Skip to content

Commit

Permalink
Add beta support for confidentialInstanceType (GoogleCloudPlatform#9847)
Browse files Browse the repository at this point in the history
  • Loading branch information
@deeglaze
deeglaze authored Feb 5, 2024
1 parent 40e92ed commit 93c0470
Show file tree
Hide file tree
Showing 11 changed files with 473 additions and 27 deletions.
18 changes: 17 additions & 1 deletion mmv1/products/compute/Instance.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -608,7 +608,23 @@ properties:
properties:
- !ruby/object:Api::Type::Boolean
name: 'enableConfidentialCompute'
description: Enables confidential computing
description: Enables confidential computing with AMD SEV.
at_least_one_of:
- confidential_instance_config.0.enable_confidential_compute
- confidential_instance_config.0.confidential_instance_type
- !ruby/object:Api::Type::Enum
name: 'confidentialInstanceType'
min_version: beta
description: |
The confidential computing technology the instance uses.
SEV is an AMD feature. One of the following values: SEV, SEV_SNP.
If SEV_SNP, min_cpu_platform = "AMD Milan" is currently required.
values:
- :SEV
- :SEV_SNP
at_least_one_of:
- confidential_instance_config.0.enable_confidential_compute
- confidential_instance_config.0.confidential_instance_type
- !ruby/object:Api::Type::Enum
name: 'status'
description: |
Expand Down
10 changes: 8 additions & 2 deletions mmv1/third_party/terraform/services/compute/compute_instance_helpers.go.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -577,16 +577,22 @@ func expandConfidentialInstanceConfig(d tpgresource.TerraformResourceData) *comp
prefix := "confidential_instance_config.0"
return &compute.ConfidentialInstanceConfig{
EnableConfidentialCompute: d.Get(prefix + ".enable_confidential_compute").(bool),
<% unless version == "ga" %>
ConfidentialInstanceType: d.Get(prefix + ".confidential_instance_type").(string),
<% end %>
}
}

func flattenConfidentialInstanceConfig(ConfidentialInstanceConfig *compute.ConfidentialInstanceConfig) []map[string]bool {
func flattenConfidentialInstanceConfig(ConfidentialInstanceConfig *compute.ConfidentialInstanceConfig) []map[string]interface{} {
if ConfidentialInstanceConfig == nil {
return nil
}

return []map[string]bool{{
return []map[string]interface{}{{
"enable_confidential_compute": ConfidentialInstanceConfig.EnableConfidentialCompute,
<% unless version == "ga" %>
"confidential_instance_type": ConfidentialInstanceConfig.ConfidentialInstanceType,
<% end %>
}}
}

