Promote enable_confidential_compute for disks to v1.

.changelog/9789.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+compute: promoted `google_compute_disk.enable_confidential_compute` to GA
+```
+```release-note:enhancement
+compute: added `enable_confidential_compute` field to `google_compute_instance.boot_disk.initialize_params`
+```

google/services/compute/resource_compute_disk.go

@@ -418,6 +418,14 @@ encryption key that protects this resource.`,
 					},
 				},
 			},
+			"enable_confidential_compute": {
+				Type:     schema.TypeBool,
+				Computed: true,
+				Optional: true,
+				ForceNew: true,
+				Description: `Whether this disk is using confidential compute mode.
+Note: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true`,
+			},
 			"guest_os_features": {
 				Type:     schema.TypeSet,
 				Computed: true,
@@ -798,6 +806,12 @@ func resourceComputeDiskCreate(d *schema.ResourceData, meta interface{}) error {
 	} else if v, ok := d.GetOkExists("image"); !tpgresource.IsEmptyValue(reflect.ValueOf(sourceImageProp)) && (ok || !reflect.DeepEqual(v, sourceImageProp)) {
 		obj["sourceImage"] = sourceImageProp
 	}
+	enableConfidentialComputeProp, err := expandComputeDiskEnableConfidentialCompute(d.Get("enable_confidential_compute"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("enable_confidential_compute"); !tpgresource.IsEmptyValue(reflect.ValueOf(enableConfidentialComputeProp)) && (ok || !reflect.DeepEqual(v, enableConfidentialComputeProp)) {
+		obj["enableConfidentialCompute"] = enableConfidentialComputeProp
+	}
 	provisionedIopsProp, err := expandComputeDiskProvisionedIops(d.Get("provisioned_iops"), d, config)
 	if err != nil {
 		return err
@@ -1018,6 +1032,9 @@ func resourceComputeDiskRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("image", flattenComputeDiskImage(res["sourceImage"], d, config)); err != nil {
 		return fmt.Errorf("Error reading Disk: %s", err)
 	}
+	if err := d.Set("enable_confidential_compute", flattenComputeDiskEnableConfidentialCompute(res["enableConfidentialCompute"], d, config)); err != nil {
+		return fmt.Errorf("Error reading Disk: %s", err)
+	}
 	if err := d.Set("provisioned_iops", flattenComputeDiskProvisionedIops(res["provisionedIops"], d, config)); err != nil {
 		return fmt.Errorf("Error reading Disk: %s", err)
 	}
@@ -1518,6 +1535,10 @@ func flattenComputeDiskImage(v interface{}, d *schema.ResourceData, config *tran
 	return v
 }
 
+func flattenComputeDiskEnableConfidentialCompute(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func flattenComputeDiskProvisionedIops(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	// Handles the string fixed64 format
 	if strVal, ok := v.(string); ok {
@@ -1786,6 +1807,10 @@ func expandComputeDiskImage(v interface{}, d tpgresource.TerraformResourceData,
 	return v, nil
 }
 
+func expandComputeDiskEnableConfidentialCompute(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandComputeDiskProvisionedIops(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
 	return v, nil
 }

google/services/compute/resource_compute_disk_test.go

@@ -557,6 +557,45 @@ func TestAccComputeDisk_encryptionKMS(t *testing.T) {
 	})
 }
 
+func TestAccComputeDisk_pdHyperDiskEnableConfidentialCompute(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"kms": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(
+			t,
+			"ENCRYPT_DECRYPT",
+			"us-central1",
+			"tf-bootstrap-hyperdisk-key1").CryptoKey.Name, // regional KMS key
+		"disk_size":            64,
+		"confidential_compute": true,
+	}
+
+	var disk compute.Disk
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeDiskDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeDisk_pdHyperDiskEnableConfidentialCompute(context),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeDiskExists(
+						t, "google_compute_disk.foobar", envvar.GetTestProjectFromEnv(), &disk),
+					testAccCheckEncryptionKey(
+						t, "google_compute_disk.foobar", &disk),
+				),
+			},
+			{
+				ResourceName:      "google_compute_disk.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccComputeDisk_deleteDetach(t *testing.T) {
 	t.Parallel()
 

google/services/compute/resource_compute_instance.go

@@ -45,6 +45,7 @@ var (
 		"boot_disk.0.initialize_params.0.resource_manager_tags",
 		"boot_disk.0.initialize_params.0.provisioned_iops",
 		"boot_disk.0.initialize_params.0.provisioned_throughput",
+		"boot_disk.0.initialize_params.0.enable_confidential_compute",
 	}
 
 	schedulingKeys = []string{
@@ -256,6 +257,14 @@ func ResourceComputeInstance() *schema.Resource {
 										ValidateFunc: validation.IntBetween(1, 7124),
 										Description:  `Indicates how much throughput to provision for the disk. This sets the number of throughput mb per second that the disk can handle. Values must be between 1 and 7,124.`,
 									},
+
+									"enable_confidential_compute": {
+										Type:         schema.TypeBool,
+										Optional:     true,
+										AtLeastOneOf: initializeParamsKeys,
+										ForceNew:     true,
+										Description:  `A flag to enable confidential compute mode on boot disk`,
+									},
 								},
 							},
 						},
@@ -2686,6 +2695,10 @@ func expandBootDisk(d *schema.ResourceData, config *transport_tpg.Config, projec
 			disk.InitializeParams.ProvisionedThroughput = int64(v.(int))
 		}
 
