Skip to content

Commit 63b16d4

Browse files
SandidoSandido
authored
Trusted Launch logic for SecurityType, Vtpm, and Secureboot parameters (Azure#21659)
* Update NewAzureRmVmssConfigCommand.cs * Update VirtualMachineScaleSetCreateOrUpdateMethod.cs * Update VirtualMachineScaleSetCreateOrUpdateMethod.cs * Update Images.json * Update VirtualMachineScaleSetStrategy.cs * Update VirtualMachineStrategy.cs * Update NewAzureVMConfigCommand.cs * Update NewAzureVMCommand.cs * Update UpdateAzureVMCommand.cs * cleanup * br removal * tests * test trying * tests recorded fine * examples and test * clean * tlvm ga no config * simple param ga defaulting * almost test * test fixed * clean * clean * clean * clena * clean * examples clean * desc * test fix * test clean again * lots of cleanup * test cleanup * clean * clean * cleanup * cleanup * pr comments
1 parent a2eb28f commit 63b16d4

25 files changed

+25166
-983
lines changed

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.cs

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -318,12 +318,26 @@ public void TestVirtualMachineScaleSetOSImageScheduledEvents()
318318
{
319319
TestRunner.RunTestScript("Test-VirtualMachineScaleSetOSImageScheduledEvents");
320320
}
321-
321+
322322
[Fact]
323323
[Trait(Category.AcceptanceType, Category.CheckIn)]
324324
public void TestVirtualMachineScaleSetGetById()
325325
{
326326
TestRunner.RunTestScript("Test-VirtualMachineScaleSetGetById");
327327
}
328+
329+
[Fact]
330+
[Trait(Category.AcceptanceType, Category.CheckIn)]
331+
public void TestVirtualMachineScaleSetSecurityType()
332+
{
333+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityType");
334+
}
335+
336+
[Fact]
337+
[Trait(Category.AcceptanceType, Category.CheckIn)]
338+
public void TestVirtualMachineScaleSetSecurityTypeWithoutConfig()
339+
{
340+
TestRunner.RunTestScript("Test-VirtualMachineScaleSetSecurityTypeWithoutConfig");
341+
}
328342
}
329343
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.ps1

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3449,6 +3449,25 @@ function Test-VirtualMachineScaleSetGuestAttestation
34493449
$vmssvm = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceId $vmssvms[0].InstanceId;
34503450
Assert-AreEqual $extDefaultName $vmssvm.Resources[2].Name;
34513451

3452+
# Simple param Set
3453+
$username = Get-ComputeTestResourceName;
3454+
$securePassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force
3455+
$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword);
3456+
3457+
$vmssname2 = "vmss2" + $rgname;
3458+
$domainNameLabel2 = "dnl" + $rgname;
3459+
$vmss2 = New-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssname2 -ImageName 'Win2019DatacenterGen2' `
3460+
-Credential $credential -InstanceCount 1 -DomainNameLabel $domainNameLabel2 -SecurityType "TrustedLaunch" `
3461+
-EnableSecureBoot $true -EnableVtpm $true;
3462+
3463+
$vmssGet2 = Get-AzVmss -ResourceGroupName $rgname -Name $vmssName2;
3464+
$output2 = $vmssGet2 | Out-String;
3465+
Assert-True { $output2.Contains($vmGADefaultIDentity) };
3466+
3467+
$vmssvms = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName2;
3468+
Assert-NotNull $vmssvms;
3469+
$vmssvm = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName2 -InstanceId $vmssvms[0].InstanceId;
3470+
Assert-AreEqual $extDefaultName $vmssvm.Resources[2].Name;
34523471

