feat: add example for GKE confidential nodes with GPU

[arthurlapertosa]

No description provided.

[arthurlapertosa]

@apeabody could you please run the build for this PR?

[apeabody]

/gcbrun

[arthurlapertosa]

@apeabody I don't have access to the GCP cloud build project. Could you please send me the error?

[apeabody]

@apeabody I don't have access to the GCP cloud build project. Could you please send me the error?

Error: Reference to undeclared input variable

  on ../../modules/beta-autopilot-private-cluster/cluster.tf line 72, in resource "google_container_cluster" "primary":
  72:       confidential_instance_type = lookup(var.node_pools[0], "confidential_instance_type", null)

An input variable with the name "node_pools" has not been declared. This
variable can be declared with a variable "node_pools" {} block.}

[arthurlapertosa]

@apeabody could you please re-run the build?

[apeabody]

/gcbrun

[arthurlapertosa]

@apeabody I think the build wasn't properly triggered, could you please take a look?

[apeabody]

/gcbrun

[apeabody]

@apeabody I think the build wasn't properly triggered, could you please take a look?

Might have been too quick after the merge, it's running now.

[apeabody]

Thanks @arthurlapertosa!

[apeabody]

Please document any new node_pool parameters in https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/blob/main/autogen/main/README.md?plain=1#L190

[apeabody]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a new example for creating a GKE cluster with confidential nodes and GPUs. This is a valuable addition. The changes include modifications to several Terraform modules to support confidential_instance_type and guest_accelerator configurations, along with the new example files and corresponding integration tests. The implementation is mostly correct, but I've found a few issues related to version constraints, external dependencies, and a bug in the for_each logic that need to be addressed.

[gemini-code-assist]

There seems to be an issue with accessing the values from the for_each iterator. The iterator for a dynamic block is named after the block itself (confidential_nodes in this case), and you should use .value to access the current item. The correct way to access the properties of the object in the for_each list would be confidential_nodes.value.enabled and confidential_nodes.value.confidential_instance_type.

This issue is present in multiple files where this pattern is repeated, including cluster.tf and various cluster.tf files under modules/.

        enabled                    = confidential_nodes.value.enabled
        confidential_instance_type = confidential_nodes.value.confidential_instance_type

[gemini-code-assist]

The kubectl_create_command and kubectl_destroy_command use a URL pointing to the master branch of GoogleCloudPlatform/container-engine-accelerators. This is not a stable reference and can change at any time, which can break this example. It is a best practice to use a permalink to a specific commit hash or tag to ensure reproducibility and security.

  kubectl_create_command  = "kubectl apply -f https://raw.githubusercontent.com/GoogleCloudPlatform/container-engine-accelerators/e0368140228308253634173809140953c0721245/nvidia-driver-installer/cos/daemonset-confidential.yaml"
  kubectl_destroy_command = "kubectl delete -f https://raw.githubusercontent.com/GoogleCloudPlatform/container-engine-accelerators/e0368140228308253634173809140953c0721245/nvidia-driver-installer/cos/daemonset-confidential.yaml"

[apeabody]

+1