Skip to content

Commit fa56da9

Browse files
markcowlmarkcowl
committed
Merge pull request Azure#1243 from AzureRT/dev
Disk encryption feature
2 parents a012c80 + 6c204ed commit fa56da9

File tree

39 files changed

+20598
-11990
lines changed

39 files changed

+20598
-11990
lines changed

‎src/ResourceManager/Compute/AzureRM.Compute.psd1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
@{
1010

1111
# Version number of this module.
12-
ModuleVersion = '1.0.1'
12+
ModuleVersion = '1.1.0'
1313

1414
# ID used to uniquely identify this module
1515
GUID = '0a83c907-1ffb-4d87-a492-c65ac7d7ed37'

‎src/ResourceManager/Compute/Commands.Compute.Test/Commands.Compute.Test.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@
6767
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Authorization.1.0.0\lib\net40\Microsoft.Azure.Management.Authorization.dll</HintPath>
6868
</Reference>
6969
<Reference Include="Microsoft.Azure.Management.Compute, Version=9.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
70-
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Compute.9.0.0\lib\net40\Microsoft.Azure.Management.Compute.dll</HintPath>
70+
<SpecificVersion>False</SpecificVersion>
71+
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Compute.9.1.0\lib\net40\Microsoft.Azure.Management.Compute.dll</HintPath>
7172
<Private>True</Private>
7273
</Reference>
7374
<Reference Include="Microsoft.Azure.Management.Network, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">

‎src/ResourceManager/Compute/Commands.Compute.Test/ScenarioTests/VirtualMachineExtensionTests.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,5 +53,13 @@ public void TestVirtualMachineAccessExtension()
5353
{
5454
ComputeTestController.NewInstance.RunPsTest("Test-VirtualMachineAccessExtension");
5555
}
56+
57+
[Fact(Skip = "TODO: only works for live mode")]
58+
[Trait(Category.RunType, Category.LiveOnly)]
59+
public void TestAzureDiskEncryptionExtension()
60+
{
61+
ComputeTestController.NewInstance.RunPsTest("Test-AzureDiskEncryptionExtension");
62+
}
63+
5664
}
5765
}

‎src/ResourceManager/Compute/Commands.Compute.Test/ScenarioTests/VirtualMachineExtensionTests.ps1

