Skip to content

Commit

Permalink
r\linux_virtual_machine_scale_set `r\windows_virtual_machine_scale_…
Browse files Browse the repository at this point in the history 
…set`: Add support for confidential vm
  • Loading branch information
@myc2h6o
myc2h6o committed May 23, 2022
1 parent eba69c7 commit e85053d
Show file tree
Hide file tree
Showing 7 changed files with 598 additions and 43 deletions.
207 changes: 207 additions & 0 deletions internal/services/compute/linux_virtual_machine_scale_set_disk_os_resource_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,36 @@ func TestAccLinuxVirtualMachineScaleSet_disksOSDiskWriteAcceleratorEnabled(t *te
})
}

func TestAccLinuxVirtualMachineScaleSet_disksOSDiskConfidentialVmWithGuestStateOnly(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_linux_virtual_machine_scale_set", "test")
r := LinuxVirtualMachineScaleSetResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.disksOSDiskConfidentialVmWithGuestStateOnly(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("admin_password"),
})
}

func TestAccLinuxVirtualMachineScaleSet_disksOSDiskConfidentialVmWithDiskAndVMGuestStateCMK(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_linux_virtual_machine_scale_set", "test")
r := LinuxVirtualMachineScaleSetResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.disksOSDiskConfidentialVmWithDiskAndVMGuestStateCMK(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("admin_password"),
})
}

func (r LinuxVirtualMachineScaleSetResource) disksOSDiskCaching(data acceptance.TestData, caching string) string {
return fmt.Sprintf(`
%s
Expand Down Expand Up @@ -534,3 +564,180 @@ resource "azurerm_linux_virtual_machine_scale_set" "test" {
}
`, r.template(data), data.RandomInteger, enabled)
}

func (r LinuxVirtualMachineScaleSetResource) disksOSDiskConfidentialVmWithGuestStateOnly(data acceptance.TestData) string {
// Confidential VM has limited region support
data.Locations.Primary = "northeurope"
return fmt.Sprintf(`
%s
resource "azurerm_linux_virtual_machine_scale_set" "test" {
name = "acctestvmss-%d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
sku = "Standard_DC2as_v5"
instances = 1
admin_username = "adminuser"
admin_password = "P@ssword1234!"
disable_password_authentication = false
source_image_reference {
publisher = "Canonical"
offer = "0001-com-ubuntu-confidential-vm-focal"
sku = "20_04-lts-cvm"
version = "latest"
}
os_disk {
storage_account_type = "Premium_LRS"
caching = "None"
security_encryption_type = "VMGuestStateOnly"
}
network_interface {
name = "example"
primary = true
ip_configuration {
name = "internal"
primary = true
subnet_id = azurerm_subnet.test.id
}
}
vtpm_enabled = true
secure_boot_enabled = true
}
`, r.template(data), data.RandomInteger)
}

func (r LinuxVirtualMachineScaleSetResource) disksOSDiskConfidentialVmWithDiskAndVMGuestStateCMK(data acceptance.TestData) string {
// Confidential VM has limited region support
data.Locations.Primary = "northeurope"
return fmt.Sprintf(`
provider "azurerm" {
features {
key_vault {
recover_soft_deleted_key_vaults = false
purge_soft_delete_on_destroy = false
purge_soft_deleted_keys_on_destroy = false
}
}
}
%[1]s
resource "azurerm_linux_virtual_machine_scale_set" "test" {
name = "acctestvmss-%d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
sku = "Standard_DC2as_v5"
instances = 1
admin_username = "adminuser"
admin_password = "P@ssword1234!"
disable_password_authentication = false
source_image_reference {
publisher = "Canonical"
offer = "0001-com-ubuntu-confidential-vm-focal"
sku = "20_04-lts-cvm"
version = "latest"
}
os_disk {
storage_account_type = "Premium_LRS"
caching = "None"
security_encryption_type = "VMGuestStateOnly"
}
network_interface {
name = "example"
primary = true
ip_configuration {
name = "internal"
primary = true
subnet_id = azurerm_subnet.test.id
}
}
vtpm_enabled = true
secure_boot_enabled = true
depends_on = [
azurerm_key_vault_access_policy.disk-encryption,
]
}
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "test" {
name = "acctestkv%[3]s"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
sku_name = "premium"
tenant_id = data.azurerm_client_config.current.tenant_id
enabled_for_disk_encryption = true
soft_delete_retention_days = 7
purge_protection_enabled = true
}
resource "azurerm_key_vault_access_policy" "service-principal" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
key_permissions = [
"Create",
"Delete",
"Get",
"Purge",
"Update",
]
secret_permissions = [
"Get",
"Delete",
"Set",
]
}
resource "azurerm_key_vault_key" "test" {
name = "examplekey"
key_vault_id = azurerm_key_vault.test.id
key_type = "RSA-HSM"
key_size = 2048
key_opts = [
"decrypt",
"encrypt",
"sign",
"unwrapKey",
"verify",
"wrapKey",
]
depends_on = [azurerm_key_vault_access_policy.service-principal]
}
resource "azurerm_disk_encryption_set" "test" {
name = "acctestdes-%[2]d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
key_vault_key_id = azurerm_key_vault_key.test.id
encryption_type = "ConfidentialVmEncryptedWithCustomerKey"
identity {
type = "SystemAssigned"
}
}
resource "azurerm_key_vault_access_policy" "disk-encryption" {
key_vault_id = azurerm_key_vault.test.id
key_permissions = [
"Get",
"WrapKey",
"UnwrapKey",
]
tenant_id = azurerm_disk_encryption_set.test.identity.0.tenant_id
object_id = azurerm_disk_encryption_set.test.identity.0.principal_id
}
`, r.template(data), data.RandomInteger, data.RandomString)
}
64 changes: 52 additions & 12 deletions internal/services/compute/linux_virtual_machine_scale_set_resource.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,11 @@ func resourceLinuxVirtualMachineScaleSetCreate(d *pluginsdk.ResourceData, meta i
}

