Skip to content

Commit 87b68cc

Browse files
SandidoSandido
authored
[PSCmdAssistant] New-AzVM and Vmss default image to Win2022AzureEdition when user explicitly sets SecurityType to Standard (#24773)
* generated code * dev, test, and changelog * simplifying to just feature ask * fixed null errors * cleanup * remove brk msg
1 parent 25dcc16 commit 87b68cc

File tree

11 files changed

+4771
-14
lines changed

11 files changed

+4771
-14
lines changed

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,5 +416,12 @@ public void TestVirtualMachineScaleSetSecurityTypeNoVMProfile()
416416
{
417417
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeNoVMProfile");
418418
}
419+
420+
[Fact]
421+
[Trait(Category.AcceptanceType, Category.CheckIn)]
422+
public void TestVirtualMachineScaleSetDefaultImgWhenStandard()
423+
{
424+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetDefaultImgWhenStandard");
425+
}
419426
}
420427
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.ps1

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5271,4 +5271,45 @@ function Test-VirtualMachineScaleSetSecurityTypeAndFlexDefaults
52715271
# Cleanup
52725272
Clean-ResourceGroup $rgname;
52735273
}
5274+
}
5275+
5276+
<#
5277+
.SYNOPSIS
5278+
Test Virtual Machine Scale Set with explicit Standard securityType.
5279+
Ensures the SecurityProfile is null, and with no other img info,
5280+
defaults to Win2022AE image.
5281+
#>
5282+
function Test-VirtualMachineScaleSetDefaultImgWhenStandard
5283+
{
5284+
# Setup
5285+
$rgname = Get-ComputeTestResourceName;
5286+
$loc = Get-ComputeVMLocation;
5287+
5288+
try
5289+
{
5290+
# Common
5291+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
5292+
5293+
$vmssName = 'vs' + $rgname;
5294+
5295+
$domainNameLabel1 = "d1" + $rgname;
5296+
$enable = $true;
5297+
$securityTypeST = "Standard";
5298+
$adminUsername = Get-ComputeTestResourceName;
5299+
$password = Get-PasswordForVM;
5300+
$adminPassword = $password | ConvertTo-SecureString -AsPlainText -Force;
5301+
$cred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
5302+
5303+
# Requirements for the TrustedLaunch default behavior.
5304+
$vmss = New-AzVmss -ResourceGroupName $rgname -Credential $cred -VMScaleSetName $vmssName -SecurityType $securityTypeST -DomainNameLabel $domainNameLabel1;
5305+
5306+
Assert-AreEqual $vmss.OrchestrationMode "Flexible";
5307+
Assert-Null $vmss.SecurityProfile;
5308+
Assert-AreEqual $vmss.VirtualMachineProfile.StorageProfile.ImageReference.Sku "2022-datacenter-azure-edition";
5309+
}
5310+
finally
5311+
{
5312+
# Cleanup
5313+
Clean-ResourceGroup $rgname;
5314+
}
52745315
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -641,5 +641,12 @@ public void TestCapacityReservationSharingProfile()
641641
TestRunner.RunTestScript("Test-CapacityReservationSharingProfile");
642642
}
643643

644+
[Fact]
645+
[Trait(Category.AcceptanceType, Category.LiveOnly)]
646+
public void TestVMDefaultsToTrustedLaunchImgWhenStnd()
647+
{
648+
TestRunner.RunTestScript("Test-VMDefaultsToTrustedLaunchImgWhenStnd");
649+
}
650+
644651
}
645652
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineTests.ps1