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -790,3 +790,138 @@ function Test-VirtualMachineAccessExtension
790790
Clean-ResourceGroup $rgname
791791
}
792792
}
793+
794+
<#
795+
.SYNOPSIS
796+
Test AzureDiskEncryption extension
797+
#>
798+
function Test-AzureDiskEncryptionExtension
799+
{
800+
# This test should be run in Live mode only not in Playback mode
801+
#Pre-requisites to be filled in before running this test. The AAD app should belong to the directory as the user running the test.
802+
$aadClientID = "";
803+
$aadClientSecret = "";
804+
#Fill in VM admin user and password
805+
$adminUser = "";
806+
$adminPassword = "";
807+
808+
#Resource group variables
809+
$rgName = "detestrg";
810+
$loc = "South Central US";
811+
812+
#KeyVault config variables
813+
$vaultName = "detestvault";
814+
$kekName = "dstestkek";
815+
816+
#VM config variables
817+
$vmName = "detestvm";
818+
$vmsize = 'Standard_D2';
819+
$imagePublisher = "MicrosoftWindowsServer";
820+
$imageOffer = "WindowsServer";
821+
$imageSku ="2012-R2-Datacenter";
822+
823+
#Storage config variables
824+
$storageAccountName = "deteststore";
825+
$stotype = 'Standard_LRS';
826+
$vhdContainerName = "vhds";
827+
$osDiskName = 'osdisk' + $vmName;
828+
$dataDiskName = 'datadisk' + $vmName;
829+
$osDiskCaching = 'ReadWrite';
830+
831+
#Network config variables
832+
$vnetName = "detestvnet";
833+
$subnetName = "detestsubnet";
834+
$publicIpName = 'pubip' + $vmName;
835+
$nicName = 'nic' + $vmName;
836+
837+
838+
#Disk encryption variables
839+
$keyEncryptionAlgorithm = "RSA-OAEP";
840+
$volumeType = "All";
841+
842+
try
843+
{
844+
Login-AzureRmAccount;
845+
# Create new resource group
846+
New-AzureRmResourceGroup -Name $rgname -Location $loc -Force;
847+
848+
# Create new KeyVault
849+
$keyVault = New-AzureRmKeyVault -VaultName $vaultName -ResourceGroupName $rgname -Location $loc -Sku standard;
850+
$keyVault = Get-AzureRmKeyVault -VaultName $vaultName -ResourceGroupName $rgname
851+
#set enabledForDiskEncryption
852+
Write-Host 'Press go to https://resources.azure.com and set enabledForDiskEncryption flag on KeyVault. [ENTER] to continue or [CTRL-C] to abort...'
853+
Read-Host
854+
#set permissions to AAD app to write secrets and keys
855+
Set-AzureRmKeyVaultAccessPolicy -VaultName $vaultName -ServicePrincipalName $aadClientID -PermissionsToKeys all -PermissionsToSecrets all
856+
#create a key in KeyVault to use as Kek
857+
$kek = Add-AzureKeyVaultKey -VaultName $vaultName -Name $kekName -Destination "Software"
858+
859+
$diskEncryptionKeyVaultUrl = $keyVault.VaultUri;
860+
$keyVaultResourceId = $keyVault.ResourceId;
861+
$keyEncryptionKeyUrl = $kek.Key.kid;
862+
863+
# VM Profile & Hardware
864+
$p = New-AzureRmVMConfig -VMName $vmname -VMSize $vmsize;
865+
866+
# NRP
867+
$subnet = New-AzureRmVirtualNetworkSubnetConfig -Name ($subnetName) -AddressPrefix "10.0.0.0/24";
868+
$vnet = New-AzureRmVirtualNetwork -Force -Name ($vnetName) -ResourceGroupName $rgname -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
869+
$vnet = Get-AzureRmVirtualNetwork -Name ($vnetName) -ResourceGroupName $rgname;
870+
$subnetId = $vnet.Subnets[0].Id;
871+
$pubip = New-AzureRmPublicIpAddress -Force -Name ($publicIpName) -ResourceGroupName $rgname -Location $loc -AllocationMethod Dynamic -DomainNameLabel ($publicIpName);
872+
$pubip = Get-AzureRmPublicIpAddress -Name ($publicIpName) -ResourceGroupName $rgname;
873+
$pubipId = $pubip.Id;
874+
$nic = New-AzureRmNetworkInterface -Force -Name ($nicName) -ResourceGroupName $rgname -Location $loc -SubnetId $subnetId -PublicIpAddressId $pubip.Id;
875+
$nic = Get-AzureRmNetworkInterface -Name ($nicName) -ResourceGroupName $rgname;
876+
$nicId = $nic.Id;
877+
878+
$p = Add-AzureRmVMNetworkInterface -VM $p -Id $nicId;
879+
880+
# Storage Account (SA)
881+
New-AzureRmStorageAccount -ResourceGroupName $rgname -Name $storageAccountName -Location $loc -Type $stotype;
882+
$stokey = (Get-AzureRmStorageAccountKey -ResourceGroupName $rgname -Name $storageAccountName).Key1;
883+
884+
$osDiskVhdUri = "https://$storageAccountName.blob.core.windows.net/$vhdContainerName/$osDiskName.vhd";
885+
$dataDiskVhdUri = "https://$storageAccountName.blob.core.windows.net/$vhdContainerName/$dataDiskName.vhd";
886+
887+
$p = Set-AzureRmVMOSDisk -VM $p -Name $osDiskName -VhdUri $osDiskVhdUri -Caching $osDiskCaching -CreateOption FromImage;
888+
$p = Add-AzureRmVMDataDisk -VM $p -Name $dataDiskName -Caching 'ReadOnly' -DiskSizeInGB 2 -Lun 1 -VhdUri $dataDiskVhdUri -CreateOption Empty;
889+
890+
# OS & Image
891+
$securePassword = ConvertTo-SecureString $adminPassword -AsPlainText -Force;
892+
$cred = New-Object System.Management.Automation.PSCredential ($adminUser, $securePassword);
893+
$computerName = $vmName;
894+
$vhdContainer = "https://$storageAccountName.blob.core.windows.net/$vhdContainerName";
895+
896+
$p = Set-AzureRmVMOperatingSystem -VM $p -Windows -ComputerName $computerName -Credential $cred -ProvisionVMAgent;
897+
$p = Set-AzureRmVMSourceImage -VM $p -PublisherName $imagePublisher -Offer $imageOffer -Skus $imageSku -Version "latest";
898+
899+
900+
# Virtual Machine
901+
New-AzureRmVM -ResourceGroupName $rgname -Location $loc -VM $p;
902+
903+
#Enable encryption on the VM
904+
Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $rgname -VMName $vmName -AadClientID $aadClientID -AadClientSecret $aadClientSecret -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $keyVaultResourceId -KeyEncryptionKeyUrl $keyEncryptionKeyUrl -KeyEncryptionKeyVaultId $keyVaultResourceId -Force;
905+
#Get encryption status
906+
$encryptionStatus = Get-AzureRmVmDiskEncryptionStatus -ResourceGroupName $rgname -VMName $vmName;
907+
#Remove AzureDiskEncryption extension
908+
Remove-AzureRmVMDiskEncryptionExtension -ResourceGroupName $rgname -VMName $vmName;
909+
910+
#Remove the VM
911+
Remove-AzureRmVm -ResourceGroupName $rgname -Name $vmName -Force;
912+
913+
#Create a brand new VM using the same OS vhd encrypted above
914+
$p.StorageProfile.ImageReference = $null;
915+
$p.OSProfile = $null;
916+
$p.StorageProfile.DataDisks = $null;
917+
$p = Set-AzureRmVMOSDisk -VM $p -Name $p.StorageProfile.OSDisk.Name -VhdUri $p.StorageProfile.OSDisk.VirtualHardDisk.Uri -Caching ReadWrite -CreateOption attach -DiskEncryptionKeyUrl $encryptionStatus.OsVolumeEncryptionSettings.DiskEncryptionKey.SecretUrl -DiskEncryptionKeyVaultId $encryptionStatus.OsVolumeEncryptionSettings.DiskEncryptionKey.SourceVault.ReferenceUri -Windows;
918+
919+
New-AzureRmVM -ResourceGroupName $rgname -Location $loc -VM $p;
920+
921+
}
922+
finally
923+
{
924+
# Cleanup
925+
Remove-AzureRmResourceGroup -Name $rgname -Force;
926+
}
927+
}

