Red Hat OpenShift Container Platform

Enabling Confidential VMs

You can use Confidential VMs when installing your Red Hat OpenShift Container Platform cluster. Confidential VMs encrypt data during processing.

For more information, see Google’s documentation on Confidential Computing. You can enable Confidential VMs and Shielded VMs at the same time, although they are not dependent on each other.

Confidential VMs are currently not supported on 64-bit ARM architectures.

Procedure

Use a text editor to edit the install-config.yaml file before deploying your cluster and add one of the following stanzas:
1. To use confidential VMs for only control plane machines:
  controlPlane: platform: gcp: confidentialCompute: AMDEncryptedVirtualizationNestedPaging type: n2d-standard-8 onHostMaintenance: Terminate
  where:
  
  confidentialCompute
  
  Enables confidential VMs with AMD Secure Encrypted Virtualization Secure Nested Paging (AMD SEV-SNP). For more information about available options, see "Additional Google Cloud configuration parameters".
  
  type
  
  Specifies a machine type that supports Confidential VMs. Confidential VMs require the N2D, C2D, C3D, or C3 series of machine types. For more information on supported machine types, see Supported operating systems and machine types.
  
  onHostMaintenance
  
  Specifies the behavior of the VM during a host maintenance event, such as a hardware or software update. For a machine that uses Confidential VM, this value must be set to Terminate, which stops the VM. Confidential VMs do not support live VM migration.
2. To use confidential VMs for only compute machines:
  compute: - platform: gcp: confidentialCompute: AMDEncryptedVirtualizationNestedPaging type: n2d-standard-8 onHostMaintenance: Terminate
3. To use confidential VMs for all machines:
  platform: gcp: defaultMachinePlatform: confidentialCompute: AMDEncryptedVirtualizationNestedPaging type: n2d-standard-8 onHostMaintenance: Terminate