType: config["confidential_instance_type"].(string),
15651574
}
15661575
}
15671576

@@ -2000,7 +2009,8 @@ func flattenConfidentialNodes(c *container.ConfidentialNodes) []map[string]inter
20002009
result := []map[string]interface{}{}
20012010
if c != nil {
20022011
result = append(result, map[string]interface{}{
2003-
"enabled": c.Enabled,
2012+
"enabled": c.Enabled,
2013+
"confidential_instance_type": c.ConfidentialInstanceType,
20042014
})
20052015
}
20062016
return result

‎google/services/container/resource_container_cluster.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,14 @@ var (
151151
}
152152
return false
153153
})
154+
155+
suppressDiffForConfidentialNodes = schema.SchemaDiffSuppressFunc(func(k, oldValue, newValue string, d *schema.ResourceData) bool {
156+
k = strings.Replace(k, "confidential_instance_type", "enabled", 1)
157+
if v, _ := d.Get(k).(bool); v {
158+
return oldValue == "SEV" && newValue == ""
159+
}
160+
return false
161+
})
154162
)
155163

156164
// Defines default nodel pool settings for the entire cluster. These settings are
@@ -1287,6 +1295,14 @@ func ResourceContainerCluster() *schema.Resource {
12871295
ForceNew: true,
12881296
Description: `Whether Confidential Nodes feature is enabled for all nodes in this cluster.`,
12891297
},
1298+
"confidential_instance_type": {
1299+
Type: schema.TypeString,
1300+
Optional: true,
1301+
ForceNew: true,
1302+
DiffSuppressFunc: suppressDiffForConfidentialNodes,
1303+
Description: `Defines the type of technology used by the confidential node.`,
1304+
ValidateFunc: validation.StringInSlice([]string{"SEV", "SEV_SNP", "TDX"}, false),
1305+
},
12901306
},
12911307
},
12921308
},

‎google/services/container/resource_container_cluster_meta.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ fields:
8383
api_field: 'autoscaling.resource_limits.resource_type'
8484
- field: 'cluster_ipv4_cidr'
8585
- field: 'confidential_nodes.enabled'
86+
- field: 'confidential_nodes.confidential_instance_type'
8687
- field: 'control_plane_endpoints_config.dns_endpoint_config.allow_external_traffic'
8788
- field: 'control_plane_endpoints_config.dns_endpoint_config.endpoint'
8889
- field: 'cost_management_config.enabled'
@@ -203,6 +204,7 @@ fields:
203204
- field: 'node_config.advanced_machine_features.threads_per_core'
204205
- field: 'node_config.boot_disk_kms_key'
205206
- field: 'node_config.confidential_nodes.enabled'
207+
- field: 'node_config.confidential_nodes.confidential_instance_type'
206208
- field: 'node_config.containerd_config.private_registry_access_config.certificate_authority_domain_config.fqdns'
207209
- field: 'node_config.containerd_config.private_registry_access_config.certificate_authority_domain_config.gcp_secret_manager_certificate_config.secret_uri'
208210
- field: 'node_config.containerd_config.private_registry_access_config.enabled'
@@ -342,6 +344,8 @@ fields:
342344
api_field: 'node_pools.config.boot_disk_kms_key'
343345
- field: 'node_pool.node_config.confidential_nodes.enabled'
344346
api_field: 'node_pools.config.confidential_nodes.enabled'
347+
- field: 'node_pool.node_config.confidential_nodes.confidential_instance_type'
348+
api_field: 'node_pools.config.confidential_nodes.confidential_instance_type'
345349
- field: 'node_pool.node_config.containerd_config.private_registry_access_config.certificate_authority_domain_config.fqdns'
346350
api_field: 'node_pools.config.containerd_config.private_registry_access_config.certificate_authority_domain_config.fqdns'
347351
- field: 'node_pool.node_config.containerd_config.private_registry_access_config.certificate_authority_domain_config.gcp_secret_manager_certificate_config.secret_uri'

‎google/services/container/resource_container_cluster_migratev1.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -960,6 +960,14 @@ func resourceContainerClusterResourceV1() *schema.Resource {
960960
ForceNew: true,
961961
Description: `Whether Confidential Nodes feature is enabled for all nodes in this cluster.`,
962962
},
963+
"confidential_instance_type": {
964+
Type: schema.TypeString,
965+
Optional: true,
966+
ForceNew: true,
967+
DiffSuppressFunc: suppressDiffForConfidentialNodes,
968+
Description: `Defines the type of technology used by the confidential node.`,
969+
ValidateFunc: validation.StringInSlice([]string{"SEV", "SEV_SNP", "TDX"}, false),
970+
},
963971
},
964972
},
965973
},

