Skip to content

Commit e10f947

Browse files
laozclaozc
committed
Add supports to Crypto Spec in VMOp VirtualMachine and PVC
1 parent 3066ca2 commit e10f947

18 files changed

+407
-21
lines changed

‎apis/vmware/v1beta1/types.go‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,65 @@ const (
7676
// state within the configured timeout (default 5m).
7777
VirtualMachinePowerOpModeTrySoft VirtualMachinePowerOpMode = "trySoft"
7878
)
79+
80+
// VirtualMachineCryptoSpec defines the desired state of a VirtualMachine's
81+
// encryption state.
82+
type VirtualMachineCryptoSpec struct {
83+
// encryptionClassName describes the name of the EncryptionClass resource
84+
// used to encrypt this VM.
85+
//
86+
// Please note, this field is not required to encrypt the VM. If the
87+
// underlying platform has a default key provider, the VM may still be fully
88+
// or partially encrypted depending on the specified storage and VM classes.
89+
//
90+
// If there is a default key provider and an encryption storage class is
91+
// selected, the files in the VM's home directory and non-PVC virtual disks
92+
// will be encrypted
93+
//
94+
// If there is a default key provider and a VM Class with a virtual, trusted
95+
// platform module (vTPM) is selected, the files in the VM's home directory,
96+
// minus any virtual disks, will be encrypted.
97+
//
98+
// If the underlying vSphere platform does not have a default key provider,
99+
// then this field is required when specifying an encryption storage class
100+
// and/or a VM Class with a vTPM.
101+
//
102+
// If this field is set, spec.storageClass must use an encryption-enabled
103+
// storage class.
104+
// +optional
105+
// +kubebuilder:validation:MaxLength=253
106+
EncryptionClassName *string `json:"encryptionClassName,omitempty"`
107+
108+
// useDefaultKeyProvider describes the desired behavior for when an explicit
109+
// EncryptionClass is not provided.
110+
//
111+
// When an explicit encryptionClass is not provided and this value is true:
112+
//
113+
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
114+
// will be encrypted using the default key provider.
115+
//
116+
// - If a VirtualMachine is not encrypted, uses an encryption storage
117+
// policy or has a virtual, trusted platform module (vTPM), there is a
118+
// default key provider, the VM will be encrypted using the default key
119+
// provider.
120+
//
121+
// - If a VirtualMachine is encrypted with a provider other than the default
122+
// key provider, the VM will be rekeyed using the default key provider.
123+
//
124+
// When an explicit EncryptionClass is not provided and this value is false:
125+
//
126+
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
127+
// will fail.
128+
//
129+
// - If a VirtualMachine is encrypted with a provider other than the default
130+
// key provider, the VM will be not be rekeyed.
131+
//
132+
// Please note, this could result in a VirtualMachine that cannot be
133+
// powered on since it is encrypted using a provider or key that may have
134+
// been removed. Without the key, the VM cannot be decrypted and thus
135+
// cannot be powered on.
136+
//
137+
// Defaults to true if omitted.
138+
// +optional
139+
UseDefaultKeyProvider *bool `json:"useDefaultKeyProvider,omitempty"`
140+
}

‎apis/vmware/v1beta1/vspheremachine_types.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,15 @@ type VSphereMachineVolume struct {
3535
// StorageClass defaults to VSphereMachineSpec.StorageClass
3636
// +optional
3737
StorageClass string `json:"storageClass,omitempty"`
38+
// encryptionClassName describes the name of the EncryptionClass resource
39+
// used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
40+
//
41+
// Please note, this field is not required to encrypt the volume. If the
42+
// underlying platform has a default key provider, the volume may still be fully
43+
// or partially encrypted depending on the specified storage.
44+
// +optional
45+
// +kubebuilder:validation:MaxLength=253
46+
EncryptionClassName *string `json:"encryptionClassName,omitempty"`
3847
}
3948

4049
// VSphereMachineSpec defines the desired state of VSphereMachine.
@@ -63,6 +72,10 @@ type VSphereMachineSpec struct {
6372
// +optional
6473
StorageClass string `json:"storageClass,omitempty"`
6574

75+
// crypto describes the desired encryption state of the VirtualMachine.
76+
// +optional
77+
Crypto *VirtualMachineCryptoSpec `json:"crypto,omitempty"`
78+
6679
// Volumes is the set of PVCs to be created and attached to the VSphereMachine
6780
// +optional
6881
Volumes []VSphereMachineVolume `json:"volumes,omitempty"`

