Skip to content

Commit 593ac5a

Browse files
jeana-redhatjeana-redhat
committed
[OSDOCS-8025]: Azure confidential computing via MAPI
1 parent 60f5e7c commit 593ac5a

File tree

5 files changed

+218
-4
lines changed

5 files changed

+218
-4
lines changed

‎machine_management/control_plane_machine_management/cpmso-using.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,12 @@ include::modules/machineset-troubleshooting-azure-ultra-disk.adoc[leveloffset=+3
8383
//Enabling customer-managed encryption keys for a machine set
8484
include::modules/machineset-customer-managed-encryption-azure.adoc[leveloffset=+2]
8585

86+
//Configuring trusted launch for Azure virtual machines by using machine sets
87+
include::modules/machineset-azure-trusted-launch.adoc[leveloffset=+2]
88+
89+
//Configuring Azure confidential virtual machines by using machine sets
90+
include::modules/machineset-azure-confidential-vms.adoc[leveloffset=+2]
91+
8692
// Accelerated Networking for Microsoft Azure VMs
8793
include::modules/machineset-azure-accelerated-networking.adoc[leveloffset=+2]
8894

‎machine_management/creating_machinesets/creating-machineset-azure.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ include::modules/machineset-troubleshooting-azure-ultra-disk.adoc[leveloffset=+2
5353
//Enabling customer-managed encryption keys for a machine set
5454
include::modules/machineset-customer-managed-encryption-azure.adoc[leveloffset=+1]
5555

56+
//Configuring trusted launch for Azure virtual machines by using machine sets
57+
include::modules/machineset-azure-trusted-launch.adoc[leveloffset=+1]
58+
59+
//Configuring Azure confidential virtual machines by using machine sets
60+
include::modules/machineset-azure-confidential-vms.adoc[leveloffset=+1]
61+
5662
// Accelerated Networking for Microsoft Azure VMs
5763
include::modules/machineset-azure-accelerated-networking.adoc[leveloffset=+1]
5864

‎modules/machineset-azure-confidential-vms.adoc

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * machine_management/creating_machinesets/creating-machineset-azure.adoc
4+
// * machine_management/control_plane_machine_management/cpmso-using.adoc
5+
6+
ifeval::["{context}" == "cpmso-using"]
7+
:cpmso:
8+
endif::[]
9+
10+
:_content-type: PROCEDURE
11+
[id="machineset-azure-confidential-vms_{context}"]
12+
= Configuring Azure confidential virtual machines by using machine sets
13+
14+
:FeatureName: Using Azure confidential virtual machines
15+
include::snippets/technology-preview.adoc[]
16+
17+
{product-title} {product-version} supports Azure confidential virtual machines (VMs).
18+
19+
[NOTE]
20+
====
21+
Confidential VMs are currently not supported on 64-bit ARM architectures.
22+
====
23+
24+
By editing the machine set YAML file, you can configure the confidential VM options that a machine set uses for machines that it deploys. For example, you can configure these machines to use UEFI security features such as Secure Boot or a dedicated virtual Trusted Platform Module (vTPM) instance.
25+
26+
ifdef::cpmso[]
27+
[WARNING]
28+
====
29+
Not all instance types support confidential VMs. Do not change the instance type for a control plane machine set that is configured to use confidential VMs to a type that is incompatible. Using an incompatible instance type can cause your cluster to become unstable.
30+
====
31+
endif::cpmso[]
32+
33+
For more information about related features and functionality, see the Microsoft Azure documentation about link:https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview[Confidential virtual machines].
34+
35+
.Procedure
36+
37+
. In a text editor, open the YAML file for an existing machine set or create a new one.
38+
39+
. Edit the following section under the `providerSpec` field:
40+
+
41+
--
42+
.Sample configuration
43+
[source,yaml]
44+
----
45+
ifndef::cpmso[]
46+
apiVersion: machine.openshift.io/v1beta1
47+
kind: MachineSet
48+
endif::cpmso[]
49+
ifdef::cpmso[]
50+
apiVersion: machine.openshift.io/v1
51+
kind: ControlPlaneMachineSet
52+
endif::cpmso[]
53+
# ...
54+
spec:
55+
template:
56+
spec:
57+
providerSpec:
58+
value:
59+
osDisk:
60+
# ...
61+
managedDisk:
62+
securityProfile: # <1>
63+
securityEncryptionType: VMGuestStateOnly # <2>
64+
# ...
65+
securityProfile: # <3>
66+
settings:
67+
securityType: ConfidentialVM # <4>
68+
confidentialVM:
69+
uefiSettings: # <5>
70+
secureBoot: Disabled # <6>
71+
virtualizedTrustedPlatformModule: Enabled # <7>
72+
vmSize: Standard_DC16ads_v5 # <8>
73+
# ...
74+
----
75+
<1> Specifies security profile settings for the managed disk when using a confidential VM.
76+
<2> Enables encryption of the Azure VM Guest State (VMGS) blob. This setting requires the use of vTPM.
77+
<3> Specifies security profile settings for the confidential VM.
78+
<4> Enables the use of confidential VMs. This value is required for all valid configurations.
79+
<5> Specifies which UEFI security features to use. This section is required for all valid configurations.
80+
<6> Disables UEFI Secure Boot.
81+
<7> Enables the use of a vTPM.
82+
<8> Specifies an instance type that supports confidential VMs.
83+
--
84+
85+
.Verification
86+
87+
* On the Azure portal, review the details for a machine deployed by the machine set and verify that the confidential VM options match the values that you configured.
88+
89+
ifeval::["{context}" == "cpmso-using"]
90+
:!cpmso:
91+
endif::[]

