Skip to content

Commit 7bfeb33

Browse files
SandidoSandido
authored
Update-AzVmss TrustedLaunch bug (#22846)
* tests working * pass and user * put back test * more tests * cleanup * changelog * clean * comments * comment
1 parent 1a4af36 commit 7bfeb33

File tree

6 files changed

+7646
-3
lines changed

6 files changed

+7646
-3
lines changed

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.cs

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,20 @@ public void TestVirtualMachineScaleSetImageReferenceSkuUpdate()
360360
{
361361
TestRunner.RunTestScript("Test-VirtualMachineScaleSetImageReferenceSkuUpdate");
362362
}
363-
363+
364+
[Fact]
365+
[Trait(Category.AcceptanceType, Category.CheckIn)]
366+
public void TestVirtualMachineScaleSetSecurityTypeWithoutConfigUpdate()
367+
{
368+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeWithoutConfigUpdate");
369+
}
370+
371+
[Fact]
372+
[Trait(Category.AcceptanceType, Category.CheckIn)]
373+
public void TestVirtualMachineScaleSetSecurityTypeUpdate()
374+
{
375+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeUpdate");
376+
}
377+
364378
}
365379
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.ps1

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4791,3 +4791,157 @@ function Test-VirtualMachineScaleSetImageReferenceSkuUpdate
47914791
Clean-ResourceGroup $rgname;
47924792
}
47934793
}
4794+
4795+
<#
4796+
.SYNOPSIS
4797+
Test Virtual Machine Scale Set VtpmEabled and SecureBootEnabled
4798+
for the Trusted Launch feature setup.
4799+
Tests that GuestAttestation extension is also installed.
4800+
#>
4801+
function Test-VirtualMachineScaleSetSecurityTypeWithoutConfigUpdate
4802+
{
4803+
# Setup
4804+
$rgname = Get-ComputeTestResourceName;
4805+
$loc = Get-ComputeVMLocation;
4806+
4807+
try
4808+
{
4809+
# Common
4810+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
4811+
4812+
$vmssSize = 'Standard_D4s_v3';
4813+
$vmssName1 = 'vmss1' + $rgname;
4814+
$vmssName2 = 'vmss2' + $rgname;
4815+
$imageName = "Win2016DataCenterGenSecond";
4816+
$PublisherName = "MicrosoftWindowsServer";
4817+
$Offer = "WindowsServer";
4818+
$SKU = "2016-datacenter-gensecond";
4819+
$domainNameLabel1 = "d1" + $rgname;
4820+
$domainNameLabel2 = "d2" + $rgname;
4821+
$disable = $false;
4822+
$enable = $true;
4823+
$securityType = "TrustedLaunch";
4824+
$adminUsername = Get-ComputeTestResourceName;
4825+
$adminPassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force;
4826+
$vmCred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
4827+
4828+
# Create TL vmss
4829+
$res = New-AzVmss -ResourceGroupName $rgname -Credential $vmCred -VMScaleSetName $vmssName1 -ImageName $imageName -DomainNameLabel $domainNameLabel1 ;
4830+
Assert-Null $res.VirtualMachineProfile.SecurityProfile;
4831+
4832+
# Test update functionality
4833+
$vmssUp = Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -SecurityType $securityType -EnableSecureBoot $disable -EnableVtpm $disable;
4834+
$vmssGet = Get-AzVmss -ResourcegroupName $rgname -VMScaleSetName $vmssName1;
4835+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.SecurityType $securityType;
4836+
4837+
$vmssUp1 = Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -EnableVtpm $true;
4838+
$vmssGet1 = Get-AzVmss -ResourcegroupName $rgname -VMScaleSetName $vmssName1;
4839+
Assert-AreEqual $vmssGet1.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $true;
4840+
4841+
$vmssUp2 = Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -EnableSecureBoot $true;
4842+
$vmssGet2 = Get-AzVmss -ResourcegroupName $rgname -VMScaleSetName $vmssName1;
4843+
Assert-AreEqual $vmssGet2.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled $true;
4844+
}
4845+
finally
4846+
{
4847+
# Cleanup
4848+
Clean-ResourceGroup $rgname;
4849+
}
4850+
}
4851+
4852+
<#
4853+
.SYNOPSIS
4854+
Test Virtual Machine Scale Set TL update and the EnableVtpm and EnableSecureBoot values.
4855+
#>
4856+
function Test-VirtualMachineScaleSetSecurityTypeUpdate
4857+
{
4858+
# Setup
4859+
$rgname = Get-ComputeTestResourceName;
4860+
$loc = Get-ComputeVMLocation;
4861+
4862+
try
4863+
{
4864+
# Common
4865+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
4866+
4867+
$vmssSize = 'Standard_D4s_v3';
4868+
$PublisherName = "MicrosoftWindowsServer";
4869+
$Offer = "WindowsServer";
4870+
$SKU = "2016-datacenter-gensecond";
4871+
$securityType = "TrustedLaunch";
4872+
$enable = $true;
4873+
$disable = $false;
4874+
4875+
# NRP
4876+
$vnetworkName = 'vnet' + $rgname;
4877+
$subnetName = 'subnet' + $rgname;