‎apis/vmware/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 35 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachines.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,69 @@ spec:
5959
ClassName is the name of the class used when specifying the underlying
6060
virtual machine
6161
type: string
62+
crypto:
63+
description: crypto describes the desired encryption state of the
64+
VirtualMachine.
65+
properties:
66+
encryptionClassName:
67+
description: |-
68+
encryptionClassName describes the name of the EncryptionClass resource
69+
used to encrypt this VM.
70+
71+
Please note, this field is not required to encrypt the VM. If the
72+
underlying platform has a default key provider, the VM may still be fully
73+
or partially encrypted depending on the specified storage and VM classes.
74+
75+
If there is a default key provider and an encryption storage class is
76+
selected, the files in the VM's home directory and non-PVC virtual disks
77+
will be encrypted
78+
79+
If there is a default key provider and a VM Class with a virtual, trusted
80+
platform module (vTPM) is selected, the files in the VM's home directory,
81+
minus any virtual disks, will be encrypted.
82+
83+
If the underlying vSphere platform does not have a default key provider,
84+
then this field is required when specifying an encryption storage class
85+
and/or a VM Class with a vTPM.
86+
87+
If this field is set, spec.storageClass must use an encryption-enabled
88+
storage class.
89+
maxLength: 253
90+
type: string
91+
useDefaultKeyProvider:
92+
description: |-
93+
useDefaultKeyProvider describes the desired behavior for when an explicit
94+
EncryptionClass is not provided.
95+
96+
When an explicit encryptionClass is not provided and this value is true:
97+
98+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
99+
will be encrypted using the default key provider.
100+
101+
- If a VirtualMachine is not encrypted, uses an encryption storage
102+
policy or has a virtual, trusted platform module (vTPM), there is a
103+
default key provider, the VM will be encrypted using the default key
104+
provider.
105+
106+
- If a VirtualMachine is encrypted with a provider other than the default
107+
key provider, the VM will be rekeyed using the default key provider.
108+
109+
When an explicit EncryptionClass is not provided and this value is false:
110+
111+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
112+
will fail.
113+
114+
- If a VirtualMachine is encrypted with a provider other than the default
115+
key provider, the VM will be not be rekeyed.
116+
117+
Please note, this could result in a VirtualMachine that cannot be
118+
powered on since it is encrypted using a provider or key that may have
119+
been removed. Without the key, the VM cannot be decrypted and thus
120+
cannot be powered on.
121+
122+
Defaults to true if omitted.
123+
type: boolean
124+
type: object
62125
failureDomain:
63126
description: |-
64127
FailureDomain is the failure domain the machine will be created in.
@@ -344,6 +407,16 @@ spec:
344407
x-kubernetes-int-or-string: true
345408
description: Capacity is the PVC capacity
346409
type: object
410+
encryptionClassName:
411+
description: |-
412+
encryptionClassName describes the name of the EncryptionClass resource
413+
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
414+
415+
Please note, this field is not required to encrypt the volume. If the
416+
underlying platform has a default key provider, the volume may still be fully
417+
or partially encrypted depending on the specified storage.
418+
maxLength: 253
419+
type: string
347420
name:
348421
description: 'Name is suffix used to name this PVC as: VSphereMachine.Name
349422
+ "-" + Name'

‎config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachinetemplates.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,69 @@ spec:
5555
ClassName is the name of the class used when specifying the underlying
5656
virtual machine
5757
type: string
58+
crypto:
59+
description: crypto describes the desired encryption state
60+
of the VirtualMachine.
61+
properties:
62+
encryptionClassName:
63+
description: |-
64+
encryptionClassName describes the name of the EncryptionClass resource
65+
used to encrypt this VM.
66+
67+
Please note, this field is not required to encrypt the VM. If the
68+
underlying platform has a default key provider, the VM may still be fully
69+
or partially encrypted depending on the specified storage and VM classes.
70+
71+
If there is a default key provider and an encryption storage class is
72+
selected, the files in the VM's home directory and non-PVC virtual disks
73+
will be encrypted
74+
75+
If there is a default key provider and a VM Class with a virtual, trusted
76+
platform module (vTPM) is selected, the files in the VM's home directory,
77+
minus any virtual disks, will be encrypted.
78+
79+
If the underlying vSphere platform does not have a default key provider,
80+
then this field is required when specifying an encryption storage class
81+
and/or a VM Class with a vTPM.
82+
83+
If this field is set, spec.storageClass must use an encryption-enabled
84+
storage class.
85+
maxLength: 253
86+
type: string
87+
useDefaultKeyProvider:
88+
description: |-
89+
useDefaultKeyProvider describes the desired behavior for when an explicit
90+
EncryptionClass is not provided.
91+
92+
When an explicit encryptionClass is not provided and this value is true:
93+
94+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
95+
will be encrypted using the default key provider.
96+
97+
- If a VirtualMachine is not encrypted, uses an encryption storage
98+
policy or has a virtual, trusted platform module (vTPM), there is a
99+
default key provider, the VM will be encrypted using the default key
100+
provider.
101+
102+
- If a VirtualMachine is encrypted with a provider other than the default
103+
key provider, the VM will be rekeyed using the default key provider.
104+
105+
When an explicit EncryptionClass is not provided and this value is false:
106+
107+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
108+
will fail.
109+
110+
- If a VirtualMachine is encrypted with a provider other than the default
111+
key provider, the VM will be not be rekeyed.
112+
113+
Please note, this could result in a VirtualMachine that cannot be
114+
powered on since it is encrypted using a provider or key that may have
115+
been removed. Without the key, the VM cannot be decrypted and thus
116+
cannot be powered on.
117+
118+
Defaults to true if omitted.
119+
type: boolean
120+
type: object
58121
failureDomain:
59122
description: |-
60123
FailureDomain is the failure domain the machine will be created in.
@@ -341,6 +404,16 @@ spec:
341404
x-kubernetes-int-or-string: true
342405
description: Capacity is the PVC capacity
343406
type: object
407+
encryptionClassName:
408+
description: |-
409+
encryptionClassName describes the name of the EncryptionClass resource
410+
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
411+
412+
Please note, this field is not required to encrypt the volume. If the
413+
underlying platform has a default key provider, the volume may still be fully
414+
or partially encrypted depending on the specified storage.
415+
maxLength: 253
416+
type: string
344417
name:
345418
description: 'Name is suffix used to name this PVC as:
346419
VSphereMachine.Name + "-" + Name'

