Skip to content

Commit 3d592ee

Browse files
author
Hovsep
committed
Merge pull request #2313 from krkhan/dev
Report OS disk encryption status as "Unknown" for Linux VMs.
2 parents 8e5d46e + ca9e2e4 commit 3d592ee

10 files changed

+201
-59
lines changed

‎src/ResourceManager/Compute/Commands.Compute/Commands.Compute.csproj

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,7 @@
222222
<Compile Include="Extension\AzureDiskEncryption\AzureDiskEncryptionExtensionPublicSettings.cs" />
223223
<Compile Include="Extension\AzureDiskEncryption\DisableAzureDiskEncryption.cs" />
224224
<Compile Include="Extension\AzureDiskEncryption\GetAzureDiskEncryptionStatus.cs" />
225+
<Compile Include="Extension\AzureDiskEncryption\OSType.cs" />
225226
<Compile Include="Extension\AzureDiskEncryption\RemoveAzureDiskEncryptionExtension.cs" />
226227
<Compile Include="Extension\AzureDiskEncryption\SetAzureDiskEncryptionExtension.cs" />
227228
<Compile Include="Extension\AzureVMBackup\AzureVMBackupExtensionUtil.cs" />

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/AzureDiskEncryptionExtensionConstants.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,5 +35,6 @@ public static class AzureDiskEncryptionExtensionConstants
3535
public const string passphraseKey = "Passphrase";
3636
public const string osTypeLinux = "Linux";
3737
public const string osTypeWindows = "Windows";
38+
public const string defaultKeyEncryptionAlgorithm = "RSA-OAEP";
3839
}
3940
}

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/GetAzureDiskEncryptionStatus.cs

Lines changed: 110 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
using Microsoft.Azure.Management.Compute;
1818
using Microsoft.Azure.Management.Compute.Models;
1919
using System;
20+
using System.Globalization;
2021
using System.Management.Automation;
2122

2223
namespace Microsoft.Azure.Commands.Compute.Extension.AzureDiskEncryption
@@ -44,16 +45,47 @@ public class GetAzureDiskEncryptionStatusCommand : VirtualMachineExtensionBaseCm
4445
[ValidateNotNullOrEmpty]
4546
public string VMName { get; set; }
4647

47-
private bool IsOsVolumeEncrypted(VirtualMachine vmParameters)
48+
private OSType GetOSType(VirtualMachine vmParameters)
4849
{
49-
var osVolumeEncryptionSettings = GetOsVolumeEncryptionSettings(vmParameters);
50-
if (osVolumeEncryptionSettings != null)
50+
if (vmParameters == null || vmParameters.StorageProfile == null || vmParameters.StorageProfile.OsDisk == null)
5151
{
52-
return (osVolumeEncryptionSettings.Enabled == true
53-
&& !string.IsNullOrWhiteSpace(osVolumeEncryptionSettings.DiskEncryptionKey.SecretUrl));
52+
return OSType.Unknown;
5453
}
54+
else
55+
{
56+
if (OperatingSystemTypes.Linux == vmParameters.StorageProfile.OsDisk.OsType)
57+
{
58+
return OSType.Linux;
59+
}
60+
if (OperatingSystemTypes.Windows == vmParameters.StorageProfile.OsDisk.OsType)
61+
{
62+
return OSType.Windows;
63+
}
64+
return OSType.Unknown;
65+
}
66+
}
67+
private EncryptionStatus IsOsVolumeEncrypted(VirtualMachine vmParameters)
68+
{
69+
OSType osType = this.GetOSType(vmParameters);
70+
switch (osType)
71+
{
72+
case OSType.Windows:
73+
DiskEncryptionSettings osEncryptionSettings = GetOsVolumeEncryptionSettings(vmParameters);
5574

56-
return false;
75+
if (osEncryptionSettings != null
76+
&& osEncryptionSettings.DiskEncryptionKey != null
77+
&& !String.IsNullOrEmpty(osEncryptionSettings.DiskEncryptionKey.SecretUrl)
78+
&& osEncryptionSettings.Enabled == true)
79+
{
80+
return EncryptionStatus.Encrypted;
81+
}
82+
else
83+
{
84+
return EncryptionStatus.NotEncrypted;
85+
}
86+
default:
87+
return EncryptionStatus.Unknown;
88+
}
5789
}
5890

