A set of configuration options describing how a workstation will be run. Workstation configurations are intended to be shared across multiple workstations.
To get more information about WorkstationConfig, see:
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
idle_timeout = "600s"
running_timeout = "21600s"
replica_zones = ["us-central1-a", "us-central1-b"]
annotations = {
label-one = "value-one"
}
labels = {
"label" = "key"
}
host {
gce_instance {
machine_type = "e2-standard-4"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
disable_ssh = false
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
host {
gce_instance {
machine_type = "n1-standard-4"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
enable_nested_virtualization = true
}
}
container {
image = "intellij"
env = {
NAME = "FOO"
BABE = "bar"
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
host {
gce_instance {
machine_type = "e2-standard-4"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
shielded_instance_config {
enable_secure_boot = true
enable_vtpm = true
}
}
}
persistent_directories {
mount_path = "/home"
gce_pd {
size_gb = 200
fs_type = "ext4"
disk_type = "pd-standard"
reclaim_policy = "DELETE"
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_compute_disk" "my_source_disk" {
provider = google-beta
name = "workstation-config"
size = 10
type = "pd-ssd"
zone = "us-central1-a"
}
resource "google_compute_snapshot" "my_source_snapshot" {
provider = google-beta
name = "workstation-config"
source_disk = google_compute_disk.my_source_disk.name
zone = "us-central1-a"
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = google_workstations_workstation_cluster.default.location
persistent_directories {
mount_path = "/home"
gce_pd {
source_snapshot = google_compute_snapshot.my_source_snapshot.id
reclaim_policy = "DELETE"
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
host {
gce_instance {
machine_type = "e2-standard-4"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
shielded_instance_config {
enable_secure_boot = true
enable_vtpm = true
}
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
host {
gce_instance {
machine_type = "n1-standard-2"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
accelerators {
type = "nvidia-tesla-t4"
count = "1"
}
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
host {
gce_instance {
machine_type = "e2-standard-4"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
boost_configs {
id = "boost-1"
machine_type = "n1-standard-2"
accelerators {
type = "nvidia-tesla-t4"
count = "1"
}
}
boost_configs {
id = "boost-1"
machine_type = "e2-standard-2"
}
}
}
}
resource "google_compute_network" "default" {
provider = google-beta
name = "workstation-cluster"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "default" {
provider = google-beta
name = "workstation-cluster"
ip_cidr_range = "10.0.0.0/24"
region = "us-central1"
network = google_compute_network.default.name
}
resource "google_workstations_workstation_cluster" "default" {
provider = google-beta
workstation_cluster_id = "workstation-cluster"
network = google_compute_network.default.id
subnetwork = google_compute_subnetwork.default.id
location = "us-central1"
labels = {
"label" = "key"
}
annotations = {
label-one = "value-one"
}
}
resource "google_kms_key_ring" "default" {
provider = google-beta
name = "workstation-cluster"
location = "us-central1"
}
resource "google_kms_crypto_key" "default" {
provider = google-beta
name = "workstation-cluster"
key_ring = google_kms_key_ring.default.id
}
resource "google_service_account" "default" {
provider = google-beta
account_id = "my-account"
display_name = "Service Account"
}
resource "google_workstations_workstation_config" "default" {
provider = google-beta
workstation_config_id = "workstation-config"
workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
location = "us-central1"
host {
gce_instance {
machine_type = "e2-standard-4"
boot_disk_size_gb = 35
disable_public_ip_addresses = true
shielded_instance_config {
enable_secure_boot = true
enable_vtpm = true
}
}
}
encryption_key {
kms_key = google_kms_crypto_key.default.id
kms_key_service_account = google_service_account.default.email
}
}
The following arguments are supported:
workstation_config_id
-
(Required)
The ID to be assigned to the workstation cluster config.
workstation_cluster_id
-
(Required)
The ID of the parent workstation cluster.
location
-
(Required)
The location where the workstation cluster config should reside.
display_name
-
(Optional)
Human-readable name for this resource.
labels
-
(Optional)
Client-specified labels that are applied to the resource and that are also propagated to the underlying Compute Engine resources.
