Skip to content

Commit acf7bc1

Browse files
jeana-redhatjeana-redhat
authored
Merge pull request #56305 from jeana-redhat/OSDOCS-5013-CPMS-GCP-support-features
[OSDOCS-5013]: CPMS for GCP: Supported features
2 parents 20b6ff3 + c9afcd0 commit acf7bc1

File tree

6 files changed

+140
-70
lines changed

6 files changed

+140
-70
lines changed

‎machine_management/control_plane_machine_management/cpmso-using.adoc

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,28 @@ include::modules/machineset-azure-accelerated-networking.adoc[leveloffset=+2]
8787

8888
// Enabling Accelerated Networking on an existing Microsoft Azure cluster
8989
include::modules/machineset-azure-enabling-accelerated-networking-existing.adoc[leveloffset=+3]
90+
91+
[id="cpmso-supported-features-gcp_{context}"]
92+
== Enabling Google Cloud Platform features for control plane machines
93+
94+
You can enable Google Cloud Platform (GCP) features on control plane machines by changing the configuration of your control plane machine set. When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy.
95+
96+
//Note: GCP GPU features should be compatible with CPMS, but dev cannot think of a use case. Leaving them out to keep things less cluttered. If a customer use case emerges, we can just add the necessary modules in here.
97+
98+
//Configuring persistent disk types by using machine sets
99+
include::modules/machineset-gcp-pd-disk-types.adoc[leveloffset=+2]
100+
101+
//Configuring Confidential VM by using machine sets
102+
include::modules/machineset-gcp-confidential-vm.adoc[leveloffset=+2]
103+
104+
//Configuring Shielded VM options by using machine sets
105+
include::modules/machineset-gcp-shielded-vms.adoc[leveloffset=+2]
106+
[role="_additional-resources"]
107+
.Additional resources
108+
* link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm[What is Shielded VM?]
109+
** link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#secure-boot[Secure Boot]
110+
** link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm[Virtual Trusted Platform Module (vTPM)]
111+
** link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#integrity-monitoring[Integrity monitoring]
112+
113+
//Enabling customer-managed encryption keys for a machine set
114+
include::modules/machineset-gcp-enabling-customer-managed-encryption.adoc[leveloffset=+2]

‎machine_management/creating_machinesets/creating-machineset-gcp.adoc

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,7 @@ include::modules/machineset-creating.adoc[leveloffset=+1]
2323
//Configuring persistent disk types by using compute machine sets
2424
include::modules/machineset-gcp-pd-disk-types.adoc[leveloffset=+1]
2525

26-
//Configuring Shielded VM options by using machine sets [PR#56252]
27-
28-
//Configuring Confidential Computing by using machine sets
26+
//Configuring Confidential VM by using machine sets
2927
include::modules/machineset-gcp-confidential-vm.adoc[leveloffset=+1]
3028

3129
//Machine sets that deploy machines as preemptible VM instances
@@ -44,12 +42,10 @@ include::modules/machineset-gcp-shielded-vms.adoc[leveloffset=+1]
4442
** link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#integrity-monitoring[Integrity monitoring]
4543
4644
//Enabling customer-managed encryption keys for a compute machine set
47-
include::modules/machineset-enabling-customer-managed-encryption.adoc[leveloffset=+1]
48-
//TODO break out procedure as a L2
45+
include::modules/machineset-gcp-enabling-customer-managed-encryption.adoc[leveloffset=+1]
4946
5047
//Enabling GPU support for a compute machine set
5148
include::modules/machineset-gcp-enabling-gpu-support.adoc[leveloffset=+1]
52-
//TODO break out procedure as a L2
5349
5450
//Adding a GPU node to a machine set (stesmith)
5551
include::modules/nvidia-gpu-gcp-adding-a-gpu-node.adoc[leveloffset=+1]

‎modules/machineset-enabling-customer-managed-encryption.adoc

Lines changed: 0 additions & 55 deletions
This file was deleted.

