Skip to content

Commit 08fbc8c

Browse files
Sneha-atk8s-infra-cherrypick-robot
Sneha-at
authored and
k8s-infra-cherrypick-robot
committed
Added support for confidential storage to disk parametrs and metric
1 parent 9455633 commit 08fbc8c

File tree

12 files changed

+55903
-42328
lines changed

12 files changed

+55903
-42328
lines changed

‎pkg/common/parameters.go

+19
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ const (
3030
ParameterKeyProvisionedIOPSOnCreate = "provisioned-iops-on-create"
3131
ParameterKeyProvisionedThroughputOnCreate = "provisioned-throughput-on-create"
3232
ParameterAvailabilityClass = "availability-class"
33+
ParameterKeyEnableConfidentialCompute = "enable-confidential-storage"
3334

3435
// Parameters for VolumeSnapshotClass
3536
ParameterKeyStorageLocations = "storage-locations"
@@ -88,6 +89,9 @@ type DiskParameters struct {
8889
// Values: {int64}
8990
// Default: none
9091
ProvisionedThroughputOnCreate int64
92+
// Values: {bool}
93+
// Default: false
94+
EnableConfidentialCompute bool
9195
// Default: false
9296
ForceAttach bool
9397
}
@@ -170,6 +174,21 @@ func ExtractAndDefaultParameters(parameters map[string]string, driverName string
170174
if paramAvailabilityClass == ParameterRegionalHardFailoverClass {
171175
p.ForceAttach = true
172176
}
177+
case ParameterKeyEnableConfidentialCompute:
178+
paramEnableConfidentialCompute, err := ConvertStringToBool(v)
179+
if err != nil {
180+
return p, fmt.Errorf("parameters contain invalid value for enable-confidential-storage parameter: %w", err)
181+
}
182+
183+
if paramEnableConfidentialCompute {
184+
// DiskEncryptionKmsKey is needed to enable confidentialStorage
185+
if val, ok := parameters[ParameterKeyDiskEncryptionKmsKey]; !ok || !isValidDiskEncryptionKmsKey(val) {
186+
return p, fmt.Errorf("Valid %v is required to enbale ConfidentialStorage", ParameterKeyDiskEncryptionKmsKey)
187+
}
188+
}
189+
190+
p.EnableConfidentialCompute = paramEnableConfidentialCompute
191+
173192
default:
174193
return p, fmt.Errorf("parameters contains invalid option %q", k)
175194
}

‎pkg/common/utils.go

+6
Original file line numberDiff line numberDiff line change
@@ -386,3 +386,9 @@ func LoggedError(msg string, err error) error {
386386
klog.Errorf(msg+"%v", err.Error())
387387
return status.Errorf(CodeForError(err), msg+"%v", err.Error())
388388
}
389+
390+
func isValidDiskEncryptionKmsKey(DiskEncryptionKmsKey string) bool {
391+
// Validate key against default kmskey pattern
392+
kmsKeyPattern := regexp.MustCompile("projects/[^/]+/locations/([^/]+)/keyRings/[^/]+/cryptoKeys/[^/]+")
393+
return kmsKeyPattern.MatchString(DiskEncryptionKmsKey)
394+
}

‎pkg/common/utils_test.go

+26
Original file line numberDiff line numberDiff line change
@@ -1075,3 +1075,29 @@ func TestIsContextError(t *testing.T) {
10751075
}
10761076
}
10771077
}
1078+
1079+
func TestIsValidDiskEncryptionKmsKey(t *testing.T) {
1080+
cases := []struct {
1081+
diskEncryptionKmsKey string
1082+
expectedIsValid bool
1083+
}{
1084+
{
1085+
diskEncryptionKmsKey: "projects/my-project/locations/us-central1/keyRings/TestKeyRing/cryptoKeys/test-key",
1086+
expectedIsValid: true,
1087+
},
1088+
{
1089+
diskEncryptionKmsKey: "projects/my-project/locations/global/keyRings/TestKeyRing/cryptoKeys/test-key",
1090+
expectedIsValid: true,
1091+
},
1092+
{
1093+
diskEncryptionKmsKey: "projects/my-project/locations/keyRings/TestKeyRing/cryptoKeys/test-key",
1094+
expectedIsValid: false,
1095+
},
1096+
}
1097+
for _, tc := range cases {
1098+
isValid := isValidDiskEncryptionKmsKey(tc.diskEncryptionKmsKey)
1099+
if tc.expectedIsValid != isValid {
1100+
t.Errorf("test failed: the provided key %s expected to be %v bu tgot %v", tc.diskEncryptionKmsKey, tc.expectedIsValid, isValid)
1101+
}
1102+
}
1103+
}