Note: This field is non-authoritative, and will only manage the labels present in your configuration.
Please refer to the field effective_labels
for all of the labels present on the resource.
annotations
-
(Optional)
Client-specified annotations. This is distinct from labels.
Note: This field is non-authoritative, and will only manage the annotations present in your configuration.
Please refer to the field effective_annotations
for all of the annotations present on the resource.
idle_timeout
-
(Optional)
How long to wait before automatically stopping an instance that hasn't recently received any user traffic. A value of 0 indicates that this instance should never time out from idleness. Defaults to 20 minutes.
A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
running_timeout
-
(Optional)
How long to wait before automatically stopping a workstation after it was started. A value of 0 indicates that workstations using this configuration should never time out from running duration. Must be greater than 0 and less than 24 hours if encryption_key
is set. Defaults to 12 hours.
A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
replica_zones
-
(Optional)
Specifies the zones used to replicate the VM and disk resources within the region. If set, exactly two zones within the workstation cluster's region must be specified—for example, ['us-central1-a', 'us-central1-f']
.
If this field is empty, two default zones within the region are used. Immutable after the workstation configuration is created.
enable_audit_agent
-
(Optional)
Whether to enable Linux auditd
logging on the workstation. When enabled, a service account must also be specified that has logging.buckets.write
permission on the project. Operating system audit logging is distinct from Cloud Audit Logs.
host
-
(Optional)
Runtime host for a workstation.
Structure is documented below.
persistent_directories
-
(Optional)
Directories to persist across workstation sessions.
Structure is documented below.
ephemeral_directories
-
(Optional)
Ephemeral directories which won't persist across workstation sessions.
Structure is documented below.
container
-
(Optional)
Container that will be run for each workstation using this configuration when that workstation is started.
Structure is documented below.
encryption_key
-
(Optional)
Encrypts resources of this workstation configuration using a customer-managed encryption key.
If specified, the boot disk of the Compute Engine instance and the persistent disk are encrypted using this encryption key. If this field is not set, the disks are encrypted using a generated key. Customer-managed encryption keys do not protect disk metadata.
If the customer-managed encryption key is rotated, when the workstation instance is stopped, the system attempts to recreate the persistent disk with the new version of the key. Be sure to keep older versions of the key until the persistent disk is recreated. Otherwise, data on the persistent disk will be lost.
If the encryption key is revoked, the workstation session will automatically be stopped within 7 hours.
Structure is documented below.
readiness_checks
-
(Optional)
Readiness checks to be performed on a workstation.
Structure is documented below.
disable_tcp_connections
-
(Optional)
Disables support for plain TCP connections in the workstation. By default the service supports TCP connections via a websocket relay. Setting this option to true disables that relay, which prevents the usage of services that require plain tcp connections, such as ssh. When enabled, all communication must occur over https or wss.
project
- (Optional) The ID of the project in which the resource belongs.
If it is not provided, the provider project is used.
gce_instance
-
(Optional)
A runtime using a Compute Engine instance.
Structure is documented below.The gce_instance
block supports:
machine_type
-
(Optional)
The name of a Compute Engine machine type.
service_account
-
(Optional)
Email address of the service account that will be used on VM instances used to support this config. This service account must have permission to pull the specified container image. If not set, VMs will run without a service account, in which case the image must be publicly accessible.
service_account_scopes
-
(Optional)
Scopes to grant to the service_account. Various scopes are automatically added based on feature usage. When specified, users of workstations under this configuration must have iam.serviceAccounts.actAs
on the service account.
pool_size
-
(Optional)
Number of instances to pool for faster workstation startup.
boot_disk_size_gb
-
(Optional)
Size of the boot disk in GB.
tags
-
(Optional)
Network tags to add to the Compute Engine machines backing the Workstations.
disable_public_ip_addresses
-
(Optional)
Whether instances have no public IP address.
disable_ssh
-
(Optional)
Whether to disable SSH access to the VM.
enable_nested_virtualization
-
(Optional)
Whether to enable nested virtualization on the Compute Engine VMs backing the Workstations.
