[Compute] az vm/vmss create: Support OS disk encryption for Confidential VM

src/azure-cli/azure/cli/command_modules/vm/_params.py

@@ -129,7 +129,7 @@ def load_arguments(self, _):
 
     enable_vtpm_type = CLIArgumentType(arg_type=get_three_state_flag(), min_api='2020-12-01', help='Enable vTPM.')
     enable_secure_boot_type = CLIArgumentType(arg_type=get_three_state_flag(), min_api='2020-12-01', help='Enable secure boot.')
-    security_type = CLIArgumentType(arg_type=get_enum_type(['TrustedLaunch']), min_api='2020-12-01', help='Specify if the VM is Trusted Launch enabled. See https://docs.microsoft.com/azure/virtual-machines/trusted-launch.')
+    security_type = CLIArgumentType(arg_type=get_enum_type(self.get_models('SecurityTypes')), min_api='2020-12-01', help='Specify the security type of the virtual machine.')
     gallery_image_name_type = CLIArgumentType(options_list=['--gallery-image-definition', '-i'], help='The name of the community gallery image definition from which the image versions are to be listed.', id_part='child_name_2')
     gallery_image_name_version_type = CLIArgumentType(options_list=['--gallery-image-version', '-e'], help='The name of the gallery image version to be created. Needs to follow semantic version name pattern: The allowed characters are digit and period. Digits must be within the range of a 32-bit integer. Format: <MajorVersion>.<MinorVersion>.<Patch>', id_part='child_name_3')
     public_gallery_name_type = CLIArgumentType(help='The public name of community gallery.', id_part='child_name_1')
@@ -950,6 +950,8 @@ def load_arguments(self, _):
             c.argument('edge_zone', edge_zone_type)
             c.argument('accept_term', action='store_true', help="Accept the license agreement and privacy statement.")
             c.argument('disable_integrity_monitoring', action='store_true', min_api='2020-12-01', help='Disable the default behavior of installing guest attestation extension and enabling System Assigned Identity for Trusted Launch enabled VMs and VMSS.')
+            c.argument('os_disk_security_encryption_type', arg_type=get_enum_type(self.get_models('SecurityEncryptionTypes')), min_api='2021-11-01', help='Specify the encryption type  of the os managed disk.')
+            c.argument('os_disk_secure_vm_disk_encryption_set', min_api='2021-11-01', help='Specify the customer managed disk encryption set resource Id or name for the managed disk that is used for Customer Managed Key encrypted ConfidentialVM OS Disk and VMGuest blob.')
 
         with self.argument_context(scope, arg_group='Authentication') as c:
             c.argument('generate_ssh_keys', action='store_true', help='Generate SSH public and private key files if missing. The keys will be stored in the ~/.ssh directory')
@@ -1428,7 +1430,7 @@ def load_arguments(self, _):
         c.argument('disk_encryption_set_name', disk_encryption_set_name)
         c.argument('key_url', help='URL pointing to a key or secret in KeyVault.')
         c.argument('source_vault', help='Name or ID of the KeyVault containing the key or secret.')
-        c.argument('encryption_type', arg_type=get_enum_type(['EncryptionAtRestWithPlatformKey', 'EncryptionAtRestWithCustomerKey', 'EncryptionAtRestWithPlatformAndCustomerKeys']),
+        c.argument('encryption_type', arg_type=get_enum_type(['EncryptionAtRestWithPlatformKey', 'EncryptionAtRestWithCustomerKey', 'EncryptionAtRestWithPlatformAndCustomerKeys', 'ConfidentialVmEncryptedWithCustomerKey']),
                    help='The type of key used to encrypt the data of the disk. EncryptionAtRestWithPlatformKey: Disk is encrypted at rest with Platform managed key. It is the default encryption type. EncryptionAtRestWithCustomerKey: Disk is encrypted at rest with Customer managed key that can be changed and revoked by a customer. EncryptionAtRestWithPlatformAndCustomerKeys: Disk is encrypted at rest with 2 layers of encryption. One of the keys is Customer managed and the other key is Platform managed.')
         c.argument('location', validator=get_default_location_from_resource_group)
         c.argument('tags', tags_type)

src/azure-cli/azure/cli/command_modules/vm/_template_builder.py

@@ -302,7 +302,8 @@ def build_vm_resource(  # pylint: disable=too-many-locals, too-many-statements,
         encryption_at_host=None, dedicated_host_group=None, enable_auto_update=None, patch_mode=None,
         enable_hotpatching=None, platform_fault_domain=None, security_type=None, enable_secure_boot=None,
         enable_vtpm=None, count=None, edge_zone=None, os_disk_delete_option=None, user_data=None,
-        capacity_reservation_group=None, enable_hibernation=None, v_cpus_available=None, v_cpus_per_core=None):
+        capacity_reservation_group=None, enable_hibernation=None, v_cpus_available=None, v_cpus_per_core=None,
+        os_disk_security_encryption_type=None, os_disk_secure_vm_disk_encryption_set=None):
 
     os_caching = disk_info['os'].get('caching')
 
