Skip to content

Commit c254295

Browse files
mjpytlakmjpytlak
authored
Merge pull request #56805 from bscott-rh/OSDOCS-5152
OSDOCS-5152 and 5158 Add support for Shielded and Confidential VMs
2 parents 28278cc + 9776c40 commit c254295

12 files changed

+181
-1
lines changed

‎installing/installing_gcp/installing-gcp-customizations.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ include::modules/installation-gcp-tested-machine-types.adoc[leveloffset=+2]
3636

3737
include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2]
3838

39+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
40+
41+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
42+
3943
include::modules/installation-gcp-config-yaml.adoc[leveloffset=+2]
4044

4145
[role="_additional-resources"]

‎installing/installing_gcp/installing-gcp-network-customizations.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ include::modules/installation-gcp-tested-machine-types.adoc[leveloffset=+2]
4242

4343
include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2]
4444

45+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
46+
47+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
48+
4549
include::modules/installation-gcp-config-yaml.adoc[leveloffset=+2]
4650

4751
[role="_additional-resources"]

‎installing/installing_gcp/installing-gcp-private.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ include::modules/installation-gcp-tested-machine-types.adoc[leveloffset=+2]
3939

4040
include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2]
4141

42+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
43+
44+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
45+
4246
include::modules/installation-gcp-config-yaml.adoc[leveloffset=+2]
4347

4448
include::modules/nw-gcp-installing-global-access-configuration.adoc[leveloffset=+2]

‎installing/installing_gcp/installing-gcp-shared-vpc.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ include::modules/installation-user-infra-generate.adoc[leveloffset=+1]
3232

3333
include::modules/installation-initializing-manual.adoc[leveloffset=+2]
3434

35+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
36+
37+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
38+
3539
include::modules/installation-gcp-shared-vpc-config.adoc[leveloffset=+2]
3640

3741
include::modules/installation-configuration-parameters.adoc[leveloffset=+2]

‎installing/installing_gcp/installing-gcp-user-infra-vpc.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,8 @@ include::modules/installation-deployment-manager-vpc.adoc[leveloffset=+3]
7171
include::modules/installation-user-infra-generate.adoc[leveloffset=+1]
7272

7373
include::modules/installation-initializing-manual.adoc[leveloffset=+2]
74-
74+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
75+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
7576
include::modules/installation-gcp-user-infra-shared-vpc-config-yaml.adoc[leveloffset=+2]
7677

7778
include::modules/installation-configure-proxy.adoc[leveloffset=+2]

‎installing/installing_gcp/installing-gcp-user-infra.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2
6262
include::modules/installation-user-infra-generate.adoc[leveloffset=+1]
6363
include::modules/installation-disk-partitioning-upi-templates.adoc[leveloffset=+2]
6464
include::modules/installation-initializing.adoc[leveloffset=+2]
65+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
66+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
6567
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
6668
//include::modules/installation-three-node-cluster.adoc[leveloffset=+2]
6769
include::modules/installation-user-infra-generate-k8s-manifest-ignition.adoc[leveloffset=+2]

‎installing/installing_gcp/installing-gcp-vpc.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ include::modules/installation-gcp-tested-machine-types.adoc[leveloffset=+2]
3535

3636
include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2]
3737

38+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
39+
40+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
41+
3842
include::modules/installation-gcp-config-yaml.adoc[leveloffset=+2]
3943

4044
include::modules/nw-gcp-installing-global-access-configuration.adoc[leveloffset=+2]

‎installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ include::modules/installation-gcp-tested-machine-types.adoc[leveloffset=+2]
4646

4747
include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2]
4848

49+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
50+
51+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
52+
4953
include::modules/installation-gcp-config-yaml.adoc[leveloffset=+2]
5054

5155
include::modules/nw-gcp-installing-global-access-configuration.adoc[leveloffset=+2]

‎installing/installing_gcp/installing-restricted-networks-gcp.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2
6868
include::modules/installation-user-infra-generate.adoc[leveloffset=+1]
6969
include::modules/installation-disk-partitioning-upi-templates.adoc[leveloffset=+2]
7070
include::modules/installation-initializing.adoc[leveloffset=+2]
71+
include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
72+
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
7173
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
7274
include::modules/installation-user-infra-generate-k8s-manifest-ignition.adoc[leveloffset=+2]
7375

‎modules/installation-configuration-parameters.adoc

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1246,6 +1246,18 @@ link:https://yaml.org/spec/1.2/spec.html#sequence//[YAML sequence].
12461246
|The GCP service account used for the encryption request for control plane and compute machines. If absent, the Compute Engine default service account is used. For more information about GCP service accounts, see Google's documentation on link:https://cloud.google.com/compute/docs/access/service-accounts#compute_engine_service_account[service accounts].
12471247
|The GCP service account email, for example `<service_account_name>@<project_id>.iam.gserviceaccount.com`.
12481248

