Skip to content

Commit

Permalink
confidentialCompute: Support TDX confidential computing machines
Browse files Browse the repository at this point in the history 
In a6e7d1a confidentialCompute was extended from Enabled/Disabled to
supporting explicit AMD SEV and AMD SEV-SNP configuration.

TDX is supported in c3 machine types in google cloud [0]. This patch
allows the user to add such instances to their clusters by declaring
confidentialCompute=IntelTrustedDomainExtensions.

[0] https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#all-confidential-vm-instances
  • Loading branch information
@bgartzi
bgartzi committed Feb 13, 2025
1 parent a6e7d1a commit 36236cc
Show file tree
Hide file tree
Showing 8 changed files with 145 additions and 1 deletion.
6 changes: 5 additions & 1 deletion api/v1beta1/gcpmachine_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,13 +138,16 @@ const (
ConfidentialComputePolicySEV ConfidentialComputePolicy = "AMDEncrytedVirtualization"
// ConfidentialComputePolicySEVSNP sets AMD SEV-SNP as the VM instance's confidential computing technology of choice.
ConfidentialComputePolicySEVSNP ConfidentialComputePolicy = "AMDEncrytedVirtualizationNestedPaging"
// ConfidentialComputePolicyTDX sets Intel TDX as the VM instance's confidential computing technology of choice.
ConfidentialComputePolicyTDX ConfidentialComputePolicy = "IntelTrustedDomainExtensions"
)

// Confidential VM Technology support depends on the configured machine types.
// reference: https://cloud.google.com/compute/confidential-vm/docs/os-and-machine-type#machine-type
var (
confidentialMachineSeriesSupportingSev = []string{"n2d", "c2d", "c3d"}
confidentialMachineSeriesSupportingSevsnp = []string{"n2d"}
confidentialMachineSeriesSupportingTdx = []string{"c3"}
)

// HostMaintenancePolicy represents the desired behavior ase of a host maintenance event.
Expand Down Expand Up @@ -347,9 +350,10 @@ type GCPMachineSpec struct {
// If Enabled, confidential computing will be configured and AMD Secure Encrypted Virtualization will be configured by default. That is subject to change over time. If using AMD Secure Encrypted Virtualization is vital, use AMDEncryptedVirtualization explicitly instead.
// If AMDEncryptedVirtualization, it will configure AMD Secure Encrypted Virtualization (AMD SEV) as the confidential computing technology.
// If AMDEncryptedVirtualizationNestedPaging, it will configure AMD Secure Encrypted Virtualization Secure Nested Paging (AMD SEV-SNP) as the confidential computing technology.
// If IntelTrustedDomainExtensions, it will configure Intel TDX as the confidential computing technology.
// If enabled (any value other than Disabled) OnHostMaintenance is required to be set to "Terminate".
// If omitted, the platform chooses a default, which is subject to change over time, currently that default is false.
// +kubebuilder:validation:Enum=Enabled;Disabled;AMDEncrytedVirtualization;AMDEncrytedVirtualizationNestedPaging
// +kubebuilder:validation:Enum=Enabled;Disabled;AMDEncrytedVirtualization;AMDEncrytedVirtualizationNestedPaging;IntelTrustedDomainExtensions
// +optional
ConfidentialCompute *ConfidentialComputePolicy `json:"confidentialCompute,omitempty"`