‎controllers/vmware/vspherecluster_reconciler_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ var _ = Describe("Cluster Controller Tests", func() {
5353
className = "test-className"
5454
imageName = "test-imageName"
5555
storageClass = "test-storageClass"
56+
encryptionClass = "test-encryptionClass"
5657
testIP = "127.0.0.1"
5758
)
5859
var (
@@ -69,7 +70,7 @@ var _ = Describe("Cluster Controller Tests", func() {
6970
cluster = util.CreateCluster(clusterName)
7071
vsphereCluster = util.CreateVSphereCluster(clusterName)
7172
clusterCtx, controllerManagerContext = util.CreateClusterContext(cluster, vsphereCluster)
72-
vsphereMachine = util.CreateVSphereMachine(machineName, clusterName, className, imageName, storageClass, controlPlaneLabelTrue)
73+
vsphereMachine = util.CreateVSphereMachine(machineName, clusterName, className, imageName, storageClass, encryptionClass, controlPlaneLabelTrue)
7374

7475
reconciler = &ClusterReconciler{
7576
Client: controllerManagerContext.Client,

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ replace sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.12.0-beta.0
77
replace github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels => github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels v0.0.0-20240404200847-de75746a9505
88

99
// The version of vm-operator should be kept in sync with the manifests at: config/deployments/integration-tests
10-
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.8.6
10+
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719
1111

1212
require (
1313
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,8 @@ github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d h1:c
241241
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d/go.mod h1:JbFOh22iDsT5BowJe0GgpMI5e2/S7cWaJlv9LdURVQM=
242242
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d h1:z9lrzKVtNlujduv9BilzPxuge/LE2F0N1ms3TP4JZvw=
243243
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d/go.mod h1:Q4JzNkNMvjo7pXtlB5/R3oME4Nhah7fAObWgghVmtxk=
244-
github.com/vmware-tanzu/vm-operator/api v1.8.6 h1:NIndORjcnSmIlQsCMIewpIwg/ocRVDh2lYjOroTVLrU=
245-
github.com/vmware-tanzu/vm-operator/api v1.8.6/go.mod h1:HHA2SNI9B5Yqtyp5t+Gt9WTWBi/fIkM6+MukDDSf11A=
244+
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719 h1:nb/5ytRj7E/5eo9UzLfaR29JytMtbGpqMVs3hjaRwZ0=
245+
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719/go.mod h1:nWTPpxfe4gHuuYuFcrs86+NMxfkqPk3a3IlvI8TCWak=
246246
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505 h1:y4wXx1FUFqqSgJ/xUOEM1DLS2Uu0KaeLADWpzpioGTU=
247247
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505/go.mod h1:5rqRJ9zGR+KnKbkGx373WgN8xJpvAj99kHnfoDYRO5I=
248248
github.com/vmware/govmomi v0.52.0 h1:JyxQ1IQdllrY7PJbv2am9mRsv3p9xWlIQ66bv+XnyLw=

‎pkg/services/network/netop_provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ func (np *netopNetworkProvider) ConfigureVirtualMachine(ctx context.Context, clu
136136
// Set the VM primary interface
137137
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
138138
Name: PrimaryInterfaceName,
139-
Network: vmoprv1common.PartialObjectRef{
139+
Network: &vmoprv1common.PartialObjectRef{
140140
TypeMeta: metav1.TypeMeta{
141141
Kind: NetworkGVKNetOperator.Kind,
142142
APIVersion: NetworkGVKNetOperator.GroupVersion().String(),

‎pkg/services/network/nsxt_provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ func (np *nsxtNetworkProvider) ConfigureVirtualMachine(_ context.Context, cluste
223223
}
224224
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
225225
Name: fmt.Sprintf("eth%d", len(vm.Spec.Network.Interfaces)),
226-
Network: vmoprv1common.PartialObjectRef{
226+
Network: &vmoprv1common.PartialObjectRef{
227227
TypeMeta: metav1.TypeMeta{
228228
Kind: NetworkGVKNSXT.Kind,
229229
APIVersion: NetworkGVKNSXT.GroupVersion().String(),

0 commit comments

Comments
 (0)