‎src/ResourceManager/Compute/Commands.Compute.Test/ScenarioTests/VirtualMachineProfileTests.ps1

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,13 +244,22 @@ function Test-VirtualMachineProfileWithoutAUC
244244
$dataDiskVhdUri2 = "https://$stoname.blob.core.windows.net/test/data2.vhd";
245245
$dataDiskVhdUri3 = "https://$stoname.blob.core.windows.net/test/data3.vhd";
246246

247-
$p = Set-AzureRmVMOSDisk -VM $p -Name $osDiskName -VhdUri $osDiskVhdUri -Caching $osDiskCaching -CreateOption Empty;
247+
$dekUri = "https://testvault123.vault.azure.net/secrets/Test1/514ceb769c984379a7e0230bddaaaaaa";
248+
$dekId = "/subscriptions/" + $subid + "/resourceGroups/RgTest1/providers/Microsoft.KeyVault/vaults/TestVault123";
249+
$kekUri = "http://keyVaultName.vault.azure.net/secrets/secretName/secretVersion";
250+
$kekId = "/subscriptions/" + $subid + "/resourceGroups/RgTest1/providers/Microsoft.KeyVault/vaults/TestVault123";
251+
252+
$p = Set-AzureRmVMOSDisk -VM $p -Windows -Name $osDiskName -VhdUri $osDiskVhdUri -Caching $osDiskCaching -CreateOption Empty -DiskEncryptionKeyUrl $dekUri -DiskEncryptionKeyVaultId $dekId -KeyEncryptionKeyUrl $kekUri -KeyEncryptionKeyVaultId $kekId;
248253

249254
$p = Add-AzureRmVMDataDisk -VM $p -Name 'testDataDisk1' -Caching 'ReadOnly' -DiskSizeInGB 10 -Lun 0 -VhdUri $dataDiskVhdUri1 -CreateOption Empty;
250255
$p = Add-AzureRmVMDataDisk -VM $p -Name 'testDataDisk2' -Caching 'ReadOnly' -DiskSizeInGB 11 -Lun 1 -VhdUri $dataDiskVhdUri2 -CreateOption Empty;
251256
$p = Add-AzureRmVMDataDisk -VM $p -Name 'testDataDisk3' -Caching 'ReadOnly' -DiskSizeInGB 12 -Lun 2 -VhdUri $dataDiskVhdUri3 -CreateOption Empty;
252257
$p = Remove-AzureRmVMDataDisk -VM $p -Name 'testDataDisk3';
253258