Expand Down
18 changes: 18 additions & 0 deletions mmv1/third_party/terraform/services/compute/resource_compute_instance.go.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -996,11 +996,29 @@ be from 0 to 999,999,999 inclusive.`,
Description: `The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create.`,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
<% if version == "ga" %>
"enable_confidential_compute": {
Type: schema.TypeBool,
Required: true,
Description: `Defines whether the instance should have confidential compute enabled.`,
},
<% else %>
"enable_confidential_compute": {
Type: schema.TypeBool,
Optional: true,
Description: `Defines whether the instance should have confidential compute enabled. Field will be deprecated in a future release`,
AtLeastOneOf: []string{"confidential_instance_config.0.enable_confidential_compute", "confidential_instance_config.0.confidential_instance_type"},
},
"confidential_instance_type": {
Type: schema.TypeString,
Optional: true,
Description: `
Specifies which confidential computing technology to use.
This could be one of the following values: SEV, SEV_SNP.
If SEV_SNP, min_cpu_platform = "AMD Milan" is currently required.`,
AtLeastOneOf: []string{"confidential_instance_config.0.enable_confidential_compute", "confidential_instance_config.0.confidential_instance_type"},
},
<% end %>
},
},
},
Expand Down
20 changes: 20 additions & 0 deletions mmv1/third_party/terraform/services/compute/resource_compute_instance_template.go.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -870,12 +870,32 @@ be from 0 to 999,999,999 inclusive.`,
Description: `The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create.`,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
<% if version == "ga" %>
"enable_confidential_compute": {
Type: schema.TypeBool,
Required: true,
ForceNew: true,
Description: `Defines whether the instance should have confidential compute enabled.`,
},
<% else %>
"enable_confidential_compute": {
Type: schema.TypeBool,
Optional: true,
ForceNew: true,
Description: `Defines whether the instance should have confidential compute enabled. Field will be deprecated in a future release.`,
AtLeastOneOf: []string{"confidential_instance_config.0.enable_confidential_compute", "confidential_instance_config.0.confidential_instance_type"},
},
"confidential_instance_type": {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
Description: `
Specifies which confidential computing technology to use.
This could be one of the following values: SEV, SEV_SNP.
If SEV_SNP, min_cpu_platform = "AMD Milan" is currently required.`,
AtLeastOneOf: []string{"confidential_instance_config.0.enable_confidential_compute", "confidential_instance_config.0.confidential_instance_type"},
},
<% end %>
},
},
},
Expand Down
134 changes: 126 additions & 8 deletions mmv1/third_party/terraform/services/compute/resource_compute_instance_template_test.go.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -772,19 +772,37 @@ func TestAccComputeInstanceTemplate_ConfidentialInstanceConfigMain(t *testing.T)
t.Parallel()

var instanceTemplate compute.InstanceTemplate
<% unless version == "ga" %>
var instanceTemplate2 compute.InstanceTemplate
<% end %>

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckComputeInstanceTemplateDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccComputeInstanceTemplateConfidentialInstanceConfig(acctest.RandString(t, 10), true),
Config: testAccComputeInstanceTemplateConfidentialInstanceConfigEnable(acctest.RandString(t, 10), "SEV"),
Check: resource.ComposeTestCheckFunc(
testAccCheckComputeInstanceTemplateExists(t, "google_compute_instance_template.foobar", &instanceTemplate),
testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(&instanceTemplate, true),
testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(&instanceTemplate, true, "SEV"),
<% unless version == "ga" %>
testAccCheckComputeInstanceTemplateExists(t, "google_compute_instance_template.foobar2", &instanceTemplate2),
testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(&instanceTemplate2, true, ""),
<% end %>
),
},
<% unless version == "ga" %>
{
Config: testAccComputeInstanceTemplateConfidentialInstanceConfigNoEnable(acctest.RandString(t, 10), "AMD Milan", "SEV_SNP"),
Check: resource.ComposeTestCheckFunc(
testAccCheckComputeInstanceTemplateExists(t, "google_compute_instance_template.foobar3", &instanceTemplate),
testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(&instanceTemplate, false, "SEV_SNP"),
testAccCheckComputeInstanceTemplateExists(t, "google_compute_instance_template.foobar4", &instanceTemplate2),
testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(&instanceTemplate2, false, "SEV_SNP"),
),
},
<% end %>
},
})
}
Expand Down Expand Up @@ -1775,12 +1793,17 @@ func testAccCheckComputeInstanceTemplateHasShieldedVmConfig(instanceTemplate *co
}
}

func testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(instanceTemplate *compute.InstanceTemplate, EnableConfidentialCompute bool) resource.TestCheckFunc {
func testAccCheckComputeInstanceTemplateHasConfidentialInstanceConfig(instanceTemplate *compute.InstanceTemplate, EnableConfidentialCompute bool, ConfidentialInstanceType string) resource.TestCheckFunc {

