Skip to content

Commit 56773e1

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1326 from bgartzi/gcp-tdx
OCPCLOUD-2882, OCPCLOUD-2889: support AMD SEV_SNP and TDX confidential computing machines on GCP
2 parents 57f828a + e4628f1 commit 56773e1

File tree

35 files changed

+987
-84
lines changed

35 files changed

+987
-84
lines changed

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ require (
1111
github.com/google/uuid v1.6.0
1212
github.com/onsi/ginkgo/v2 v2.22.2
1313
github.com/onsi/gomega v1.36.2
14-
github.com/openshift/api v0.0.0-20250218131406-8b82294c5e3a
14+
github.com/openshift/api v0.0.0-20250305122440-3e04d3af8c3e
1515
github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7
1616
github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20250122171707-86066d47a264
1717
github.com/openshift/cluster-control-plane-machine-set-operator v0.0.0-20250128131205-c7b3d7b57a8e

‎go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -357,8 +357,8 @@ github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU
357357
github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
358358
github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
359359
github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
360-
github.com/openshift/api v0.0.0-20250218131406-8b82294c5e3a h1:G26rXyn/CoUWkZW/nQS8dhOG9061GxeshAtuJDlwv7Q=
361-
github.com/openshift/api v0.0.0-20250218131406-8b82294c5e3a/go.mod h1:yk60tHAmHhtVpJQo3TwVYq2zpuP70iJIFDCmeKMIzPw=
360+
github.com/openshift/api v0.0.0-20250305122440-3e04d3af8c3e h1:bEcCutNr5RLU/DudWNs/nlOLBqMxrfsHtVuMttkxvWE=
361+
github.com/openshift/api v0.0.0-20250305122440-3e04d3af8c3e/go.mod h1:yk60tHAmHhtVpJQo3TwVYq2zpuP70iJIFDCmeKMIzPw=
362362
github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7 h1:4iliLcvr1P9EUMZgIaSNEKNQQzBn+L6PSequlFOuB6Q=
363363
github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7/go.mod h1:2tcufBE4Cu6RNgDCxcUJepa530kGo5GFVfR9BSnndhI=
364364
github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20250122171707-86066d47a264 h1:KoJiId8Ynajf/ZFodvmayFkDODIL7Vow3LmgR5+oVRg=

‎pkg/webhooks/machine_webhook.go

Lines changed: 31 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,9 @@ const (
225225

226226
// GCP Confidential VM supports Compute Engine machine types in the following series:
227227
// reference: https://cloud.google.com/compute/confidential-vm/docs/os-and-machine-type#machine-type
228-
var gcpConfidentialComputeSupportedMachineSeries = []string{"n2d", "c2d"}
228+
var gcpConfidentialTypeMachineSeriesSupportingSEV = []string{"n2d", "c2d", "c3d"}
229+
var gcpConfidentialTypeMachineSeriesSupportingSEVSNP = []string{"n2d"}
230+
var gcpConfidentialTypeMachineSeriesSupportingTDX = []string{"c3"}
229231

230232
// defaultInstanceTypeForCloudProvider returns the default instance type for the given cloud provider and architecture.
231233
// If the cloud provider is not supported, an empty string is returned.
@@ -1320,30 +1322,44 @@ func validateShieldedInstanceConfig(providerSpec *machinev1beta1.GCPMachineProvi
13201322

