Skip to content

Commit 895882e

Browse files
bmcelveebmcelvee
authored
Merge pull request #94345 from mletalie/OSDOCS-14845
[OSDOCS-14845]OSDOCS Story [Virt on OSD] Secure Boot on per machine pool basis
2 parents 4572e87 + 133abe9 commit 895882e

File tree

6 files changed

+60
-6
lines changed

6 files changed

+60
-6
lines changed

‎modules/create-wif-cluster-ocm.adoc

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,18 @@ Workload Identity Federation (WIF) is only supported on {product-title} version
5555
.. Select a cloud provider region from the *Region* drop-down menu.
5656
.. Select a *Single zone* or *Multi-zone* configuration.
5757
+
58-
.. Optional: Select *Enable Secure Boot support for Shielded VMs* to use Shielded VMs when installing your cluster. For more information, see link:https://cloud.google.com/security/products/shielded-vm[Shielded VMs].
58+
.. Optional: Select *Enable Secure Boot support for Shielded VMs* to use Shielded VMs when installing your cluster. Once you create your cluster, the *Enable Secure Boot support for Shielded VMs* setting cannot be changed. For more information, see link:https://cloud.google.com/security/products/shielded-vm[Shielded VMs].
5959
+
6060
[IMPORTANT]
6161
====
6262
To successfully create a cluster, you must select *Enable Secure Boot support for Shielded VMs* if your organization has the policy constraint `constraints/compute.requireShieldedVm` enabled. For more information regarding GCP organizational policy constraints, see link:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints[Organization policy constraints].
6363
====
6464
+
65-
65+
[IMPORTANT]
66+
====
67+
*Enable Secure Boot support for Shielded VMs* is not supported for {product-title} on {GCP} clusters created using bare-metal instance types. For more information, see link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#limitations[Limitations] in the Google Cloud documentation.
68+
====
69+
+
6670
.. Leave *Enable user workload monitoring* selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.
6771

6872
. Optional: Expand *Advanced Encryption* to make changes to encryption settings.

‎modules/creating-a-machine-pool-ocm.adoc

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,22 @@ Your Amazon EC2 Spot Instances might be interrupted at any time. Use Amazon EC2
146146
====
147147
If you select *Use Amazon EC2 Spot Instances* for a machine pool, you cannot disable the option after the machine pool is created.
148148
====
149+
+
149150
endif::openshift-rosa-hcp[]
150-
151+
ifdef::openshift-dedicated[]
152+
. Optional: By default, {product-title} on {GCP} instances in the machine pools inherit the Shielded VM settings at the cluster level. You can override the cluster level Shielded VM settings at the machine pool level by selecting or clearing the *Enable Secure Boot support for Shielded VMs* checkbox.
153+
+
154+
[IMPORTANT]
155+
====
156+
Once a machine pool is created, the *Enable Secure Boot support for Shielded VMs* setting cannot be changed.
157+
====
158+
+
159+
[IMPORTANT]
160+
====
161+
*Enable Secure Boot support for Shielded VMs* is not supported for {product-title} on {GCP} clusters created using bare-metal instance types. For more information, see link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#limitations[Limitations] in the Google Cloud documentation.
162+
====
163+
endif::openshift-dedicated[]
164+
+
151165
. Click *Add machine pool* to create the machine pool.
152166

153167
.Verification

‎modules/osd-create-cluster-ccs.adoc

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,23 @@ Clusters configured with Private Service Connect (PSC) are only supported on Ope
5959
.. Select a *Single zone* or *Multi-zone* configuration.
6060
+
6161

62-
.. Optional: Select *Enable Secure Boot for Shielded VMs* to use Shielded VMs when installing your cluster. For more information, see link:https://cloud.google.com/security/products/shielded-vm[Shielded VMs].
62+
.. Optional: Select *Enable Secure Boot for Shielded VMs* to use Shielded VMs when installing your cluster. Once you create your cluster, the *Enable Secure Boot for Shielded VMs* setting cannot be changed. For more information, see link:https://cloud.google.com/security/products/shielded-vm[Shielded VMs].
6363
+
6464
[IMPORTANT]
6565
====
6666
To successfully create a cluster, you must select *Enable Secure Boot support for Shielded VMs* if your organization has the policy constraint `constraints/compute.requireShieldedVm` enabled. For more information regarding GCP organizational policy constraints, see link:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints[Organization policy constraints].
6767
====
68+
// +
69+
// [IMPORTANT]
70+
// ====
71+
// Once a machine pool is saved, the *Enable Secure Boot support for Shielded VMs* setting cannot be changed.
72+
// ====
73+
+
74+
[IMPORTANT]
75+
====
76+
*Enable Secure Boot support for Shielded VMs* is not supported for {product-title} on {GCP} clusters created using bare-metal instance types. For more information, see link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#limitations[Limitations] in the Google Cloud documentation.
77+
====
6878
+
69-
7079
.. Leave *Enable user workload monitoring* selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.
7180

