Configuring Google Cloud features for control plane machines - Managing control plane machines | Machine management

Configuring persistent disk types by using machine sets
Configuring Confidential VM by using machine sets
Configuring Shielded VM options by using machine sets
Enabling customer-managed encryption keys for a machine set
Additional resources

You can enable or change the configuration of features for your control plane machines by editing values in the control plane machine set specification.

When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy. For more information, see "Updating the control plane configuration".

Configuring persistent disk types by using machine sets

Configure the persistent disk type for your machine set on Google Cloud to match your workload requirements. Editing the MachineSet YAML file allows you to choose between standard, balanced, or SSD persistent disks.

For more information about persistent disk types, compatibility, regional availability, and limitations, see the Google Cloud Compute Engine documentation about persistent disks.

Procedure

In a text editor, open the YAML file for an existing machine set or create a new one.

Edit the following line under the providerSpec field:

apiVersion: machine.openshift.io/v1
kind: ControlPlaneMachineSet
...
spec:
  template:
    spec:
      providerSpec:
        value:
          disks:
            type: pd-ssd

where:

spec.template.spec.providerSpec.value.disks.type: Uses the pd-ssd disk type for control plane nodes. Using the pd-ssd disk type is required for control plane nodes.

Verification

Using the Google Cloud console, review the details for a machine deployed by the machine set and verify that the Type field matches the configured disk type.

Configuring Confidential VM by using machine sets

You create machine sets to scale clusters on Google Cloud. By editing the machine set YAML file, you can configure the Confidential VM options that a machine set uses for machines that it deploys.

For more information about Confidential VM features, functions, and compatibility, see the Google Cloud Compute Engine documentation about Confidential VM.

Confidential VMs are currently not supported on 64-bit ARM architectures. If you use Confidential VM, you must ensure that you select a supported region. For details on supported regions and configurations, see the Google Cloud Compute Engine documentation about supported zones.

Procedure

In a text editor, open the YAML file for an existing machine set or create a new one.
Edit the following section under the providerSpec field:
```
apiVersion: machine.openshift.io/v1
kind: ControlPlaneMachineSet
# ...
    machines_v1beta1_machine_openshift_io:
      spec:
        providerSpec:
          value:
            confidentialCompute: Enabled
            onHostMaintenance: Terminate
            machineType: n2d-standard-8
# ...
```
where:

spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.confidentialCompute

Specifies whether Confidential VM is enabled. The following values are valid:

Enabled

Enables Confidential VM with a default selection of Confidential VM technology. The default selection is AMD Secure Encrypted Virtualization (AMD SEV).

The Enabled value selects Confidential Computing with AMD Secure Encrypted Virtualization (AMD SEV), which is deprecated.

Disabled

Disables Confidential VM.

AMDEncryptedVirtualizationNestedPaging

Enables Confidential VM using AMD Secure Encrypted Virtualization Secure Nested Paging (AMD SEV-SNP). AMD SEV-SNP supports n2d machines.

AMDEncryptedVirtualization

Enables Confidential VM using AMD SEV. AMD SEV supports c2d, n2d, and c3d machines.

The use of Confidential Computing with AMD Secure Encrypted Virtualization (AMD SEV) has been deprecated and will be removed in a future release.

IntelTrustedDomainExtensions

Enables Confidential VM using Intel Trusted Domain Extensions (Intel TDX). Intel TDX supports n2d machines.

spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.onHostMaintenance

Specifies the behavior of the VM during a host maintenance event, such as a hardware or software update. For a machine that uses Confidential VM, this value must be set to Terminate, which stops the VM. Confidential VM does not support live VM migration.

spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.machineType

Specifies a machine type that supports the Confidential VM option that you specified in the confidentialCompute field.

Verification

On the Google Cloud console, review the details for a machine deployed by the machine set and verify that the Confidential VM options match the values that you configured.

Configuring Shielded VM options by using machine sets

Configure Shielded Virtual Machine (VM) options for your machine sets on Google Cloud to help secure your cluster instances. By editing the MachineSet YAML file, you can configure the Shielded VM options that a machine set uses for machines that it deploys.

For more information about Shielded VM features and functionality, see the Google Cloud Compute Engine documentation about Shielded VM.

