Skip to content

Commit 7842cd9

Browse files
SandidoSandido
authored
Add SecurityType of Standard to VM and VMSS cmdlets for Trusted Launch, includes breaking changes (#22534)
* initial dev * successful test 1 * vmss test and rest of dev * vmss with config test * vm with config test * tests fixed maybe 1 fails * static analysis * remove vmss validation * null check * changelog and help doc * constant values * clean * valids and clean * Update BreakingChangeIssues.csv * remove breaking * Update BreakingChangeIssues.csv
1 parent c600245 commit 7842cd9

32 files changed

+12337
-79
lines changed

‎src/Compute/Compute.Test/ScenarioTests/DiskRPTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,5 +163,12 @@ public void TestDiskAcceleratedNetworkAndPublicNetworkAccess()
163163
{
164164
TestRunner.RunTestScript("Test-DiskAcceleratedNetworkAndPublicNetworkAccess");
165165
}
166+
167+
[Fact]
168+
[Trait(Category.AcceptanceType, Category.LiveOnly)]
169+
public void TestSecurityProfileStandard()
170+
{
171+
TestRunner.RunTestScript("Test-SecurityProfileStandard");
172+
}
166173
}
167174
}

‎src/Compute/Compute.Test/ScenarioTests/DiskRPTests.ps1

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1518,6 +1518,35 @@ function Test-SecurityProfile
15181518
}
15191519
}
15201520

1521+
<#
1522+
.SYNOPSIS
1523+
Test Set-AzDiskSecurityProfile with the Standard securityType.
1524+
There should be no securityProfile made for Standard at this time.
1525+
#>
1526+
function Test-SecurityProfileStandard
1527+
{
1528+
$rgname = Get-ComputeTestResourceName;
1529+
$loc = "eastus2";
1530+
1531+
try
1532+
{
1533+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
1534+
1535+
# Standard SecurityType
1536+
$diskconfig = New-AzDiskConfig -Location $loc -DiskSizeGB 1 -AccountType "Premium_LRS" -OsType "Windows" -CreateOption "Empty" -HyperVGeneration "V1";
1537+
$diskname = "diskstnd" + $rgname;
1538+
$diskconfig = Set-AzDiskSecurityProfile -Disk $diskconfig -SecurityType "Standard";
1539+
$diskPr = New-AzDisk -ResourceGroupName $rgname -DiskName $diskname -Disk $diskconfig;
1540+
$disk = Get-AzDisk -ResourceGroupName $rgname -DiskName $diskname;
1541+
Assert-Null $disk.SecurityProfile;
1542+
}
1543+
finally
1544+
{
1545+
# Cleanup
1546+
Clean-ResourceGroup $rgname
1547+
}
1548+
}
1549+
15211550
<#
15221551
.SYNOPSIS
15231552
Test SupportsHibernation Parameter

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.cs

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,5 +339,19 @@ public void TestVirtualMachineScaleSetSecurityTypeWithoutConfig()
339339
{
340340
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeWithoutConfig");
341341
}
342+
343+
[Fact]
344+
[Trait(Category.AcceptanceType, Category.CheckIn)]
345+
public void TestVirtualMachineScaleSetSecurityTypeStandard()
346+
{
347+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeStandard");
348+
}
349+
350+
[Fact]
351+
[Trait(Category.AcceptanceType, Category.CheckIn)]
352+
public void TestVirtualMachineScaleSetSecurityTypeStandardWithConfig()
353+
{
354+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeStandardWithConfig");
355+
}
342356
}
343357
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.ps1

Lines changed: 112 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4527,7 +4527,6 @@ function Test-VirtualMachineScaleSetSecurityType
45274527
}
45284528
}
45294529

