Add support for nested virtualization on GCE instances

api/v1beta1/gcpmachine_types.go

@@ -365,6 +365,13 @@ type GCPMachineSpec struct {
 	// attached to the instance.
 	// +optional
 	GuestAccelerators []Accelerator `json:"guestAccelerators,omitempty"`
+
+	// EnableNestedVirtualization specifies whether to enable nested virtualization or not
+	// (default is false). Nested virtualization allows VMs to run inside other VMs.
+	// Note: Requires at minimum "Intel Haswell" CPU platform.
+	// This field cannot be changed after instance creation.
+	// +optional
+	EnableNestedVirtualization *bool `json:"enableNestedVirtualization,omitempty"`
 }
 
 // Accelerator is a specification of the type and number of accelerator

cloud/scope/machine.go

@@ -493,6 +493,12 @@ func (m *MachineScope) InstanceSpec(log logr.Logger) *compute.Instance {
 		instance.Scheduling.OnHostMaintenance = "TERMINATE"
 	}
 
+	if m.GCPMachine.Spec.EnableNestedVirtualization != nil && *m.GCPMachine.Spec.EnableNestedVirtualization {
+		instance.AdvancedMachineFeatures = &compute.AdvancedMachineFeatures{
+			EnableNestedVirtualization: true,
+		}
+	}
+
 	return instance
 }
 

config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmachines.yaml

@@ -208,6 +208,13 @@ spec:
                 - AMDEncryptedVirtualizationNestedPaging
                 - IntelTrustedDomainExtensions
                 type: string
+              enableNestedVirtualization:
+                description: |-
+                  EnableNestedVirtualization specifies whether to enable nested virtualization or not
+                  (default is false). Nested virtualization allows VMs to run inside other VMs.
+                  Note: Requires at minimum "Intel Haswell" CPU platform.
+                  This field cannot be changed after instance creation.
+                type: boolean
               guestAccelerators:
                 description: |-
                   GuestAccelerators is a list of the type and count of accelerator cards

config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmachinetemplates.yaml

@@ -223,6 +223,13 @@ spec:
                         - AMDEncryptedVirtualizationNestedPaging
                         - IntelTrustedDomainExtensions
                         type: string
+                      enableNestedVirtualization:
+                        description: |-
+                          EnableNestedVirtualization specifies whether to enable nested virtualization or not
+                          (default is false). Nested virtualization allows VMs to run inside other VMs.
+                          Note: Requires at minimum "Intel Haswell" CPU platform.
+                          This field cannot be changed after instance creation.
+                        type: boolean
                       guestAccelerators:
                         description: |-
                           GuestAccelerators is a list of the type and count of accelerator cards

docs/book/src/SUMMARY.md

@@ -19,6 +19,7 @@
     - [Conformance](./topics/conformance.md)
     - [Machine Locations](./topics/machine-locations.md)
     - [Preemptible VMs](./topics/preemptible-vms.md)
+    - [Nested Virtualization](./topics/nested-virtualization.md)
 - [Developer Guide](./developers/index.md)
     - [Development](./developers/development.md)
     - [Try unreleased changes with Nightly Builds](./developers/nightlies.md)

docs/book/src/topics/nested-virtualization.md

@@ -0,0 +1,21 @@
+# Nested Virtualization
+
+Enable nested virtualization to run VMs inside GCE instances via the `enableNestedVirtualization` field. This allows running container sandboxes, KVM, QEMU, or other hypervisors inside the instance. Requires Intel Haswell or later CPU platforms.
+
+```yaml
+---
+apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+kind: GCPMachineTemplate
+metadata:
+  name: mygcpmachinetemplate
+  namespace: mynamespace
+spec:
+  template:
+    spec:
+      instanceType: n2-standard-8
+      enableNestedVirtualization: true
+```
+
+https://cloud.google.com/compute/docs/instances/nested-virtualization/overview
+
+NOTE: Nested virtualization must be enabled at instance creation time and cannot be changed after the instance is created.