Skip to content

Commit f93f493

Browse files
modular-magicianmodular-magician
authored
Changes to support TDX ConfidentialInstanceType (#11166) (#19033)
[upstream:308fdd773fe8601557771bd5ec8611495b1a1cf2] Signed-off-by: Modular Magician <magic-modules@google.com>
1 parent b74c44e commit f93f493

8 files changed

+354
-19
lines changed

‎.changelog/11166.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note: enhancement
2+
compute: added `TDX` instance option to `confidential_instance_type` instance in `google_compute_instance`
3+
```

‎google/services/compute/resource_compute_instance.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1011,9 +1011,10 @@ be from 0 to 999,999,999 inclusive.`,
10111011
Type: schema.TypeString,
10121012
Optional: true,
10131013
Description: `
1014-
Specifies which confidential computing technology to use.
1015-
This could be one of the following values: SEV, SEV_SNP.
1016-
If SEV_SNP, min_cpu_platform = "AMD Milan" is currently required.`,
1014+
The confidential computing technology the instance uses.
1015+
SEV is an AMD feature. TDX is an Intel feature. One of the following
1016+
values is required: SEV, SEV_SNP, TDX. If SEV_SNP, min_cpu_platform =
1017+
"AMD Milan" is currently required. TDX is only available in beta.`,
10171018
AtLeastOneOf: []string{"confidential_instance_config.0.enable_confidential_compute", "confidential_instance_config.0.confidential_instance_type"},
10181019
},
10191020
},

‎google/services/compute/resource_compute_instance_from_template_test.go

Lines changed: 330 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,53 @@ func testAccCheckComputeInstanceFromTemplateDestroyProducer(t *testing.T) func(s
329329
}
330330
}
331331

332+
func TestAccComputeInstanceFromTemplate_confidentialInstanceConfigMain(t *testing.T) {
333+
t.Parallel()
334+
335+
var instance compute.Instance
336+
var instance2 compute.Instance
337+
338+
acctest.VcrTest(t, resource.TestCase{
339+
PreCheck: func() { acctest.AccTestPreCheck(t) },
340+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
341+
CheckDestroy: testAccCheckComputeInstanceFromTemplateDestroyProducer(t),
342+
Steps: []resource.TestStep{
343+
{
344+
Config: testAccComputeInstanceFromTemplate_confidentialInstanceConfigEnable(
345+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
346+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
347+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
348+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
349+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
350+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
351+
"SEV"),
352+
Check: resource.ComposeTestCheckFunc(
353+
testAccCheckComputeInstanceExists(t, "google_compute_instance_from_template.inst1", &instance),
354+
testAccCheckComputeInstanceHasConfidentialInstanceConfig(&instance, true, "SEV"),
355+
testAccCheckComputeInstanceExists(t, "google_compute_instance_from_template.inst2", &instance2),
356+
testAccCheckComputeInstanceHasConfidentialInstanceConfig(&instance2, true, ""),
357+
),
358+
},
359+
{
360+
Config: testAccComputeInstanceFromTemplate_confidentialInstanceConfigNoConfigSevSnp(
361+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
362+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
363+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
364+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
365+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
366+
fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
367+
"SEV_SNP"),
368+
Check: resource.ComposeTestCheckFunc(
369+
testAccCheckComputeInstanceExists(t, "google_compute_instance_from_template.inst1", &instance),
370+
testAccCheckComputeInstanceHasConfidentialInstanceConfig(&instance, false, "SEV_SNP"),
371+
testAccCheckComputeInstanceExists(t, "google_compute_instance_from_template.inst2", &instance2),
372+
testAccCheckComputeInstanceHasConfidentialInstanceConfig(&instance2, false, "SEV_SNP"),
373+
),
374+
},
375+
},
376+
})
377+
}
378+
332379
func testAccComputeInstanceFromTemplate_basic(instance, template string) string {
333380
return fmt.Sprintf(`
334381
data "google_compute_image" "my_image" {
@@ -1045,3 +1092,286 @@ resource "google_compute_instance_from_template" "inst" {
10451092
}
10461093
`, template, instance)
10471094
}
1095+
1096+
func testAccComputeInstanceFromTemplate_confidentialInstanceConfigEnable(templateDisk string, image string, template string, instance string, template2 string, instance2 string, confidentialInstanceType string) string {
1097+
return fmt.Sprintf(`