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7488,3 +7488,48 @@ function Test-CapacityReservationSharingProfile
74887488
Clean-ResourceGroup $rgname;
74897489
}
74907490
}
7491+
7492+
<#
7493+
.SYNOPSIS
7494+
Test Virtual Machines with explicit Standard securityType.
7495+
Ensures the SecurityProfile is null, and with no other img info,
7496+
defaults to Win2022AE image.
7497+
#>
7498+
function Test-VMDefaultsToTrustedLaunchImgWhenStnd
7499+
{
7500+
# Setup
7501+
$rgname = Get-ComputeTestResourceName;
7502+
$loc = Get-ComputeVMLocation;
7503+
7504+
try
7505+
{
7506+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
7507+
# SimpleParameterSet, no config, scenario.
7508+
# create credential
7509+
$password = Get-PasswordForVM;
7510+
$user = Get-ComputeTestResourceName;
7511+
$securePassword = $password | ConvertTo-SecureString -AsPlainText -Force;
7512+
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);
7513+
7514+
# Add one VM from creation
7515+
$vmname = 'vm' + $rgname;
7516+
$domainNameLabel = "d1" + $rgname;
7517+
$securityTypeST = "Standard";
7518+
$SKU = "2022-datacenter-azure-edition";
7519+
$disable = $false;
7520+
$enable = $true;
7521+
7522+
$vm = New-AzVM -ResourceGroupName $rgname -Name $vmname -Credential $cred -SecurityType $securityTypeST -DomainNameLabel $domainNameLabel;
7523+
7524+
$vm = Get-AzVm -ResourceGroupName $rgname -Name $vmname;
7525+
7526+
# Validate
7527+
Assert-AreEqual $vm.StorageProfile.ImageReference.Sku $SKU;
7528+
Assert-Null $vm.SecurityProfile;
7529+
}
7530+
finally
7531+
{
7532+
# Cleanup
7533+
Clean-ResourceGroup $rgname;
7534+
}
7535+
}

‎src/Compute/Compute.Test/SessionRecords/Microsoft.Azure.Commands.Compute.Test.ScenarioTests.VirtualMachineScaleSetTests/TestVirtualMachineScaleSetDefaultImgWhenStandard.json

Lines changed: 3269 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Compute/Compute.Test/SessionRecords/Microsoft.Azure.Commands.Compute.Test.ScenarioTests.VirtualMachineTests/TestVMDefaultsToTrustedLaunchImgWhenStnd.json

Lines changed: 1359 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Compute/Compute/ChangeLog.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,13 @@
2525
* Added `Etag` property to PSVirtualMachine and PSVirtualMachineScaleSet objects.
2626
* Added parameters `-IfMatch` and `-IfNoneMatch` to `Update-AzVM`, `Update-AzVmss`, `New-AzVm`, `New-AzVmss`, `New-AzVmConfig`, and `New-AzVmssConfig` cmdlets.
2727
* Resolved the bug with `New-AzVMConfig` for `-CommunityGalleryImageId` and `-SharedGalleryImageId` parameters.
28+
* [Breaking Change] Added ValidateNotNullOrEmpty for `-ResourceGroupName` and `-VMScaleSetName` parameters to `Get-AzVmss` cmdlet. [#20095]
29+
* [Breaking Change] Added new business logic to `New-AzVmss` and `New-AzVM` cmdlets. When the user explicitly sets the `SecurityType` to `Standard`, the Image alias defaults to `Win2022AzureEdition` to make future migrations to Trusted Launch easier.
2830

2931
## Version 7.3.0
3032
* Added cmdlet `Invoke-AzSpotPlacementRecommender`.
3133
* Fixed `Update-AzCapacityReservationGroup` to remove Subscriptions from SharingProfile.
34+
* Added new optional parameter `SecureVMGuestStateSAS` to cmdlet `Grant-AzDiskAccess`.
3235

3336
## Version 7.2.0
3437
* Added parameters `-scriptUriManagedIdentity`, `-outputBlobManagedIdentity`, `-errorBlobMangedIdentity`, and `-TreatFailureAsDeploymentFailure` to cmdlets `Set-AzVmRunCommand` and `Set-AzVmssRunCommand`.

