Skip to content

Commit 51b6a13

Browse files
steenbliksteenblik
authored
Add confidential compute support to google_dataproc_cluster (#12397)
1 parent 545ef44 commit 51b6a13

File tree

3 files changed

+117
-0
lines changed

3 files changed

+117
-0
lines changed

‎mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go

+39
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ var (
6262
"cluster_config.0.gce_cluster_config.0.metadata",
6363
"cluster_config.0.gce_cluster_config.0.reservation_affinity",
6464
"cluster_config.0.gce_cluster_config.0.node_group_affinity",
65+
"cluster_config.0.gce_cluster_config.0.confidential_instance_config",
6566
}
6667

6768
schieldedInstanceConfigKeys = []string{
@@ -76,6 +77,10 @@ var (
7677
"cluster_config.0.gce_cluster_config.0.reservation_affinity.0.values",
7778
}
7879

80+
confidentialInstanceConfigKeys = []string{
81+
"cluster_config.0.gce_cluster_config.0.confidential_instance_config.0.enable_confidential_compute",
82+
}
83+
7984
masterDiskConfigKeys = diskConfigKeys("master_config")
8085
workerDiskConfigKeys = diskConfigKeys("worker_config")
8186
preemptibleWorkerDiskConfigKeys = diskConfigKeys("preemptible_worker_config")
@@ -757,6 +762,26 @@ func ResourceDataprocCluster() *schema.Resource {
757762
},
758763
},
759764
},
765+
"confidential_instance_config": {
766+
Type: schema.TypeList,
767+
Optional: true,
768+
AtLeastOneOf: gceClusterConfigKeys,
769+
Computed: true,
770+
MaxItems: 1,
771+
Description: `Confidential Instance Config for clusters using Compute Engine Confidential VMs.`,
772+
Elem: &schema.Resource{
773+
Schema: map[string]*schema.Schema{
774+
"enable_confidential_compute": {
775+
Type: schema.TypeBool,
776+
Optional: true,
777+
Default: false,
778+
AtLeastOneOf: confidentialInstanceConfigKeys,
779+
ForceNew: true,
780+
Description: `Defines whether the instance should have confidential compute enabled.`,
781+
},
782+
},
783+
},
784+
},
760785
},
761786
},
762787
},
@@ -2246,6 +2271,13 @@ func expandGceClusterConfig(d *schema.ResourceData, config *transport_tpg.Config
22462271
conf.NodeGroupAffinity.NodeGroupUri = v.(string)
22472272
}
22482273
}
2274+
if v, ok := d.GetOk("cluster_config.0.gce_cluster_config.0.confidential_instance_config"); ok {
2275+
cfgCic := v.([]interface{})[0].(map[string]interface{})
2276+
conf.ConfidentialInstanceConfig = &dataproc.ConfidentialInstanceConfig{}
2277+
if v, ok := cfgCic["enable_confidential_compute"]; ok {
2278+
conf.ConfidentialInstanceConfig.EnableConfidentialCompute = v.(bool)
2279+
}
2280+
}
22492281
return conf, nil
22502282
}
22512283

@@ -3194,6 +3226,13 @@ func flattenGceClusterConfig(d *schema.ResourceData, gcc *dataproc.GceClusterCon
31943226
},
31953227
}
31963228
}
3229+
if gcc.ConfidentialInstanceConfig != nil {
3230+
gceConfig["confidential_instance_config"] = []map[string]interface{}{
3231+
{
3232+
"enable_confidential_compute": gcc.ConfidentialInstanceConfig.EnableConfidentialCompute,
3233+
},
3234+
}
3235+
}
31973236

31983237
return []map[string]interface{}{gceConfig}
31993238
}

‎mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_test.go.tmpl

+75
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,51 @@ func TestAccDataprocCluster_withInternalIpOnlyTrueAndShieldedConfig(t *testing.T
256256
})
257257
}
258258

