feat: add autopilot confidential nodes example #2289
Conversation
arthurlapertosa
requested review from
apeabody,
ericyz and
a team
as code owners
| "state" : "ENCRYPTED" | ||
| } | ||
| ] | ||
|
|
There was a problem hiding this comment.
consider a way to specify a persistent volume claim using Confidential mode for Hyperdisk.
https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes#creating_chd_pv
There was a problem hiding this comment.
Hey, @erlanderlo. Thanks for the review! I didn't find a way to specify a persistent volume claim using confidential mode for hyperdisk. I took a look at https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#gce_persistent_disk_csi_driver_config-1 but it doesn't appear to have a way to specify that gce_persistent_disk_csi_driver_config be on Confidential mode.
We can create the boot disk to be Hyperdisk-balanced (https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#disk_type-1), but also, I couldn't find a way to specify that it must be Confidential.
Would you know how to specify the hyperdisk to be confidential? When enabling Confidential GKE nodes, doesn't it automatically makes the disk Confidential?
There was a problem hiding this comment.
I believe you can create the storage class and then create PVCs using confidential mode, if they are using the specified storage class
resource "kubernetes_storage_class" "balanced_storage" {
metadata {
name = "balanced-storage"
}
provisioner = "pd.csi.storage.gke.io"
volume_binding_mode = "WaitForFirstConsumer"
allow_volume_expansion = true
parameters = {
type = "hyperdisk-balanced"
provisioned-throughput-on-create = "250Mi"
provisioned-iops-on-create = "7000"
enable-confidential-storage = "true"
disk-encryption-kms-key = "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME"
}
}There was a problem hiding this comment.
The example adding a confidential hyperdisk is: #2311.
Do you think it's a good ideia to add a hyperdisk here too?
Is it possible to manually add node pools to GKE autopilot?
There was a problem hiding this comment.
@arthurlapertosa - Let me know when this PR is ready for re-review. Thanks!
arthurlapertosa
force-pushed
the
confidential-autopilot-example
branch
from
c91e999 to
e3cf206
Compare
|
@apeabody this PR is ready for a re-review. Thanks! |
|
Hi @arthurlapertosa - Can you please run |
No description provided.