1098+
data "google_compute_image" "my_image1" {
1099+
family = "ubuntu-2004-lts"
1100+
project = "ubuntu-os-cloud"
1101+
}
1102+
1103+
resource "google_compute_disk" "foobar1" {
1104+
name = "%s"
1105+
image = data.google_compute_image.my_image1.self_link
1106+
size = 10
1107+
type = "pd-standard"
1108+
zone = "us-central1-a"
1109+
}
1110+
1111+
resource "google_compute_image" "foobar1" {
1112+
name = "%s"
1113+
source_disk = google_compute_disk.foobar1.self_link
1114+
}
1115+
1116+
resource "google_compute_instance_template" "foobar1" {
1117+
name = "%s"
1118+
machine_type = "n2d-standard-2"
1119+
1120+
disk {
1121+
source_image = google_compute_image.foobar1.name
1122+
auto_delete = true
1123+
boot = true
1124+
}
1125+
1126+
network_interface {
1127+
network = "default"
1128+
}
1129+
1130+
metadata = {
1131+
foo = "bar"
1132+
}
1133+
1134+
scheduling {
1135+
automatic_restart = false
1136+
on_host_maintenance = "TERMINATE"
1137+
}
1138+
1139+
confidential_instance_config {
1140+
enable_confidential_compute = true
1141+
confidential_instance_type = %q
1142+
}
1143+
}
1144+
1145+
resource "google_compute_instance_from_template" "inst1" {
1146+
name = "%s"
1147+
zone = "us-central1-a"
1148+
1149+
source_instance_template = google_compute_instance_template.foobar1.self_link
1150+
}
1151+
1152+
resource "google_compute_instance_template" "foobar2" {
1153+
name = "%s"
1154+
machine_type = "n2d-standard-2"
1155+
1156+
disk {
1157+
source_image = google_compute_image.foobar1.name
1158+
auto_delete = true
1159+
boot = true
1160+
}
1161+
1162+
network_interface {
1163+
network = "default"
1164+
}
1165+
1166+
metadata = {
1167+
foo = "bar"
1168+
}
1169+
1170+
scheduling {
1171+
automatic_restart = false
1172+
on_host_maintenance = "TERMINATE"
1173+
}
1174+
1175+
confidential_instance_config {
1176+
enable_confidential_compute = true
1177+
}
1178+
}
1179+
1180+
resource "google_compute_instance_from_template" "inst2" {
1181+
name = "%s"
1182+
zone = "us-central1-a"
1183+
1184+
source_instance_template = google_compute_instance_template.foobar2.self_link
1185+
}
1186+
`, templateDisk, image, template, confidentialInstanceType, instance, template2, instance2)
1187+
}
1188+
1189+
func testAccComputeInstanceFromTemplate_confidentialInstanceConfigNoConfigSevSnp(templateDisk string, image string, template string, instance string, template2 string, instance2 string, confidentialInstanceType string) string {
1190+
return fmt.Sprintf(`
1191+
data "google_compute_image" "my_image1" {
1192+
family = "ubuntu-2004-lts"
1193+
project = "ubuntu-os-cloud"
1194+
}
1195+
1196+
resource "google_compute_disk" "foobar1" {
1197+
name = "%s"
1198+
image = data.google_compute_image.my_image1.self_link
1199+
size = 10
1200+
type = "pd-standard"
1201+
zone = "us-central1-a"
1202+
}
1203+
1204+
resource "google_compute_image" "foobar1" {
1205+
name = "%s"
1206+
source_disk = google_compute_disk.foobar1.self_link
1207+
}
1208+
1209+
resource "google_compute_instance_template" "foobar3" {
1210+
name = "%s"
1211+
machine_type = "n2d-standard-2"
1212+
1213+
disk {
1214+
source_image = google_compute_image.foobar1.name
1215+
auto_delete = true
1216+
boot = true
1217+
}
1218+
1219+
network_interface {
1220+
network = "default"
1221+
}
1222+
1223+
metadata = {
1224+
foo = "bar"
1225+
}
1226+
1227+
scheduling {
1228+
automatic_restart = false
1229+
on_host_maintenance = "TERMINATE"
1230+
}
1231+
1232+
confidential_instance_config {
1233+
enable_confidential_compute = false
1234+
confidential_instance_type = %q
1235+
}
1236+
}
1237+
1238+
resource "google_compute_instance_from_template" "inst1" {
1239+
name = "%s"
1240+
zone = "us-central1-a"
1241+
1242+
source_instance_template = google_compute_instance_template.foobar3.self_link
1243+
}
1244+
1245+
resource "google_compute_instance_template" "foobar4" {
1246+
name = "%s"
1247+
machine_type = "n2d-standard-2"
1248+
1249+
disk {
1250+
source_image = google_compute_image.foobar1.name
1251+
auto_delete = true
1252+
boot = true
1253+
}
1254+
1255+
network_interface {
1256+
network = "default"
1257+
}
1258+
1259+
metadata = {
1260+
foo = "bar"
1261+
}
1262+
1263+
scheduling {
1264+
automatic_restart = false
1265+
on_host_maintenance = "TERMINATE"
1266+
}
1267+
1268+
confidential_instance_config {
1269+
confidential_instance_type = %q
1270+
}
1271+
}
1272+
1273+
resource "google_compute_instance_from_template" "inst2" {
1274+
name = "%s"
1275+
zone = "us-central1-a"
1276+
1277+
source_instance_template = google_compute_instance_template.foobar4.self_link
1278+
}
