feat: add API for GPU driver installation config

Google APIs · copybara-github · commit b7e93121d514 · 2023-06-08T06:47:08.000-07:00
---
feat: add SecurityPostureConfig API field to allow customers to enable GKE Security Posture capabilities for their clusters

---
feat: add workloadPolicyConfig API field to allow customer enable NET_ADMIN capability for their autopilot clusters
PiperOrigin-RevId: 538770734
diff --git a/google/container/v1/cluster_service.proto b/google/container/v1/cluster_service.proto
@@ -1911,6 +1911,9 @@ message Cluster {
   // Fleet information for the cluster.
   Fleet fleet = 140;
 
+  // Enable/Disable Security Posture API features for the cluster.
+  SecurityPostureConfig security_posture_config = 145;
+
   // Beta APIs Config
   K8sBetaAPIConfig enable_k8s_beta_apis = 143;
 }
@@ -1921,6 +1924,40 @@ message K8sBetaAPIConfig {
   repeated string enabled_apis = 1;
 }
 
+// SecurityPostureConfig defines the flags needed to enable/disable features for
+// the Security Posture API.
+message SecurityPostureConfig {
+  // Mode defines enablement mode for GKE Security posture features.
+  enum Mode {
+    // Default value not specified.
+    MODE_UNSPECIFIED = 0;
+
+    // Disables Security Posture features on the cluster.
+    DISABLED = 1;
+
+    // Applies Security Posture features on the cluster.
+    BASIC = 2;
+  }
+
+  // VulnerabilityMode defines enablement mode for vulnerability scanning.
+  enum VulnerabilityMode {
+    // Default value not specified.
+    VULNERABILITY_MODE_UNSPECIFIED = 0;
+
+    // Disables vulnerability scanning on the cluster.
+    VULNERABILITY_DISABLED = 1;
+
+    // Applies basic vulnerability scanning on the cluster.
+    VULNERABILITY_BASIC = 2;
+  }
+
+  // Sets which mode to use for Security Posture features.
+  optional Mode mode = 1;
+
+  // Sets which mode to use for vulnerability scanning.
+  optional VulnerabilityMode vulnerability_mode = 2;
+}
+
 // Node pool configs that apply to all auto-provisioned node pools
 // in autopilot clusters and node auto-provisioning enabled clusters.
 message NodePoolAutoConfig {
@@ -2145,9 +2182,15 @@ message ClusterUpdate {
   // Kubernetes open source beta apis enabled on the cluster. Only beta apis
   K8sBetaAPIConfig enable_k8s_beta_apis = 122;
 
+  // Enable/Disable Security Posture API features for the cluster.
+  SecurityPostureConfig desired_security_posture_config = 124;
+
   // Enable/Disable FQDN Network Policy for the cluster.
   optional bool desired_enable_fqdn_network_policy = 126;
 
+  // The desired workload policy configuration for the autopilot cluster.
+  WorkloadPolicyConfig desired_autopilot_workload_policy_config = 128;
+
   // Desired Beta APIs to be enabled for cluster.
   K8sBetaAPIConfig desired_k8s_beta_apis = 131;
 }
@@ -3956,6 +3999,9 @@ message AcceleratorConfig {
 
   // The configuration for GPU sharing options.
   optional GPUSharingConfig gpu_sharing_config = 5;
+
+  // The configuration for auto installation of GPU driver.
+  optional GPUDriverInstallationConfig gpu_driver_installation_config = 6;
 }
 
 // GPUSharingConfig represents the GPU sharing configuration for Hardware
@@ -3977,6 +4023,28 @@ message GPUSharingConfig {
   optional GPUSharingStrategy gpu_sharing_strategy = 2;
 }
 
+// GPUDriverInstallationConfig specifies the version of GPU driver to be auto
+// installed.
+message GPUDriverInstallationConfig {
+  // The GPU driver version to install.
+  enum GPUDriverVersion {
+    // Default value is to not install any GPU driver.
+    GPU_DRIVER_VERSION_UNSPECIFIED = 0;
+
+    // Disable GPU driver auto installation and needs manual installation
+    INSTALLATION_DISABLED = 1;
+
+    // "Default" GPU driver in COS and Ubuntu.
+    DEFAULT = 2;
+
+    // "Latest" GPU driver in COS.
+    LATEST = 3;
+  }
+
+  // Mode for how the GPU driver is installed.
+  optional GPUDriverVersion gpu_driver_version = 1;
+}
+
 // WorkloadMetadataConfig defines the metadata configuration to expose to
 // workloads on the node pool.
 message WorkloadMetadataConfig {
@@ -4785,6 +4853,16 @@ message SecurityBulletinEvent {
 message Autopilot {
   // Enable Autopilot
   bool enabled = 1;
+
+  // Workload policy configuration for Autopilot.
+  WorkloadPolicyConfig workload_policy_config = 2;
+}
+
+// WorkloadPolicyConfig is the configuration of workload policy for autopilot
+// clusters.
+message WorkloadPolicyConfig {
+  // If true, workloads can use NET_ADMIN capability.
+  optional bool allow_net_admin = 1;
 }
 
 // LoggingConfig is cluster logging configuration.
