[terraform] enable secure boot in k8s node pools (#15068)

## Change Description

Fixes hail-is/hail-security#47

Enables secure boot and shielded nodes for node pools and vdc cluster.

Note:
- [x] Apply terraform and validate that it works in a sandbox instance
before bringing to production
- [ ] Must be applied manually in production after the PR merges

## Security Assessment

- This change potentially impacts the Hail Batch instance as deployed by
Broad Institute in GCP

### Impact Rating

- This change has a medium security impact

### Impact Description

Enables secure boot and shielded nodes. Makes sure the kernels being
loaded in are properly protected

### Appsec Review

- [x] Required: The impact has been assessed and approved by appsec

Author: cjllanwarne

infra/gcp-broad/main.tf

@@ -143,7 +143,7 @@ resource "google_container_cluster" "vdc" {
   name = "vdc"
   location = var.gcp_zone
   network = google_compute_network.default.name
-  enable_shielded_nodes = false
+  enable_shielded_nodes = true
 
   # We can't create a cluster with no node pool defined, but we want to only use
   # separately managed node pools. So we create the smallest possible default
@@ -263,7 +263,7 @@ resource "google_container_node_pool" "vdc_preemptible_pool" {
 
     shielded_instance_config {
       enable_integrity_monitoring = true
-      enable_secure_boot          = false
+      enable_secure_boot          = true
     }
   }
 
@@ -310,7 +310,7 @@ resource "google_container_node_pool" "vdc_nonpreemptible_pool" {
 
     shielded_instance_config {
       enable_integrity_monitoring = true
-      enable_secure_boot          = false
+      enable_secure_boot          = true
     }
   }
 

infra/gcp/main.tf

@@ -121,6 +121,7 @@ resource "google_container_cluster" "vdc" {
   name = "vdc"
   location = var.gcp_zone
   network = google_compute_network.default.name
+  enable_shielded_nodes = true
 
   # We can't create a cluster with no node pool defined, but we want to only use
   # separately managed node pools. So we create the smallest possible default
@@ -200,6 +201,11 @@ resource "google_container_node_pool" "vdc_preemptible_pool" {
     metadata = {
       disable-legacy-endpoints = "true"
     }
+
+    shielded_instance_config {
+      enable_integrity_monitoring = true
+      enable_secure_boot          = true
+    }
   }
 }
 
@@ -228,6 +234,11 @@ resource "google_container_node_pool" "vdc_nonpreemptible_pool" {
     metadata = {
       disable-legacy-endpoints = "true"
     }
+
+    shielded_instance_config {
+      enable_integrity_monitoring = true
+      enable_secure_boot          = true
+    }
   }
 }