Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-18 03:30:18 -04:00
Code Issues Projects Releases Packages Wiki Activity

terraform: enable creation of SEV-SNP VMs on GCP

Browse source
This commit is contained in:
Moritz Sanft 2024-04-04 16:30:35 +02:00
parent f189aa186f
commit 667e04193d
No known key found for this signature in database
GPG key ID: 335D28368B1DA615
8 changed files with 91 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

16
terraform/infrastructure/gcp/modules/instance_group/main.tf
View file

@ -2,7 +2,12 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = "5.17.0"
version = "5.23.0"
}
google-beta = {
source = "hashicorp/google-beta"
version = "5.23.0"
}
random = {
@ -23,6 +28,10 @@ resource "random_id" "uid" {
}
resource "google_compute_instance_template" "template" {
# Beta provider is necessary to set confidential instance types.
# TODO(msanft): Remove beta provider once confidential instance type setting is in GA.
provider = google-beta
name = local.name
machine_type = var.instance_type
tags = ["constellation-${var.uid}"] // Note that this is also applied as a label
@ -33,8 +42,13 @@ resource "google_compute_instance_template" "template" {
confidential_instance_config {
enable_confidential_compute = true
confidential_instance_type = var.cc_technology
}
# If SEV-SNP is used, we have to explicitly select a Milan processor, as per
# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance_template#confidential_instance_type
min_cpu_platform = var.cc_technology == "SEV_SNP" ? "AMD Milan" : null
disk {
disk_size_gb = 10
source_image = var.image_id

9
terraform/infrastructure/gcp/modules/instance_group/variables.tf
View file

@ -99,3 +99,12 @@ variable "custom_endpoint" {
type = string
description = "Custom endpoint to use for the Kubernetes API server. If not set, the default endpoint will be used."
}
variable "cc_technology" {
type = string
description = "The confidential computing technology to use for the nodes. One of `SEV`, `SEV_SNP`."
validation {
condition = contains(["SEV", "SEV_SNP"], var.cc_technology)
error_message = "The confidential computing technology has to be 'SEV' or 'SEV_SNP'."
}
}