Procedure

In a text editor, open the YAML file for an existing machine set or create a new one.
Edit the following section under the providerSpec field:
```
apiVersion: machine.openshift.io/v1
kind: ControlPlaneMachineSet
# ...
spec:
  template:
    spec:
      providerSpec:
        value:
          shieldedInstanceConfig:
            integrityMonitoring: Enabled
            secureBoot: Disabled
            virtualizedTrustedPlatformModule: Enabled
# ...
```
where:

spec.template.spec.providerSpec.value.shieldedInstanceConfig

Specifies the Shielded VM configuration.

spec.template.spec.providerSpec.value.shieldedInstanceConfig.integrityMonitoring

Specifies whether integrity monitoring is enabled. Valid values are Disabled or Enabled.

When integrity monitoring is enabled, you must not disable virtual trusted platform module (vTPM).

spec.template.spec.providerSpec.value.shieldedInstanceConfig.secureBoot

Specifies whether UEFI Secure Boot is enabled. Valid values are Disabled or Enabled.

spec.template.spec.providerSpec.value.shieldedInstanceConfig.virtualizedTrustedPlatformModule

Specifies whether vTPM is enabled. Valid values are Disabled or Enabled.

Verification

Using the Google Cloud console, review the details for a machine deployed by the machine set and verify that the Shielded VM options match the values that you configured.

Additional resources

Enabling customer-managed encryption keys for a machine set

Use Google Cloud Compute Engine to supply an encryption key to encrypt data on disks at rest. The key is used to encrypt the data encryption key, not to encrypt the customer’s data. By default, Compute Engine encrypts this data by using Compute Engine keys.

You can enable encryption with a customer-managed key in clusters that use the Machine API. You must first create a KMS key and assign the correct permissions to a service account. The KMS key name, key ring name, and location are required to allow a service account to use your key.

If you do not want to use a dedicated service account for the KMS encryption, the Compute Engine default service account is used instead. You must grant the default service account permission to access the keys if you do not use a dedicated service account. The Compute Engine default service account name follows the service-<project_number>@compute-system.iam.gserviceaccount.com pattern.

Procedure

To allow a specific service account to use your KMS key and to grant the service account the correct IAM role, run the following command with your KMS key name, key ring name, and location:

$ gcloud kms keys add-iam-policy-binding <key_name> \
  --keyring <key_ring_name> \
  --location <key_ring_location> \
  --member "serviceAccount:service-<project_number>@compute-system.iam.gserviceaccount.com” \
  --role roles/cloudkms.cryptoKeyEncrypterDecrypter

Configure the encryption key under the providerSpec field in your machine set YAML file. For example:
```
apiVersion: machine.openshift.io/v1
kind: ControlPlaneMachineSet
...
spec:
  template:
    spec:
      providerSpec:
        value:
          disks:
          - type:
            encryptionKey:
              kmsKey:
                name: machine-encryption-key
                keyRing: openshift-encryption-ring
                location: global
                projectID: openshift-gcp-project
              kmsKeyServiceAccount: openshift-service-account@openshift-gcp-project.iam.gserviceaccount.com
```
where:

spec.template.spec.providerSpec.value.disks.type.encryptionKey.kmsKey.name

Specifies the name of the customer-managed encryption key that is used for the disk encryption.

spec.template.spec.providerSpec.value.disks.type.encryptionKey.kmsKey.keyRing

Specifies the name of the KMS key ring that the KMS key belongs to.

spec.template.spec.providerSpec.value.disks.type.encryptionKey.kmsKey.location

Specifies the Google Cloud location in which the KMS key ring exists.

spec.template.spec.providerSpec.value.disks.type.encryptionKey.kmsKey.projectID

Optional: Specifies the ID of the project in which the KMS key ring exists. If a project ID is not set, the machine set projectID in which the machine set was created is used.

spec.template.spec.providerSpec.value.disks.type.encryptionKey.kmsKeyServiceAccount

Optional: Specifies the service account that is used for the encryption request for the given KMS key. If a service account is not set, the Compute Engine default service account is used.

When a new machine is created by using the updated providerSpec object configuration, the disk encryption key is encrypted with the KMS key.