34533472
}
34543473
finally
@@ -4401,4 +4420,182 @@ function Test-VirtualMachineScaleSetGetById
44014420
# Cleanup
44024421
Clean-ResourceGroup $rgname;
44034422
}
4423+
}
4424+
4425+
<#
4426+
.SYNOPSIS
4427+
Test Virtual Machine Scale Set VtpmEabled and SecureBootEnabled
4428+
for the certain Trusted Launch feature setup.
4429+
#>
4430+
function Test-VirtualMachineScaleSetSecurityType
4431+
{
4432+
# Setup
4433+
$rgname = Get-ComputeTestResourceName;
4434+
$loc = Get-ComputeVMLocation;
4435+
4436+
try
4437+
{
4438+
# Common
4439+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
4440+
4441+
$vmssSize = 'Standard_D4s_v3';
4442+
$PublisherName = "MicrosoftWindowsServer";
4443+
$Offer = "WindowsServer";
4444+
$SKU = "2016-datacenter-gensecond";
4445+
$securityType = "TrustedLaunch";
4446+
$enable = $true;
4447+
$disable = $false;
4448+
4449+
# NRP
4450+
$vnetworkName = 'vnet' + $rgname;
4451+
$subnetName = 'subnet' + $rgname;
4452+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix "10.0.0.0/24";
4453+
$vnet = New-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
4454+
$vnet = Get-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname;
4455+
$subnetId = $vnet.Subnets[0].Id;
4456+
4457+
# New VMSS Parameters
4458+
$vmssName1 = 'vmss1' + $rgname;
4459+
$vmssName2 = 'vmss2' + $rgname;
4460+
$vmssType = 'Microsoft.Compute/virtualMachineScaleSets';
4461+
4462+
$adminUsername = Get-ComputeTestResourceName;
4463+
$adminPassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force;
4464+
4465+
$imgRef = New-Object -TypeName 'Microsoft.Azure.Commands.Compute.Models.PSVirtualMachineImage';
4466+
$imgRef.PublisherName = $PublisherName;
4467+
$imgRef.Offer = $Offer;
4468+
$imgRef.Skus = $SKU;
4469+
$imgRef.Version = "latest";
4470+
4471+
4472+
$ipCfg = New-AzVmssIPConfig -Name 'test' -SubnetId $subnetId;
4473+
4474+
$vmss = New-AzVmssConfig -Location $loc -SkuCapacity 2 -SkuName $vmssSize -UpgradePolicyMode 'Manual' `
4475+
| Add-AzVmssNetworkInterfaceConfiguration -Name 'test' -Primary $true -IPConfiguration $ipCfg `
4476+
| Set-AzVmssOSProfile -ComputerNamePrefix 'test' -AdminUsername $adminUsername -AdminPassword $adminPassword `
4477+
| Set-AzVmssStorageProfile -OsDiskCreateOption 'FromImage' -OsDiskCaching 'ReadOnly' `
4478+
-ImageReferenceOffer $imgRef.Offer -ImageReferenceSku $imgRef.Skus -ImageReferenceVersion $imgRef.Version `
4479+
-ImageReferencePublisher $imgRef.PublisherName ;
4480+
4481+
# Requirements for the TrustedLaunch default behavior.
4482+
#Case 1: -SecurityType = TrustedLaunch || ConfidentialVM
4483+
# validate that for -SecurityType "TrustedLaunch" "-Vtpm" and -"SecureBoot" are "Enabled/true"
4484+
$vmss1 = Set-AzVmssSecurityProfile -VirtualMachineScaleSet $vmss -SecurityType $securityType;
4485+
$result = New-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -VirtualMachineScaleSet $vmss1;
4486+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4487+
4488+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.SecurityType $securityType;
4489+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $true;
4490+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled $true;
4491+
4492+
#Case 2: -SecurityType = "TrustedLaunch" || "ConfidentialVM" -EnableVtpm $false -EnableSecureBoot $true
4493+
$vmss2 = Set-AzVmssUefi -VirtualMachineScaleSet $VMSS -EnableVtpm $disable -EnableSecureBoot $enable;
4494+
$result = New-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName2 -VirtualMachineScaleSet $vmss2;
4495+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName2;
4496+
4497+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.SecurityType $securityType;
4498+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $false;
4499+
Assert-AreEqual $vmssGet.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled $true;
4500+
# Vmss Identity is now in fact only UserAssigned as expected.
4501+
4502+
# Guest Attestation extension defaulting test
4503+
# Validate
4504+
$vmGADefaultIdentity = "SystemAssigned"; # New defaulting behavior that was unexpected but feature team says go with it.
4505+
$extDefaultName = "GuestAttestation";
4506+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -Name $vmssName1;
4507+
# Assert-AreEqual $vmGADefaultIDentity $vmssGet.Identity.Type;
4508+
4509+
$output = $vmssGet | Out-String;
4510+
# Write-Verbose ($output);
4511+
Assert-True { $output.Contains($vmGADefaultIdentity) };
4512+
4513+
$vmssvms = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4514+
Assert-NotNull $vmssvms;
4515+
$vmssvm = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -InstanceId $vmssvms[0].InstanceId;
4516+
