Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DNM] Support TDX confidentialInstanceTypes #2193

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[DNM] Support TDX confidentialInstanceTypes #2193

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
232b41e
Support SEV_SNP confidential type selection on GCP
bgartzi Jan 17, 2025
e3d90e7
GCP: Support tdx confidentialInstanceTypes
bgartzi Feb 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions machine/v1beta1/types_gcpprovider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,17 @@ const (
ConfidentialComputePolicyDisabled ConfidentialComputePolicy = "Disabled"
)

type ConfidentialVMTechnology string

const (
// ConfidentialVMTechSEV sets AMD SEV as the VM instance's confidential computing technology of choice.
ConfidentialVMTechSEV ConfidentialVMTechnology = "sev"
// ConfidentialVMTechSEVSNP sets AMD SEV-SNP as the VM instance's confidential computing technology of choice.
ConfidentialVMTechSEVSNP ConfidentialVMTechnology = "sev-snp"
// ConfidentialVMTechnologyTDX sets Intel TDX as the VM instance's confidential computing technology of choice.
ConfidentialVMTechTDX ConfidentialVMTechnology = "tdx"
)

// GCPMachineProviderSpec is the type that will be embedded in a Machine.Spec.ProviderSpec field
// for an GCP virtual machine. It is used by the GCP machine actuator to create a single Machine.
// Compatibility level 2: Stable within a major release for a minimum of 9 months or 3 minor releases (whichever is longer).
Expand Down Expand Up @@ -146,9 +157,24 @@ type GCPMachineProviderSpec struct {
// confidentialCompute Defines whether the instance should have confidential compute enabled.
// If enabled OnHostMaintenance is required to be set to "Terminate".
// If omitted, the platform chooses a default, which is subject to change over time, currently that default is false.
// If confidentialInstanceType is configured, even if confidentialCompute is Disabled, a confidential compute instance will be configured.
// +kubebuilder:validation:Enum=Enabled;Disabled
// +optional
ConfidentialCompute ConfidentialComputePolicy `json:"confidentialCompute,omitempty"`
// ConfidentialInstanceType determines the required type of confidential computing technology.
// To set a ConfidentialInstanceType ConfidentialCompute must be first set to "Enabled".
// If ConfidentialCompute is "Enabled" and ConfidentialInstanceType isn't provided, the default ConfidentialInstanceType will be set. At this moment, the default for this case is "sev".
// If ConfidentialCompute is "Enabled" and ConfidentialInstanceType is provided, the provided ConfidentialInstanceType will be set.
// If ConfidentialCompute is "Disabled" and ConfidentialInstanceType isn't provided, confidential computing technology won't be enabled and the instance will be run normally.
// Setting ConfidentialCompute to "Disabled" and ConfidentialInstanceType to a valid value isn't supported. That will raise an error.
// Valid ConfidentialInstanceType values are "sev", "sev-snp", and "tdx".
// Note that supported ConfidentialInstanceType values will depend on the configured instance machine types.
// "sev" is supported in "n2d", "c2d" and "c3d" machines.
// "sev-snp" is supported in "n2d" machines.
// "tdx" is supported in "c3" machines.
// +kubebuilder:validation:Enum=sev;sev-snp;tdx;
// +optional
ConfidentialInstanceType ConfidentialVMTechnology `json:"confidentialInstanceType,omitempty"`

// resourceManagerTags is an optional list of tags to apply to the GCP resources created for
// the cluster. See https://cloud.google.com/resource-manager/docs/tags/tags-overview for
Expand Down
49 changes: 25 additions & 24 deletions machine/v1beta1/zz_generated.swagger_doc_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 8 additions & 1 deletion openapi/generated_openapi/zz_generated.openapi.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion openapi/openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21289,7 +21289,11 @@
"default": false
},
"confidentialCompute": {
"description": "confidentialCompute Defines whether the instance should have confidential compute enabled. If enabled OnHostMaintenance is required to be set to \"Terminate\". If omitted, the platform chooses a default, which is subject to change over time, currently that default is false.",
"description": "confidentialCompute Defines whether the instance should have confidential compute enabled. If enabled OnHostMaintenance is required to be set to \"Terminate\". If omitted, the platform chooses a default, which is subject to change over time, currently that default is false. If confidentialInstanceType is configured, even if confidentialCompute is Disabled, a confidential compute instance will be configured.",
"type": "string"
},
"confidentialInstanceType": {
"description": "ConfidentialInstanceType determines the required type of confidential computing technology. To set a ConfidentialInstanceType ConfidentialCompute must be first set to \"Enabled\". If ConfidentialCompute is \"Enabled\" and ConfidentialInstanceType isn't provided, the default ConfidentialInstanceType will be set. At this moment, the default for this case is \"sev\". If ConfidentialCompute is \"Enabled\" and ConfidentialInstanceType is provided, the provided ConfidentialInstanceType will be set. If ConfidentialCompute is \"Disabled\" and ConfidentialInstanceType isn't provided, confidential computing technology won't be enabled and the instance will be run normally. Setting ConfidentialCompute to \"Disabled\" and ConfidentialInstanceType to a valid value isn't supported. That will raise an error. Valid ConfidentialInstanceType values are \"sev\", \"sev-snp\", and \"tdx\". Note that supported ConfidentialInstanceType values will depend on the configured instance machine types. \"sev\" is supported in \"n2d\", \"c2d\" and \"c3d\" machines. \"sev-snp\" is supported in \"n2d\" machines. \"tdx\" is supported in \"c3\" machines.",
"type": "string"
},
"credentialsSecret": {
Expand Down