Para crear un clúster de Dataproc que use máquinas virtuales confidenciales, usa el comando gcloud dataproc clusters create con la marca --confidential-compute.
Requisitos:
Las instancias maestras y de trabajador deben usar el tipo de máquina N2D (con AMD Secure Encrypted Virtualization [SEV]).
El clúster se debe crear en una región y una zona de Compute Engine que admitan la CPU AMD EPYC Rome (tipo de máquina N2D) que usan las VMs confidenciales (consulta la columna CPUs en Regiones y zonas disponibles).
Puedes ejecutar el siguiente comando para enumerar las CPUs admitidas en una zona de Compute Engine:
gcloud compute zones describe ZONE_NAME --format="value(availableCpuPlatforms)"
gcloud dataproc clusters create cluster-name \
--confidential-compute \
--image-version=Ubuntu image version \
--region=region with zone that supports the AMD EPYC Rome CPU \
--zone=zone within the region that supports the AMD EPYC Rome CPU \
--master-machine-type=N2D machine type \
--worker-machine-type=N2D machine type" \
other args ...
API REST
Para crear un clúster de Dataproc que use máquinas virtuales confidenciales, incluye ConfidentialInstanceConfig como parte de una solicitud clusters.create. Asigna el valor true a enableConfidentialCompute.
Requisitos:
masterConfig.machineTypeUrimasterConfig.machineTypeUri, y, si procede,
secondaryWorkerConfig.machineTypeUri: las instancias de máquina maestra y de trabajador
deben usar el
tipo de máquina N2D
(con AMD Secure Encrypted Virtualization [SEV]).
gceClusterConfig.zoneUri: El clúster debe crearse en una zona de Compute Engine que admita la CPU AMD EPYC Rome N2D que usan las VMs confidenciales (consulta la columna CPUs en Regiones y zonas disponibles).
Puedes ejecutar el siguiente comando para enumerar las CPUs admitidas en una zona de Compute Engine:
gcloud beta compute zones describe "ZONE_NAME --format="value(availableCpuPlatforms)"
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-11 (UTC)."],[[["\u003cp\u003eDataproc clusters can be created with Confidential VMs, which provide inline memory encryption using the N2D machine type with AMD Secure Encrypted Virtualization (SEV).\u003c/p\u003e\n"],["\u003cp\u003eCreating a cluster with confidential VMs using the \u003ccode\u003egcloud\u003c/code\u003e command requires the \u003ccode\u003e--confidential-compute\u003c/code\u003e flag and the use of N2D machine types for both master and worker instances.\u003c/p\u003e\n"],["\u003cp\u003eWhen using the REST API, enable confidential computing by setting \u003ccode\u003eenableConfidentialCompute\u003c/code\u003e to \u003ccode\u003etrue\u003c/code\u003e within the \u003ccode\u003eConfidentialInstanceConfig\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eBoth \u003ccode\u003egcloud\u003c/code\u003e command and REST API methods require the cluster to utilize a supported Ubuntu image and to be created in a region and Compute Engine zone that supports the AMD EPYC Rome CPU.\u003c/p\u003e\n"],["\u003cp\u003eYou can verify supported CPUs in a given zone with the \u003ccode\u003egcloud compute zones describe ZONE_NAME --format="value(availableCpuPlatforms)"\u003c/code\u003e command.\u003c/p\u003e\n"]]],[],null,["You can create a Dataproc cluster that uses\n[Compute Engine Confidential VMs](/confidential-computing/confidential-vm/docs/about-cvm)\nto provide inline memory encryption. Confidential VMs use the [N2D machine type](/compute/docs/machine-types#machine_family_categories) (with AMD Secure\nEncrypted Virtualization (SEV)).\n\nCreate a cluster with confidential VMs \n\ngcloud command\n\nTo create a Dataproc cluster that uses confidential VMs, use the\n`gcloud dataproc clusters create` command\nwith the\n[--confidential-compute](/sdk/gcloud/reference/dataproc/clusters/create#--confidential-compute), flag.\n\nRequirements:\n\n- The master and worker instances must use the [N2D machine type](/compute/docs/machine-types#machine_family_categories) (with AMD Secure Encrypted Virtualization (SEV)).\n- The cluster must use one of the [supported Ubuntu images](/dataproc/docs/concepts/versioning/dataproc-versions#ubuntu_images).\n- The cluster must be created in a region and Compute Engine zone that supports the **AMD EPYC Rome** CPU (N2D machine type) used by confidential VMs (see the **CPUs** column in [Available regions and zones](/compute/docs/regions-zones#available)). You can run the following command to list the CPUs supported in a Compute Engine zone: \n\n ```\n gcloud compute zones describe ZONE_NAME --format=\"value(availableCpuPlatforms)\"\n \n ```\n\n```\ngcloud dataproc clusters create cluster-name \\ \n --confidential-compute \\ \n --image-version=Ubuntu image version \\\n --region=region with zone that supports the AMD EPYC Rome CPU \\\n --zone=zone within the region that supports the AMD EPYC Rome CPU \\\n --master-machine-type=N2D machine type \\ \n --worker-machine-type=N2D machine type\" \\ \n other args ...\n```\n\nREST API\n\nTo create a Dataproc cluster that uses confidential VMs, include\nthe [ConfidentialInstanceConfig](/dataproc/docs/reference/rest/v1/ClusterConfig#confidentialinstanceconfig)\nas part of a\n[clusters.create](/dataproc/docs/reference/rest/v1/projects.regions.clusters/create)\nrequest. Set `enableConfidentialCompute` to `true`.\n\nRequirements:\n\n- `masterConfig.machineTypeUri` `masterConfig.machineTypeUri,` and, if applicable, `secondaryWorkerConfig.machineTypeUri:` Master and worker instances must use the [N2D machine type](/compute/docs/machine-types#machine_family_categories) (with AMD Secure Encrypted Virtualization (SEV)).\n- `softwareConfig.imageVersion:` The cluster must use one of the [supported Ubuntu images](/dataproc/docs/concepts/versioning/dataproc-versions#ubuntu_images).\n- `gceClusterConfig.zoneUri:` The cluster must be created in a Compute Engine zone that supports the N2D **AMD EPYC Rome** CPU used by confidential VMs (see the **CPUs** column in [Available regions and zones](/compute/docs/regions-zones#available)). You can run the following command to list the CPUs supported in a Compute Engine zone: \n\n ```\n gcloud beta compute zones describe \"ZONE_NAME --format=\"value(availableCpuPlatforms)\"\n \n ```"]]
