Merge pull request #297 from vermashi/shiv-allow-update-encryption-settings

Allow updates for encryption settings on premium storage VMs

Author: cormacpayne

src/ResourceManager/Compute/Commands.Compute.Test/ScenarioTests/VirtualMachineExtensionTests.ps1

@@ -1044,18 +1044,19 @@ function Test-AzureDiskEncryptionExtension
 
     #KeyVault config variables
     $vaultName = "detestvault";
+    $vault2Name = "detestvault2";
     $kekName = "dstestkek";
 
     #VM config variables
     $vmName = "detestvm";
-    $vmsize = 'Standard_D2';
+    $vmsize = 'Standard_DS2';
     $imagePublisher = "MicrosoftWindowsServer";
     $imageOffer = "WindowsServer";
     $imageSku ="2012-R2-Datacenter";
 
     #Storage config variables
     $storageAccountName = "deteststore";
-    $stotype = 'Standard_LRS';
+    $stotype = 'Premium_LRS';
     $vhdContainerName = "vhds";
     $osDiskName = 'osdisk' + $vmName;
     $dataDiskName = 'datadisk' + $vmName;
@@ -1117,6 +1118,17 @@ function Test-AzureDiskEncryptionExtension
         $keyVaultResourceId = $keyVault.ResourceId;
         $keyEncryptionKeyUrl = $kek.Key.kid;
 
+        # Create the 2nd key vault
+        $keyVault2 = New-AzureRmKeyVault -VaultName $vault2Name -ResourceGroupName $rgname -Location $loc -Sku standard;
+        $keyVault2 = Get-AzureRmKeyVault -VaultName $vault2Name -ResourceGroupName $rgname
+        #set enabledForDiskEncryption
+        Set-AzureRmKeyVaultAccessPolicy -VaultName $vault2Name -ResourceGroupName $rgname -EnabledForDiskEncryption;
+        #set permissions to AAD app to write secrets and keys
+        Set-AzureRmKeyVaultAccessPolicy -VaultName $vault2Name -ServicePrincipalName $aadClientID -PermissionsToKeys all -PermissionsToSecrets all
+
+        $diskEncryptionKeyVaultUrl2 = $keyVault2.VaultUri;
+        $keyVaultResourceId2 = $keyVault2.ResourceId;
+
         # VM Profile & Hardware   
         $p = New-AzureRmVMConfig -VMName $vmname -VMSize $vmsize;
 
@@ -1169,6 +1181,9 @@ function Test-AzureDiskEncryptionExtension
         Assert-NotNull $OsVolumeEncryptionSettings.DiskEncryptionKey.SecretUrl;
         Assert-NotNull $OsVolumeEncryptionSettings.DiskEncryptionKey.SourceVault;
 
+        # Change settings on the VM
+        Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $rgname -VMName $vmName -AadClientID $aadClientID -AadClientSecret $aadClientSecret -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl2 -DiskEncryptionKeyVaultId $keyVaultResourceId2 -KeyEncryptionKeyUrl $keyEncryptionKeyUrl -KeyEncryptionKeyVaultId $keyVaultResourceId -Force;
+
         #Add a couple of data volumes to encrypt them
         $p = Add-AzureRmVMDataDisk -VM $p -Name $extraDataDiskName1 -Caching 'ReadOnly' -DiskSizeInGB 2 -Lun 1 -VhdUri $dataDiskVhdUri -CreateOption Empty;
         $p = Add-AzureRmVMDataDisk -VM $p -Name $extraDataDiskName2 -Caching 'ReadOnly' -DiskSizeInGB 2 -Lun 1 -VhdUri $dataDiskVhdUri -CreateOption Empty;

src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/SetAzureDiskEncryptionExtension.cs

@@ -265,7 +265,7 @@ private string GetExtensionStatusMessage()
         /// <summary>
         /// This function gets the VM model, fills in the OSDisk properties with encryptionSettings and does an UpdateVM
         /// </summary>
-        private AzureOperationResponse<VirtualMachine> UpdateVmEncryptionSettings()
+        private AzureOperationResponse<VirtualMachine> UpdateVmEncryptionSettings(DiskEncryptionSettings encryptionSettingsBackup)
         {
             string statusMessage = GetExtensionStatusMessage();
 
@@ -282,14 +282,6 @@ private AzureOperationResponse<VirtualMachine> UpdateVmEncryptionSettings()
                                                       null));
             }
 
