diff --git a/README.md b/README.md index da942ab..8b40e94 100644 --- a/README.md +++ b/README.md @@ -266,9 +266,11 @@ No modules. | [boot\_image\_family](#input\_boot\_image\_family) | The image from which to initialize this disk | `string` | `"ubuntu-2204-lts"` | no | | [boot\_image\_project](#input\_boot\_image\_project) | The ID of the project in which the source image resides. | `string` | `"ubuntu-os-cloud"` | no | | [can\_ip\_forward](#input\_can\_ip\_forward) | Conditional that allows sending and receiving of packets with non-matching source or destination IPs. | `bool` | `false` | no | +| [confidential\_instance\_type](#input\_confidential\_instance\_type) | n/a | `string` | `null` | no | | [deletion\_protection](#input\_deletion\_protection) | Enable deletion protection on this instance | `bool` | `false` | no | | [description](#input\_description) | A brief description of this resource | `string` | `"Intel accelerated virtual machine."` | no | | [desired\_status](#input\_desired\_status) | Desired status of the instance. | `string` | `"RUNNING"` | no | +| [enable\_confidential\_compute](#input\_enable\_confidential\_compute) | n/a | `bool` | `false` | no | | [enable\_integrity\_monitoring](#input\_enable\_integrity\_monitoring) | Compare the most recent boot measurements to the integrity policy baseline and return a pair of pass/fail results depending on whether they match or not. | `bool` | `true` | no | | [enable\_nested\_virtualization](#input\_enable\_nested\_virtualization) | Boolean that specifies if nested virtualization should be enabled or disabled on the instance. | `bool` | `false` | no | | [enable\_secure\_boot](#input\_enable\_secure\_boot) | Verify the digital signature of all boot components, and halt the boot process if signature verification fails. | `bool` | `false` | no | diff --git a/examples/gcp-linux-tdx-vm/README.md b/examples/gcp-linux-tdx-vm/README.md new file mode 100644 index 0000000..a040206 --- /dev/null +++ b/examples/gcp-linux-tdx-vm/README.md @@ -0,0 +1,64 @@ +

+ Intel Logo +

+ +# Intel Cloud Optimization Modules for Terraform + +© Copyright 2023, Intel Corporation + +## Intel GCP VM on default network + +This module creates a Intel Confiddential Compute Linux VM on the default network with Intel Xeon 4th Generation Scalable processors (code-named Sapphire Rapids) VM with Confidential Computing and Intel Trust Domain Extension (Intel TDX) technology. + +Update the project with a your project id in GCP. It is located on the variables.tf file under this example folder for "GCP-Linux-VM" + +## Usage + +**See examples folder for complete examples.** + +variables.tf + +```hcl +variable "project" { + type = string + description = "The ID of the project in which the resource resides." +} +``` + +main.tf +```hcl +# You will need to provide value of the variable project, which is your GCP project id when you do terraform apply + +module "linux_vm" { + source = "intel/gcp-vm/intel" + project = var.project + name = "intel-tdx-linux01" + + #required for Intel Confidential Compute VM with TDX + enable_confidential_compute = var.enable_confidential_compute + confidential_instance_type = var.confidential_instance_type + on_host_maintenance = "TERMINATE" + + access_config = [{ + nat_ip = null + public_ptr_domain_name = null + network_tier = "PREMIUM" + }, ] +} +``` + + + +Run Terraform + +```hcl +terraform init +terraform plan +terraform apply -var="project=" +``` + +## Considerations +Add additional considerations here: +- The GCP zone can be updated in the providers.tf file under this example folder for "GCP-Linux-VM" +- Update the project with a your project id in GCP. It is located on the variables.tf file under this example folder for "GCP-Linux-VM" +- The VM is created using the default network in the GCP zone configured in the providers.tf file. Please make sure you have a default network in the GCP zone of your choice diff --git a/examples/gcp-linux-tdx-vm/main.tf b/examples/gcp-linux-tdx-vm/main.tf new file mode 100644 index 0000000..0afbf16 --- /dev/null +++ b/examples/gcp-linux-tdx-vm/main.tf @@ -0,0 +1,26 @@ +# -------------------------------------------------------- +# _ _ _ +# (_) | | | | +# _ _ __ | |_ ___| | +# | | '_ \| __/ _ \ | +# | | | | | || __/ | +# |_|_| |_|\__\___|_| +# -------------------------------------------------------- +# Provision GCP virtual machine on Intel Xeon 4th Generation Scalable processors (code-named Sapphire Rapids) VM which supports Confidential Computing with Intel Trust Domain Extension (Intel TDX) technology +# You will need to provide value of the variable project, which is your GCP project id when you do terraform apply +module "linux_vm" { + source = "intel/gcp-vm/intel" + project = var.project + name = "intel-tdx-linux01" + + #required for Intel Confidential Compute VM with TDX + enable_confidential_compute = var.enable_confidential_compute + confidential_instance_type = var.confidential_instance_type + on_host_maintenance = "TERMINATE" + + access_config = [{ + nat_ip = null + public_ptr_domain_name = null + network_tier = "PREMIUM" + }, ] +} diff --git a/examples/gcp-linux-tdx-vm/outputs.tf b/examples/gcp-linux-tdx-vm/outputs.tf new file mode 100644 index 0000000..8121bf9 --- /dev/null +++ b/examples/gcp-linux-tdx-vm/outputs.tf @@ -0,0 +1,62 @@ +output "cpu_platform" { + value = module.linux_vm.cpu_platform + description = "The CPU platform of the VM instance" +} + +output "current_status" { + value = module.linux_vm.current_status + description = "Current status of the VM instance" +} + +output "id" { + value = module.linux_vm.id + description = "An identifier for the resource" +} + +output "instance_id" { + value = module.linux_vm.instance_id + description = "The server-assigned unique identifier of this instance" +} + +output "machine_type" { + value = module.linux_vm.machine_type + description = "Type of the machine created" +} + +output "min_cpu_platform" { + value = module.linux_vm.min_cpu_platform + description = "Minimum CPU platform for the VM instance" +} + +output "name" { + value = module.linux_vm.name + description = "Unique name of the instance created" +} + +output "self_link" { + value = module.linux_vm.self_link + description = "The URI of the created resource" +} + +output "boot_disk_size" { + value = module.linux_vm.boot_disk_size + description = "Size of the boot disk of the instance" +} + + + + + + + + + + + + + + + + + + diff --git a/examples/gcp-linux-tdx-vm/providers.tf b/examples/gcp-linux-tdx-vm/providers.tf new file mode 100644 index 0000000..12d1310 --- /dev/null +++ b/examples/gcp-linux-tdx-vm/providers.tf @@ -0,0 +1,3 @@ +provider "google" { + zone = "us-central1-a" +} \ No newline at end of file diff --git a/examples/gcp-linux-tdx-vm/variables.tf b/examples/gcp-linux-tdx-vm/variables.tf new file mode 100644 index 0000000..d42e8b1 --- /dev/null +++ b/examples/gcp-linux-tdx-vm/variables.tf @@ -0,0 +1,17 @@ +variable "project" { + type = string + description = "The ID of the project in which the resource resides." +} + +#required for Intel Confidential Compute VM with TDX +variable "enable_confidential_compute" { + description = "Enable confidential computing" + type = bool + default = true +} + +variable "confidential_instance_type" { + description = "Type of confidential instance" + type = string + default = "TDX" +} diff --git a/main.tf b/main.tf index 715ef4c..7599d87 100644 --- a/main.tf +++ b/main.tf @@ -63,6 +63,12 @@ resource "google_compute_instance" "instance" { } } + #Required for optional Intel Confidential Compute with TDX +confidential_instance_config { + enable_confidential_compute = var.enable_confidential_compute + confidential_instance_type = var.confidential_instance_type + } + # Networking can_ip_forward = var.can_ip_forward network_interface { diff --git a/variables.tf b/variables.tf index 1a4adf0..679c23b 100644 --- a/variables.tf +++ b/variables.tf @@ -285,4 +285,14 @@ variable "user_data" { type = string description = "User data to be placed on the instance. Used to place cloud-init on VMs" default = null +} + +variable "enable_confidential_compute" { + type = bool + default = false +} + +variable "confidential_instance_type" { + type = string + default = null } \ No newline at end of file