5991
private DiskEncryptionSettings GetOsVolumeEncryptionSettings(VirtualMachine vmParameters)
@@ -66,18 +98,38 @@ private DiskEncryptionSettings GetOsVolumeEncryptionSettings(VirtualMachine vmPa
6698
}
6799
return null;
68100
}
69-
private bool IsAzureDiskEncryptionExtension(VirtualMachineExtension vmExtension)
101+
102+
private bool IsAzureDiskEncryptionExtension(OSType osType, VirtualMachineExtension vmExtension)
70103
{
71-
if ((vmExtension != null) &&
72-
(vmExtension.Publisher != null) &&
73-
(vmExtension.VirtualMachineExtensionType != null) &&
74-
(vmExtension.Publisher.Equals(AzureDiskEncryptionExtensionContext.ExtensionDefaultPublisher, StringComparison.InvariantCultureIgnoreCase)) &&
75-
(vmExtension.VirtualMachineExtensionType.Equals(AzureDiskEncryptionExtensionContext.ExtensionDefaultName, StringComparison.InvariantCultureIgnoreCase)))
104+
switch (osType)
76105
{
77-
return true;
78-
}
106+
case OSType.Windows:
107+
if ((vmExtension != null) &&
108+
(vmExtension.Publisher != null) &&
109+
(vmExtension.VirtualMachineExtensionType != null) &&
110+
(vmExtension.Publisher.Equals(AzureDiskEncryptionExtensionContext.ExtensionDefaultPublisher, StringComparison.InvariantCultureIgnoreCase)) &&
111+
(vmExtension.VirtualMachineExtensionType.Equals(AzureDiskEncryptionExtensionContext.ExtensionDefaultName, StringComparison.InvariantCultureIgnoreCase)))
112+
{
113+
return true;
114+
}
79115

80-
return false;
116+
return false;
117+
case OSType.Linux:
118+
if ((vmExtension != null) &&
119+
(vmExtension.Publisher != null) &&
120+
(vmExtension.VirtualMachineExtensionType != null) &&
121+
(vmExtension.Publisher.Equals(AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultPublisher, StringComparison.InvariantCultureIgnoreCase)) &&
122+
(vmExtension.VirtualMachineExtensionType.Equals(AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultName, StringComparison.InvariantCultureIgnoreCase)))
123+
{
124+
return true;
125+
}
126+
127+
return false;
128+
case OSType.Unknown:
129+
return false;
130+
default:
131+
return false;
132+
}
81133
}
82134

83135
private bool DataVolumeInExtensionConfig(AzureDiskEncryptionExtensionContext adeExtension)
@@ -108,32 +160,42 @@ private bool ExtensionProvisioningSucceeded(AzureDiskEncryptionExtensionContext
108160
return false;
109161
}
110162

111-
private bool AreDataVolumesEncrypted(VirtualMachine vmParameters)
163+
private EncryptionStatus AreDataVolumesEncrypted(VirtualMachine vmParameters)
112164
{
113165
if (vmParameters == null || vmParameters.Resources == null)
114166
{
115-
return false;
167+
return EncryptionStatus.Unknown;
116168
}
117169