return func(s *terraform.State) error {
if instanceTemplate.Properties.ConfidentialInstanceConfig.EnableConfidentialCompute != EnableConfidentialCompute {
return fmt.Errorf("Wrong ConfidentialInstanceConfig EnableConfidentialCompute: expected %t, got, %t", EnableConfidentialCompute, instanceTemplate.Properties.ConfidentialInstanceConfig.EnableConfidentialCompute)
}
<% unless version == "ga" %>
if instanceTemplate.Properties.ConfidentialInstanceConfig.ConfidentialInstanceType != ConfidentialInstanceType {
return fmt.Errorf("Wrong ConfidentialInstanceConfig ConfidentialInstanceType: expected %s, got, %s", ConfidentialInstanceType, instanceTemplate.Properties.ConfidentialInstanceConfig.ConfidentialInstanceType)
}
<% end %>

return nil
}
Expand Down Expand Up @@ -3078,7 +3101,7 @@ resource "google_compute_instance_template" "foobar" {
`, suffix, enableSecureBoot, enableVtpm, enableIntegrityMonitoring)
}

func testAccComputeInstanceTemplateConfidentialInstanceConfig(suffix string, enableConfidentialCompute bool) string {
func testAccComputeInstanceTemplateConfidentialInstanceConfigEnable(suffix string, confidentialInstanceType string) string {
return fmt.Sprintf(`
data "google_compute_image" "my_image" {
family = "ubuntu-2004-lts"
Expand All @@ -3091,7 +3114,7 @@ resource "google_compute_instance_template" "foobar" {

disk {
source_image = data.google_compute_image.my_image.self_link
auto_delete = true
auto_delete = true
boot = true
}

Expand All @@ -3100,16 +3123,111 @@ resource "google_compute_instance_template" "foobar" {
}

confidential_instance_config {
enable_confidential_compute = %t
enable_confidential_compute = true
<% unless version == "ga" %>
confidential_instance_type = %q
<% end %>
}

scheduling {
on_host_maintenance = "TERMINATE"
on_host_maintenance = "TERMINATE"
}

}
<% unless version == "ga" %>
resource "google_compute_instance_template" "foobar2" {
name = "tf-test-instance2-template-%s"
machine_type = "n2d-standard-2"

disk {
source_image = data.google_compute_image.my_image.self_link
auto_delete = true
boot = true
}

network_interface {
network = "default"
}

confidential_instance_config {
enable_confidential_compute = true
}

scheduling {
on_host_maintenance = "TERMINATE"
}

}
<% end %>
<% if version == "ga" %>
`, suffix)
<% else %>
`, suffix, confidentialInstanceType, suffix)
<% end %>
}

<% unless version == "ga" %>
func testAccComputeInstanceTemplateConfidentialInstanceConfigNoEnable(suffix string, minCpuPlatform, confidentialInstanceType string) string {
return fmt.Sprintf(`
data "google_compute_image" "my_image2" {
family = "ubuntu-2004-lts"
project = "ubuntu-os-cloud"
}

resource "google_compute_instance_template" "foobar3" {
name = "tf-test-instance3-template-%s"
machine_type = "n2d-standard-2"

disk {
source_image = data.google_compute_image.my_image2.self_link
auto_delete = true
boot = true
}

network_interface {
network = "default"
}

min_cpu_platform = %q

confidential_instance_config {
enable_confidential_compute = false
confidential_instance_type = %q
}

scheduling {
on_host_maintenance = "TERMINATE"
}

}
resource "google_compute_instance_template" "foobar4" {
name = "tf-test-instance4-template-%s"
machine_type = "n2d-standard-2"

disk {
source_image = data.google_compute_image.my_image2.self_link
auto_delete = true
boot = true
}

network_interface {
network = "default"
}

min_cpu_platform = %q

confidential_instance_config {
confidential_instance_type = %q
}

scheduling {
on_host_maintenance = "TERMINATE"
}

}
`, suffix, enableConfidentialCompute)
`, suffix, minCpuPlatform, confidentialInstanceType, suffix, minCpuPlatform, confidentialInstanceType)
}
<% end %>

func testAccComputeInstanceTemplateAdvancedMachineFeatures(suffix string) string {
return fmt.Sprintf(`
Expand Down
Loading

0 comments on commit 93c0470

Please sign in to comment.