Expand Down
4 changes: 4 additions & 0 deletions api/v1beta1/gcpmachine_webhook.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,10 @@ func validateConfidentialCompute(spec GCPMachineSpec) error {
if !slices.Contains(confidentialMachineSeriesSupportingSevsnp, machineSeries) {
return fmt.Errorf("ConfidentialCompute %s requires any of the following machine series: %s. %s was found instead", *spec.ConfidentialCompute, strings.Join(confidentialMachineSeriesSupportingSevsnp, ", "), spec.InstanceType)
}
case ConfidentialComputePolicyTDX:
if !slices.Contains(confidentialMachineSeriesSupportingTdx, machineSeries) {
return fmt.Errorf("ConfidentialCompute %s requires any of the following machine series: %s. %s was found instead", *spec.ConfidentialCompute, strings.Join(confidentialMachineSeriesSupportingTdx, ", "), spec.InstanceType)
}
default:
return fmt.Errorf("invalid ConfidentialCompute %s", *spec.ConfidentialCompute)
}
Expand Down
23 changes: 23 additions & 0 deletions api/v1beta1/gcpmachine_webhook_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ func TestGCPMachine_ValidateCreate(t *testing.T) {
confidentialComputeEnabled := ConfidentialComputePolicyEnabled
confidentialComputeSEV := ConfidentialComputePolicySEV
confidentialComputeSEVSNP := ConfidentialComputePolicySEVSNP
confidentialComputeTDX := ConfidentialComputePolicyTDX
confidentialComputeFooBar := ConfidentialComputePolicy("foobar")
onHostMaintenanceTerminate := HostMaintenancePolicyTerminate
onHostMaintenanceMigrate := HostMaintenancePolicyMigrate
Expand Down Expand Up @@ -165,6 +166,28 @@ func TestGCPMachine_ValidateCreate(t *testing.T) {
},
wantErr: true,
},
{
name: "GCPMachine with explicit TDX ConfidentialInstanceType and supported machine type - valid",
GCPMachine: &GCPMachine{
Spec: GCPMachineSpec{
InstanceType: "c3-standard-4",
ConfidentialCompute: &confidentialComputeTDX,
OnHostMaintenance: &onHostMaintenanceTerminate,
},
},
wantErr: false,
},
{
name: "GCPMachine with explicit TDX ConfidentialInstanceType and unsupported machine type - invalid",
GCPMachine: &GCPMachine{
Spec: GCPMachineSpec{
InstanceType: "c3d-standard-4",
ConfidentialCompute: &confidentialComputeTDX,
OnHostMaintenance: &onHostMaintenanceTerminate,
},
},
wantErr: true,
},
{
name: "GCPMachine with RootDiskEncryptionKey KeyType Managed and Managed field set",
GCPMachine: &GCPMachine{
Expand Down
31 changes: 31 additions & 0 deletions api/v1beta1/gcpmachinetemplate_webhook_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ func TestGCPMachineTemplate_ValidateCreate(t *testing.T) {
confidentialComputeEnabled := ConfidentialComputePolicyEnabled
confidentialComputeSEV := ConfidentialComputePolicySEV
confidentialComputeSEVSNP := ConfidentialComputePolicySEVSNP
confidentialComputeTDX := ConfidentialComputePolicyTDX
onHostMaintenanceTerminate := HostMaintenancePolicyTerminate
onHostMaintenanceMigrate := HostMaintenancePolicyMigrate
tests := []struct {
Expand Down Expand Up @@ -197,6 +198,36 @@ func TestGCPMachineTemplate_ValidateCreate(t *testing.T) {
},
wantErr: true,
},
{
name: "GCPMachine with explicit TDX ConfidentialInstanceType and supported machine type - valid",
template: &GCPMachineTemplate{
Spec: GCPMachineTemplateSpec{
Template: GCPMachineTemplateResource{
Spec: GCPMachineSpec{
InstanceType: "c3-standard-4",
ConfidentialCompute: &confidentialComputeTDX,
OnHostMaintenance: &onHostMaintenanceTerminate,
},
},
},
},
wantErr: false,
},
{
name: "GCPMachine with explicit TDX ConfidentialInstanceType and unsupported machine type - invalid",
template: &GCPMachineTemplate{
Spec: GCPMachineTemplateSpec{
Template: GCPMachineTemplateResource{
Spec: GCPMachineSpec{
InstanceType: "c3d-standard-4",
ConfidentialCompute: &confidentialComputeTDX,
OnHostMaintenance: &onHostMaintenanceTerminate,
},
},
},
},
wantErr: true,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
Expand Down
2 changes: 2 additions & 0 deletions cloud/scope/machine.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -454,6 +454,8 @@ func (m *MachineScope) InstanceSpec(log logr.Logger) *compute.Instance {
instance.ConfidentialInstanceConfig.ConfidentialInstanceType = "SEV"
case infrav1.ConfidentialComputePolicySEVSNP:
instance.ConfidentialInstanceConfig.ConfidentialInstanceType = "SEV_SNP"
case infrav1.ConfidentialComputePolicyTDX:
instance.ConfidentialInstanceConfig.ConfidentialInstanceType = "TDX"
default:
}
}
Expand Down
76 changes: 76 additions & 0 deletions cloud/services/compute/instances/reconcile_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -647,6 +647,82 @@ func TestService_createOrGetInstance(t *testing.T) {
Zone: "us-central1-c",
},
},
{
name: "instance does not exist (should create instance) with confidential compute enabled and TDX confidential instance type specified",