‎google/services/container/resource_container_cluster_test.go

Lines changed: 31 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -419,7 +419,7 @@ func TestAccContainerCluster_withConfidentialNodes(t *testing.T) {
419419
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
420420
Steps: []resource.TestStep{
421421
{
422-
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName),
422+
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName, false, "", "n2d-standard-2"),
423423
},
424424
{
425425
ResourceName: "google_container_cluster.confidential_nodes",
@@ -428,7 +428,7 @@ func TestAccContainerCluster_withConfidentialNodes(t *testing.T) {
428428
ImportStateVerifyIgnore: []string{"deletion_protection"},
429429
},
430430
{
431-
Config: testAccContainerCluster_disableConfidentialNodes(clusterName, npName, networkName, subnetworkName),
431+
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName, true, "", "n2d-standard-2"),
432432
},
433433
{
434434
ResourceName: "google_container_cluster.confidential_nodes",
@@ -437,7 +437,25 @@ func TestAccContainerCluster_withConfidentialNodes(t *testing.T) {
437437
ImportStateVerifyIgnore: []string{"deletion_protection"},
438438
},
439439
{
440-
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName),
440+
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName, false, "SEV", "n2d-standard-2"),
441+
},
442+
{
443+
ResourceName: "google_container_cluster.confidential_nodes",
444+
ImportState: true,
445+
ImportStateVerify: true,
446+
ImportStateVerifyIgnore: []string{"deletion_protection"},
447+
},
448+
{
449+
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName, false, "SEV_SNP", "n2d-standard-2"),
450+
},
451+
{
452+
ResourceName: "google_container_cluster.confidential_nodes",
453+
ImportState: true,
454+
ImportStateVerify: true,
455+
ImportStateVerifyIgnore: []string{"deletion_protection"},
456+
},
457+
{
458+
Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName, false, "TDX", "c3-standard-4"),
441459
},
442460
{
443461
ResourceName: "google_container_cluster.confidential_nodes",
@@ -6666,60 +6684,36 @@ resource "google_container_cluster" "filtered_notification_config" {
66666684
`, topic, topic, clusterName, topic, networkName, subnetworkName)
66676685
}
66686686

6669-
func testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName string) string {
6670-
return fmt.Sprintf(`
6671-
resource "google_container_cluster" "confidential_nodes" {
6672-
name = "%s"
6673-
location = "us-central1-a"
6674-
release_channel {
6675-
channel = "RAPID"
6676-
}
6677-
6678-
node_pool {
6679-
name = "%s"
6680-
initial_node_count = 1
6681-
node_config {
6682-
machine_type = "n2d-standard-2" // can't be e2 because Confidential Nodes require AMD CPUs
6683-
}
6684-
}
6685-
6686-
confidential_nodes {
6687-
enabled = true
6688-
}
6689-
network = "%s"
6690-
subnetwork = "%s"
6691-
6692-
deletion_protection = false
6693-
}
6694-
`, clusterName, npName, networkName, subnetworkName)
6695-
}
6687+
func testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName string, enable bool, confidentialInstanceType, machineType string) string {
6688+
confInsTypeString := ""
6689+
if confidentialInstanceType != "" {
6690+
confInsTypeString = fmt.Sprintf(`confidential_instance_type = "%s"`, confidentialInstanceType)
6691+
}
66966692

6697-
func testAccContainerCluster_disableConfidentialNodes(clusterName, npName, networkName, subnetworkName string) string {
66986693
return fmt.Sprintf(`
66996694
resource "google_container_cluster" "confidential_nodes" {
67006695
name = "%s"
67016696
location = "us-central1-a"
6702-
release_channel {
6703-
channel = "RAPID"
6704-
}
67056697
67066698
node_pool {
67076699
name = "%s"
67086700
initial_node_count = 1
67096701
node_config {
6710-
machine_type = "n2d-standard-2"
6702+
machine_type = "%s"
67116703
}
67126704
}
67136705
67146706
confidential_nodes {
6715-
enabled = false
6707+
enabled = %t
6708+
%s
67166709
}
6710+
67176711
network = "%s"
67186712
subnetwork = "%s"
67196713
67206714
deletion_protection = false
67216715
}
6722-
`, clusterName, npName, networkName, subnetworkName)
6716+
`, clusterName, npName, machineType, enable, confInsTypeString, networkName, subnetworkName)
67236717
}
67246718

67256719
func testAccContainerCluster_withLocalSsdEncryptionMode(clusterName, npName, networkName, subnetworkName, mode string) string {