-            DiskEncryptionSettings encryptionSettingsBackup = vmParameters.StorageProfile.OsDisk.EncryptionSettings;
-
-            if (encryptionSettingsBackup == null)
-            {
-                encryptionSettingsBackup = new DiskEncryptionSettings();
-                encryptionSettingsBackup.Enabled = false;
-            }
-
             DiskEncryptionSettings encryptionSettings = new DiskEncryptionSettings();
             encryptionSettings.Enabled = true;
             encryptionSettings.DiskEncryptionKey = new KeyVaultSecretReference();
@@ -315,21 +307,50 @@ private AzureOperationResponse<VirtualMachine> UpdateVmEncryptionSettings()
                 Tags = vmParameters.Tags
             };
 
-            AzureOperationResponse<VirtualMachine> updateResult = this.ComputeClient.ComputeManagementClient.VirtualMachines.CreateOrUpdateWithHttpMessagesAsync(
-                this.ResourceGroupName,
-                vmParameters.Name,
-                parameters).GetAwaiter().GetResult();
+            AzureOperationResponse<VirtualMachine> updateResult = null;
 
-            if(!updateResult.Response.IsSuccessStatusCode)
+            // The 2nd pass. TODO: If something goes wrong here, try to revert to encryptionSettingsBackup.
+            if (encryptionSettingsBackup.Enabled != true)
+            {
+                updateResult = this.ComputeClient.ComputeManagementClient.VirtualMachines.CreateOrUpdateWithHttpMessagesAsync(
+                    this.ResourceGroupName,
+                    vmParameters.Name,
+                    parameters).GetAwaiter().GetResult();
+            }
+            else
             {
+
+                // stop-update-start
+                // stop vm
+                this.ComputeClient.ComputeManagementClient.VirtualMachines
+                    .DeallocateWithHttpMessagesAsync(this.ResourceGroupName, this.VMName).GetAwaiter()
+                    .GetResult();
+                
+                // update vm
                 vmParameters = (this.ComputeClient.ComputeManagementClient.VirtualMachines.Get(
-                   this.ResourceGroupName, this.VMName));
-                vmParameters.StorageProfile.OsDisk.EncryptionSettings = encryptionSettingsBackup;
+                this.ResourceGroupName, this.VMName));
+                vmParameters.StorageProfile.OsDisk.EncryptionSettings = encryptionSettings;
+                parameters = new VirtualMachine
+                {
+                    DiagnosticsProfile = vmParameters.DiagnosticsProfile,
+                    HardwareProfile = vmParameters.HardwareProfile,
+                    StorageProfile = vmParameters.StorageProfile,
+                    NetworkProfile = vmParameters.NetworkProfile,
+                    OsProfile = vmParameters.OsProfile,
+                    Plan = vmParameters.Plan,
+                    AvailabilitySet = vmParameters.AvailabilitySet,
+                    Location = vmParameters.Location,
+                    Tags = vmParameters.Tags
+                };
 
-                this.ComputeClient.ComputeManagementClient.VirtualMachines.CreateOrUpdateWithHttpMessagesAsync(
+                updateResult = this.ComputeClient.ComputeManagementClient.VirtualMachines.CreateOrUpdateWithHttpMessagesAsync(
                     this.ResourceGroupName,
                     vmParameters.Name,
                     parameters).GetAwaiter().GetResult();
+
+                // start vm
+                this.ComputeClient.ComputeManagementClient.VirtualMachines
+                    .StartWithHttpMessagesAsync(ResourceGroupName, this.VMName).GetAwaiter().GetResult();
             }
 
             return updateResult;
@@ -467,6 +488,10 @@ public override void ExecuteCmdlet()
 
                     VirtualMachineExtension parameters = GetVmExtensionParameters(virtualMachineResponse);
 
+                    DiskEncryptionSettings encryptionSettingsBackup = virtualMachineResponse.StorageProfile.OsDisk.EncryptionSettings ??
+                                                                      new DiskEncryptionSettings { Enabled = false };
+
+                     // The "1st pass". If this goes wrong, just bubble up the error and abort.
                     AzureOperationResponse<VirtualMachineExtension> extensionPushResult = this.VirtualMachineExtensionClient.CreateOrUpdateWithHttpMessagesAsync(
                         this.ResourceGroupName,
                         this.VMName,
@@ -484,7 +509,8 @@ public override void ExecuteCmdlet()
                                                               null));
                     }
 
-                    var op = UpdateVmEncryptionSettings();
+                    var op = UpdateVmEncryptionSettings(encryptionSettingsBackup);
+
                     var result = Mapper.Map<PSAzureOperationResponse>(op);
                     WriteObject(result);
                 }