HTCondor tutorial: Secure Boot error

[jd-foster]

Hi all, I'm a new user here, trying out the HTCondor Tutorial through the Google Cloud Shell.
I've managed to get through most of the set-up phase, however I am stopped after receiving the following error:

==> htcondor-pool.googlecompute.toolkit_image: Checking image does not exist...
==> htcondor-pool.googlecompute.toolkit_image: Creating temporary RSA SSH key for instance...
==> htcondor-pool.googlecompute.toolkit_image: no persistent disk to create
==> htcondor-pool.googlecompute.toolkit_image: Using image: hpc-rocky-linux-8-v20230727
==> htcondor-pool.googlecompute.toolkit_image: Creating instance...
    htcondor-pool.googlecompute.toolkit_image: Loading zone: australia-southeast1-c
    htcondor-pool.googlecompute.toolkit_image: Loading machine type: n2-standard-4
    htcondor-pool.googlecompute.toolkit_image: Requesting instance creation...
==> htcondor-pool.googlecompute.toolkit_image: Error creating instance: googleapi: Error 412: Constraint constraints/compute.requireShieldedVm violated for project projects/gcel-prod-6b01. Secure Boot is not enabled in the 'shielded_instance_config' field. See https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints for more information., conditionNotMet

Note that the policy compute.requireShieldedVm is enforced and inherited from organisation policy.
Is there a way to enable Secure Boot for provisioning here?
Thanks in advance for any help.

[mr0re1]

Hello @jd-foster ,
Looks like it's a mater of setting fields
enable_secure_boot (maybe enable_vtpm as well) fields of googlecompute builder to true.
Sadly our current packer module custom-image used in this tutorial doesn't support those fields yet.

I've create a feature request to add those fields. I will update this topic with ETA soon.

[tpdownes]

@jd-foster #1682 will add the features necessary to the Packer module to boot Shielded VMs with independent controls for Secure Boot, vTPM, and Integrity Monitoring. It will take some additional work to add the same settings for the HTCondor modules, though. I will give you an update on that after assessing the work involved.

It may help if you reach out through your account team (I believe CSIRO has one) to contact the HPC Toolkit team and describe your project.

[tpdownes]

We will not be able to address the subsequent changes to HTCondor modules until next week, however the work should not be too complex. I've created a task to do so and will update here when I complete it.

[jd-foster]

Thank you for your help with this, and responsive replies.

[tpdownes]

The current state of develop branch should have a complete set of fixes for your needs. The example has been modified to enable all Shielded VM features (incl. Secure Boot) by default. You should just need to modify the tutorial to run:

git checkout develop
git pull

after git clone and before make.

[jd-foster]

Thanks Tom! I've have been testing the develop branch and it does indeed fix the issue. I appreciate your work on this.

[tpdownes]

I encourage you to reach out through your sales rep ("FSR") if you run into issues getting real workloads running. Would love to have feedback on HTCondor specifically.

[jd-foster]

Yes, will do. I've now connected with a sales rep here too.