7281
. Optional: Expand *Advanced Encryption* to make changes to encryption settings.

‎modules/osd-create-cluster-red-hat-account.adoc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,18 @@ To customize the subdomain, select the *Create custom domain prefix* checkbox, a
3939
.. Select a *Persistent storage* capacity for the cluster. For more information, see the _Storage_ section in the {product-title} service definition.
4040
.. Specify the number of *Load balancers* that you require for your cluster. For more information, see the _Load balancers_ section in the {product-title} service definition.
4141
+
42-
.. Optional: Select *Enable Secure Boot for Shielded VMs* to use Shielded VMs when installing your cluster. For more information, see link:https://cloud.google.com/security/products/shielded-vm[Shielded VMs].
42+
.. Optional: Select *Enable Secure Boot support for Shielded VMs* to use Shielded VMs when installing your cluster. Once you create your cluster, the *Enable Secure Boot support for Shielded VMs* setting cannot be changed. For more information, see link:https://cloud.google.com/security/products/shielded-vm[Shielded VMs].
4343
+
4444
[IMPORTANT]
4545
====
4646
To successfully create a cluster, you must select *Enable Secure Boot support for Shielded VMs* if your organization has the policy constraint `constraints/compute.requireShieldedVm` enabled. For more information regarding GCP organizational policy constraints, see link:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints[Organization policy constraints].
4747
====
4848
+
49+
[IMPORTANT]
50+
====
51+
*Enable Secure Boot support for Shielded VMs* is not supported for {product-title} on {GCP} clusters created using bare-metal instance types. For more information, see link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#limitations[Limitations] in the Google Cloud documentation.
52+
====
53+
+
4954
.. Leave *Enable user workload monitoring* selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.
5055
. Optional: Expand *Advanced Encryption* to make changes to encryption settings.
5156
+

‎osd_whats_new/osd-whats-new.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ With its foundation in Kubernetes, {product-title} is a complete {OCP} cluster p
2222
// re-add once upgrade to 4.19 is available
2323
// For more information about upgrading to this latest version, see xref:../upgrading/osd-upgrades.adoc#osd-upgrades[Red Hat OpenShift Dedicated cluster upgrades].
2424

25+
* **Support for enabling and disabling Secure Boot for Shielded VMs on a per machine basis.**
26+
{product-title} on {GCP} users can now enable or disable Secure Boot for Shielded VMs on a per machine basis. For more information, see xref:../osd_cluster_admin/osd_nodes/osd-managing-worker-nodes.adoc#osd-managing-worker-nodes[Managing compute nodes].
27+
28+
2529
[id="osd-q1-2025_{context}"]
2630
=== Q1 2025
2731

‎snippets/shieldedvm-baremetal-support.adoc

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// Text snippet included in the following assemblies: (1)
2+
//
3+
// * rosa_cluster_admin/rosa-configuring-pid-limits.adoc
4+
//
5+
// Text snippet included in the following modules: (2)
6+
//
7+
// * modules/setting-higher-pid-limit-on-existing-cluster.adoc
8+
9+
:_mod-docs-content-type: SNIPPET
10+
11+
// Snippet that notifies user that Shielded VM is not supported for clusters created using bare metal instance types.
12+
13+
[IMPORTANT]
14+
====
15+
[subs="attributes+"]
16+
Shielded VM is not supported for {product-title} on {GCP} clusters using bare-metal instance types. For more information, see link:https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#limitations[Limitations] in the Google Cloud documentation.
17+
====
18+
// Undefine {FeatureName} attribute, so that any mistakes are easily spotted

0 commit comments

Comments
 (0)