Reservation Affinity for workbench instances

mmv1/products/workbench/Instance.yaml

@@ -75,6 +75,7 @@ examples:
     region_override: 'us-west1-a'
     vars:
       instance_name: 'workbench-instance'
+      reservation_name: 'wbi-reservation'
     ignore_read_extra:
       - 'gce_setup.0.vm_image'
   - name: 'workbench_instance_labels_stopped'
@@ -95,6 +96,7 @@ examples:
     vars:
       instance_name: 'workbench-instance'
       network_name: 'wbi-test-default'
+      reservation_name: 'wbi-reservation'
       key_name: 'my-crypto-key'
     test_env_vars:
       project_id: 'PROJECT_NAME'
@@ -105,6 +107,12 @@ examples:
       - 'gce_setup.0.vm_image'
       - 'gce_setup.0.boot_disk.0.disk_type'
       - 'gce_setup.0.data_disks.0.disk_type'
+  - name: 'workbench_instance_confidential_compute'
+    primary_resource_id: 'instance'
+    primary_resource_name: 'fmt.Sprintf("tf-test-workbench-instance%s", context["random_suffix"])'
+    region_override: 'us-west1-a'
+    vars:
+      instance_name: 'workbench-instance'
 virtual_fields:
   - name: 'desired_state'
     description: |
@@ -441,6 +449,58 @@ properties:
           Optional. Flag to enable ip forwarding or not, default false/off.
           https://cloud.google.com/vpc/docs/using-routes#canipforward
         immutable: true
+      - name: 'confidentialInstanceConfig'
+        type: NestedObject
+        immutable: true
+        description: |
+          Confidential instance configuration.
+        properties:
+          - name: 'enableConfidentialCompute'
+            type: Boolean
+            description: |
+              Defines whether the instance should have confidential compute enabled.
+          - name: 'confidentialInstanceType'
+            type: Enum
+            description: |
+              Defines the type of technology used by the confidential instance.
+            enum_values:
+              - 'SEV'
+              - 'SEV_SNP'
+              - 'TDX'
+      - name: 'reservationAffinity'
+        type: NestedObject
+        immutable: true
+        default_from_api: true
+        description: |
+          Reservations that this instance can consume from.
+        properties:
+          - name: 'consumeReservationType'
+            type: Enum
+            immutable: true
+            default_from_api: true
+            description: |
+              Specifies the type of reservation from which this instance can consume resources:
+              RESERVATION_ANY (default), RESERVATION_SPECIFIC, or RESERVATION_NONE.
+            enum_values:
+              - 'RESERVATION_NONE'
+              - 'RESERVATION_ANY'
+              - 'RESERVATION_SPECIFIC'
+          - name: 'key'
+            immutable: true
+            description: |
+              Corresponds to the label key of a reservation resource. To target a
+              RESERVATION_SPECIFIC by name, use compute.googleapis.com/reservation-name
+              as the key and specify the name of your reservation as its value.
+          - name: 'values'
+            type: Array
+            immutable: true
+            item_type:
+              type: String
+            description: |
+              Corresponds to the label values of a reservation resource. This can be
+              either a name to a reservation in the same project or
+              "projects/different-project/reservations/some-reservation-name"
+              to target a shared reservation in the same zone but in a different project.
   - name: 'proxyUri'
     type: String
     description: |

mmv1/templates/terraform/examples/workbench_instance_basic_gpu.tf.tmpl

@@ -1,3 +1,23 @@
+resource "google_compute_reservation" "gpu_reservation" {
+  name     = "{{index $.Vars "reservation_name"}}"
+  zone     = "us-central1-a"
+
+  specific_reservation {
+    count = 1
+
+    instance_properties {
+      machine_type = "n1-standard-1"
+
+      guest_accelerators {
+        accelerator_type  = "nvidia-tesla-t4"
+        accelerator_count = 1
+      }
+    }
+  }
+
+  specific_reservation_required = false
+}
+
 resource "google_workbench_instance" "{{$.PrimaryResourceId}}" {
   name = "{{index $.Vars "instance_name"}}"
   location = "us-central1-a"
@@ -11,5 +31,13 @@ resource "google_workbench_instance" "{{$.PrimaryResourceId}}" {
       project      = "cloud-notebooks-managed"
       family       = "workbench-instances"
     }
+    reservation_affinity {
+      consume_reservation_type = "RESERVATION_ANY"
+    }
   }
+
+  depends_on = [
+    google_compute_reservation.gpu_reservation
+  ]
+
 }

mmv1/templates/terraform/examples/workbench_instance_confidential_compute.tf.tmpl

@@ -0,0 +1,24 @@
+resource "google_workbench_instance" "{{$.PrimaryResourceId}}" {
+  name = "{{index $.Vars "instance_name"}}"
+  location = "us-central1-a"
+
+  gce_setup {
+    machine_type = "n2d-standard-2" // cant be e2 because of accelerator
+
+    shielded_instance_config {
+      enable_secure_boot = true
+      enable_vtpm = true
+      enable_integrity_monitoring = true
+    }
+
+    metadata = {
+      terraform = "true"
+    }
+
+    confidential_instance_config {
+      enable_confidential_compute = true
+      confidential_instance_type = "SEV"
+    }
+
+  }
+}

mmv1/templates/terraform/examples/workbench_instance_full.tf.tmpl

@@ -22,6 +22,26 @@ resource "google_service_account_iam_binding" "act_as_permission" {
   ]
 }
 
+resource "google_compute_reservation" "gpu_reservation" {
+  name     = "{{index $.Vars "reservation_name"}}"
+  zone     = "us-central1-a"
+
+  specific_reservation {
+    count = 1
+
+    instance_properties {
+      machine_type = "n1-standard-4"
+
+      guest_accelerators {
+        accelerator_type  = "nvidia-tesla-t4"
+        accelerator_count = 1
+      }
+    }
+  }
+
+  specific_reservation_required = true
+}
+
 resource "google_workbench_instance" "{{$.PrimaryResourceId}}" {
   name = "{{index $.Vars "instance_name"}}"
   location = "us-central1-a"
@@ -72,6 +92,12 @@ resource "google_workbench_instance" "{{$.PrimaryResourceId}}" {
       terraform = "true"
     }
 
+    reservation_affinity {
+      consume_reservation_type = "RESERVATION_SPECIFIC"
+      key = "compute.googleapis.com/reservation-name"
+      values = [google_compute_reservation.gpu_reservation.name]
+    }
+
     enable_ip_forwarding = true
 
     tags = ["abc", "def"]
@@ -90,4 +116,12 @@ resource "google_workbench_instance" "{{$.PrimaryResourceId}}" {
 
   enable_third_party_identity = "true"
 
+    depends_on = [
+    google_compute_network.my_network,
+    google_compute_subnetwork.my_subnetwork,
+    google_compute_address.static,
+    google_service_account_iam_binding.act_as_permission,
+    google_compute_reservation.gpu_reservation
+  ]
+
 }