4530-
45314530
<#
45324531
.SYNOPSIS
45334532
Test Virtual Machine Scale Set VtpmEabled and SecureBootEnabled
@@ -4605,3 +4604,115 @@ function Test-VirtualMachineScaleSetSecurityTypeWithoutConfig
46054604
Clean-ResourceGroup $rgname;
46064605
}
46074606
}
4607+
4608+
<#
4609+
.SYNOPSIS
4610+
Test Virtual Machine Scale Set with SecurityType of Standard.
4611+
#>
4612+
function Test-VirtualMachineScaleSetSecurityTypeStandard
4613+
{
4614+
# Setup
4615+
$rgname = Get-ComputeTestResourceName;
4616+
$loc = Get-ComputeVMLocation;
4617+
4618+
try
4619+
{
4620+
# Common
4621+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
4622+
4623+
$vmssSize = 'Standard_D4s_v3';
4624+
$vmssName1 = 'vmss1' + $rgname;
4625+
$imageName = "Win2016DataCenterGenSecond";
4626+
$PublisherName = "MicrosoftWindowsServer";
4627+
$Offer = "WindowsServer";
4628+
$SKU = "2016-datacenter-gensecond";
4629+
$domainNameLabel1 = "d1" + $rgname;
4630+
$disable = $false;
4631+
$enable = $true;
4632+
$securityTypeStnd = "Standard";
4633+
$adminUsername = Get-ComputeTestResourceName;
4634+
$adminPassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force;
4635+
$vmCred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
4636+
4637+
# Create Vmss
4638+
$vmss = New-AzVmss -ResourceGroupName $rgname -Credential $vmCred -VMScaleSetName $vmssName1 -ImageName $imageName -DomainNameLabel $domainNameLabel1 -SecurityType $securityTypeStnd;
4639+
4640+
Assert-Null $vmss.VirtualMachineProfile.SecurityProfile;
4641+
}
4642+
finally
4643+
{
4644+
# Cleanup
4645+
Clean-ResourceGroup $rgname;
4646+
}
4647+
}
4648+
4649+
<#
4650+
.SYNOPSIS
4651+
Test Virtual Machine Scale Set with SecurityType of Standard with Config.
4652+
No SecurityPRofile should be made for now in this scenario.
4653+
#>
4654+
function Test-VirtualMachineScaleSetSecurityTypeStandardWithConfig
4655+
{
4656+
# Setup
4657+
$rgname = Get-ComputeTestResourceName;
4658+
$loc = Get-ComputeVMLocation;
4659+
4660+
try
4661+
{
4662+
# Common
4663+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
4664+
4665+
$vmssSize = 'Standard_D4s_v3';
4666+
$PublisherName = "MicrosoftWindowsServer";
4667+
$Offer = "WindowsServer";
4668+
$SKU = "2016-datacenter-gensecond";
4669+
$securityType = "Standard";
4670+
$enable = $true;
4671+
$disable = $false;
4672+
4673+
# NRP
4674+
$vnetworkName = 'vnet' + $rgname;
4675+
$subnetName = 'subnet' + $rgname;
4676+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix "10.0.0.0/24";
4677+
$vnet = New-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
4678+
$vnet = Get-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname;
4679+
$subnetId = $vnet.Subnets[0].Id;
4680+
4681+
# New VMSS Parameters
4682+
$vmssName1 = 'vmss1' + $rgname;
4683+
$vmssType = 'Microsoft.Compute/virtualMachineScaleSets';
4684+
4685+
$adminUsername = Get-ComputeTestResourceName;
4686+
$adminPassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force;
4687+
4688+
$imgRef = New-Object -TypeName 'Microsoft.Azure.Commands.Compute.Models.PSVirtualMachineImage';
4689+
$imgRef.PublisherName = $PublisherName;
4690+
$imgRef.Offer = $Offer;
4691+
$imgRef.Skus = $SKU;
4692+
$imgRef.Version = "latest";
4693+
4694+
4695+
$ipCfg = New-AzVmssIPConfig -Name 'test' -SubnetId $subnetId;
4696+
4697+
$vmss = New-AzVmssConfig -Location $loc -SkuCapacity 2 -SkuName $vmssSize -UpgradePolicyMode 'Manual' `
4698+
| Add-AzVmssNetworkInterfaceConfiguration -Name 'test' -Primary $true -IPConfiguration $ipCfg `
4699+
| Set-AzVmssOSProfile -ComputerNamePrefix 'test' -AdminUsername $adminUsername -AdminPassword $adminPassword `
4700+
| Set-AzVmssStorageProfile -OsDiskCreateOption 'FromImage' -OsDiskCaching 'ReadOnly' `
4701+
-ImageReferenceOffer $imgRef.Offer -ImageReferenceSku $imgRef.Skus -ImageReferenceVersion $imgRef.Version `
4702+
-ImageReferencePublisher $imgRef.PublisherName ;
4703+
4704+
# Create Vmss
4705+
$vmss1 = Set-AzVmssSecurityProfile -VirtualMachineScaleSet $vmss -SecurityType $securityType;
4706+
$result = New-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -VirtualMachineScaleSet $vmss1;
4707+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4708+
4709+
# Verify security value
4710+
Assert-Null $vmssGet.VirtualMachineProfile.SecurityProfile;
4711+
4712+
}
4713+
finally
4714+
{
4715+
# Cleanup
4716+
Clean-ResourceGroup $rgname;
4717+
}
4718+
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineTests.cs