‎pkg/gce-cloud-provider/compute/cloud-disk.go

+11
Original file line numberDiff line numberDiff line change
@@ -223,3 +223,14 @@ func (d *CloudDisk) GetMultiWriter() bool {
223223
return false
224224
}
225225
}
226+
227+
func (d *CloudDisk) GetEnableConfidentialCompute() bool {
228+
switch {
229+
case d.disk != nil:
230+
return false
231+
case d.betaDisk != nil:
232+
return d.betaDisk.EnableConfidentialCompute
233+
default:
234+
return false
235+
}
236+
}

‎pkg/gce-cloud-provider/compute/cloud-disk_test.go

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
*/
17+
18+
package gcecloudprovider
19+
20+
import (
21+
"testing"
22+
23+
computebeta "google.golang.org/api/compute/v0.beta"
24+
computev1 "google.golang.org/api/compute/v1"
25+
)
26+
27+
func CreateDiskWithConfidentialCompute(betaDisk bool, confidentialCompute bool, diskType string) *CloudDisk {
28+
if betaDisk {
29+
return &CloudDisk{
30+
betaDisk: &computebeta.Disk{
31+
EnableConfidentialCompute: confidentialCompute,
32+
Type: diskType,
33+
},
34+
}
35+
}
36+
return &CloudDisk{
37+
disk: &computev1.Disk{},
38+
}
39+
}
40+
41+
func TestGetEnableConfidentialCompute(t *testing.T) {
42+
testCases := []struct {
43+
name string
44+
diskVersion *CloudDisk
45+
expectedEnableConfidentialCompute bool
46+
}{
47+
{
48+
name: "test betaDisk with enableConfidentialCompute=false",
49+
diskVersion: CreateDiskWithConfidentialCompute(true, false, "hyperdisk-balanced"),
50+
expectedEnableConfidentialCompute: false,
51+
},
52+
{
53+
name: "test betaDisk with enableConfidentialCompute=true",
54+
diskVersion: CreateDiskWithConfidentialCompute(true, true, "hyperdisk-balanced"),
55+
expectedEnableConfidentialCompute: true,
56+
},
57+
{
58+
name: "test disk withpit enableConfidentialCompute",
59+
diskVersion: CreateDiskWithConfidentialCompute(false, false, "hyperdisk-balanced"),
60+
expectedEnableConfidentialCompute: false,
61+
},
62+
{
63+
name: "test disk withpit enableConfidentialCompute",
64+
diskVersion: CreateDiskWithConfidentialCompute(false, false, "pd-standard"),
65+
expectedEnableConfidentialCompute: false,
66+
},
67+
}
68+
69+
for _, tc := range testCases {
70+
t.Logf("Running test: %v", tc.name)
71+
confidentialCompute := tc.diskVersion.GetEnableConfidentialCompute()
72+
if confidentialCompute != tc.expectedEnableConfidentialCompute {
73+
t.Fatalf("Got confidentialCompute value %t expected %t", confidentialCompute, tc.expectedEnableConfidentialCompute)
74+
}
75+
if confidentialCompute != tc.expectedEnableConfidentialCompute {
76+
t.Fatalf("Got confidentialCompute value %t expected %t", confidentialCompute, tc.expectedEnableConfidentialCompute)
77+
}
78+
}
79+
}

‎pkg/gce-cloud-provider/compute/fake-gce.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,13 @@ func (cloud *FakeCloudProvider) InsertDisk(ctx context.Context, project string,
237237
return fmt.Errorf("could not create disk, key was neither zonal nor regional, instead got: %v", volKey.String())
238238
}
239239