1249+
|`platform.gcp.defaultMachinePlatform.secureBoot`
1250+
|Whether to enable Shielded VM secure boot for all machines in the cluster. Shielded VMs have additional security protocols such as secure boot, firmware and integrity monitoring, and rootkit protection. For more information on Shielded VMs, see Google's documentation on link:https://cloud.google.com/shielded-vm[Shielded VMs].
1251+
|`Enabled` or `Disabled`. The default value is `Disabled`.
1252+
1253+
|`platform.gcp.defaultMachinePlatform.confidentialCompute`
1254+
|Whether to use Confidential VMs for all machines in the cluster. Confidential VMs provide encryption for data during processing. For more information on Confidential computing, see Google's documentation on link:https://cloud.google.com/confidential-computing[Confidential computing].
1255+
|`Enabled` or `Disabled`. The default value is `Disabled`.
1256+
1257+
|`platform.gcp.defaultMachinePlatform.onHostMaintenance`
1258+
|Specifies the behavior of all VMs during a host maintenance event, such as a software or hardware update. For Confidential VMs, this parameter must be set to `Terminate`. Confidential VMs do not support live VM migration.
1259+
|`Terminate` or `Migrate`. The default value is `Migrate`.
1260+
12491261
|`controlPlane.platform.gcp.osDisk.encryptionKey.kmsKey.name`
12501262
|The name of the customer managed encryption key to be used for control plane machine disk encryption.
12511263
|The encryption key name.
@@ -1287,6 +1299,18 @@ link:https://yaml.org/spec/1.2/spec.html#sequence//[YAML sequence].
12871299
|A list of valid link:https://cloud.google.com/compute/docs/regions-zones#available[GCP availability zones], such as `us-central1-a`, in a
12881300
link:https://yaml.org/spec/1.2/spec.html#sequence//[YAML sequence].
12891301

1302+
|`controlPlane.platform.gcp.secureBoot`
1303+
|Whether to enable Shielded VM secure boot for control plane machines. Shielded VMs have additional security protocols such as secure boot, firmware and integrity monitoring, and rootkit protection. For more information on Shielded VMs, see Google's documentation on link:https://cloud.google.com/shielded-vm[Shielded VMs].
1304+
|`Enabled` or `Disabled`. The default value is `Disabled`.
1305+
1306+
|`controlPlane.platform.gcp.confidentialCompute`
1307+
|Whether to enable Confidential VMs for control plane machines. Confidential VMs provide encryption for data while it is being processed. For more information on Confidential VMs, see Google's documentation on link:https://cloud.google.com/confidential-computing[Confidential Computing].
1308+
|`Enabled` or `Disabled`. The default value is `Disabled`.
1309+
1310+
|`controlPlane.platform.gcp.onHostMaintenance`
1311+
|Specifies the behavior of control plane VMs during a host maintenance event, such as a software or hardware update. For Confidential VMs, this parameter must be set to `Terminate`. Confidential VMs do not support live VM migration.
1312+
|`Terminate` or `Migrate`. The default value is `Migrate`.
1313+
12901314
|`compute.platform.gcp.osDisk.encryptionKey.kmsKey.name`
12911315
|The name of the customer managed encryption key to be used for compute machine disk encryption.
12921316
|The encryption key name.
@@ -1328,6 +1352,18 @@ link:https://yaml.org/spec/1.2/spec.html#sequence//[YAML sequence].
13281352
|A list of valid link:https://cloud.google.com/compute/docs/regions-zones#available[GCP availability zones], such as `us-central1-a`, in a
13291353
link:https://yaml.org/spec/1.2/spec.html#sequence//[YAML sequence].
13301354

1355+
|`compute.platform.gcp.secureBoot`
1356+
|Whether to enable Shielded VM secure boot for compute machines. Shielded VMs have additional security protocols such as secure boot, firmware and integrity monitoring, and rootkit protection. For more information on Shielded VMs, see Google's documentation on link:https://cloud.google.com/shielded-vm[Shielded VMs].
1357+
|`Enabled` or `Disabled`. The default value is `Disabled`.
1358+
1359+
|`compute.platform.gcp.confidentialCompute`
1360+
|Whether to enable Confidential VMs for compute machines. Confidential VMs provide encryption for data while it is being processed. For more information on Confidential VMs, see Google's documentation on link:https://cloud.google.com/confidential-computing[Confidential Computing].
1361+
|`Enabled` or `Disabled`. The default value is `Disabled`.
1362+
1363+
|`compute.platform.gcp.onHostMaintenance`
1364+
|Specifies the behavior of compute VMs during a host maintenance event, such as a software or hardware update. For Confidential VMs, this parameter must be set to `Terminate`. Confidential VMs do not support live VM migration.
1365+
|`Terminate` or `Migrate`. The default value is `Migrate`.
1366+
13311367
|====
13321368

13331369
endif::gcp[]

0 commit comments

Comments
 (0)