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,5 +591,19 @@ public void TestVirtualMachineSecurityTypeWithoutConfig()
591591
{
592592
TestRunner.RunTestScript("Test-VirtualMachineSecurityTypeWithoutConfig");
593593
}
594+
595+
[Fact]
596+
[Trait(Category.AcceptanceType, Category.CheckIn)]
597+
public void TestVirtualMachineSecurityTypeStandard()
598+
{
599+
TestRunner.RunTestScript("Test-VirtualMachineSecurityTypeStandard");
600+
}
601+
602+
[Fact]
603+
[Trait(Category.AcceptanceType, Category.CheckIn)]
604+
public void TestVirtualMachineSecurityTypeStandardWithConfig()
605+
{
606+
TestRunner.RunTestScript("Test-VirtualMachineSecurityTypeStandardWithConfig");
607+
}
594608
}
595609
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineTests.ps1

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6754,5 +6754,118 @@ function Test-VirtualMachineSecurityTypeWithoutConfig
67546754
# Cleanup
67556755
Clean-ResourceGroup $rgname;
67566756
}
6757+
}
6758+
6759+
<#
6760+
.SYNOPSIS
6761+
Test Virtual Machines SecurityType parameter with the Standard value.
6762+
This should prevent the TrustedLaunch value from being defaulted in.
6763+
No SecurityProfile value should be made at this time.
6764+
#>
6765+
function Test-VirtualMachineSecurityTypeStandard
6766+
{
6767+
# Setup
6768+
$rgname = Get-ComputeTestResourceName;
6769+
$loc = Get-ComputeVMLocation;
6770+
try
6771+
{
6772+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
6773+
6774+
$domainNameLabel1 = "d1" + $rgname;
6775+
$vmsize = 'Standard_D4s_v3';
6776+
$vmname1 = $rgname + 'V';
6777+
$imageName = "Win2016DataCenterGenSecond";
6778+
$disable = $false;
6779+
$enable = $true;
6780+
$securityTypeStnd = "Standard";
6781+
6782+
# Creating a VM using Simple parameterset
6783+
$password = Get-PasswordForVM;
6784+
$user = Get-ComputeTestResourceName;
6785+
$securePassword = $password | ConvertTo-SecureString -AsPlainText -Force;
6786+
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);
6787+
6788+
# Create Vmss
6789+
New-AzVM -ResourceGroupName $rgname -Location $loc -Name $vmname1 -Credential $cred -Size $vmsize -Image $imageName -DomainNameLabel $domainNameLabel1 -SecurityType $securityTypeStnd;
6790+
# Verify security value
6791+
$vm1 = Get-AzVM -ResourceGroupName $rgname -Name $vmname1;
6792+
Assert-Null $vm1.SecurityProfile;
6793+
6794+
# validate GA extension is not installed by default.
6795+
$extDefaultName = "GuestAttestation";
6796+
$vmGADefaultIDentity = "SystemAssignedUserAssigned";
6797+
$vmname = $vmname1;
6798+
$vm = Get-AzVm -ResourceGroupName $rgname -Name $vmName;
6799+
Assert-ThrowsContains { Get-AzVMExtension -ResourceGroupName $rgname -VMName $vmName -Name $extDefaultName; } "was not found. For more details please go to"
6800+
}
6801+
finally
6802+
{
6803+
# Cleanup
6804+
Clean-ResourceGroup $rgname;
6805+
}
6806+
}
6807+
6808+