13211323
func validateGCPConfidentialComputing(providerSpec *machinev1beta1.GCPMachineProviderSpec) field.ErrorList {
13221324
var errs field.ErrorList
1323-
1324-
switch providerSpec.ConfidentialCompute {
1325-
case machinev1beta1.ConfidentialComputePolicyEnabled:
1325+
if providerSpec.ConfidentialCompute != "" && providerSpec.ConfidentialCompute != machinev1beta1.ConfidentialComputePolicyDisabled {
13261326
// Check on host maintenance
13271327
if providerSpec.OnHostMaintenance != machinev1beta1.TerminateHostMaintenanceType {
13281328
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "onHostMaintenance"),
13291329
providerSpec.OnHostMaintenance,
1330-
fmt.Sprintf("ConfidentialCompute require OnHostMaintenance to be set to %s, the current value is: %s", machinev1beta1.TerminateHostMaintenanceType, providerSpec.OnHostMaintenance)))
1330+
fmt.Sprintf("ConfidentialCompute %s requires OnHostMaintenance to be set to %s, the current value is: %s", providerSpec.ConfidentialCompute, machinev1beta1.TerminateHostMaintenanceType, providerSpec.OnHostMaintenance)))
13311331
}
13321332
// Check machine series supports confidential computing
13331333
machineSeries := strings.Split(providerSpec.MachineType, "-")[0]
1334-
if !slices.Contains(gcpConfidentialComputeSupportedMachineSeries, machineSeries) {
1335-
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "machineType"),
1336-
providerSpec.MachineType,
1337-
fmt.Sprintf("ConfidentialCompute require machine type in the following series: %s", strings.Join(gcpConfidentialComputeSupportedMachineSeries, `,`))),
1334+
switch providerSpec.ConfidentialCompute {
1335+
case machinev1beta1.ConfidentialComputePolicyEnabled, machinev1beta1.ConfidentialComputePolicySEV:
1336+
if !slices.Contains(gcpConfidentialTypeMachineSeriesSupportingSEV, machineSeries) {
1337+
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "machineType"),
1338+
providerSpec.MachineType,
1339+
fmt.Sprintf("ConfidentialCompute %s requires a machine type in the following series: %s", providerSpec.ConfidentialCompute, strings.Join(gcpConfidentialTypeMachineSeriesSupportingSEV, `,`))),
1340+
)
1341+
}
1342+
case machinev1beta1.ConfidentialComputePolicySEVSNP:
1343+
if !slices.Contains(gcpConfidentialTypeMachineSeriesSupportingSEVSNP, machineSeries) {
1344+
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "machineType"),
1345+
providerSpec.MachineType,
1346+
fmt.Sprintf("ConfidentialCompute %s requires a machine type in the following series: %s", providerSpec.ConfidentialCompute, strings.Join(gcpConfidentialTypeMachineSeriesSupportingSEVSNP, `,`))),
1347+
)
1348+
}
1349+
case machinev1beta1.ConfidentialComputePolicyTDX:
1350+
if !slices.Contains(gcpConfidentialTypeMachineSeriesSupportingTDX, machineSeries) {
1351+
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "machineType"),
1352+
providerSpec.MachineType,
1353+
fmt.Sprintf("ConfidentialCompute %s requires a machine type in the following series: %s", providerSpec.ConfidentialCompute, strings.Join(gcpConfidentialTypeMachineSeriesSupportingTDX, `,`))),
1354+
)
1355+
}
1356+
default:
1357+
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "confidentialCompute"),
1358+
providerSpec.ConfidentialCompute,
1359+
fmt.Sprintf("ConfidentialCompute must be %s, %s, %s, %s, or %s", machinev1beta1.ConfidentialComputePolicyEnabled, machinev1beta1.ConfidentialComputePolicyDisabled, machinev1beta1.ConfidentialComputePolicySEV, machinev1beta1.ConfidentialComputePolicySEVSNP, machinev1beta1.ConfidentialComputePolicyTDX)),
13381360
)
13391361
}
1340-
case machinev1beta1.ConfidentialComputePolicyDisabled, "":
1341-
default:
1342-
errs = append(errs, field.Invalid(field.NewPath("providerSpec", "confidentialCompute"),
1343-
providerSpec.ConfidentialCompute,
1344-
fmt.Sprintf("ConfidentialCompute must be either %s or %s.", machinev1beta1.ConfidentialComputePolicyEnabled, machinev1beta1.ConfidentialComputePolicyDisabled)))
13451362
}
1346-
13471363
return errs
13481364
}
13491365