See https://cloud.google.com/workstations/docs/reference/rest/v1beta/projects.locations.workstationClusters.workstationConfigs#GceInstance.FIELDS.enable_nested_virtualization
shielded_instance_config
-
(Optional)
A set of Compute Engine Shielded instance options.
Structure is documented below.
confidential_instance_config
-
(Optional)
A set of Compute Engine Confidential VM instance options.
Structure is documented below.
accelerators
-
(Optional)
An accelerator card attached to the instance.
Structure is documented below.
boost_configs
-
(Optional)
A list of the boost configurations that workstations created using this workstation configuration are allowed to use.
Structure is documented below.
The shielded_instance_config
block supports:
enable_secure_boot
-
(Optional)
Whether the instance has Secure Boot enabled.
enable_vtpm
-
(Optional)
Whether the instance has the vTPM enabled.
enable_integrity_monitoring
-
(Optional)
Whether the instance has integrity monitoring enabled.
The confidential_instance_config
block supports:
enable_confidential_compute
-
(Optional)
Whether the instance has confidential compute enabled.The accelerators
block supports:
type
-
(Required)
Type of accelerator resource to attach to the instance, for example, "nvidia-tesla-p100".
count
-
(Required)
Number of accelerator cards exposed to the instance.
The boost_configs
block supports:
id
-
(Required)
The id to be used for the boost config.
machine_type
-
(Optional)
The type of machine that boosted VM instances will use—for example, e2-standard-4. For more information about machine types that Cloud Workstations supports, see the list of available machine types https://cloud.google.com/workstations/docs/available-machine-types. Defaults to e2-standard-4.
accelerators
-
(Optional)
An accelerator card attached to the boost instance.
Structure is documented below.
The accelerators
block supports:
type
-
(Required)
Type of accelerator resource to attach to the instance, for example, "nvidia-tesla-p100".
count
-
(Required)
Number of accelerator cards exposed to the instance.
The persistent_directories
block supports:
mount_path
-
(Optional)
Location of this directory in the running workstation.
gce_pd
-
(Optional)
A directory to persist across workstation sessions, backed by a Compute Engine regional persistent disk. Can only be updated if not empty during creation.
Structure is documented below.
fs_type
-
(Optional)
Type of file system that the disk should be formatted with. The workstation image must support this file system type. Must be empty if sourceSnapshot
is set. Defaults to ext4
.
disk_type
-
(Optional)
The type of the persistent disk for the home directory. Defaults to pd-standard
.
size_gb
-
(Optional)
The GB capacity of a persistent home directory for each workstation created with this configuration. Must be empty if sourceSnapshot
is set.
Valid values are 10
, 50
, 100
, 200
, 500
, or 1000
. Defaults to 200
. If less than 200
GB, the diskType
must be pd-balanced
or pd-ssd
.
reclaim_policy
-
(Optional)
Whether the persistent disk should be deleted when the workstation is deleted. Valid values are DELETE
and RETAIN
. Defaults to DELETE
.
Possible values are: DELETE
, RETAIN
.
source_snapshot
-
(Optional)
Name of the snapshot to use as the source for the disk. This can be the snapshot's self_link
, id
, or a string in the format of projects/{project}/global/snapshots/{snapshot}
. If set, sizeGb
and fsType
must be empty. Can only be updated if it has an existing value.
The ephemeral_directories
block supports:
mount_path
-
(Optional)
Location of this directory in the running workstation.
gce_pd
-
(Optional)
An EphemeralDirectory backed by a Compute Engine persistent disk.
Structure is documented below.
disk_type
-
(Optional)
Type of the disk to use. Defaults to "pd-standard"
.
source_snapshot
-
(Optional)
Name of the snapshot to use as the source for the disk.
