Support confidential nodepools

[jawnsy]

TL;DR

We currently support confidential clusters (a cluster-level setting that enforces that all nodepools are confidential VMs), but do not support the setting at a per-nodepool level. We could add a new node_pool setting (e.g. enable_confidential_nodes) to enable this on a per-nodepool basis, similar to the enable_secure_boot setting)

Terraform Resources

No response

Detailed design

No response

Additional information

GKE supports mixed clusters where some nodepools are confidential instances (n2d or c2d) but others run on other instances (n1, n2, c2, t2d), but the submodule does not support this.

[bharathkkb]

@jawnsy happy to review a PR exposing this!

[maksym-kursin]

It seems impossible to implement it right now because a confidential node is not supported by google_container_node_pool resource.

Here is the related provider issue: hashicorp/terraform-provider-google#13127

[DrFaust92]

@apeabody, I think this can be closed as its supported already

[apeabody]

Thanks, added in #1815

[redoak666]

#1815 does not include support for nodepool level enablement of confidential nodes, only cluster level is supported
#1756 is the correct fix, but NOT merged

[redoak666]

as of today, the latest release v32.0.4 lacks of capability of nodepool level enablement of confidential nodes

[redoak666]

Since v30 is the release that confidential node goes GA, can this confidential nodepool support backported to v30?