‎modules/machineset-gcp-enabling-customer-managed-encryption.adoc

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * machine_management/creating_machinesets/creating-machineset-gcp.adoc
4+
// * machine_management/control_plane_machine_management/cpmso-using.adoc
5+
6+
ifeval::["{context}" == "cpmso-using"]
7+
:cpmso:
8+
endif::[]
9+
10+
:_content-type: PROCEDURE
11+
[id="machineset-gcp-enabling-customer-managed-encryption_{context}"]
12+
= Enabling customer-managed encryption keys for a machine set
13+
14+
Google Cloud Platform (GCP) Compute Engine allows users to supply an encryption key to encrypt data on disks at rest. The key is used to encrypt the data encryption key, not to encrypt the customer's data. By default, Compute Engine encrypts this data by using Compute Engine keys.
15+
16+
You can enable encryption with a customer-managed key in clusters that use the Machine API. You must first link:https://cloud.google.com/compute/docs/disks/customer-managed-encryption#before_you_begin[create a KMS key] and assign the correct permissions to a service account. The KMS key name, key ring name, and location are required to allow a service account to use your key.
17+
18+
[NOTE]
19+
====
20+
If you do not want to use a dedicated service account for the KMS encryption, the Compute Engine default service account is used instead. You must grant the default service account permission to access the keys if you do not use a dedicated service account. The Compute Engine default service account name follows the `service-<project_number>@compute-system.iam.gserviceaccount.com` pattern.
21+
====
22+
23+
.Procedure
24+
25+
. To allow a specific service account to use your KMS key and to grant the service account the correct IAM role, run the following command with your KMS key name, key ring name, and location:
26+
+
27+
[source,terminal]
28+
----
29+
$ gcloud kms keys add-iam-policy-binding <key_name> \
30+
--keyring <key_ring_name> \
31+
--location <key_ring_location> \
32+
--member "serviceAccount:service-<project_number>@compute-system.iam.gserviceaccount.com” \
33+
--role roles/cloudkms.cryptoKeyEncrypterDecrypter
34+
----
35+
36+
. Configure the encryption key under the `providerSpec` field in your machine set YAML file. For example:
37+
+
38+
[source,yaml]
39+
----
40+
ifndef::cpmso[]
41+
apiVersion: machine.openshift.io/v1beta1
42+
kind: MachineSet
43+
endif::cpmso[]
44+
ifdef::cpmso[]
45+
apiVersion: machine.openshift.io/v1
46+
kind: ControlPlaneMachineSet
47+
endif::cpmso[]
48+
...
49+
spec:
50+
template:
51+
spec:
52+
providerSpec:
53+
value:
54+
disks:
55+
- type:
56+
encryptionKey:
57+
kmsKey:
58+
name: machine-encryption-key <1>
59+
keyRing: openshift-encrpytion-ring <2>
60+
location: global <3>
61+
projectID: openshift-gcp-project <4>
62+
kmsKeyServiceAccount: openshift-service-account@openshift-gcp-project.iam.gserviceaccount.com <5>
63+
----
64+
<1> The name of the customer-managed encryption key that is used for the disk encryption.
65+
<2> The name of the KMS key ring that the KMS key belongs to.
66+
<3> The GCP location in which the KMS key ring exists.
67+
<4> Optional: The ID of the project in which the KMS key ring exists. If a project ID is not set, the machine set `projectID` in which the machine set was created is used.
68+
<5> Optional: The service account that is used for the encryption request for the given KMS key. If a service account is not set, the Compute Engine default service account is used.
69+
+
70+
When a new machine is created by using the updated `providerSpec` object configuration, the disk encryption key is encrypted with the KMS key.
71+
72+
ifeval::["{context}" == "cpmso-using"]
73+
:!cpmso:
74+
endif::[]

‎modules/machineset-gcp-pd-disk-types.adoc

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,51 @@
11
// Module included in the following assemblies:
22
//
33
// * machine_management/creating_machinesets/creating-machineset-gcp.adoc
4+
// * machine_management/control_plane_machine_management/cpmso-using.adoc
5+
6+
ifeval::["{context}" == "cpmso-using"]
7+
:cpmso:
8+
endif::[]
49

510
:_content-type: PROCEDURE
611
[id="machineset-gcp-pd-disk-types_{context}"]
7-
= Configuring persistent disk types by using compute machine sets
12+
= Configuring persistent disk types by using machine sets
813

9-
You can configure the type of persistent disk that a compute machine set deploys machines on by editing the compute machine set YAML file.
14+
You can configure the type of persistent disk that a machine set deploys machines on by editing the machine set YAML file.
1015

1116
For more information about persistent disk types, compatibility, regional availability, and limitations, see the GCP Compute Engine documentation about link:https://cloud.google.com/compute/docs/disks#pdspecs[persistent disks].
1217

1318
.Procedure
1419

15-
. In a text editor, open the YAML file for an existing compute machine set or create a new one.
20+
. In a text editor, open the YAML file for an existing machine set or create a new one.
1621

1722
. Edit the following line under the `providerSpec` field:
1823
+
1924
[source,yaml]
2025
----
21-
providerSpec:
22-
value:
23-
disks:
24-
type: <pd-disk-type> <1>
26+
ifndef::cpmso[]
27+
apiVersion: machine.openshift.io/v1beta1
28+
kind: MachineSet
29+
endif::cpmso[]
30+
ifdef::cpmso[]
31+
apiVersion: machine.openshift.io/v1
32+
kind: ControlPlaneMachineSet
33+
endif::cpmso[]
34+
...
35+
spec:
36+
template:
37+
spec:
38+
providerSpec:
39+
value:
40+
disks:
41+
type: <pd-disk-type> <1>
2542
----
2643
<1> Specify the disk persistent type. Valid values are `pd-ssd`, `pd-standard`, and `pd-balanced`. The default value is `pd-standard`.
2744

2845
.Verification
2946

30-
* Using the Google Cloud console, review the details for a machine deployed by the compute machine set and verify that the `Type` field matches the configured disk type.
47+
* Using the Google Cloud console, review the details for a machine deployed by the machine set and verify that the `Type` field matches the configured disk type.
48+
49+
ifeval::["{context}" == "cpmso-using"]
50+
:!cpmso:
51+
endif::[]

‎modules/machineset-gcp-shielded-vms.adoc

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,19 @@ spec:
4242
virtualizedTrustedPlatformModule: Enabled <4>
4343
...
4444
----
45+
+
46+
--
4547
<1> In this section, specify any Shielded VM options that you want.
4648
<2> Specify whether UEFI Secure Boot is enabled. Valid values are `Disabled` or `Enabled`.
4749
<3> Specify whether integrity monitoring is enabled. Valid values are `Disabled` or `Enabled`.
48-
<4> Specify whether virtual trusted platform module (vTPM) is enabled. Valid values are `Disabled` or `Enabled`.
50+
+
51+
[NOTE]
52+
====
53+
When integrity monitoring is enabled, you must not disable virtual trusted platform module (vTPM).
54+
====
55+
56+
<4> Specify whether vTPM is enabled. Valid values are `Disabled` or `Enabled`.
57+
--
4958

5059
.Verification
5160

0 commit comments

Comments
 (0)