Red Hat OpenShift Container Platform

Configuring Confidential VM by using machine sets

You create machine sets to scale clusters on Google Cloud. By editing the machine set YAML file, you can configure the Confidential VM options that a machine set uses for machines that it deploys.

For more information about Confidential VM features, functions, and compatibility, see the Google Cloud Compute Engine documentation about Confidential VM.

Confidential VMs are currently not supported on 64-bit ARM architectures. If you use Confidential VM, you must ensure that you select a supported region. For details on supported regions and configurations, see the Google Cloud Compute Engine documentation about supported zones.

Procedure

In a text editor, open the YAML file for an existing machine set or create a new one.
Edit the following section under the providerSpec field:
```
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
# ...
spec:
  template:
    spec:
      providerSpec:
        value:
          confidentialCompute: Enabled
          onHostMaintenance: Terminate
          machineType: n2d-standard-8
# ...
```
where:

spec.template.spec.providerSpec.value.confidentialCompute

Specifies whether Confidential VM is enabled. The following values are valid:

Enabled

Enables Confidential VM with a default selection of Confidential VM technology. The default selection is AMD Secure Encrypted Virtualization (AMD SEV).

The Enabled value selects Confidential Computing with AMD Secure Encrypted Virtualization (AMD SEV), which is deprecated.

Disabled

Disables Confidential VM.

AMDEncryptedVirtualizationNestedPaging

Enables Confidential VM using AMD Secure Encrypted Virtualization Secure Nested Paging (AMD SEV-SNP). AMD SEV-SNP supports n2d machines.

AMDEncryptedVirtualization

Enables Confidential VM using AMD SEV. AMD SEV supports c2d, n2d, and c3d machines.

The use of Confidential Computing with AMD Secure Encrypted Virtualization (AMD SEV) has been deprecated and will be removed in a future release.

IntelTrustedDomainExtensions

Enables Confidential VM using Intel Trusted Domain Extensions (Intel TDX). Intel TDX supports n2d machines.

spec.template.spec.providerSpec.value.onHostMaintenance

Specifies the behavior of the VM during a host maintenance event, such as a hardware or software update. For a machine that uses Confidential VM, this value must be set to Terminate, which stops the VM. Confidential VM does not support live VM migration.

spec.template.spec.providerSpec.value.machineType

Specifies a machine type that supports the Confidential VM option that you specified in the confidentialCompute field.

Verification

On the Google Cloud console, review the details for a machine deployed by the machine set and verify that the Confidential VM options match the values that you configured.