‎src/Compute/Compute/Common/ConstantStringTypes.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ public static class ValidateSetValues
9292

9393
public static class ConstantValues
9494
{
95+
public const string DefaultVMandVMSSImage = "Win2016Datacenter";
9596
public const string StandardSecurityType = "standard";
9697
public const string TrustedLaunchSecurityType = "trustedlaunch";
9798
public const string ConfidentialVMSecurityType = "confidentialvm";

‎src/Compute/Compute/Generated/VirtualMachineScaleSet/VirtualMachineScaleSetCreateOrUpdateMethod.cs

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,16 +74,21 @@ public override void ExecuteCmdlet()
7474
{
7575
// TL defaulting for default param set, config object.
7676
// if security type not set,
77-
// if parameters.VirtualMachineProfile.StorageProfile.ImageReference.SharedGalleryImageId == null
78-
// if parameters.VirtualMachineProfile.StorageProfile.ImageReference.Id == null
79-
// if parameters.VirtualMachineProfile.StorageProfile.OsDisk == null
77+
8078
if (this.VirtualMachineScaleSet.VirtualMachineProfile?.SecurityProfile?.SecurityType == null
8179
&& this.VirtualMachineScaleSet.VirtualMachineProfile?.StorageProfile?.ImageReference == null
8280
&& this.VirtualMachineScaleSet.VirtualMachineProfile?.StorageProfile?.OsDisk == null)
8381
{
8482
trustedLaunchDefaultingSecurityValues();
8583
trustedLaunchDefaultingImageValues();
8684
}
85+
// if securityType is Standard explicitly.
86+
else if (this.VirtualMachineScaleSet.VirtualMachineProfile?.SecurityProfile?.SecurityType?.ToLower() == ConstantValues.StandardSecurityType
87+
&& this.VirtualMachineScaleSet.VirtualMachineProfile?.StorageProfile?.ImageReference == null
88+
&& this.VirtualMachineScaleSet.VirtualMachineProfile?.StorageProfile?.OsDisk == null)
89+
{
90+
this.ImageName = ConstantValues.TrustedLaunchDefaultImageAlias;
91+
}
8792

8893
if (this.VirtualMachineScaleSet.VirtualMachineProfile?.SecurityProfile?.SecurityType == null
8994
//&& this.VirtualMachineScaleSet.VirtualMachineProfile?.StorageProfile?.OsDisk == null//had to remove this as it has the FromImage value from set-azvmssstorageprofile call
@@ -97,6 +102,7 @@ public override void ExecuteCmdlet()
97102
specificImageRespone = retrieveSpecificImageFromNotId();
98103
setHyperVGenForImageCheckAndTLDefaulting(specificImageRespone);
99104
}
105+
100106
}
101107

102108
string resourceGroupName = this.ResourceGroupName;
@@ -132,6 +138,7 @@ public override void ExecuteCmdlet()
132138
}
133139
}
134140

141+
135142
// For Cross-tenant RBAC sharing
136143
Dictionary<string, List<string>> auxAuthHeader = null;
137144
if (!string.IsNullOrEmpty(parameters.VirtualMachineProfile?.StorageProfile?.ImageReference?.Id))

‎src/Compute/Compute/Manual/VirtualMachineScaleSetCreateOrUpdateMethod.cs

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@
3434

3535
namespace Microsoft.Azure.Commands.Compute.Automation
3636
{
37-
[GenericBreakingChangeWithVersionAttribute("Starting in May 2024 the \"New-AzVmss\" cmdlet will deploy with the image 'Windows Server 2022 Azure Edition' by default. This will make migrating to Trusted Launch easier in the future. To know more about Trusted Launch, please visit https://docs.microsoft.com/en-us/azure/virtual-machines/trusted-launch", "12.0.0", "8.0.0")]
3837
public partial class NewAzureRmVmss : ComputeAutomationBaseCmdlet
3938
{
4039
private const string flexibleOrchestrationMode = "Flexible", uniformOrchestrationMode = "Uniform";
@@ -59,7 +58,7 @@ public partial class NewAzureRmVmss : ComputeAutomationBaseCmdlet
5958
"Win2012R2Datacenter",
6059
"Win2012Datacenter")]
6160
[Alias("Image")]
62-
public string ImageName { get; set; } = "Win2016Datacenter";
61+
public string ImageName { get; set; } = ConstantValues.DefaultVMandVMSSImage;
6362