‎modules/machineset-azure-trusted-launch.adoc

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * machine_management/creating_machinesets/creating-machineset-azure.adoc
4+
// * machine_management/control_plane_machine_management/cpmso-using.adoc
5+
6+
ifeval::["{context}" == "cpmso-using"]
7+
:cpmso:
8+
endif::[]
9+
10+
:_content-type: PROCEDURE
11+
[id="machineset-azure-trusted-launch_{context}"]
12+
= Configuring trusted launch for Azure virtual machines by using machine sets
13+
14+
:FeatureName: Using trusted launch for Azure virtual machines
15+
include::snippets/technology-preview.adoc[]
16+
17+
{product-title} {product-version} supports trusted launch for Azure virtual machines (VMs). By editing the machine set YAML file, you can configure the trusted launch options that a machine set uses for machines that it deploys. For example, you can configure these machines to use UEFI security features such as Secure Boot or a dedicated virtual Trusted Platform Module (vTPM) instance.
18+
19+
[NOTE]
20+
====
21+
Some feature combinations result in an invalid configuration.
22+
====
23+
24+
.UEFI feature combination compatibility
25+
|====
26+
|Secure Boot^[1]^ |vTPM^[2]^ |Valid configuration
27+
28+
|Enabled
29+
|Enabled
30+
|Yes
31+
32+
|Enabled
33+
|Disabled
34+
|Yes
35+
36+
|Enabled
37+
|Omitted
38+
|Yes
39+
40+
|Disabled
41+
|Enabled
42+
|Yes
43+
44+
|Omitted
45+
|Enabled
46+
|Yes
47+
48+
|Disabled
49+
|Disabled
50+
|No
51+
52+
|Omitted
53+
|Disabled
54+
|No
55+
56+
|Omitted
57+
|Omitted
58+
|No
59+
|====
60+
[.small]
61+
--
62+
1. Using the `secureBoot` field.
63+
2. Using the `virtualizedTrustedPlatformModule` field.
64+
--
65+
66+
For more information about related features and functionality, see the Microsoft Azure documentation about link:https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch[Trusted launch for Azure virtual machines].
67+
68+
.Procedure
69+
70+
. In a text editor, open the YAML file for an existing machine set or create a new one.
71+
72+
. Edit the following section under the `providerSpec` field to provide a valid configuration:
73+
+
74+
.Sample valid configuration with UEFI Secure Boot and vTPM enabled
75+
[source,yaml]
76+
----
77+
ifndef::cpmso[]
78+
apiVersion: machine.openshift.io/v1beta1
79+
kind: MachineSet
80+
endif::cpmso[]
81+
ifdef::cpmso[]
82+
apiVersion: machine.openshift.io/v1
83+
kind: ControlPlaneMachineSet
84+
endif::cpmso[]
85+
# ...
86+
spec:
87+
template:
88+
spec:
89+
providerSpec:
90+
value:
91+
securityProfile:
92+
settings:
93+
securityType: TrustedLaunch # <1>
94+
trustedLaunch:
95+
uefiSettings: # <2>
96+
secureBoot: Enabled # <3>
97+
virtualizedTrustedPlatformModule: Enabled # <4>
98+
# ...
99+
----
100+
<1> Enables the use of trusted launch for Azure virtual machines. This value is required for all valid configurations.
101+
<2> Specifies which UEFI security features to use. This section is required for all valid configurations.
102+
<3> Enables UEFI Secure Boot.
103+
<4> Enables the use of a vTPM.
104+
105+
.Verification
106+
107+
* On the Azure portal, review the details for a machine deployed by the machine set and verify that the trusted launch options match the values that you configured.
108+
109+
ifeval::["{context}" == "cpmso-using"]
110+
:!cpmso:
111+
endif::[]

‎modules/machineset-gcp-shielded-vms.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ ifdef::cpmso[]
3030
apiVersion: machine.openshift.io/v1
3131
kind: ControlPlaneMachineSet
3232
endif::cpmso[]
33-
...
33+
# ...
3434
spec:
3535
template:
3636
spec:
@@ -40,19 +40,19 @@ spec:
4040
integrityMonitoring: Enabled <2>
4141
secureBoot: Disabled <3>
4242
virtualizedTrustedPlatformModule: Enabled <4>
43-
...
43+
# ...
4444
----
4545
+
4646
--
4747
<1> In this section, specify any Shielded VM options that you want.
48-
<2> Specify whether UEFI Secure Boot is enabled. Valid values are `Disabled` or `Enabled`.
49-
<3> Specify whether integrity monitoring is enabled. Valid values are `Disabled` or `Enabled`.
48+
<2> Specify whether integrity monitoring is enabled. Valid values are `Disabled` or `Enabled`.
5049
+
5150
[NOTE]
5251
====
5352
When integrity monitoring is enabled, you must not disable virtual trusted platform module (vTPM).
5453
====
5554

55+
<3> Specify whether UEFI Secure Boot is enabled. Valid values are `Disabled` or `Enabled`.
5656
<4> Specify whether vTPM is enabled. Valid values are `Disabled` or `Enabled`.
5757
--
5858

0 commit comments

Comments
 (0)