170+
OSType osType = this.GetOSType(vmParameters);
118171
foreach (VirtualMachineExtension vmExtension in vmParameters.Resources)
119172
{
120-
if (IsAzureDiskEncryptionExtension(vmExtension))
173+
switch (osType)
121174
{
122-
AzureDiskEncryptionExtensionContext adeExtension = new AzureDiskEncryptionExtensionContext(vmExtension.ToPSVirtualMachineExtension(this.ResourceGroupName, this.VMName));
123-
if (DataVolumeInExtensionConfig(adeExtension))
124-
{
125-
if (adeExtension.EncryptionOperation.Equals(AzureDiskEncryptionExtensionConstants.enableEncryptionOperation, StringComparison.InvariantCultureIgnoreCase))
175+
case OSType.Windows:
176+
case OSType.Linux:
177+
if (IsAzureDiskEncryptionExtension(osType, vmExtension))
126178
{
127-
if (ExtensionProvisioningSucceeded(adeExtension))
179+
AzureDiskEncryptionExtensionContext adeExtension = new AzureDiskEncryptionExtensionContext(vmExtension.ToPSVirtualMachineExtension(this.ResourceGroupName, this.VMName));
180+
if (DataVolumeInExtensionConfig(adeExtension))
128181
{
129-
return true;
182+
if (adeExtension.EncryptionOperation.Equals(AzureDiskEncryptionExtensionConstants.enableEncryptionOperation, StringComparison.InvariantCultureIgnoreCase))
183+
{
184+
if (ExtensionProvisioningSucceeded(adeExtension))
185+
{
186+
return EncryptionStatus.Encrypted;
187+
}
188+
}
130189
}
131190
}
132-
}
191+
break;
192+
case OSType.Unknown:
193+
return EncryptionStatus.Unknown;
194+
default:
195+
return EncryptionStatus.Unknown;
133196
}
134197
}
135-
136-
return false;
198+
return EncryptionStatus.NotEncrypted;
137199
}
138200

139201
public override void ExecuteCmdlet()
@@ -144,19 +206,31 @@ public override void ExecuteCmdlet()
144206
{
145207
VirtualMachine vmParameters = (this.ComputeClient.ComputeManagementClient.VirtualMachines.Get(this.ResourceGroupName, this.VMName));
146208

147-
bool osVolumeEncrypted = IsOsVolumeEncrypted(vmParameters);
209+
EncryptionStatus osVolumeEncrypted = IsOsVolumeEncrypted(vmParameters);
148210
DiskEncryptionSettings osVolumeEncryptionSettings = GetOsVolumeEncryptionSettings(vmParameters);
149-
bool dataVolumesEncrypted = AreDataVolumesEncrypted(vmParameters);
211+
EncryptionStatus dataVolumesEncrypted = AreDataVolumesEncrypted(vmParameters);
150212

151-
AzureDiskEncryptionStatusContext encryptionStatus = new AzureDiskEncryptionStatusContext
213+
OSType osType = GetOSType(vmParameters);
214+
switch (osType)
152215
{
153-
OsVolumeEncrypted = osVolumeEncrypted,
154-
OsVolumeEncryptionSettings = osVolumeEncryptionSettings,
155-
DataVolumesEncrypted = dataVolumesEncrypted
156-
};
157-
WriteObject(encryptionStatus);
216+
case OSType.Windows:
217+
case OSType.Linux:
218+
AzureDiskEncryptionStatusContext encryptionStatus = new AzureDiskEncryptionStatusContext
219+
{
220+
OsVolumeEncrypted = osVolumeEncrypted,
221+
DataVolumesEncrypted = dataVolumesEncrypted,
222+
OsVolumeEncryptionSettings = osVolumeEncryptionSettings
223+
};
224+
WriteObject(encryptionStatus);
225+
break;
226+
case OSType.Unknown:
227+
ThrowTerminatingError(new ErrorRecord(new ApplicationException(string.Format(CultureInfo.CurrentUICulture, "OS type unknown.")),
228+
"InvalidResult",
229+
ErrorCategory.InvalidResult,
230+
null));
231+
break;
232+
}
158233
});
159-
160234
}
161235
}
162236
}

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/OSType.cs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using System;
16+
using System.Collections.Generic;
17+
using System.Linq;
18+
using System.Text;
19+
using System.Threading.Tasks;
20+
21+
namespace Microsoft.Azure.Commands.Compute.Extension.AzureDiskEncryption
22+
{
23+
enum OSType
24+
{
25+
Windows,
26+
Linux,
27+
Unknown
28+
}
29+
}

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/SetAzureDiskEncryptionExtension.cs

