feat: add hyperdisk confidential node pool to the confidential safer cluster example (#2311)

Author: arthurlapertosa

autogen/main/cluster.tf.tmpl

@@ -536,6 +536,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

cluster.tf

@@ -412,6 +412,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

examples/confidential_safer_cluster/main.tf

@@ -45,11 +45,21 @@ data "google_container_engine_versions" "current" {
   location = var.region
 }
 
+data "google_project" "main" {
+  project_id = var.project_id
+}
+
 resource "random_shuffle" "version" {
   input        = data.google_container_engine_versions.current.valid_master_versions
   result_count = 1
 }
 
+resource "google_kms_crypto_key_iam_member" "main" {
+  crypto_key_id = module.kms.keys[local.key_name]
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.main.number}@compute-system.iam.gserviceaccount.com"
+}
+
 module "gke" {
   source  = "terraform-google-modules/kubernetes-engine/google//modules/safer-cluster"
   version = "~> 36.0"
@@ -87,9 +97,11 @@ module "gke" {
 
   node_pools = [
     {
-      name               = "default"
-      machine_type       = "n2d-standard-2"
-      enable_secure_boot = true
+      name                        = "default"
+      machine_type                = "n2d-standard-2"
+      disk_type                   = "hyperdisk-balanced"
+      boot_disk_kms_key           = module.kms.keys[local.key_name]
+      enable_confidential_storage = true
     },
   ]
 

modules/beta-private-cluster-update-variant/cluster.tf

@@ -449,6 +449,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

modules/beta-private-cluster/cluster.tf

@@ -449,6 +449,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

modules/beta-public-cluster-update-variant/cluster.tf

@@ -449,6 +449,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

modules/beta-public-cluster/cluster.tf

@@ -449,6 +449,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

modules/private-cluster-update-variant/cluster.tf

@@ -412,6 +412,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

modules/private-cluster/cluster.tf

@@ -412,6 +412,7 @@ resource "google_container_cluster" "primary" {
       machine_type                = lookup(var.node_pools[0], "machine_type", "e2-medium")
       min_cpu_platform            = lookup(var.node_pools[0], "min_cpu_platform", "")
       enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
+      disk_type                   = lookup(var.node_pools[0], "disk_type", null)
       dynamic "gcfs_config" {
         for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
         content {

test/integration/confidential_safer_cluster/confidential_safer_cluster_test.go

@@ -63,6 +63,14 @@ func TestConfidentialSaferCluster(t *testing.T) {
 			"binaryAuthorization.evaluationMode",
 			"legacyAbac",
 			"meshCertificates.enableCertificates",
+			"nodeConfig.bootDiskKmsKey",
+			"nodeConfig.diskType",
+			"nodeConfig.enableConfidentialStorage",
+			"nodeConfig.machineType",
+			"nodeConfig.diskType",
+			"nodePools.enableConfidentialStorage",
+			"nodePools.diskType",
+			"nodePools.bootDiskKmsKey",
 			"nodePools.autoscaling",
 			"nodePools.config.machineType",
 			"nodePools.config.diskSizeGb",