Compute Engine

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Compute Engine VM instance: a machine you boot from an image and keep patching yourself
3# ("Compute Engine instances" — you specify the zone, operating system and machine type, so an
4# instance lives in one zone). Persistent disks are encrypted at rest with Google-owned and
5# Google-managed keys without any action ("Protect resources by using Cloud KMS keys").
6#
7# Spot and Confidential VMs are this component, not separate ones.
8#
9# provisioningModel: "spot" is a Spot VM, which Compute Engine may preempt at any time ("Spot VMs",
10# https://cloud.google.com/compute/docs/instances/spot). provisioningModel already carried "spot",
11# so it is the capacity switch here rather than a second property. terminationAction,
12# preemptionNoticeSeconds and coveredBySla mean something only when provisioningModel is "spot",
13# so none is defaulted. Google's own defaults for a Spot VM: stop on preemption, 0 seconds'
14# notice, excluded from the Compute Engine SLA. A Spot VM cannot live migrate; that is
15# onHostMaintenance: "terminate", so no separate live-migration flag is carried.
16#
17# securityType: "confidential" is a Confidential VM, memory encrypted in use by the hardware
18# ("Confidential VM overview",
19# https://cloud.google.com/confidential-computing/confidential-vm/docs/confidential-vm-overview).
20# The technology follows the machine type and CPU platform (AMD SEV, AMD SEV-SNP, Intel TDX).
21# confidentialComputingTechnology, memoryEncryption, attestation and confidentialAccelerator mean
22# something only when securityType is "confidential", so none is defaulted. "shielded" is Shielded
23# VM (Secure Boot, vTPM, integrity monitoring), which Compute Engine turns on for supported public
24# images ("Shielded VM", https://cloud.google.com/compute/shielded-vm/docs/shielded-vm).
25schemaVersion: "1"
26type: "component"
27id: "google-compute-engine"
28kind: "virtual-machine"
29provider: "gcp"
30docs: "https://cloud.google.com/compute/docs/instances"
31aliases: ["GCE", "Spot VM", "Confidential VM"]
32defaults:
33  managed: false
34  diskEncryption: true
35  zoneRedundant: false
36properties:
37  provisioningModel:
38    type: "enum"
39    values: ["standard", "spot"]
40    default: "standard"
41  securityType:
42    type: "enum"
43    values: ["standard", "shielded", "confidential"]
44    default: "shielded"
45  machineFamily:
46    type: "enum"
47    values: ["general-purpose", "compute-optimized", "memory-optimized", "storage-optimized", "accelerator-optimized"]
48    default: "general-purpose"
49  onHostMaintenance:
50    type: "enum"
51    values: ["migrate", "terminate"]
52    default: "migrate"
53  terminationAction:
54    type: "enum"
55    values: ["stop", "delete"]
56  preemptionNoticeSeconds:
57    type: "integer"
58  coveredBySla:
59    type: "boolean"
60  confidentialComputingTechnology:
61    type: "enum"
62    values: ["amd-sev", "amd-sev-snp", "intel-tdx"]
63  memoryEncryption:
64    type: "boolean"
65  attestation:
66    type: "boolean"
67  confidentialAccelerator:
68    type: "boolean"