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -311,11 +311,24 @@ private Hashtable GetExtensionPublicSettings()
311311
publicSettings.Add(AzureDiskEncryptionExtensionConstants.aadClientCertThumbprintKey, AadClientCertThumbprint ?? String.Empty);
312312
publicSettings.Add(AzureDiskEncryptionExtensionConstants.keyVaultUrlKey, DiskEncryptionKeyVaultUrl ?? String.Empty);
313313
publicSettings.Add(AzureDiskEncryptionExtensionConstants.keyEncryptionKeyUrlKey, KeyEncryptionKeyUrl ?? String.Empty);
314-
publicSettings.Add(AzureDiskEncryptionExtensionConstants.keyEncryptionAlgorithmKey, KeyEncryptionAlgorithm ?? String.Empty);
315314
publicSettings.Add(AzureDiskEncryptionExtensionConstants.volumeTypeKey, VolumeType ?? String.Empty);
316315
publicSettings.Add(AzureDiskEncryptionExtensionConstants.encryptionOperationKey, AzureDiskEncryptionExtensionConstants.enableEncryptionOperation);
317316
publicSettings.Add(AzureDiskEncryptionExtensionConstants.sequenceVersionKey, SequenceVersion ?? String.Empty);
318317

318+
string keyEncryptAlgorithm = string.Empty;
319+
if (!string.IsNullOrEmpty(this.KeyEncryptionKeyUrl))
320+
{
321+
if(!string.IsNullOrEmpty(KeyEncryptionAlgorithm))
322+
{
323+
keyEncryptAlgorithm = KeyEncryptionAlgorithm;
324+
}
325+
else
326+
{
327+
keyEncryptAlgorithm = AzureDiskEncryptionExtensionConstants.defaultKeyEncryptionAlgorithm;
328+
}
329+
}
330+
publicSettings.Add(AzureDiskEncryptionExtensionConstants.keyEncryptionAlgorithmKey, keyEncryptAlgorithm);
331+
319332
return publicSettings;
320333
}
321334

@@ -347,12 +360,11 @@ private VirtualMachineExtension GetVmExtensionParameters(VirtualMachine vmParame
347360

348361
if (OperatingSystemTypes.Windows.Equals(currentOSType))
349362
{
350-
this.Name = this.Name ?? AzureDiskEncryptionExtensionContext.ExtensionDefaultName;
351363
vmExtensionParameters = new VirtualMachineExtension
352364
{
353365
Location = vmParameters.Location,
354366
Publisher = AzureDiskEncryptionExtensionContext.ExtensionDefaultPublisher,
355-
VirtualMachineExtensionType = AzureDiskEncryptionExtensionContext.ExtensionDefaultName,
367+
VirtualMachineExtensionType = this.Name ?? AzureDiskEncryptionExtensionContext.ExtensionDefaultName,
356368
TypeHandlerVersion = (this.TypeHandlerVersion) ?? AzureDiskEncryptionExtensionContext.ExtensionDefaultVersion,
357369
Settings = SettingString,
358370
ProtectedSettings = ProtectedSettingString,
@@ -361,12 +373,11 @@ private VirtualMachineExtension GetVmExtensionParameters(VirtualMachine vmParame
361373
}
362374
else if (OperatingSystemTypes.Linux.Equals(currentOSType))
363375
{
364-
this.Name = this.Name ?? AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultName;
365376
vmExtensionParameters = new VirtualMachineExtension
366377
{
367378
Location = vmParameters.Location,
368379
Publisher = AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultPublisher,
369-
VirtualMachineExtensionType = AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultName,
380+
VirtualMachineExtensionType = this.Name ?? AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultName,
370381
TypeHandlerVersion = (this.TypeHandlerVersion) ?? AzureDiskEncryptionExtensionContext.LinuxExtensionDefaultVersion,
371382
Settings = SettingString,
372383
ProtectedSettings = ProtectedSettingString,

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureVMBackup/AzureVMBackupException.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public class AzureVMBackupErrorCodes
2121
public const int TimeOut = 1;
2222
public const int OSNotSupported = 2;
2323
public const int WrongBlobUriFormat = 3;
24+
public const int NoSnapshotFound = 4;
2425
}
2526

2627
public class AzureVMBackupException : Exception

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureVMBackup/AzureVMBackupExtensionUtil.cs