259+
func TestAccDataprocCluster_withConfidentialCompute(t *testing.T) {
260+
t.Parallel()
261+
262+
var cluster dataproc.Cluster
263+
rnd := acctest.RandString(t, 10)
264+
networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
265+
subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
266+
acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
267+
imageUri := "https://www.googleapis.com/compute/v1/projects/cloud-dataproc/global/images/dataproc-2-1-ubu20-20241026-165100-rc01"
268+
269+
acctest.VcrTest(t, resource.TestCase{
270+
PreCheck: func() { acctest.AccTestPreCheck(t) },
271+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
272+
CheckDestroy: testAccCheckDataprocClusterDestroy(t),
273+
Steps: []resource.TestStep{
274+
{
275+
Config: testAccDataprocCluster_withConfidentialCompute(rnd, subnetworkName, imageUri),
276+
Check: resource.ComposeTestCheckFunc(
277+
testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.confidential", &cluster),
278+
279+
// Check confidential compute
280+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
281+
"cluster_config.0.gce_cluster_config.0.confidential_instance_config.0.enable_confidential_compute", "true"),
282+
283+
// Check master
284+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
285+
"cluster_config.0.master_config.0.machine_type", "n2d-standard-2"),
286+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
287+
"cluster_config.0.master_config.0.image_uri", imageUri),
288+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
289+
"cluster_config.0.master_config.0.min_cpu_platform", "AMD Rome"),
290+
291+
// Check worker
292+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
293+
"cluster_config.0.worker_config.0.machine_type", "n2d-standard-2"),
294+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
295+
"cluster_config.0.worker_config.0.image_uri", imageUri),
296+
resource.TestCheckResourceAttr("google_dataproc_cluster.confidential",
297+
"cluster_config.0.worker_config.0.min_cpu_platform", "AMD Rome"),
298+
),
299+
},
300+
},
301+
})
302+
}
303+
259304
func TestAccDataprocCluster_withMetadataAndTags(t *testing.T) {
260305
t.Parallel()
261306

@@ -1538,6 +1583,36 @@ resource "google_dataproc_cluster" "basic" {
15381583
`, rnd, rnd, rnd, rnd)
15391584
}
15401585

1586+
func testAccDataprocCluster_withConfidentialCompute(rnd, subnetworkName string, imageUri string) string {
1587+
return fmt.Sprintf(`
1588+
resource "google_dataproc_cluster" "confidential" {
1589+
name = "tf-test-dproc-%s"
1590+
region = "us-central1"
1591+
1592+
cluster_config {
1593+
gce_cluster_config {
1594+
subnetwork = "%s"
1595+
confidential_instance_config {
1596+
enable_confidential_compute = true
1597+
}
1598+
}
1599+
1600+
master_config {
1601+
machine_type = "n2d-standard-2"
1602+
image_uri = "%s"
1603+
min_cpu_platform = "AMD Rome"
1604+
}
1605+
1606+
worker_config {
1607+
machine_type = "n2d-standard-2"
1608+
image_uri = "%s"
1609+
min_cpu_platform = "AMD Rome"
1610+
}
1611+
}
1612+
}
1613+
`, rnd, subnetworkName, imageUri, imageUri)
1614+
}
1615+
15411616
func testAccDataprocCluster_withMetadataAndTags(rnd, subnetworkName string) string {
15421617
return fmt.Sprintf(`
15431618
resource "google_dataproc_cluster" "basic" {

‎mmv1/third_party/terraform/website/docs/r/dataproc_cluster.html.markdown

+3
Original file line numberDiff line numberDiff line change
@@ -448,6 +448,9 @@ resource "google_dataproc_cluster" "accelerated_cluster" {
448448
* `node_group_affinity` - (Optional) Node Group Affinity for sole-tenant clusters.
449449
* `node_group_uri` - (Required) The URI of a sole-tenant node group resource that the cluster will be created on.
450450

451+
* `confidential_instance_config` - (Optional) Confidential Instance Config for clusters using [Confidential VMs](https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/confidential-compute)
452+
* `enable_confidential_compute` - (Optional) Defines whether the instance should have confidential compute enabled.
453+
451454
* `shielded_instance_config` (Optional) Shielded Instance Config for clusters using [Compute Engine Shielded VMs](https://cloud.google.com/security/shielded-cloud/shielded-vm).
452455

453456
- - -

0 commit comments

Comments
 (0)