1279+
`, templateDisk, image, template, confidentialInstanceType, instance, template2, confidentialInstanceType, instance2)
1280+
}
1281+
1282+
func testAccComputeInstanceFromTemplate_confidentialInstanceConfigNoConfigTdx(templateDisk string, image string, template string, instance string, template2 string, instance2 string, confidentialInstanceType string) string {
1283+
return fmt.Sprintf(`
1284+
data "google_compute_image" "my_image2" {
1285+
family = "ubuntu-2204-lts"
1286+
project = "tdx-guest-images"
1287+
}
1288+
1289+
resource "google_compute_disk" "foobar2" {
1290+
name = "%s"
1291+
image = data.google_compute_image.my_image2.self_link
1292+
size = 10
1293+
type = "pd-balanced"
1294+
zone = "us-central1-a"
1295+
}
1296+
1297+
resource "google_compute_image" "foobar2" {
1298+
name = "%s"
1299+
source_disk = google_compute_disk.foobar2.self_link
1300+
}
1301+
1302+
resource "google_compute_instance_template" "foobar5" {
1303+
name = "%s"
1304+
machine_type = "c3-standard-4"
1305+
1306+
disk {
1307+
source_image = google_compute_image.foobar2.name
1308+
auto_delete = true
1309+
boot = true
1310+
disk_type = "pd-balanced"
1311+
type = "PERSISTENT"
1312+
}
1313+
1314+
network_interface {
1315+
network = "default"
1316+
}
1317+
1318+
metadata = {
1319+
foo = "bar"
1320+
}
1321+
1322+
scheduling {
1323+
automatic_restart = false
1324+
on_host_maintenance = "TERMINATE"
1325+
}
1326+
1327+
confidential_instance_config {
1328+
enable_confidential_compute = false
1329+
confidential_instance_type = %q
1330+
}
1331+
}
1332+
1333+
resource "google_compute_instance_from_template" "inst1" {
1334+
name = "%s"
1335+
zone = "us-central1-a"
1336+
1337+
source_instance_template = google_compute_instance_template.foobar5.self_link
1338+
}
1339+
1340+
resource "google_compute_instance_template" "foobar6" {
1341+
name = "%s"
1342+
machine_type = "c3-standard-4"
1343+
1344+
disk {
1345+
source_image = google_compute_image.foobar2.name
1346+
auto_delete = true
1347+
boot = true
1348+
disk_type = "pd-balanced"
1349+
type = "PERSISTENT"
1350+
}
1351+
1352+
network_interface {
1353+
network = "default"
1354+
}
1355+
1356+
metadata = {
1357+
foo = "bar"
1358+
}
1359+
1360+
scheduling {
1361+
automatic_restart = false
1362+
on_host_maintenance = "TERMINATE"
1363+
}
1364+
1365+
confidential_instance_config {
1366+
confidential_instance_type = %q
1367+
}
1368+
}
1369+
1370+
resource "google_compute_instance_from_template" "inst2" {
1371+
name = "%s"
1372+
zone = "us-central1-a"
1373+
1374+
source_instance_template = google_compute_instance_template.foobar6.self_link
1375+
}
1376+
`, templateDisk, image, template, confidentialInstanceType, instance, template2, confidentialInstanceType, instance2)
1377+
}

‎google/services/compute/resource_compute_instance_template.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -866,9 +866,10 @@ be from 0 to 999,999,999 inclusive.`,
866866
Optional: true,
867867
ForceNew: true,
868868
Description: `
869-
Specifies which confidential computing technology to use.
870-
This could be one of the following values: SEV, SEV_SNP.
871-
If SEV_SNP, min_cpu_platform = "AMD Milan" is currently required.`,
869+
The confidential computing technology the instance uses.
870+
SEV is an AMD feature. TDX is an Intel feature. One of the following
871+
values is required: SEV, SEV_SNP, TDX. If SEV_SNP, min_cpu_platform =
872+
"AMD Milan" is currently required. TDX is only available in beta.`,
872873
AtLeastOneOf: []string{"confidential_instance_config.0.enable_confidential_compute", "confidential_instance_config.0.confidential_instance_type"},
873874
},
874875
},
@@ -958,7 +959,7 @@ be from 0 to 999,999,999 inclusive.`,
958959
Elem: &schema.Schema{Type: schema.TypeString},
959960
Set: schema.HashString,
960961
Description: `A set of key/value label pairs to assign to instances created from this template.
961-
962+
962963
**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
963964
Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
964965
},

‎google/services/compute/resource_compute_region_instance_template.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -924,7 +924,7 @@ be from 0 to 999,999,999 inclusive.`,
924924
Elem: &schema.Schema{Type: schema.TypeString},
925925
Set: schema.HashString,
926926
Description: `A set of key/value label pairs to assign to instances created from this template,
927-
927+
928928
**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
929929
Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
930930
},

0 commit comments

Comments
 (0)