fix: do not set confidential_instance_type for autopilot clusters

Author: arthurlapertosa

autogen/main/cluster.tf.tmpl

@@ -83,7 +83,9 @@ resource "google_container_cluster" "primary" {
     for_each = local.confidential_node_config
     content {
       enabled = confidential_nodes.value.enabled
-      confidential_instance_type = lookup(var.node_pools[0], "confidential_instance_type", null)
+      {% if autopilot_cluster != true %}
+        confidential_instance_type = lookup(var.node_pools[0], "confidential_instance_type", null)
+      {% endif %}
     }
   }
 

modules/beta-autopilot-private-cluster/cluster.tf

@@ -68,8 +68,7 @@ resource "google_container_cluster" "primary" {
   dynamic "confidential_nodes" {
     for_each = local.confidential_node_config
     content {
-      enabled                    = confidential_nodes.value.enabled
-      confidential_instance_type = lookup(var.node_pools[0], "confidential_instance_type", null)
+      enabled = confidential_nodes.value.enabled
     }
   }
 

modules/beta-autopilot-public-cluster/cluster.tf

@@ -68,8 +68,7 @@ resource "google_container_cluster" "primary" {
   dynamic "confidential_nodes" {
     for_each = local.confidential_node_config
     content {
-      enabled                    = confidential_nodes.value.enabled
-      confidential_instance_type = lookup(var.node_pools[0], "confidential_instance_type", null)
+      enabled = confidential_nodes.value.enabled
     }
   }
 

modules/gke-autopilot-cluster/metadata.yaml

@@ -36,6 +36,8 @@ spec:
         location: examples/autopilot_private_firewalls
       - name: confidential_autopilot_private
         location: examples/confidential_autopilot_private
+      - name: confidential_gpu_public
+        location: examples/confidential_gpu_public
       - name: confidential_safer_cluster
         location: examples/confidential_safer_cluster
       - name: deploy_service

modules/gke-node-pool/metadata.yaml

@@ -36,6 +36,8 @@ spec:
         location: examples/autopilot_private_firewalls
       - name: confidential_autopilot_private
         location: examples/confidential_autopilot_private
+      - name: confidential_gpu_public
+        location: examples/confidential_gpu_public
       - name: confidential_safer_cluster
         location: examples/confidential_safer_cluster
       - name: deploy_service

modules/gke-standard-cluster/metadata.yaml

@@ -36,6 +36,8 @@ spec:
         location: examples/autopilot_private_firewalls
       - name: confidential_autopilot_private
         location: examples/confidential_autopilot_private
+      - name: confidential_gpu_public
+        location: examples/confidential_gpu_public
       - name: confidential_safer_cluster
         location: examples/confidential_safer_cluster
       - name: deploy_service
@@ -1008,9 +1010,9 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/iam.serviceAccountUser
           - roles/compute.admin
           - roles/container.admin
-          - roles/iam.serviceAccountUser
     services:
       - compute.googleapis.com
       - container.googleapis.com