osDiskRaw := d.Get("os_disk").([]interface{})
osDisk := ExpandVirtualMachineScaleSetOSDisk(osDiskRaw, compute.OperatingSystemTypesLinux)
osDisk, err := ExpandVirtualMachineScaleSetOSDisk(osDiskRaw, compute.OperatingSystemTypesLinux)
if err != nil {
return fmt.Errorf("expanding `os_disk`: %+v", err)
}
securityEncryptionType := osDiskRaw[0].(map[string]interface{})["security_encryption_type"].(string)

planRaw := d.Get("plan").([]interface{})
plan := expandPlan(planRaw)
Expand Down Expand Up @@ -229,31 +233,59 @@ func resourceLinuxVirtualMachineScaleSetCreate(d *pluginsdk.ResourceData, meta i
}

if encryptionAtHostEnabled, ok := d.GetOk("encryption_at_host_enabled"); ok {
if encryptionAtHostEnabled.(bool) {
if compute.SecurityEncryptionTypesDiskWithVMGuestState == compute.SecurityEncryptionTypes(securityEncryptionType) {
return fmt.Errorf("`encryption_at_host_enabled` cannot be set to `true` when `os_disk.0.security_encryption_type` is set to `DiskWithVMGuestState`")
}
}

virtualMachineProfile.SecurityProfile = &compute.SecurityProfile{
EncryptionAtHost: utils.Bool(encryptionAtHostEnabled.(bool)),
}
}

if secureBootEnabled, ok := d.GetOk("secure_boot_enabled"); ok && secureBootEnabled.(bool) {
if virtualMachineProfile.SecurityProfile == nil {
virtualMachineProfile.SecurityProfile = &compute.SecurityProfile{}
secureBootEnabled := d.Get("secure_boot_enabled").(bool)
vtpmEnabled := d.Get("vtpm_enabled").(bool)
if securityEncryptionType != "" {
if !secureBootEnabled {
return fmt.Errorf("`secure_boot_enabled` must be set to `true` when `os_disk.0.security_encryption_type` is specified")
}
if virtualMachineProfile.SecurityProfile.UefiSettings == nil {
virtualMachineProfile.SecurityProfile.UefiSettings = &compute.UefiSettings{}
if !vtpmEnabled {
return fmt.Errorf("`vtpm_enabled` must be set to `true` when `os_disk.0.security_encryption_type` is specified")
}
virtualMachineProfile.SecurityProfile.SecurityType = compute.SecurityTypesTrustedLaunch
virtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled = utils.Bool(secureBootEnabled.(bool))
}

if vtpmEnabled, ok := d.GetOk("vtpm_enabled"); ok && vtpmEnabled.(bool) {
if virtualMachineProfile.SecurityProfile == nil {
virtualMachineProfile.SecurityProfile = &compute.SecurityProfile{}
}
virtualMachineProfile.SecurityProfile.SecurityType = compute.SecurityTypesConfidentialVM

if virtualMachineProfile.SecurityProfile.UefiSettings == nil {
virtualMachineProfile.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}
virtualMachineProfile.SecurityProfile.SecurityType = compute.SecurityTypesTrustedLaunch
virtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled = utils.Bool(vtpmEnabled.(bool))
virtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled = utils.Bool(true)
virtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled = utils.Bool(true)
} else {
if secureBootEnabled {
if virtualMachineProfile.SecurityProfile == nil {
virtualMachineProfile.SecurityProfile = &compute.SecurityProfile{}
}
if virtualMachineProfile.SecurityProfile.UefiSettings == nil {
virtualMachineProfile.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}
virtualMachineProfile.SecurityProfile.SecurityType = compute.SecurityTypesTrustedLaunch
virtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled = utils.Bool(secureBootEnabled)
}

if vtpmEnabled {
if virtualMachineProfile.SecurityProfile == nil {
virtualMachineProfile.SecurityProfile = &compute.SecurityProfile{}
}
if virtualMachineProfile.SecurityProfile.UefiSettings == nil {
virtualMachineProfile.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}
virtualMachineProfile.SecurityProfile.SecurityType = compute.SecurityTypesTrustedLaunch
virtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled = utils.Bool(vtpmEnabled)
}
}

if v, ok := d.GetOk("user_data"); ok {
Expand Down Expand Up @@ -595,6 +627,14 @@ func resourceLinuxVirtualMachineScaleSetUpdate(d *pluginsdk.ResourceData, meta i
}

if d.HasChange("encryption_at_host_enabled") {
if d.Get("encryption_at_host_enabled").(bool) {
osDiskRaw := d.Get("os_disk").([]interface{})
securityEncryptionType := osDiskRaw[0].(map[string]interface{})["security_encryption_type"].(string)
if compute.SecurityEncryptionTypesDiskWithVMGuestState == compute.SecurityEncryptionTypes(securityEncryptionType) {
return fmt.Errorf("`encryption_at_host_enabled` cannot be set to `true` when `os_disk.0.security_encryption_type` is set to `DiskWithVMGuestState`")
}
}

updateProps.VirtualMachineProfile.SecurityProfile = &compute.SecurityProfile{
EncryptionAtHost: utils.Bool(d.Get("encryption_at_host_enabled").(bool)),
}
Expand Down
Loading

0 comments on commit e85053d

Please sign in to comment.