Skip to content

Commit ddb6985

Browse files
arthurlapertosaarthurlapertosa
authored
feat: add confidential computing example (#421)
1 parent a1c19b0 commit ddb6985

File tree

20 files changed

+404
-6
lines changed

20 files changed

+404
-6
lines changed

‎examples/confidential_computing/README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# confidential computing vm
2+
3+
This is an example of a vm creation with confidential computing,
4+
encrypted disk using a multiregion (US by default) Cloud HSM key
5+
and a custom service account with cloud-platform scope.
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Inputs
9+
10+
| Name | Description | Type | Default | Required |
11+
|------|-------------|------|---------|:--------:|
12+
| key | Key name. | `string` | n/a | yes |
13+
| keyring | Keyring name. | `string` | n/a | yes |
14+
| location | Location for the resources (keyring, key, network, etc.). | `string` | `"us"` | no |
15+
| project\_id | The Google Cloud project ID. | `string` | n/a | yes |
16+
| region | The GCP region to create and test resources in. | `string` | `"us-central1"` | no |
17+
| service\_account\_roles | Predefined roles for the Service account that will be created for the VM. Remember to follow principles of least privileges with Cloud IAM. | `list(string)` | `[]` | no |
18+
| subnetwork | The subnetwork selflink to host the compute instances in. | `string` | n/a | yes |
19+
| suffix | A suffix to be used as an identifier for resources. (e.g., suffix for KMS Key, Keyring). | `string` | `""` | no |
20+
21+
## Outputs
22+
23+
| Name | Description |
24+
|------|-------------|
25+
| instance\_self\_link | Self-link for compute instance. |
26+
| name | Name of the instance templates. |
27+
| self\_link | Self-link to the instance template. |
28+
| suffix | Suffix used as an identifier for resources. |
29+
30+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/confidential_computing/main.tf‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
default_suffix = var.suffix == "" ? random_string.suffix.result : "${random_string.suffix.result}-${var.suffix}"
19+
key_name = "${var.key}-${local.default_suffix}"
20+
}
21+
22+
resource "random_string" "suffix" {
23+
length = 4
24+
special = false
25+
upper = false
26+
}
27+
28+
module "kms" {
29+
source = "terraform-google-modules/kms/google"
30+
version = "2.3.0"
31+
32+
keyring = "${var.keyring}-${local.default_suffix}"
33+
location = var.location
34+
project_id = var.project_id
35+
keys = [local.key_name]
36+
purpose = "ENCRYPT_DECRYPT"
37+
key_protection_level = "HSM"
38+
prevent_destroy = false
39+
}
40+
41+
resource "google_service_account" "default" {
42+
project = var.project_id
43+
account_id = "confidential-compute-sa"
44+
display_name = "Custom SA for confidential VM Instance"
45+
}
46+
47+
resource "google_project_iam_member" "service_account_roles" {
48+
for_each = toset(var.service_account_roles)
49+
50+
project = var.project_id
51+
role = each.key
52+
member = "serviceAccount:${google_service_account.default.email}"
53+
}
54+
55+
data "google_project" "project" {
56+
project_id = var.project_id
57+
}
58+
59+
resource "google_kms_crypto_key_iam_binding" "crypto_key" {
60+
crypto_key_id = module.kms.keys[local.key_name]
61+
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
62+
members = [
63+
"serviceAccount:service-${data.google_project.project.number}@compute-system.iam.gserviceaccount.com",
64+
]
65+
}
66+
67+
module "instance_template" {
68+
source = "../../modules/instance_template"
69+
70+
region = var.region
71+
project_id = var.project_id
72+
subnetwork = var.subnetwork
73+
74+
name_prefix = "confidential-encrypted-template"
75+
source_image_project = "ubuntu-os-cloud"
76+
source_image = "ubuntu-2004-lts"
77+
machine_type = "n2d-standard-2"
78+
min_cpu_platform = "AMD Milan"
79+
enable_confidential_vm = true
80+
confidential_instance_type = "SEV"
81+
82+
service_account = {
83+
email = google_service_account.default.email
84+
scopes = ["cloud-platform"]
85+
}
86+
disk_encryption_key = module.kms.keys[local.key_name]
87+
}
88+
89+
module "compute_instance" {
90+
source = "terraform-google-modules/vm/google//modules/compute_instance"
91+
version = "~> 11.0"
92+
93+
region = var.region
94+
subnetwork = var.subnetwork
95+
hostname = "confidential-encrypted-instance"
96+
instance_template = module.instance_template.self_link
97+
deletion_protection = false
98+
}

