@@ -36,6 +36,7 @@ import (
3636
3737 "golang.org/x/crypto/ssh"
3838 "k8s.io/klog/v2"
39+ "k8s.io/utils/pointer"
3940)
4041
4142const (
@@ -235,16 +236,11 @@ func (s *Service) deriveVirtualMachineParameters(vmSpec *Spec, nic network.Inter
235236 }
236237 }
237238
238- var diskEncryptionSet * compute.DiskEncryptionSetParameters
239- if vmSpec .OSDisk .ManagedDisk .DiskEncryptionSet != nil {
240- diskEncryptionSet = & compute.DiskEncryptionSetParameters {ID : to .StringPtr (vmSpec .OSDisk .ManagedDisk .DiskEncryptionSet .ID )}
241- }
239+ osDisk := generateOSDisk (vmSpec )
242240
243- var securityProfile * compute.SecurityProfile
244- if vmSpec .SecurityProfile != nil {
245- securityProfile = & compute.SecurityProfile {
246- EncryptionAtHost : vmSpec .SecurityProfile .EncryptionAtHost ,
247- }
241+ securityProfile , err := generateSecurityProfile (vmSpec , osDisk )
242+ if err != nil {
243+ return nil , err
248244 }
249245
250246 priority , evictionPolicy , billingProfile , err := getSpotVMOptions (s .Scope .MachineConfig .SpotVMOptions )
@@ -267,17 +263,8 @@ func (s *Service) deriveVirtualMachineParameters(vmSpec *Spec, nic network.Inter
267263 },
268264 StorageProfile : & compute.StorageProfile {
269265 ImageReference : imageReference ,
270- OsDisk : & compute.OSDisk {
271- Name : to .StringPtr (fmt .Sprintf ("%s_OSDisk" , vmSpec .Name )),
272- OsType : compute .OperatingSystemTypes (vmSpec .OSDisk .OSType ),
273- CreateOption : compute .DiskCreateOptionTypesFromImage ,
274- DiskSizeGB : to .Int32Ptr (vmSpec .OSDisk .DiskSizeGB ),
275- ManagedDisk : & compute.ManagedDiskParameters {
276- StorageAccountType : compute .StorageAccountTypes (vmSpec .OSDisk .ManagedDisk .StorageAccountType ),
277- DiskEncryptionSet : diskEncryptionSet ,
278- },
279- },
280- DataDisks : & dataDisks ,
266+ OsDisk : osDisk ,
267+ DataDisks : & dataDisks ,
281268 },
282269 SecurityProfile : securityProfile ,
283270 OsProfile : osProfile ,
@@ -436,6 +423,125 @@ func generateImagePlan(image machinev1.Image) *compute.Plan {
436423 }
437424}
438425
426+ func generateOSDisk (vmSpec * Spec ) * compute.OSDisk {
427+ osDisk := & compute.OSDisk {
428+ Name : to .StringPtr (fmt .Sprintf ("%s_OSDisk" , vmSpec .Name )),
429+ OsType : compute .OperatingSystemTypes (vmSpec .OSDisk .OSType ),
430+ CreateOption : compute .DiskCreateOptionTypesFromImage ,
431+ ManagedDisk : & compute.ManagedDiskParameters {},
432+ DiskSizeGB : to .Int32Ptr (vmSpec .OSDisk .DiskSizeGB ),
433+ }
434+
435+ if vmSpec .OSDisk .ManagedDisk .StorageAccountType != "" {
436+ osDisk .ManagedDisk .StorageAccountType = compute .StorageAccountTypes (vmSpec .OSDisk .ManagedDisk .StorageAccountType )
437+ }
438+ if vmSpec .OSDisk .ManagedDisk .DiskEncryptionSet != nil {
439+ osDisk .ManagedDisk .DiskEncryptionSet = & compute.DiskEncryptionSetParameters {ID : to .StringPtr (vmSpec .OSDisk .ManagedDisk .DiskEncryptionSet .ID )}
440+ }
441+ if vmSpec .OSDisk .ManagedDisk .SecurityProfile .SecurityEncryptionType != "" {
442+ osDisk .ManagedDisk .SecurityProfile = & compute.VMDiskSecurityProfile {}
443+
444+ osDisk .ManagedDisk .SecurityProfile .SecurityEncryptionType = compute .SecurityEncryptionTypes (string (vmSpec .OSDisk .ManagedDisk .SecurityProfile .SecurityEncryptionType ))
445+
446+ if vmSpec .OSDisk .ManagedDisk .SecurityProfile .DiskEncryptionSet .ID != "" {
447+ osDisk .ManagedDisk .SecurityProfile .DiskEncryptionSet = & compute.DiskEncryptionSetParameters {ID : pointer .String (vmSpec .OSDisk .ManagedDisk .SecurityProfile .DiskEncryptionSet .ID )}
448+ }
449+ }
450+
451+ return osDisk
452+ }
453+
454+ func generateSecurityProfile (vmSpec * Spec , osDisk * compute.OSDisk ) (* compute.SecurityProfile , error ) {
455+ if vmSpec .SecurityProfile == nil {
456+ return nil , nil
457+ }
458+
459+ securityProfile := & compute.SecurityProfile {
460+ EncryptionAtHost : vmSpec .SecurityProfile .EncryptionAtHost ,
461+ }
462+
463+ if osDisk .ManagedDisk != nil &&
464+ osDisk .ManagedDisk .SecurityProfile != nil &&
465+ osDisk .ManagedDisk .SecurityProfile .SecurityEncryptionType != "" {
466+
467+ if vmSpec .SecurityProfile .Settings .SecurityType != machinev1 .SecurityTypesConfidentialVM {