4878+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix "10.0.0.0/24";
4879+
$vnet = New-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
4880+
$vnet = Get-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname;
4881+
$subnetId = $vnet.Subnets[0].Id;
4882+
4883+
# New VMSS Parameters
4884+
$vmssName1 = 'vmss1' + $rgname;
4885+
$vmssName2 = 'vmss2' + $rgname;
4886+
$vmssType = 'Microsoft.Compute/virtualMachineScaleSets';
4887+
4888+
$adminUsername = Get-ComputeTestResourceName;
4889+
$adminPassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force;
4890+
4891+
$imgRef = New-Object -TypeName 'Microsoft.Azure.Commands.Compute.Models.PSVirtualMachineImage';
4892+
$imgRef.PublisherName = $PublisherName;
4893+
$imgRef.Offer = $Offer;
4894+
$imgRef.Skus = $SKU;
4895+
$imgRef.Version = "latest";
4896+
4897+
$ipCfg = New-AzVmssIPConfig -Name 'test' -SubnetId $subnetId;
4898+
4899+
$vmss = New-AzVmssConfig -Location $loc -SkuCapacity 2 -SkuName $vmssSize -UpgradePolicyMode 'Manual' `
4900+
| Add-AzVmssNetworkInterfaceConfiguration -Name 'test' -Primary $true -IPConfiguration $ipCfg `
4901+
| Set-AzVmssOSProfile -ComputerNamePrefix 'test' -AdminUsername $adminUsername -AdminPassword $adminPassword `
4902+
| Set-AzVmssStorageProfile -OsDiskCreateOption 'FromImage' -OsDiskCaching 'ReadOnly' `
4903+
-ImageReferenceOffer $imgRef.Offer -ImageReferenceSku $imgRef.Skus -ImageReferenceVersion $imgRef.Version `
4904+
-ImageReferencePublisher $imgRef.PublisherName ;
4905+
4906+
# Create TL Vmss
4907+
$result = New-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -VirtualMachineScaleSet $vmss;
4908+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4909+
Assert-Null $vmssGet.VirtualMachineProfile.SecurityProfile.SecurityType;
4910+
4911+
# Test update functionality
4912+
Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -VirtualMachineScaleSet $vmssGet -SecurityType $securityType -EnableSecureBoot $disable -EnableVtpm $disable;
4913+
4914+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4915+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.SecurityType $securityType;
4916+
4917+
$vmssUp1 = Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -VirtualMachineScaleSet $vmssGet -EnableVtpm $true;
4918+
$vmssGet1 = Get-AzVmss -ResourcegroupName $rgname -VMScaleSetName $vmssName1;
4919+
Assert-AreEqual $vmssGet1.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $true;
4920+
4921+
$vmssUp2 = Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -VirtualMachineScaleSet $vmssGet1 -EnableSecureBoot $true;
4922+
$vmssGet2 = Get-AzVmss -ResourcegroupName $rgname -VMScaleSetName $vmssName1;
4923+
Assert-AreEqual $vmssGet2.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled $true;
4924+
4925+
# Guest Attestation extension defaulting test
4926+
# Validate
4927+
$vmGADefaultIdentity = "SystemAssigned"; # New defaulting behavior that was unexpected but feature team says go with it.
4928+
$extDefaultName = "GuestAttestation";
4929+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -Name $vmssName1;
4930+
# Assert-AreEqual $vmGADefaultIDentity $vmssGet.Identity.Type;
4931+
4932+
# $output = $vmssGet | Out-String;
4933+
# Write-Verbose ($output);
4934+
# Assert-True { $output.Contains($vmGADefaultIdentity) };
4935+
4936+
#$vmssvms = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4937+
#Assert-NotNull $vmssvms;
4938+
#$vmssvm = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -InstanceId $vmssvms[0].InstanceId;
4939+
# Assert-AreEqual $extDefaultName $vmssvm.Resources[2].Name;
4940+
# Assert-True {$vmssvm.Resources[2].EnableAutomaticUpgrade};
4941+
}
4942+
finally
4943+
{
4944+
# Cleanup
4945+
Clean-ResourceGroup $rgname;
4946+
}
4947+
}

‎src/Compute/Compute.Test/SessionRecords/Microsoft.Azure.Commands.Compute.Test.ScenarioTests.VirtualMachineScaleSetTests/TestVirtualMachineScaleSetSecurityTypeUpdate.json

Lines changed: 3224 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Compute/Compute.Test/SessionRecords/Microsoft.Azure.Commands.Compute.Test.ScenarioTests.VirtualMachineScaleSetTests/TestVirtualMachineScaleSetSecurityTypeWithoutConfigUpdate.json

Lines changed: 4193 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Compute/Compute/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
2121
-->
2222
## Upcoming Release
23+
* Added update functionality in `Update-AzVmss` for parameters `SecurityType`, `EnableSecureBoot`, and `EnableVtpm` for the parameter set with the Put operation.
2324

2425
## Version 6.3.0
2526
* Added `-Hibernate` switch parameter to `Stop-AzVmss` default parameter set.