6463
[Parameter(ParameterSetName = SimpleParameterSet, Mandatory = true)]
6564
public PSCredential Credential { get; set; }
@@ -542,15 +541,20 @@ private async Task<ResourceConfig<VirtualMachineScaleSet>> SimpleParameterSetOrc
542541
{
543542
if (_cmdlet.SecurityType?.ToLower() == ConstantValues.TrustedLaunchSecurityType || _cmdlet.SecurityType?.ToLower() == ConstantValues.ConfidentialVMSecurityType)
544543
{
545-
_cmdlet.SecurityType = _cmdlet.SecurityType;
546544
_cmdlet.EnableVtpm = _cmdlet.EnableVtpm ?? true;
547545
_cmdlet.EnableSecureBoot = _cmdlet.EnableSecureBoot ?? true;
548546
}
549547
else if (_cmdlet.SecurityType?.ToLower() == ConstantValues.StandardSecurityType)
550548
{
551-
_cmdlet.SecurityType = _cmdlet.SecurityType;
549+
// default the imagereference or image parameter to Win2022AzureEdition img.
550+
if (!_cmdlet.IsParameterBound(c => c.ImageName) && !_cmdlet.IsParameterBound(c => c.ImageReferenceId)
551+
&& !_cmdlet.IsParameterBound(c => c.SharedGalleryImageId))
552+
{
553+
_cmdlet.ImageName = ConstantValues.TrustedLaunchDefaultImageAlias;
554+
}
552555
}
553556
}
557+
554558
_cmdlet.NatBackendPort = ImageAndOsType.UpdatePorts(_cmdlet.NatBackendPort);
555559

556560
var networkSecurityGroup = noZones
@@ -654,7 +658,8 @@ async Task SimpleParameterSetExecuteCmdlet(IAsyncCmdlet asyncCmdlet)
654658
&& !this.IsParameterBound(c => c.SharedGalleryImageId))
655659
{
656660
this.SecurityType = ConstantValues.TrustedLaunchSecurityType;
657-
if (!this.IsParameterBound(c => c.ImageName) && !this.IsParameterBound(c => c.ImageReferenceId) && !this.IsParameterBound(c => c.SharedGalleryImageId))
661+
if (!this.IsParameterBound(c => c.ImageName) && !this.IsParameterBound(c => c.ImageReferenceId)
662+
&& !this.IsParameterBound(c => c.SharedGalleryImageId))
658663
{
659664
this.ImageName = ConstantValues.TrustedLaunchDefaultImageAlias;
660665
}
@@ -667,11 +672,20 @@ async Task SimpleParameterSetExecuteCmdlet(IAsyncCmdlet asyncCmdlet)
667672
this.EnableVtpm = true;
668673
}
669674
}
670-
675+
// default Win2022AzureEdition img for explicitly set Standard.
676+
// handles when default img was set for ImageName parameter.
677+
if (this.IsParameterBound(c => c.SecurityType)
678+
&& this.SecurityType?.ToLower() == ConstantValues.StandardSecurityType
679+
&& !this.IsParameterBound(c => c.ImageName)
680+
&& !this.IsParameterBound(c => c.ImageReferenceId)
681+
&& !this.IsParameterBound(c => c.SharedGalleryImageId))
682+
{
683+
this.ImageName = ConstantValues.TrustedLaunchDefaultImageAlias;
684+
}
685+
671686
// API does not currently support Standard securityType value, so need to null it out here.
672687
if (this.IsParameterBound(c => c.SecurityType)
673-
&& this.SecurityType != null
674-
&& this.SecurityType.ToString().ToLower() == ConstantValues.StandardSecurityType)
688+
&& this.SecurityType?.ToLower() == ConstantValues.StandardSecurityType)
675689
{
676690
this.SecurityType = null;
677691
}
@@ -681,7 +695,6 @@ async Task SimpleParameterSetExecuteCmdlet(IAsyncCmdlet asyncCmdlet)
681695
{
682696
if (this.SecurityType?.ToLower() == ConstantValues.TrustedLaunchSecurityType || this.SecurityType?.ToLower() == ConstantValues.ConfidentialVMSecurityType)
683697
{
684-
this.SecurityType = this.SecurityType;
685698
this.EnableVtpm = this.EnableVtpm ?? true;
686699
this.EnableSecureBoot = this.EnableSecureBoot ?? true;
687700
}

0 commit comments

Comments
 (0)