<#
6809+
.SYNOPSIS
6810+
Test Virtual Machines SecurityType parameter with the Standard value with New-AzVMConfig.
6811+
No SecurityProfile should be made at this time.
6812+
#>
6813+
function Test-VirtualMachineSecurityTypeStandardWithConfig
6814+
{
6815+
# Setup
6816+
$rgname = Get-ComputeTestResourceName;
6817+
$loc = Get-ComputeVMLocation;
6818+
try
6819+
{
6820+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
6821+
$domainNameLabel = "d1" + $rgname;
6822+
$vmsize = 'Standard_D4s_v3';
6823+
$vmname = $rgname + 'Vm';
6824+
$securityTypeStnd = "Standard";
6825+
$vnetname = "myVnet";
6826+
$vnetAddress = "10.0.0.0/16";
6827+
$subnetname = "slb" + $rgname;
6828+
$subnetAddress = "10.0.2.0/24";
6829+
$OSDiskName = $vmname + "-osdisk";
6830+
$NICName = $vmname+ "-nic";
6831+
$NSGName = $vmname + "-NSG";
6832+
$OSDiskSizeinGB = 128;
6833+
$PublisherName = "MicrosoftWindowsServer";
6834+
$Offer = "WindowsServer";
6835+
$SKU = "2016-datacenter-gensecond";
6836+
$disable = $false;
6837+
$enable = $true;
6838+
6839+
# Creating a VM using Simple parameterset
6840+
$password = Get-PasswordForVM;
6841+
$user = Get-ComputeTestResourceName;
6842+
$securePassword = $password | ConvertTo-SecureString -AsPlainText -Force;
6843+
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);
6844+
6845+
$frontendSubnet = New-AzVirtualNetworkSubnetConfig -Name $subnetname -AddressPrefix $subnetAddress;
6846+
6847+
$vnet = New-AzVirtualNetwork -Name $vnetname -ResourceGroupName $rgname -Location $loc -AddressPrefix $vnetAddress -Subnet $frontendSubnet;
6848+
6849+
$nsgRuleRDP = New-AzNetworkSecurityRuleConfig -Name RDP -Protocol Tcp -Direction Inbound -Priority 1001 -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389 -Access Allow;
6850+
$nsg = New-AzNetworkSecurityGroup -ResourceGroupName $rgname -Location $loc -Name $NSGName -SecurityRules $nsgRuleRDP;
6851+
$nic = New-AzNetworkInterface -Name $NICName -ResourceGroupName $rgname -Location $loc -SubnetId $vnet.Subnets[0].Id -NetworkSecurityGroupId $nsg.Id -EnableAcceleratedNetworking;
67576852

6853+
# VM
6854+
$vmConfig = New-AzVMConfig -VMName $vmname -VMSize $vmsize;
6855+
Set-AzVMOperatingSystem -VM $vmConfig -Windows -ComputerName $vmname -Credential $cred;
6856+
Set-AzVMSourceImage -VM $vmConfig -PublisherName $PublisherName -Offer $Offer -Skus $SKU -Version latest ;
6857+
Add-AzVMNetworkInterface -VM $vmConfig -Id $nic.Id;
6858+
6859+
# Create Vmss
6860+
$vmConfig = Set-AzVMSecurityProfile -VM $vmConfig -SecurityType $securityTypeStnd;
6861+
New-AzVM -ResourceGroupName $rgname -Location $loc -VM $vmConfig;
6862+
# Verify security value
6863+
$vm = Get-AzVM -ResourceGroupName $rgname -Name $vmname;
6864+
Assert-Null $vm.SecurityProfile;
6865+
}
6866+
finally
6867+
{
6868+
# Cleanup
6869+
Clean-ResourceGroup $rgname;
6870+
}
67586871
}

0 commit comments

Comments
 (0)