Skip to content

Commit e30432e

Browse files
ScottSuarezScottSuarez
authored
Adding shielded config values to dataproc_cluster (#4694)
1 parent 6f9d8d8 commit e30432e

File tree

3 files changed

+105
-6
lines changed

3 files changed

+105
-6
lines changed

‎mmv1/third_party/terraform/resources/resource_dataproc_cluster.go.erb‎

Lines changed: 69 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,16 @@ var (
3131
"cluster_config.0.gce_cluster_config.0.service_account",
3232
"cluster_config.0.gce_cluster_config.0.service_account_scopes",
3333
"cluster_config.0.gce_cluster_config.0.internal_ip_only",
34+
"cluster_config.0.gce_cluster_config.0.shielded_instance_config",
3435
"cluster_config.0.gce_cluster_config.0.metadata",
3536
}
3637

38+
schieldedInstanceConfigKeys = []string{
39+
"cluster_config.0.gce_cluster_config.0.shielded_instance_config.0.enable_secure_boot",
40+
"cluster_config.0.gce_cluster_config.0.shielded_instance_config.0.enable_vtpm",
41+
"cluster_config.0.gce_cluster_config.0.shielded_instance_config.0.enable_integrity_monitoring",
42+
}
43+
3744
preemptibleWorkerDiskConfigKeys = []string{
3845
"cluster_config.0.preemptible_worker_config.0.disk_config.0.num_local_ssds",
3946
"cluster_config.0.preemptible_worker_config.0.disk_config.0.boot_disk_size_gb",
@@ -268,6 +275,43 @@ func resourceDataprocCluster() *schema.Resource {
268275
ForceNew: true,
269276
Description: `A map of the Compute Engine metadata entries to add to all instances`,
270277
},
278+
279+
"shielded_instance_config": {
280+
Type: schema.TypeList,
281+
Optional: true,
282+
AtLeastOneOf: gceClusterConfigKeys,
283+
Computed: true,
284+
MaxItems: 1,
285+
Description: `Shielded Instance Config for clusters using Compute Engine Shielded VMs.`,
286+
Elem: &schema.Resource{
287+
Schema: map[string]*schema.Schema{
288+
"enable_secure_boot": {
289+
Type: schema.TypeBool,
290+
Optional: true,
291+
Default: false,
292+
AtLeastOneOf: schieldedInstanceConfigKeys,
293+
ForceNew: true,
294+
Description: `Defines whether instances have Secure Boot enabled.`,
295+
},
296+
"enable_vtpm": {
297+
Type: schema.TypeBool,
298+
Optional: true,
299+
Default: false,
300+
AtLeastOneOf: schieldedInstanceConfigKeys,
301+
ForceNew: true,
302+
Description: `Defines whether instances have the vTPM enabled.`,
303+
},
304+
"enable_integrity_monitoring": {
305+
Type: schema.TypeBool,
306+
Optional: true,
307+
Default: false,
308+
AtLeastOneOf: schieldedInstanceConfigKeys,
309+
ForceNew: true,
310+
Description: `Defines whether instances have integrity monitoring enabled.`,
311+
},
312+
},
313+
},
314+
},
271315
},
272316
},
273317
},
@@ -971,6 +1015,19 @@ func expandGceClusterConfig(d *schema.ResourceData, config *Config) (*dataproc.G
9711015
if v, ok := cfg["metadata"]; ok {
9721016
conf.Metadata = convertStringMap(v.(map[string]interface{}))
9731017
}
1018+
if v, ok := d.GetOk("cluster_config.0.gce_cluster_config.0.shielded_instance_config"); ok {
1019+
cfgSic := v.([]interface{})[0].(map[string]interface{})
1020+
conf.ShieldedInstanceConfig = &dataproc.ShieldedInstanceConfig{}
1021+
if v, ok := cfgSic["enable_integrity_monitoring"]; ok {
1022+
conf.ShieldedInstanceConfig.EnableIntegrityMonitoring = v.(bool)
1023+
}
1024+
if v, ok := cfgSic["enable_secure_boot"]; ok {
1025+
conf.ShieldedInstanceConfig.EnableSecureBoot = v.(bool)
1026+
}
1027+
if v, ok := cfgSic["enable_vtpm"]; ok {
1028+
conf.ShieldedInstanceConfig.EnableVtpm = v.(bool)
1029+
}
1030+
}
9741031
return conf, nil
9751032
}
9761033

@@ -1354,13 +1411,13 @@ func flattenClusterConfig(d *schema.ResourceData, cfg *dataproc.ClusterConfig) (
13541411
"bucket": cfg.ConfigBucket,
13551412
"temp_bucket": cfg.TempBucket,
13561413
"gce_cluster_config": flattenGceClusterConfig(d, cfg.GceClusterConfig),
1357-
"security_config": flattenSecurityConfig(d, cfg.SecurityConfig),
1358-
"software_config": flattenSoftwareConfig(d, cfg.SoftwareConfig),
13591414
"master_config": flattenInstanceGroupConfig(d, cfg.MasterConfig),
13601415
"worker_config": flattenInstanceGroupConfig(d, cfg.WorkerConfig),
1361-
"preemptible_worker_config": flattenPreemptibleInstanceGroupConfig(d, cfg.SecondaryWorkerConfig),
1416+
"software_config": flattenSoftwareConfig(d, cfg.SoftwareConfig),
13621417
"encryption_config": flattenEncryptionConfig(d, cfg.EncryptionConfig),
13631418
"autoscaling_config": flattenAutoscalingConfig(d, cfg.AutoscalingConfig),
1419+
"security_config": flattenSecurityConfig(d, cfg.SecurityConfig),
1420+
"preemptible_worker_config": flattenPreemptibleInstanceGroupConfig(d, cfg.SecondaryWorkerConfig),
13641421
<% unless version == 'ga' -%>
13651422
"lifecycle_config": flattenLifecycleConfig(d, cfg.LifecycleConfig),
13661423
"endpoint_config": flattenEndpointConfig(d, cfg.EndpointConfig),
@@ -1528,6 +1585,15 @@ func flattenGceClusterConfig(d *schema.ResourceData, gcc *dataproc.GceClusterCon
15281585
if len(gcc.ServiceAccountScopes) > 0 {
15291586
gceConfig["service_account_scopes"] = schema.NewSet(stringScopeHashcode, convertStringArrToInterface(gcc.ServiceAccountScopes))
15301587
}
1588+
if gcc.ShieldedInstanceConfig != nil {
1589+
gceConfig["shielded_instance_config"] = []map[string]interface{}{
1590+
{
1591+
"enable_integrity_monitoring": gcc.ShieldedInstanceConfig.EnableIntegrityMonitoring,
1592+
"enable_secure_boot": gcc.ShieldedInstanceConfig.EnableSecureBoot,
1593+
"enable_vtpm": gcc.ShieldedInstanceConfig.EnableVtpm,
1594+
},
1595+
}
1596+
}
15311597