Assert-AreEqual $extDefaultName $vmssvm.Resources[2].Name;
4517+
}
4518+
finally
4519+
{
4520+
# Cleanup
4521+
Clean-ResourceGroup $rgname;
4522+
}
4523+
}
4524+
4525+
4526+
<#
4527+
.SYNOPSIS
4528+
Test Virtual Machine Scale Set VtpmEabled and SecureBootEnabled
4529+
for the Trusted Launch feature setup.
4530+
Tests that GuestAttestation extension is also installed.
4531+
#>
4532+
function Test-VirtualMachineScaleSetSecurityTypeWithoutConfig
4533+
{
4534+
# Setup
4535+
$rgname = Get-ComputeTestResourceName;
4536+
$loc = Get-ComputeVMLocation;
4537+
4538+
try
4539+
{
4540+
# Common
4541+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
4542+
4543+
$vmssSize = 'Standard_D4s_v3';
4544+
$vmssName1 = 'vmss1' + $rgname;
4545+
$vmssName2 = 'vmss2' + $rgname;
4546+
$imageName = "Win2016DataCenterGenSecond";
4547+
$PublisherName = "MicrosoftWindowsServer";
4548+
$Offer = "WindowsServer";
4549+
$SKU = "2016-datacenter-gensecond";
4550+
$domainNameLabel1 = "d1" + $rgname;
4551+
$domainNameLabel2 = "d2" + $rgname;
4552+
$disable = $false;
4553+
$enable = $true;
4554+
$securityType = "TrustedLaunch";
4555+
$adminUsername = Get-ComputeTestResourceName;
4556+
$adminPassword = Get-PasswordForVM | ConvertTo-SecureString -AsPlainText -Force;
4557+
$vmCred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
4558+
4559+
# Requirements for the TrustedLaunch default behavior.
4560+
#Case 1: -SecurityType = TrustedLaunch || ConfidentialVM
4561+
# validate that for -SecurityType "TrustedLaunch" "-Vtpm" and -"SecureBoot" are "Enabled/true"
4562+
$res = New-AzVmss -ResourceGroupName $rgname -Credential $vmCred -VMScaleSetName $vmssName1 -ImageName $imageName -DomainNameLabel $domainNameLabel1 -SecurityType $securityType ;
4563+
4564+
Assert-AreEqual $res.VirtualMachineProfile.SecurityProfile.SecurityType $securityType;
4565+
Assert-AreEqual $res.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $true;
4566+
Assert-AreEqual $res.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled $true;
4567+
4568+
#Case 2: -SecurityType = "TrustedLaunch" || "ConfidentialVM" -EnableVtpm $false -EnableSecureBoot $true
4569+
$result = New-AzVmss -ResourceGroupName $rgname -Credential $vmCred -VMScaleSetName $vmssName2 -ImageName $imageName -DomainNameLabel $domainNameLabel2 -SecurityType $securityType -EnableVtpm $disable;
4570+
4571+
Assert-AreEqual $result.VirtualMachineProfile.SecurityProfile.SecurityType $securityType;
4572+
Assert-AreEqual $result.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $false;
4573+
Assert-AreEqual $result.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled $true;
4574+
4575+
# Update-AzVmss EnableVtpm
4576+
$vmssUp = Update-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName2 -EnableVtpm $true;
4577+
$vmssGet2 = Get-AzVmss -ResourcegroupName $rgname -VMScaleSetName $vmssName2;
4578+
Assert-AreEqual $vmssGet2.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled $true;
4579+
4580+
# Guest Attestation extension defaulting test
4581+
# Validate
4582+
$vmGADefaultIdentity = "SystemAssigned"; # New defaulting behavior that was unexpected but feature team says go with it.
4583+
$extDefaultName = "GuestAttestation";
4584+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -Name $vmssName1;
4585+
# Assert-AreEqual $vmGADefaultIDentity $vmssGet.Identity.Type;
4586+
4587+
$output = $vmssGet | Out-String;
4588+
# Write-Verbose ($output);
4589+
Assert-True { $output.Contains($vmGADefaultIdentity) };
4590+
4591+
$vmssvms = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName1;
4592+
Assert-NotNull $vmssvms;
4593+
$vmssvm = Get-AzVmssvm -ResourceGroupName $rgname -VMScaleSetName $vmssName1 -InstanceId $vmssvms[0].InstanceId;
4594+
Assert-AreEqual $extDefaultName $vmssvm.Resources[2].Name;
4595+
}
4596+
finally
4597+
{
4598+
# Cleanup
4599+
Clean-ResourceGroup $rgname;
4600+
}
44044601
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineTests.cs

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -577,5 +577,19 @@ public void TestVirtualMachineEdgeZoneSimpleParameterSet()
577577
{
578578
TestRunner.RunTestScript("Test-VirtualMachineEdgeZoneSimpleParameterSet");
579579
}
580+
581+
[Fact]
582+
[Trait(Category.AcceptanceType, Category.CheckIn)]
583+
public void TestVirtualMachineSecurityType()
584+
{
585+
TestRunner.RunTestScript("Test-VirtualMachineSecurityType");
586+
}
587+
588+
[Fact]
589+
[Trait(Category.AcceptanceType, Category.CheckIn)]
590+
public void TestVirtualMachineSecurityTypeWithoutConfig()
591+
{
592+
TestRunner.RunTestScript("Test-VirtualMachineSecurityTypeWithoutConfig");
593+
}
580594
}
581595
}

0 commit comments

Comments
 (0)