scope: func() Scope {
machineScope.GCPMachine = getFakeGCPMachine()
hostMaintenancePolicyTerminate := infrav1.HostMaintenancePolicyTerminate
machineScope.GCPMachine.Spec.OnHostMaintenance = &hostMaintenancePolicyTerminate
confidentialInstTypeTDX := infrav1.ConfidentialComputePolicyTDX
machineScope.GCPMachine.Spec.ConfidentialCompute = &confidentialInstTypeTDX
return machineScope
},
mockInstance: &cloud.MockInstances{
ProjectRouter: &cloud.SingleProjectRouter{ID: "proj-id"},
Objects: map[meta.Key]*cloud.MockInstancesObj{},
},
want: &compute.Instance{
Name: "my-machine",
CanIpForward: true,
Disks: []*compute.AttachedDisk{
{
AutoDelete: true,
Boot: true,
InitializeParams: &compute.AttachedDiskInitializeParams{
DiskType: "zones/us-central1-c/diskTypes/pd-standard",
SourceImage: "projects/my-proj/global/images/family/capi-ubuntu-1804-k8s-v1-19",
ResourceManagerTags: map[string]string{},
Labels: map[string]string{
"foo": "bar",
},
},
},
},
Labels: map[string]string{
"capg-role": "node",
"capg-cluster-my-cluster": "owned",
"foo": "bar",
},
MachineType: "zones/us-central1-c/machineTypes",
Metadata: &compute.Metadata{
Items: []*compute.MetadataItems{
{
Key: "user-data",
Value: ptr.To[string]("Zm9vCg=="),
},
},
},
NetworkInterfaces: []*compute.NetworkInterface{
{
Network: "projects/my-proj/global/networks/default",
},
},
Params: &compute.InstanceParams{
ResourceManagerTags: map[string]string{},
},
SelfLink: "https://www.googleapis.com/compute/v1/projects/proj-id/zones/us-central1-c/instances/my-machine",
ConfidentialInstanceConfig: &compute.ConfidentialInstanceConfig{
EnableConfidentialCompute: true,
ConfidentialInstanceType: "TDX",
},
Scheduling: &compute.Scheduling{
OnHostMaintenance: strings.ToUpper(string(infrav1.HostMaintenancePolicyTerminate)),
},
ServiceAccounts: []*compute.ServiceAccount{
{
Email: "default",
Scopes: []string{"https://www.googleapis.com/auth/cloud-platform"},
},
},
Tags: &compute.Tags{
Items: []string{
"my-cluster-node",
"my-cluster",
},
},
Zone: "us-central1-c",
},
},
{
name: "instance does not exist (should create instance) with MIGRATE OnHostMaintenance",
scope: func() Scope {
Expand Down
2 changes: 2 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmachines.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -198,13 +198,15 @@ spec:
If Enabled, confidential computing will be configured and AMD Secure Encrypted Virtualization will be configured by default. That is subject to change over time. If using AMD Secure Encrypted Virtualization is vital, use AMDEncryptedVirtualization explicitly instead.
If AMDEncryptedVirtualization, it will configure AMD Secure Encrypted Virtualization (AMD SEV) as the confidential computing technology.
If AMDEncryptedVirtualizationNestedPaging, it will configure AMD Secure Encrypted Virtualization Secure Nested Paging (AMD SEV-SNP) as the confidential computing technology.
If IntelTrustedDomainExtensions, it will configure Intel TDX as the confidential computing technology.
If enabled (any value other than Disabled) OnHostMaintenance is required to be set to "Terminate".
If omitted, the platform chooses a default, which is subject to change over time, currently that default is false.
enum:
- Enabled
- Disabled
- AMDEncrytedVirtualization
- AMDEncrytedVirtualizationNestedPaging
- IntelTrustedDomainExtensions
type: string
image:
description: |-
Expand Down
2 changes: 2 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmachinetemplates.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -213,13 +213,15 @@ spec:
If Enabled, confidential computing will be configured and AMD Secure Encrypted Virtualization will be configured by default. That is subject to change over time. If using AMD Secure Encrypted Virtualization is vital, use AMDEncryptedVirtualization explicitly instead.
If AMDEncryptedVirtualization, it will configure AMD Secure Encrypted Virtualization (AMD SEV) as the confidential computing technology.
If AMDEncryptedVirtualizationNestedPaging, it will configure AMD Secure Encrypted Virtualization Secure Nested Paging (AMD SEV-SNP) as the confidential computing technology.
If IntelTrustedDomainExtensions, it will configure Intel TDX as the confidential computing technology.
If enabled (any value other than Disabled) OnHostMaintenance is required to be set to "Terminate".
If omitted, the platform chooses a default, which is subject to change over time, currently that default is false.
enum:
- Enabled
- Disabled
- AMDEncrytedVirtualization
- AMDEncrytedVirtualizationNestedPaging
- IntelTrustedDomainExtensions
type: string
image:
description: |-
Expand Down

0 comments on commit 36236cc

Please sign in to comment.