‎examples/confidential_computing/outputs.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
18+
output "self_link" {
19+
description = "Self-link to the instance template."
20+
value = module.instance_template.self_link
21+
}
22+
23+
output "name" {
24+
description = "Name of the instance templates."
25+
value = module.instance_template.name
26+
}
27+
28+
output "instance_self_link" {
29+
description = "Self-link for compute instance."
30+
value = module.compute_instance.instances_self_links[0]
31+
}
32+
33+
output "suffix" {
34+
description = "Suffix used as an identifier for resources."
35+
value = local.default_suffix
36+
}

‎examples/confidential_computing/variables.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The Google Cloud project ID."
19+
type = string
20+
}
21+
22+
variable "region" {
23+
description = "The GCP region to create and test resources in."
24+
type = string
25+
default = "us-central1"
26+
}
27+
28+
variable "subnetwork" {
29+
description = "The subnetwork selflink to host the compute instances in."
30+
type = string
31+
}
32+
33+
variable "location" {
34+
description = "Location for the resources (keyring, key, network, etc.)."
35+
type = string
36+
default = "us"
37+
}
38+
39+
variable "suffix" {
40+
description = "A suffix to be used as an identifier for resources. (e.g., suffix for KMS Key, Keyring)."
41+
type = string
42+
default = ""
43+
}
44+
45+
variable "keyring" {
46+
description = "Keyring name."
47+
type = string
48+
}
49+
50+
variable "key" {
51+
description = "Key name."
52+
type = string
53+
}
54+
55+
variable "service_account_roles" {
56+
description = "Predefined roles for the Service account that will be created for the VM. Remember to follow principles of least privileges with Cloud IAM."
57+
type = list(string)
58+
default = []
59+
}

‎metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@ spec:
4848
location: examples/instance_template/alias_ip_range
4949
- name: autoscaler
5050
location: examples/mig/autoscaler
51+
- name: confidential_computing
52+
location: examples/confidential_computing
5153
- name: confidential_computing
5254
location: examples/instance_template/confidential_computing
5355
- name: disk_snapshot

‎modules/compute_disk_snapshot/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ See the [disk snapshot](https://github.com/terraform-google-modules/terraform-go
2626

2727
| Name | Description |
2828
|------|-------------|
29-
| attachments | Disk attachments to the resource policy |
30-
| policy | Resource snapshot policy details |
29+
| attachments | Disk attachments to the resource policy. |
30+
| policy | Resource snapshot policy details. |
3131

3232
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/compute_disk_snapshot/metadata.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ spec:
3838
location: examples/instance_template/alias_ip_range
3939
- name: autoscaler
4040
location: examples/mig/autoscaler
41+
- name: confidential_computing
42+
location: examples/confidential_computing
4143
- name: confidential_computing
4244
location: examples/instance_template/confidential_computing
4345
- name: disk_snapshot
@@ -148,9 +150,9 @@ spec:
148150
required: true
149151
outputs:
150152
- name: attachments
151-
description: Disk attachments to the resource policy
153+
description: Disk attachments to the resource policy.
152154
- name: policy
153-
description: Resource snapshot policy details
155+
description: Resource snapshot policy details.
154156
requirements:
155157
roles:
156158
- level: Project

‎modules/compute_disk_snapshot/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
*/
1616

1717
output "policy" {
18-
description = "Resource snapshot policy details"
18+
description = "Resource snapshot policy details."
1919
value = google_compute_resource_policy.policy
2020
}
2121

2222
output "attachments" {
23-
description = "Disk attachments to the resource policy"
23+
description = "Disk attachments to the resource policy."
2424
value = google_compute_disk_resource_policy_attachment.attachment[*]
2525
}

‎modules/compute_instance/metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ spec:
3838
location: examples/instance_template/alias_ip_range
3939
- name: autoscaler
4040
location: examples/mig/autoscaler
41+
- name: confidential_computing
42+
location: examples/confidential_computing
4143
- name: confidential_computing
4244
location: examples/instance_template/confidential_computing
4345
- name: disk_snapshot

‎modules/instance_template/metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ spec:
3838
location: examples/instance_template/alias_ip_range
3939
- name: autoscaler
4040
location: examples/mig/autoscaler
41+
- name: confidential_computing
42+
location: examples/confidential_computing
4143
- name: confidential_computing
4244
location: examples/instance_template/confidential_computing
4345
- name: disk_snapshot

0 commit comments

Comments
 (0)