468+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
469+ "SecurityType should be set to %s when SecurityEncryptionType is defined." ,
470+ vmSpec .Name , compute .SecurityTypesConfidentialVM )
471+ }
472+
473+ if vmSpec .SecurityProfile .Settings .ConfidentialVM == nil {
474+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
475+ "UEFISettings should be set when SecurityEncryptionType is defined." , vmSpec .Name )
476+ }
477+
478+ if vmSpec .SecurityProfile .Settings .ConfidentialVM .UEFISettings .VirtualizedTrustedPlatformModule != machinev1 .VirtualizedTrustedPlatformModulePolicyEnabled {
479+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
480+ "VirtualizedTrustedPlatformModule should be enabled when SecurityEncryptionType is defined." , vmSpec .Name )
481+ }
482+
483+ if osDisk .ManagedDisk .SecurityProfile .SecurityEncryptionType == compute .SecurityEncryptionTypesDiskWithVMGuestState {
484+ if vmSpec .SecurityProfile .EncryptionAtHost != nil && * vmSpec .SecurityProfile .EncryptionAtHost {
485+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
486+ "EncryptionAtHost cannot be set to true when SecurityEncryptionType is set to %s." ,
487+ vmSpec .Name , compute .SecurityEncryptionTypesDiskWithVMGuestState )
488+ }
489+ if vmSpec .SecurityProfile .Settings .ConfidentialVM .UEFISettings .SecureBoot != machinev1 .SecureBootPolicyEnabled {
490+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
491+ "SecureBoot should be enabled when SecurityEncryptionType is set to %s." ,
492+ vmSpec .Name , compute .SecurityEncryptionTypesDiskWithVMGuestState )
493+ }
494+ }
495+
496+ securityProfile .SecurityType = compute .SecurityTypesConfidentialVM
497+
498+ securityProfile .UefiSettings = & compute.UefiSettings {
499+ SecureBootEnabled : pointer .Bool (false ),
500+ VTpmEnabled : pointer .Bool (true ),
501+ }
502+
503+ if vmSpec .SecurityProfile .Settings .ConfidentialVM .UEFISettings .SecureBoot == machinev1 .SecureBootPolicyEnabled {
504+ securityProfile .UefiSettings .SecureBootEnabled = pointer .Bool (true )
505+ }
506+
507+ return securityProfile , nil
508+ }
509+
510+ if vmSpec .SecurityProfile .Settings .SecurityType == machinev1 .SecurityTypesTrustedLaunch && vmSpec .SecurityProfile .Settings .TrustedLaunch == nil {
511+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
512+ "UEFISettings should be set when SecurityType is set to %s." ,
513+ vmSpec .Name , compute .SecurityTypesTrustedLaunch )
514+ }
515+
516+ if vmSpec .SecurityProfile .Settings .TrustedLaunch != nil &&
517+ (vmSpec .SecurityProfile .Settings .TrustedLaunch .UEFISettings .SecureBoot == machinev1 .SecureBootPolicyEnabled ||
518+ vmSpec .SecurityProfile .Settings .TrustedLaunch .UEFISettings .VirtualizedTrustedPlatformModule == machinev1 .VirtualizedTrustedPlatformModulePolicyEnabled ) {
519+
520+ if vmSpec .SecurityProfile .Settings .SecurityType != machinev1 .SecurityTypesTrustedLaunch {
521+ return nil , apierrors .InvalidMachineConfiguration ("failed to generate security profile for vm %s. " +
522+ "SecurityType should be set to %s when UEFISettings are defined." ,
523+ vmSpec .Name , compute .SecurityTypesTrustedLaunch )
524+ }
525+
526+ securityProfile .SecurityType = compute .SecurityTypesTrustedLaunch
527+
528+ securityProfile .UefiSettings = & compute.UefiSettings {
529+ SecureBootEnabled : pointer .Bool (false ),
530+ VTpmEnabled : pointer .Bool (false ),
531+ }
532+
533+ if vmSpec .SecurityProfile .Settings .TrustedLaunch .UEFISettings .SecureBoot == machinev1 .SecureBootPolicyEnabled {
534+ securityProfile .UefiSettings .SecureBootEnabled = pointer .Bool (true )
535+ }
536+
537+ if vmSpec .SecurityProfile .Settings .TrustedLaunch .UEFISettings .VirtualizedTrustedPlatformModule == machinev1 .VirtualizedTrustedPlatformModulePolicyEnabled {
538+ securityProfile .UefiSettings .VTpmEnabled = pointer .Bool (true )
539+ }
540+ }
541+
542+ return securityProfile , nil
543+ }
544+
439545func generateDataDisks (vmSpec * Spec ) ([]compute.DataDisk , error ) {
440546 seenDataDiskLuns := make (map [int32 ]struct {})
441547 seenDataDiskNames := make (map [string ]struct {})
0 commit comments