259+
Assert-AreEqual $p.StorageProfile.OSDisk.EncryptionSettings.DiskEncryptionKey.SourceVault.ReferenceUri $dekId
260+
Assert-AreEqual $p.StorageProfile.OSDisk.EncryptionSettings.DiskEncryptionKey.SecretUrl $dekUri
261+
Assert-AreEqual $p.StorageProfile.OSDisk.EncryptionSettings.KeyEncryptionKey.SourceVault.ReferenceUri $kekId
262+
Assert-AreEqual $p.StorageProfile.OSDisk.EncryptionSettings.KeyEncryptionKey.KeyUrl $kekUri
254263
Assert-AreEqual $p.StorageProfile.OSDisk.Caching $osDiskCaching;
255264
Assert-AreEqual $p.StorageProfile.OSDisk.Name $osDiskName;
256265
Assert-AreEqual $p.StorageProfile.OSDisk.VirtualHardDisk.Uri $osDiskVhdUri;

‎src/ResourceManager/Compute/Commands.Compute.Test/ScenarioTests/VirtualMachineTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public partial class VirtualMachineTests
2323
[Trait(Category.AcceptanceType, Category.CheckIn)]
2424
public void TestVirtualMachine()
2525
{
26-
ComputeTestController.NewInstance.RunPsTest("Test-VirtualMachine");
26+
ComputeTestController.NewInstance.RunPsTest(@"Test-VirtualMachine $null");
2727
}
2828

2929
[Fact]

‎src/ResourceManager/Compute/Commands.Compute.Test/ScenarioTests/VirtualMachineTests.ps1

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,17 @@ Test Virtual Machines
1818
#>
1919
function Test-VirtualMachine
2020
{
21+
param ($loc)
2122
# Setup
2223
$rgname = Get-ComputeTestResourceName
2324

2425
try
2526
{
2627
# Common
27-
$loc = Get-ComputeVMLocation;
28+
if ($loc -eq $null)
29+
{
30+
$loc = Get-ComputeVMLocation;
31+
}
2832
New-AzureRmResourceGroup -Name $rgname -Location $loc -Force;
2933

3034
# VM Profile & Hardware

‎src/ResourceManager/Compute/Commands.Compute.Test/packages.config

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<package id="Microsoft.Azure.Gallery" version="2.6.2-preview" targetFramework="net45" />
88
<package id="Microsoft.Azure.Graph.RBAC" version="1.7.0-preview" targetFramework="net45" />
99
<package id="Microsoft.Azure.Management.Authorization" version="1.0.0" targetFramework="net45" />
10-
<package id="Microsoft.Azure.Management.Compute" version="9.0.0" targetFramework="net45" />
10+
<package id="Microsoft.Azure.Management.Compute" version="9.1.0" targetFramework="net45" />
1111
<package id="Microsoft.Azure.Management.Network" version="2.0.13-preview" targetFramework="net45" />
1212
<package id="Microsoft.Azure.Management.Resources" version="2.18.7-preview" targetFramework="net45" />
1313
<package id="Microsoft.Azure.Management.Storage" version="3.0.0" targetFramework="net45" />