+		if v, ok := d.GetOk("boot_disk.0.initialize_params.0.enable_confidential_compute"); ok {
+			disk.InitializeParams.EnableConfidentialCompute = v.(bool)
+		}
+
 		if v, ok := d.GetOk("boot_disk.0.initialize_params.0.type"); ok {
 			diskTypeName := v.(string)
 			diskType, err := readDiskType(config, d, diskTypeName)
@@ -2747,12 +2760,13 @@ func flattenBootDisk(d *schema.ResourceData, disk *compute.AttachedDisk, config
 			"type": tpgresource.GetResourceNameFromSelfLink(diskDetails.Type),
 			// If the config specifies a family name that doesn't match the image name, then
 			// the diff won't be properly suppressed. See DiffSuppressFunc for this field.
-			"image":                  diskDetails.SourceImage,
-			"size":                   diskDetails.SizeGb,
-			"labels":                 diskDetails.Labels,
-			"resource_manager_tags":  d.Get("boot_disk.0.initialize_params.0.resource_manager_tags"),
-			"provisioned_iops":       diskDetails.ProvisionedIops,
-			"provisioned_throughput": diskDetails.ProvisionedThroughput,
+			"image":                       diskDetails.SourceImage,
+			"size":                        diskDetails.SizeGb,
+			"labels":                      diskDetails.Labels,
+			"resource_manager_tags":       d.Get("boot_disk.0.initialize_params.0.resource_manager_tags"),
+			"provisioned_iops":            diskDetails.ProvisionedIops,
+			"provisioned_throughput":      diskDetails.ProvisionedThroughput,
+			"enable_confidential_compute": diskDetails.EnableConfidentialCompute,
 		}}
 	}
 

google/services/compute/resource_compute_instance_test.go

@@ -1819,6 +1819,43 @@ func TestAccComputeInstanceConfidentialInstanceConfigMain(t *testing.T) {
 	})
 }
 
+func TestAccComputeInstance_confidentialHyperDiskBootDisk(t *testing.T) {
+	t.Parallel()
+	kms := acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-hyperdisk-key1")
+
+	context_1 := map[string]interface{}{
+		"instance_name":        fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
+		"confidential_compute": true,
+		"key_ring":             kms.KeyRing.Name,
+		"key_name":             kms.CryptoKey.Name,
+		"zone":                 "us-central1-a",
+	}
+
+	context_2 := map[string]interface{}{
+		"instance_name":        context_1["instance_name"],
+		"confidential_compute": false,
+		"key_ring":             context_1["key_ring"],
+		"key_name":             context_1["key_name"],
+		"zone":                 context_1["zone"],
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstanceConfidentialHyperDiskBootDisk(context_1),
+			},
+			computeInstanceImportStep(context_1["zone"].(string), context_1["instance_name"].(string), []string{"allow_stopping_for_update"}),
+			{
+				Config: testAccComputeInstanceConfidentialHyperDiskBootDisk(context_2),
+			},
+			computeInstanceImportStep(context_2["zone"].(string), context_2["instance_name"].(string), []string{"allow_stopping_for_update"}),
+		},
+	})
+}
+
 func TestAccComputeInstance_hyperdiskBootDisk_provisioned_iops_throughput(t *testing.T) {
 	t.Parallel()
 
@@ -6472,6 +6509,46 @@ resource "google_compute_instance" "foobar" {
 `, instance, enableConfidentialCompute)
 }
 
+func testAccComputeInstanceConfidentialHyperDiskBootDisk(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_compute_image" "my_image" {
+  family    = "ubuntu-2204-lts"
+  project   = "ubuntu-os-cloud"
+}
+
+data "google_project" "project" {}
+
+resource "google_kms_crypto_key_iam_member" "crypto_key" {
+  crypto_key_id = "%{key_name}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member = "serviceAccount:${data.google_project.project.number}[email protected]"
+}
+
+resource "google_compute_instance" "foobar" {
+  name         = "%{instance_name}"
+  machine_type = "h3-standard-88"
+  zone         = "%{zone}"
+
+  boot_disk {
+
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+      enable_confidential_compute = %{confidential_compute}
+      type  = "hyperdisk-balanced"
+    }
+
+    kms_key_self_link = "%{key_name}"
+  }
+
+  network_interface {
+    network = "default"
+  }
+  depends_on = [google_kms_crypto_key_iam_member.crypto_key]
+
+}
+`, context)
+}
+
 func testAccComputeInstanceHyperDiskBootDiskProvisionedIopsThroughput(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 data "google_compute_image" "my_image" {

website/docs/r/compute_disk.html.markdown

@@ -228,7 +228,7 @@ The following arguments are supported:
   to allow for updating the resource policy attached to the disk.
 
 * `enable_confidential_compute` -
-  (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
+  (Optional)
   Whether this disk is using confidential compute mode.
   Note: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true
 

website/docs/r/compute_instance.html.markdown

@@ -265,6 +265,9 @@ is desired, you will need to modify your state file manually using
     recreate the disk, hyperdisk allows for an update of throughput every 4 hours.
     To update your hyperdisk more frequently, you'll need to manually delete and recreate it.
 
+* `enable_confidential_compute` - (Optional) Whether this disk is using confidential compute mode.
+    Note: Only supported on hyperdisk skus, disk_encryption_key is required when setting to true.
+
 <a name="nested_scratch_disk"></a>The `scratch_disk` block supports:
 
 * `interface` - (Required) The disk interface to use for attaching this disk; either SCSI or NVME.