Must be empty if sourceImage
is set.
Must be empty if read_only
is false.
Updating source_snapshot
will update content in the ephemeral directory after the workstation is restarted.
source_image
-
(Optional)
Name of the disk image to use as the source for the disk.
Must be empty sourceSnapshot
is set.
Updating sourceImage
will update content in the ephemeral directory after the workstation is restarted.
read_only
-
(Optional)
Whether the disk is read only. If true, the disk may be shared by multiple VMs and sourceSnapshot
must be set.
image
-
(Optional)
Docker image defining the container. This image must be accessible by the config's service account.
command
-
(Optional)
If set, overrides the default ENTRYPOINT specified by the image.
args
-
(Optional)
Arguments passed to the entrypoint.
working_dir
-
(Optional)
If set, overrides the default DIR specified by the image.
env
-
(Optional)
Environment variables passed to the container.
The elements are of the form "KEY=VALUE" for the environment variable "KEY" being given the value "VALUE".
run_as_user
-
(Optional)
If set, overrides the USER specified in the image with the given uid.
The encryption_key
block supports:
kms_key
-
(Required)
The name of the Google Cloud KMS encryption key.
kms_key_service_account
-
(Required)
The service account to use with the specified KMS key.
The readiness_checks
block supports:
path
-
(Required)
Path to which the request should be sent.
port
-
(Required)
Port to which the request should be sent.
In addition to the arguments listed above, the following computed attributes are exported:
id
- an identifier for the resource with format projects/{{project}}/locations/{{location}}/workstationClusters/{{workstation_cluster_id}}/workstationConfigs/{{workstation_config_id}}
name
-
Full name of this resource.
uid
-
The system-generated UID of the resource.
etag
-
Checksum computed by the server.
May be sent on update and delete requests to ensure that the client has an up-to-date value before proceeding.
create_time
-
Time when this resource was created.
degraded
-
Whether this resource is in degraded mode, in which case it may require user action to restore full functionality. Details can be found in the conditions field.
conditions
-
Status conditions describing the current resource state.
Structure is documented below.
terraform_labels
-
The combination of labels configured directly on the resource
and default labels configured on the provider.
effective_labels
-
All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
effective_annotations
-
All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
The conditions
block contains:
code
-
(Output)
The status code, which should be an enum value of google.rpc.Code.
message
-
(Output)
Human readable message indicating details about the current status.
details
-
(Output)
A list of messages that carry the error details.
This resource provides the following Timeouts configuration options:
create
- Default is 30 minutes.update
- Default is 30 minutes.delete
- Default is 30 minutes.WorkstationConfig can be imported using any of these accepted formats:
projects/{{project}}/locations/{{location}}/workstationClusters/{{workstation_cluster_id}}/workstationConfigs/{{workstation_config_id}}
{{project}}/{{location}}/{{workstation_cluster_id}}/{{workstation_config_id}}
{{location}}/{{workstation_cluster_id}}/{{workstation_config_id}}
In Terraform v1.5.0 and later, use an import
block to import WorkstationConfig using one of the formats above. For example:
import {
id = "projects/{{project}}/locations/{{location}}/workstationClusters/{{workstation_cluster_id}}/workstationConfigs/{{workstation_config_id}}"
to = google_workstations_workstation_config.default
}
When using the terraform import
command, WorkstationConfig can be imported using one of the formats above. For example:
$ terraform import google_workstations_workstation_config.default projects/{{project}}/locations/{{location}}/workstationClusters/{{workstation_cluster_id}}/workstationConfigs/{{workstation_config_id}}
$ terraform import google_workstations_workstation_config.default {{project}}/{{location}}/{{workstation_cluster_id}}/{{workstation_config_id}}
$ terraform import google_workstations_workstation_config.default {{location}}/{{workstation_cluster_id}}/{{workstation_config_id}}
This resource supports User Project Overrides.