‎src/ResourceManager/Compute/Commands.Compute/Commands.Compute.csproj

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@
8181
<Private>True</Private>
8282
</Reference>
8383
<Reference Include="Microsoft.Azure.Management.Compute, Version=9.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
84-
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Compute.9.0.0\lib\net40\Microsoft.Azure.Management.Compute.dll</HintPath>
84+
<SpecificVersion>False</SpecificVersion>
85+
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Compute.9.1.0\lib\net40\Microsoft.Azure.Management.Compute.dll</HintPath>
8586
<Private>True</Private>
8687
</Reference>
8788
<Reference Include="Microsoft.Azure.Management.Network, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
@@ -206,6 +207,19 @@
206207
<Compile Include="ExtensionImages\GetAzureVMExtensionImageTypeCommand.cs" />
207208
<Compile Include="ExtensionImages\GetAzureVMExtensionImageCommand.cs" />
208209
<Compile Include="ExtensionImages\VirtualMachineExtensionImageBaseCmdlet.cs" />
210+
<Compile Include="Extension\AzureDiskEncryption\AzureDiskEncryptionExtensionContext.cs" />
211+
<Compile Include="Extension\AzureDiskEncryption\AzureDiskEncryptionExtensionProtectedSettings.cs" />
212+
<Compile Include="Extension\AzureDiskEncryption\AzureDiskEncryptionExtensionPublicSettings.cs" />
213+
<Compile Include="Extension\AzureDiskEncryption\GetAzureDiskEncryptionStatus.cs" />
214+
<Compile Include="Extension\AzureDiskEncryption\RemoveAzureDiskEncryptionExtension.cs" />
215+
<Compile Include="Extension\AzureDiskEncryption\SetAzureDiskEncryptionExtension.cs" />
216+
<Compile Include="Extension\AzureVMBackup\AzureVMBackupExtensionUtil.cs" />
217+
<Compile Include="Extension\AzureVMBackup\AzureVMBackupException.cs" />
218+
<Compile Include="Extension\AzureVMBackup\AzureVMBackupExtensionProtectedSettings.cs" />
219+
<Compile Include="Extension\AzureVMBackup\AzureVMBackupExtensionPublicSettings.cs" />
220+
<Compile Include="Extension\AzureVMBackup\AzureVMBackupConfig.cs" />
221+
<Compile Include="Extension\AzureVMBackup\RemoveAzureVMBackup.cs" />
222+
<Compile Include="Extension\AzureVMBackup\SetAzureVMBackupExtension.cs" />
209223
<Compile Include="Extension\CustomScript\GetAzureVMCustomScriptExtensionCommand.cs" />
210224
<Compile Include="Extension\CustomScript\CustomScriptExtensionPrivateSettings.cs" />
211225
<Compile Include="Extension\CustomScript\CustomScriptExtensionPublicSettings.cs" />
@@ -241,6 +255,7 @@
241255
<Compile Include="Extension\SqlServer\VirtualMachineSqlServerExtensionContext.cs" />
242256
<Compile Include="Images\GetAzureVMImageCommand.cs" />
243257
<Compile Include="Common\HashTableExtensions.cs" />
258+
<Compile Include="Models\AzureDiskEncryptionStatusContext.cs" />
244259
<Compile Include="Models\PSComputeLongRunningOperation.cs" />
245260
<Compile Include="Models\PSOperation.cs" />
246261
<Compile Include="Extension\VMAccess\GetAzureVMAccessExtension.cs" />

‎src/ResourceManager/Compute/Commands.Compute/Common/ConstantStringTypes.cs

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ public static class HelpMessages
2828
public const string VMOSDiskCaching = "The virtual machine OS disk's caching.";
2929
public const string VMOSDiskWindowsOSType = "The virtual machine disk's OS is Windows.";
3030
public const string VMOSDiskLinuxOSType = "The virtual machine disk's OS is Linux.";
31+
public const string VMOSDiskDiskEncryptionKeyUrl = "the URL referencing a secret in a disk encryption key vault";
32+
public const string VMOSDiskDiskEncryptionKeyVaultId = "the Id of a disk encryption key vault";
33+
public const string VMOSDiskKeyEncryptionKeyUrl = "the URL referencing a key in a key encryption key vault";
34+
public const string VMOSDiskKeyEncryptionKeyVaultId = "the Id of a key encryption key Vault";
3135
public const string VMSourceImageUri = "The virtual machine OS disk's source image Uri.";
3236

3337
public const string VMDataDiskName = "The virtual machine data disk's name.";
@@ -110,5 +114,14 @@ public static class ProfileNouns
110114

111115
// Sql Server
112116
public const string VirtualMachineSqlServerExtension = "AzureRmVMSqlServerExtension";
117+
118+
//AzureDiskEncryption
119+
public const string AzureDiskEncryptionExtension = "AzureRmVMDiskEncryptionExtension";
120+
public const string AzureDiskEncryptionStatus = "AzureRmVMDiskEncryptionStatus";
121+
122+
//AzureVMBackup
123+
public const string AzureVMBackup = "AzureRmVMBackup";
124+
public const string AzureVMBackupExtension = "AzureRmVMBackupExtension";
125+
113126
}
114127
}

0 commit comments

Comments
 (0)