‎google/services/container/resource_container_node_pool_meta.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ fields:
4343
api_field: 'config.boot_disk_kms_key'
4444
- field: 'node_config.confidential_nodes.enabled'
4545
api_field: 'config.confidential_nodes.enabled'
46+
- field: 'node_config.confidential_nodes.confidential_instance_type'
47+
api_field: 'config.confidential_nodes.confidential_instance_type'
4648
- field: 'node_config.containerd_config.private_registry_access_config.certificate_authority_domain_config.fqdns'
4749
api_field: 'config.containerd_config.private_registry_access_config.certificate_authority_domain_config.fqdns'
4850
- field: 'node_config.containerd_config.private_registry_access_config.certificate_authority_domain_config.gcp_secret_manager_certificate_config.secret_uri'

‎google/services/container/resource_container_node_pool_test.go

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4313,23 +4313,37 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
43134313
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
43144314
Steps: []resource.TestStep{
43154315
{
4316-
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, true),
4316+
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, false, "", "n2d-standard-2"),
43174317
},
43184318
{
43194319
ResourceName: "google_container_node_pool.np",
43204320
ImportState: true,
43214321
ImportStateVerify: true,
43224322
},
43234323
{
4324-
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, false),
4324+
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, true, "", "n2d-standard-2"),
43254325
},
43264326
{
43274327
ResourceName: "google_container_node_pool.np",
43284328
ImportState: true,
43294329
ImportStateVerify: true,
43304330
},
43314331
{
4332-
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, true),
4332+
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, false, "SEV", "n2d-standard-2"),
4333+
},
4334+
{
4335+
ResourceName: "google_container_node_pool.np",
4336+
ImportState: true,
4337+
ImportStateVerify: true,
4338+
}, {
4339+
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, false, "SEV_SNP", "n2d-standard-2"),
4340+
},
4341+
{
4342+
ResourceName: "google_container_node_pool.np",
4343+
ImportState: true,
4344+
ImportStateVerify: true,
4345+
}, {
4346+
Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName, false, "TDX", "c3-standard-4"),
43334347
},
43344348
{
43354349
ResourceName: "google_container_node_pool.np",
@@ -4340,18 +4354,16 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
43404354
})
43414355
}
43424356

4343-
func testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName string, confidential bool) string {
4357+
func testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName string, enable bool, confidentialInstanceType, machineType string) string {
4358+
confInsTypeString := ""
4359+
if confidentialInstanceType != "" {
4360+
confInsTypeString = fmt.Sprintf(`confidential_instance_type = "%s"`, confidentialInstanceType)
4361+
}
43444362
return fmt.Sprintf(`
43454363
resource "google_container_cluster" "cluster" {
43464364
name = "%s"
43474365
location = "us-central1-a"
43484366
initial_node_count = 1
4349-
node_config {
4350-
confidential_nodes {
4351-
enabled = false
4352-
}
4353-
machine_type = "n2-standard-2"
4354-
}
43554367
deletion_protection = false
43564368
network = "%s"
43574369
subnetwork = "%s"
@@ -4363,13 +4375,14 @@ resource "google_container_node_pool" "np" {
43634375
cluster = google_container_cluster.cluster.name
43644376
initial_node_count = 1
43654377
node_config {
4366-
machine_type = "n2d-standard-2" // can't be e2 because Confidential Nodes require AMD CPUs
4378+
machine_type = "%s"
43674379
confidential_nodes {
4368-
enabled = "%t"
4380+
enabled = %t
4381+
%s
43694382
}
43704383
}
43714384
}
4372-
`, clusterName, networkName, subnetworkName, np, confidential)
4385+
`, clusterName, networkName, subnetworkName, np, machineType, enable, confInsTypeString)
43734386
}
43744387

43754388
func TestAccContainerNodePool_withLocalSsdEncryptionMode(t *testing.T) {

‎website/docs/r/container_cluster.html.markdown

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1066,6 +1066,9 @@ sole_tenant_config {
10661066
* `enabled` (Required) - Enable Confidential GKE Nodes for this node pool, to
10671067
enforce encryption of data in-use.
10681068

1069+
* `confidential_instance_type` (Optional) - Defines the type of technology used
1070+
by the confidential node.
1071+
10691072
<a name="nested_node_affinity"></a>The `node_affinity` block supports:
10701073

10711074
* `key` (Required) - The default or custom node affinity label key name.
@@ -1227,6 +1230,9 @@ notification_config {
12271230
* `enabled` (Required) - Enable Confidential GKE Nodes for this cluster, to
12281231
enforce encryption of data in-use.
12291232

1233+
* `confidential_instance_type` (Optional) - Defines the type of technology used
1234+
by the confidential node.
1235+
12301236
<a name="nested_pod_security_policy_config"></a>The `pod_security_policy_config` block supports:
12311237

12321238
* `enabled` (Required) - Enable the PodSecurityPolicy controller for this cluster.

0 commit comments

Comments
 (0)