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
using System;
3030
using System.Collections.Generic;
3131
using System.Threading;
32+
using System.Threading.Tasks;
3233

3334
namespace Microsoft.Azure.Commands.Compute.Extension.AzureVMBackup
3435
{
@@ -168,10 +169,18 @@ public void RemoveSnapshot(AzureVMBackupConfig vmConfig, string snapshotTag, Vir
168169
List<string> blobUris = this.GetDiskBlobUris(virtualMachineResponse.Body);
169170

170171
Dictionary<string, string> snapshotQuery = new Dictionary<string, string>();
171-
List<CloudPageBlob> snapshots = this.FindSnapshot(blobUris, snapshotQuery, storageCredentialsFactory);
172-
foreach (CloudPageBlob snapshot in snapshots)
172+
snapshotQuery.Add(backupExtensionMetadataName, snapshotTag);
173+
List <CloudPageBlob> snapshots = this.FindSnapshot(blobUris, snapshotQuery, storageCredentialsFactory);
174+
if (snapshots == null || snapshots.Count == 0)
175+
{
176+
throw new AzureVMBackupException(AzureVMBackupErrorCodes.NoSnapshotFound, "snapshot with the tag not found.");
177+
}
178+
else
173179
{
174-
snapshot.Delete();
180+
foreach (CloudPageBlob snapshot in snapshots)
181+
{
182+
snapshot.Delete();
183+
}
175184
}
176185
}
177186

‎src/ResourceManager/Compute/Commands.Compute/Microsoft.Azure.Commands.Compute.dll-Help.xml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3087,7 +3087,7 @@ PS C:\&gt; Add-AzureRmVmssWinRMListener -VirtualMachineScaleSet $VMSS -Protocol
30873087
<dev:version />
30883088
</command:details>
30893089
<maml:description>
3090-
<maml:para>The Disable-AzureRmVMDiskEncryption cmdlet disables encryption on an infrastructure as a service (IaaS) virtual machine. This cmdlet is only supported on Windows virtual machines and not Linux virtual machines. This cmdlet installs an extension on the virtual machine to disable encryption. If the Name parameter is not specified, an extension with the default name &quot;AzureDiskEncryption for Windows VMs&quot; is created. Caution: This cmdlet reboots the virtual machine.</maml:para>
3090+
<maml:para>The Disable-AzureRmVMDiskEncryption cmdlet disables encryption on an infrastructure as a service (IaaS) virtual machine. This cmdlet installs an extension on the virtual machine to disable encryption. If the Name parameter is not specified, extension with the name &quot;AzureDiskEncryption/AzureDiskEncryptionForLinux&quot; (depending on the OS) is used. Caution: This cmdlet reboots the virtual machine.</maml:para>
30913091
</maml:description>
30923092
<command:syntax>
30933093
<command:syntaxItem>
@@ -5438,7 +5438,8 @@ PS C:\&gt; Disable-AzureRMVMDiskEncryption -ResourceGroupName &quot;Group002&quo
54385438
<dev:version />
54395439
</command:details>
54405440
<maml:description>
5441-
<maml:para>The Get-AzureRmVMDiskEncryptionStatus cmdlet gets the encryption status of the virtual machine. It displays the encryption status of the operating system and data volumes. In addition to encryption status, it also displays the encryption secret URL, key encryption key URL, resource IDs of the KeyVaults where the encryption key and key encryption key for operating system volume are present.</maml:para>
5441+
<maml:para>The Get-AzureRmVMDiskEncryptionStatus cmdlet gets the encryption status of the virtual machine. It displays the encryption status of the operating system and data volumes. In addition to encryption status, it also displays the encryption secret URL, key encryption key URL, resource IDs of the KeyVaults where the encryption key and key encryption key for operating system volume are present. </maml:para>
5442+
<maml:para>The OS disk encryption status reporting is not supported for Linux VMs in the preview release. Currently it is reported as &quot;Unknown&quot;.</maml:para>
54425443
</maml:description>
54435444
<command:syntax>
54445445
<command:syntaxItem>

0 commit comments

Comments
 (0)