‎src/Compute/Compute/Generated/VirtualMachineScaleSet/VirtualMachineScaleSetUpdateMethod.cs

Lines changed: 59 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1314,6 +1314,7 @@ private void BuildPatchObject()
13141314
this.VirtualMachineScaleSetUpdate.VirtualMachineProfile.ScheduledEventsProfile.OsImageNotificationProfile.NotBeforeTimeout = this.OSImageScheduledEventNotBeforeTimeoutInMinutes;
13151315
}
13161316

1317+
// SecurityType, includes TrustedLaunch and ConfidentialVM and Standard.
13171318
if (this.IsParameterBound(c => c.SecurityType))
13181319
{
13191320
if (this.VirtualMachineScaleSetUpdate == null)
@@ -1339,7 +1340,7 @@ private void BuildPatchObject()
13391340
this.VirtualMachineScaleSetUpdate.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled = this.VirtualMachineScaleSetUpdate.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled == null ? true : this.EnableSecureBoot;
13401341
}
13411342
}
1342-
1343+
// Only used for SecurityType == TrustedLaunch
13431344
if (this.IsParameterBound(c => c.EnableVtpm))
13441345
{
13451346
if (this.VirtualMachineScaleSetUpdate == null)
@@ -1360,7 +1361,7 @@ private void BuildPatchObject()
13601361
}
13611362
this.VirtualMachineScaleSetUpdate.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled = this.EnableVtpm;
13621363
}
1363-
1364+
// Only used for SecurityType == TrustedLaunch
13641365
if (this.IsParameterBound(c => c.EnableSecureBoot))
13651366
{
13661367
if (this.VirtualMachineScaleSetUpdate == null)
@@ -2094,6 +2095,62 @@ private void BuildPutObject()
20942095
this.VirtualMachineScaleSet.PriorityMixPolicy.RegularPriorityPercentageAboveBase = this.RegularPriorityPercentage;
20952096
}
20962097

2098+
if (this.IsParameterBound(c => c.SecurityType))
2099+
{
2100+
if (this.VirtualMachineScaleSet.VirtualMachineProfile == null)
2101+
{
2102+
this.VirtualMachineScaleSet.VirtualMachineProfile = new PSVirtualMachineScaleSetVMProfile();
2103+
}
2104+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile == null)
2105+
{
2106+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile = new SecurityProfile();
2107+
}
2108+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings == null)
2109+
{
2110+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings = new UefiSettings();
2111+
}
2112+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.SecurityType = this.SecurityType;
2113+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.SecurityType?.ToLower() == ConstantValues.TrustedLaunchSecurityType || this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.SecurityType?.ToLower() == ConstantValues.ConfidentialVMSecurityType)
2114+
{
2115+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled = this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled == null ? true : this.EnableVtpm;
2116+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled = this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled == null ? true : this.EnableSecureBoot;
2117+
}
2118+
}
2119+
// Only used for SecurityType == TrustedLaunch
2120+
if (this.IsParameterBound(c => c.EnableVtpm))
2121+
{
2122+
if (this.VirtualMachineScaleSet.VirtualMachineProfile == null)
2123+
{
2124+
this.VirtualMachineScaleSet.VirtualMachineProfile = new PSVirtualMachineScaleSetVMProfile();
2125+
}
2126+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile == null)
2127+
{
2128+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile = new SecurityProfile();
2129+
}
2130+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings == null)
2131+
{
2132+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings = new UefiSettings();
2133+
}
2134+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled = this.EnableVtpm;
2135+
}
2136+
// Only used for SecurityType == TrustedLaunch
2137+
if (this.IsParameterBound(c => c.EnableSecureBoot))
2138+
{
2139+
if (this.VirtualMachineScaleSet.VirtualMachineProfile == null)
2140+
{
2141+
this.VirtualMachineScaleSet.VirtualMachineProfile = new PSVirtualMachineScaleSetVMProfile();
2142+
}
2143+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile == null)
2144+
{
2145+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile = new SecurityProfile();
2146+
}
2147+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings == null)
2148+
{
2149+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings = new UefiSettings();
2150+
}
2151+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled = this.EnableSecureBoot;
2152+
}
2153+
20972154
if (this.VirtualMachineScaleSet != null
20982155
&& this.VirtualMachineScaleSet.VirtualMachineProfile != null
20992156
&& this.VirtualMachineScaleSet.VirtualMachineProfile.OsProfile != null

0 commit comments

Comments
 (0)