Enabling secure boot on an existing nodepool is failing

[shako92]

Hello, we tried to enable secure boot on an existing node pool, but its failing.

NP Config: added enable_secure_boot:true

      {
        name = "node-pool"
        machine_type = "n1-standard-8"
        local_ssd_count = 0
        disk_size_gb = 100
        disk_type = "pd-standard"
        image_type = "COS_CONTAINERD"
        auto_repair = true
        auto_upgrade = false
        preemptible = false
        initial_node_count = 1
        min_count = 1
        max_count = 10
        default_max_pods_per_node = 32
        max_surge = 1
        max_unavailable = 0
        version = "1.18.16-gke.502"
        enable_secure_boot = true
      }

PLAN RELATED TO CHANGE:

taint             = [] -> (known after apply)
~ shielded_instance_config {
    enable_integrity_monitoring = true
    ~ enable_secure_boot          = false -> true # forces replacement
}
--

ERROR:

Error: error creating NodePool: googleapi: Error 409: Already exists: projects/PROJECT/locations/us-central1/clusters/CLUSTER/nodePools/NP., alreadyExists

TRIED:

To update file cluster.tf and add in "beta-private-cluster-update-variant/cluster.tf", under force_node_pool_recreation_resources, enable_secure_boot, but this did not help.

Please let me know how we should proceed in here?

Thanks

[shako92]

Ideally it should create a new NP, migrate workloads and then shutdown the old one right? Because this operation requires NP recreation

[morgante]

To update file cluster.tf and add in "beta-private-cluster-update-variant/cluster.tf", under force_node_pool_recreation_resources, enable_secure_boot, but this did not help.

What happened when you tried this? I have a feeling the change might not have been properly applied, because the fix here most likely is to put secure boot in the triggers for node pool naming.

[skakauridze-clgx]

Actually it was still complaining that NodePool exists, I'll try to reran and make sure the latest push was in place and get back

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days