240-
cloud.disks[volKey.Name] = CloudDiskFromV1(computeDisk)
240+
if containsBetaDiskType(hyperdiskTypes, params.DiskType) {
241+
betaDisk := convertV1DiskToBetaDisk(computeDisk, params.ProvisionedThroughputOnCreate)
242+
betaDisk.EnableConfidentialCompute = params.EnableConfidentialCompute
243+
cloud.disks[volKey.Name] = CloudDiskFromBeta(betaDisk)
244+
} else {
245+
cloud.disks[volKey.Name] = CloudDiskFromV1(computeDisk)
246+
}
241247
return nil
242248
}
243249

‎pkg/gce-cloud-provider/compute/gce-compute.go

+13-2
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ const (
4343
pdDiskTypeUnsupportedPattern = `\[([a-z-]+)\] features are not compatible for creating instance`
4444
)
4545

46-
var hyperdiskTypes = []string{"hyperdisk-extreme", "hyperdisk-throughput"}
46+
var hyperdiskTypes = []string{"hyperdisk-extreme", "hyperdisk-throughput", "hyperdisk-balanced"}
4747
var pdDiskTypeUnsupportedRegex = regexp.MustCompile(pdDiskTypeUnsupportedPattern)
4848

4949
type GCEAPIVersion string
@@ -258,6 +258,9 @@ func (cloud *CloudProvider) ListSnapshots(ctx context.Context, filter string) ([
258258

259259
func (cloud *CloudProvider) GetDisk(ctx context.Context, project string, key *meta.Key, gceAPIVersion GCEAPIVersion) (*CloudDisk, error) {
260260
klog.V(5).Infof("Getting disk %v", key)
261+
262+
// Override GCEAPIVersion as hyperdisk is only available in beta and we cannot get the disk-type with get disk call.
263+
gceAPIVersion = GCEAPIVersionBeta
261264
switch key.Type() {
262265
case meta.Zonal:
263266
if gceAPIVersion == GCEAPIVersionBeta {
@@ -416,8 +419,16 @@ func convertV1DiskToBetaDisk(v1Disk *computev1.Disk, provisionedThroughputOnCrea
416419
Description: v1Disk.Description,
417420
Type: v1Disk.Type,
418421
SourceSnapshot: v1Disk.SourceSnapshot,
422+
SourceImage: v1Disk.SourceImage,
423+
SourceImageId: v1Disk.SourceImageId,
424+
SourceSnapshotId: v1Disk.SourceSnapshotId,
425+
SourceDisk: v1Disk.SourceDisk,
419426
ReplicaZones: v1Disk.ReplicaZones,
420427
DiskEncryptionKey: dek,
428+
Zone: v1Disk.Zone,
429+
Region: v1Disk.Region,
430+
Status: v1Disk.Status,
431+
SelfLink: v1Disk.SelfLink,
421432
}
422433
if v1Disk.ProvisionedIops > 0 {
423434
betaDisk.ProvisionedIops = v1Disk.ProvisionedIops
@@ -558,7 +569,6 @@ func (cloud *CloudProvider) insertZonalDisk(
558569
opName string
559570
gceAPIVersion = GCEAPIVersionV1
560571
)
561-
562572
if multiWriter || containsBetaDiskType(hyperdiskTypes, params.DiskType) {
563573
gceAPIVersion = GCEAPIVersionBeta
564574
}
@@ -600,6 +610,7 @@ func (cloud *CloudProvider) insertZonalDisk(
600610
var insertOp *computebeta.Operation
601611
betaDiskToCreate := convertV1DiskToBetaDisk(diskToCreate, params.ProvisionedThroughputOnCreate)
602612
betaDiskToCreate.MultiWriter = multiWriter
613+
betaDiskToCreate.EnableConfidentialCompute = params.EnableConfidentialCompute
603614
insertOp, err = cloud.betaService.Disks.Insert(project, volKey.Zone, betaDiskToCreate).Context(ctx).Do()
604615
if insertOp != nil {
605616
opName = insertOp.Name

0 commit comments

Comments
 (0)