15321598
return []map[string]interface{}{gceConfig}
15331599
}

‎mmv1/third_party/terraform/tests/resource_dataproc_cluster_test.go.erb‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ func testAccCheckDataprocClusterAccelerator(cluster *dataproc.Cluster, project s
282282
}
283283
}
284284

285-
func TestAccDataprocCluster_withInternalIpOnlyTrue(t *testing.T) {
285+
func TestAccDataprocCluster_withInternalIpOnlyTrueAndShieldedConfig(t *testing.T) {
286286
t.Parallel()
287287

288288
var cluster dataproc.Cluster
@@ -293,12 +293,15 @@ func TestAccDataprocCluster_withInternalIpOnlyTrue(t *testing.T) {
293293
CheckDestroy: testAccCheckDataprocClusterDestroy(t),
294294
Steps: []resource.TestStep{
295295
{
296-
Config: testAccDataprocCluster_withInternalIpOnlyTrue(rnd),
296+
Config: testAccDataprocCluster_withInternalIpOnlyTrueAndShieldedConfig(rnd),
297297
Check: resource.ComposeTestCheckFunc(
298298
testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
299299

300300
// Testing behavior for Dataproc to use only internal IP addresses
301301
resource.TestCheckResourceAttr("google_dataproc_cluster.basic", "cluster_config.0.gce_cluster_config.0.internal_ip_only", "true"),
302+
resource.TestCheckResourceAttr("google_dataproc_cluster.basic", "cluster_config.0.gce_cluster_config.0.shielded_instance_config.0.enable_integrity_monitoring", "true"),
303+
resource.TestCheckResourceAttr("google_dataproc_cluster.basic", "cluster_config.0.gce_cluster_config.0.shielded_instance_config.0.enable_secure_boot", "true"),
304+
resource.TestCheckResourceAttr("google_dataproc_cluster.basic", "cluster_config.0.gce_cluster_config.0.shielded_instance_config.0.enable_vtpm", "true"),
302305
),
303306
},
304307
},
@@ -1074,7 +1077,7 @@ resource "google_dataproc_cluster" "accelerated_cluster" {
10741077
`, rnd, zone, acceleratorType, acceleratorType)
10751078
}
10761079

1077-
func testAccDataprocCluster_withInternalIpOnlyTrue(rnd string) string {
1080+
func testAccDataprocCluster_withInternalIpOnlyTrueAndShieldedConfig(rnd string) string {
10781081
return fmt.Sprintf(`
10791082
variable "subnetwork_cidr" {
10801083
default = "10.0.0.0/16"
@@ -1135,6 +1138,11 @@ resource "google_dataproc_cluster" "basic" {
11351138
gce_cluster_config {
11361139
subnetwork = google_compute_subnetwork.dataproc_subnetwork.name
11371140
internal_ip_only = true
1141+
shielded_instance_config{
1142+
enable_integrity_monitoring = true
1143+
enable_secure_boot = true
1144+
enable_vtpm = true
1145+
}
11381146
}
11391147
}
11401148
}

‎mmv1/third_party/terraform/website/docs/r/dataproc_cluster.html.markdown‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,31 @@ The `cluster_config.gce_cluster_config` block supports:
265265
* `metadata` - (Optional) A map of the Compute Engine metadata entries to add to all instances
266266
(see [Project and instance metadata](https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
267267

268+
* `shielded_instance_config` (Optional) Shielded Instance Config for clusters using [Compute Engine Shielded VMs](https://cloud.google.com/security/shielded-cloud/shielded-vm).
269+
270+
- - -
271+
272+
273+
The `cluster_config.gce_cluster_config.shielded_instance_config` block supports:
274+
275+
```hcl
276+
cluster_config{
277+
gce_cluster_config{
278+
shielded_instance_config{
279+
enable_secure_boot = true
280+
enable_vtpm = true
281+
enable_integrity_monitoring = true
282+
}
283+
}
284+
}
285+
```
286+
287+
* `enable_secure_boot` - (Optional) Defines whether instances have Secure Boot enabled.
288+
289+
* `enable_vtpm` - (Optional) Defines whether instances have the [vTPM](https://cloud.google.com/security/shielded-cloud/shielded-vm#vtpm) enabled.
290+
291+
* `enable_integrity_monitoring` - (Optional) Defines whether instances have integrity monitoring enabled.
292+
268293
- - -
269294

270295
The `cluster_config.master_config` block supports:

0 commit comments

Comments
 (0)