‎pkg/webhooks/machine_webhook_test.go

Lines changed: 97 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3862,9 +3862,10 @@ func TestValidateGCPProviderSpec(t *testing.T) {
38623862
testCase: "with ConfidentialCompute invalid value",
38633863
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
38643864
p.ConfidentialCompute = "invalid-value"
3865+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
38653866
},
38663867
expectedOk: false,
3867-
expectedError: "providerSpec.confidentialCompute: Invalid value: \"invalid-value\": ConfidentialCompute must be either Enabled or Disabled.",
3868+
expectedError: "providerSpec.confidentialCompute: Invalid value: \"invalid-value\": ConfidentialCompute must be Enabled, Disabled, AMDEncryptedVirtualization, AMDEncryptedVirtualizationNestedPaging, or IntelTrustedDomainExtensions",
38683869
},
38693870
{
38703871
testCase: "with ConfidentialCompute enabled while onHostMaintenance is set to Migrate",
@@ -3875,7 +3876,7 @@ func TestValidateGCPProviderSpec(t *testing.T) {
38753876
p.GPUs = []machinev1beta1.GCPGPUConfig{}
38763877
},
38773878
expectedOk: false,
3878-
expectedError: "providerSpec.onHostMaintenance: Invalid value: \"Migrate\": ConfidentialCompute require OnHostMaintenance to be set to Terminate, the current value is: Migrate",
3879+
expectedError: "providerSpec.onHostMaintenance: Invalid value: \"Migrate\": ConfidentialCompute Enabled requires OnHostMaintenance to be set to Terminate, the current value is: Migrate",
38793880
},
38803881
{
38813882
testCase: "with ConfidentialCompute enabled and unsupported machineType",
@@ -3885,7 +3886,100 @@ func TestValidateGCPProviderSpec(t *testing.T) {
38853886
p.MachineType = "e2-standard-4"
38863887
},
38873888
expectedOk: false,
3888-
expectedError: "providerSpec.machineType: Invalid value: \"e2-standard-4\": ConfidentialCompute require machine type in the following series: n2d,c2d",
3889+
expectedError: "providerSpec.machineType: Invalid value: \"e2-standard-4\": ConfidentialCompute Enabled requires a machine type in the following series: n2d,c2d,c3d",
3890+
},
3891+
{
3892+
testCase: "with ConfidentialCompute AMDEncryptedVirtualization and an unsupported machine",
3893+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3894+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicySEV
3895+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
3896+
p.MachineType = "c3-standard-4"
3897+
},
3898+
expectedOk: false,
3899+
expectedError: "providerSpec.machineType: Invalid value: \"c3-standard-4\": ConfidentialCompute AMDEncryptedVirtualization requires a machine type in the following series: n2d,c2d,c3d",
3900+
},
3901+
{
3902+
testCase: "with ConfidentialCompute AMDEncryptedVirtualization and a supported machine",
3903+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3904+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicySEV
3905+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
3906+
p.MachineType = "c2d-standard-4"
3907+
},
3908+
expectedOk: true,
3909+
expectedError: "",
3910+
},
3911+
{
3912+
testCase: "with ConfidentialCompute AMDEncryptedVirtualization and onHostMaintenance set to Migrate",
3913+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3914+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicySEV
3915+
p.OnHostMaintenance = machinev1beta1.MigrateHostMaintenanceType
3916+
p.MachineType = "c3d-standard-4"
3917+
p.GPUs = []machinev1beta1.GCPGPUConfig{}
3918+
},
3919+
expectedOk: false,
3920+
expectedError: "providerSpec.onHostMaintenance: Invalid value: \"Migrate\": ConfidentialCompute AMDEncryptedVirtualization requires OnHostMaintenance to be set to Terminate, the current value is: Migrate",
3921+
},
3922+
{
3923+
testCase: "with ConfidentialCompute AMDEncryptedVirtualizationNestedPaging and an unsupported machine",
3924+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3925+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicySEVSNP
3926+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
3927+
p.MachineType = "c3-standard-4"
3928+
},
3929+
expectedOk: false,
3930+
expectedError: "providerSpec.machineType: Invalid value: \"c3-standard-4\": ConfidentialCompute AMDEncryptedVirtualizationNestedPaging requires a machine type in the following series: n2d",
3931+
},
3932+
{
3933+
testCase: "with ConfidentialCompute AMDEncryptedVirtualizationNestedPaging and a supported machine",
3934+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3935+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicySEVSNP
3936+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
3937+
p.MachineType = "n2d-standard-4"
3938+
},
3939+
expectedOk: true,
3940+
expectedError: "",
3941+
},
3942+
{
3943+
testCase: "with ConfidentialCompute AMDEncryptedVirtualizationNestedPaging and onHostMaintenance set to Migrate",
3944+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3945+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicySEVSNP
3946+
p.OnHostMaintenance = machinev1beta1.MigrateHostMaintenanceType
3947+
p.MachineType = "n2d-standard-4"
3948+
p.GPUs = []machinev1beta1.GCPGPUConfig{}
3949+
},
3950+
expectedOk: false,
3951+
expectedError: "providerSpec.onHostMaintenance: Invalid value: \"Migrate\": ConfidentialCompute AMDEncryptedVirtualizationNestedPaging requires OnHostMaintenance to be set to Terminate, the current value is: Migrate",
3952+
},
3953+
{
3954+
testCase: "with ConfidentialCompute IntelTrustedDomainExtensions and an unsupported machine",
3955+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3956+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicyTDX
3957+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
3958+
p.MachineType = "c3d-standard-4"
3959+
},
3960+
expectedOk: false,
3961+
expectedError: "providerSpec.machineType: Invalid value: \"c3d-standard-4\": ConfidentialCompute IntelTrustedDomainExtensions requires a machine type in the following series: c3",
3962+
},
3963+
{
3964+
testCase: "with ConfidentialCompute IntelTrustedDomainExtensions and a supported machine",
3965+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3966+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicyTDX
3967+
p.OnHostMaintenance = machinev1beta1.TerminateHostMaintenanceType
3968+
p.MachineType = "c3-standard-4"
3969+
},
3970+
expectedOk: true,
3971+
expectedError: "",
3972+
},
3973+
{
3974+
testCase: "with ConfidentialCompute IntelTrustedDomainExtensions and onHostMaintenance set to Migrate",
3975+
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
3976+
p.ConfidentialCompute = machinev1beta1.ConfidentialComputePolicyTDX
3977+
p.OnHostMaintenance = machinev1beta1.MigrateHostMaintenanceType
3978+
p.MachineType = "c3-standard-4"
3979+
p.GPUs = []machinev1beta1.GCPGPUConfig{}
3980+
},
3981+
expectedOk: false,
3982+
expectedError: "providerSpec.onHostMaintenance: Invalid value: \"Migrate\": ConfidentialCompute IntelTrustedDomainExtensions requires OnHostMaintenance to be set to Terminate, the current value is: Migrate",
38893983
},
38903984
{
38913985
testCase: "with GPUs and Migrate onHostMaintenance",

‎vendor/github.com/openshift/api/config/v1/types_cluster_version.go

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/openshift/api/config/v1/types_image.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)