@@ -492,6 +493,48 @@ def _build_storage_profile():
             storage_profiles['CommunityGalleryImage']['osDisk']['managedDisk']['diskEncryptionSet'] = {
                 'id': os_disk_encryption_set,
             }
+        if os_disk_security_encryption_type is not None:
+            storage_profiles['ManagedPirImage']['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type,
+                }
+            })
+            storage_profiles['ManagedCustomImage']['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type,
+                }
+            })
+            storage_profiles['SharedGalleryImage']['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type,
+                }
+            })
+            storage_profiles['CommunityGalleryImage']['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type,
+                }
+            })
+            if os_disk_secure_vm_disk_encryption_set is not None:
+                storage_profiles['ManagedPirImage']['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
+                storage_profiles['ManagedCustomImage']['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
+                storage_profiles['SharedGalleryImage']['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
+                storage_profiles['CommunityGalleryImage']['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
 
         profile = storage_profiles[storage_profile.name]
         if os_disk_size_gb:
@@ -867,7 +910,8 @@ def build_vmss_resource(cmd, name, computer_name_prefix, location, tags, overpro
                         enable_spot_restore=None, spot_restore_timeout=None, capacity_reservation_group=None,
                         enable_auto_update=None, patch_mode=None, enable_agent=None, security_type=None,
                         enable_secure_boot=None, enable_vtpm=None, automatic_repairs_action=None, v_cpus_available=None,
-                        v_cpus_per_core=None):
+                        v_cpus_per_core=None, os_disk_security_encryption_type=None,
+                        os_disk_secure_vm_disk_encryption_set=None):
 
     # Build IP configuration
     ip_configuration = {}
@@ -944,6 +988,18 @@ def build_vmss_resource(cmd, name, computer_name_prefix, location, tags, overpro
             storage_properties['osDisk']['managedDisk']['diskEncryptionSet'] = {
                 'id': os_disk_encryption_set
             }
+        if os_disk_security_encryption_type is not None:
+            storage_properties['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type
+                }
+            })
+            if os_disk_secure_vm_disk_encryption_set is not None:
+                storage_properties['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
         if disk_info and disk_info['os'].get('diffDiskSettings'):
             storage_properties['osDisk']['diffDiskSettings'] = disk_info['os']['diffDiskSettings']
 
@@ -975,6 +1031,18 @@ def build_vmss_resource(cmd, name, computer_name_prefix, location, tags, overpro
             storage_properties['osDisk']['managedDisk']['diskEncryptionSet'] = {
                 'id': os_disk_encryption_set
             }
+        if os_disk_security_encryption_type is not None:
+            storage_properties['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type,
+                }
+            })
+            if os_disk_secure_vm_disk_encryption_set is not None:
+                storage_properties['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
     if storage_profile == StorageProfile.CommunityGalleryImage:
         storage_properties['osDisk'] = {
             'caching': os_caching,
@@ -989,6 +1057,18 @@ def build_vmss_resource(cmd, name, computer_name_prefix, location, tags, overpro
             storage_properties['osDisk']['managedDisk']['diskEncryptionSet'] = {
                 'id': os_disk_encryption_set
             }
+        if os_disk_security_encryption_type is not None:
+            storage_properties['osDisk']['managedDisk'].update({
+                'securityProfile': {
+                    'securityEncryptionType': os_disk_security_encryption_type,
+                }
+            })
+            if os_disk_secure_vm_disk_encryption_set is not None:
+                storage_properties['osDisk']['managedDisk']['securityProfile'].update({
+                    'diskEncryptionSet': {
+                        'id': os_disk_secure_vm_disk_encryption_set
+                    }
+                })
 
     if disk_info:
         data_disks = [v for k, v in disk_info.items() if k != 'os']

src/azure-cli/azure/cli/command_modules/vm/_validators.py

@@ -574,6 +574,35 @@ def _validate_vm_create_storage_profile(cmd, namespace, for_scale_set=False):
                 "the os type of this image should be {}".format(community_gallery_image_info.os_type))
         namespace.os_type = community_gallery_image_info.os_type
 
+    if getattr(namespace, 'security_type', None):
+        if getattr(namespace, 'os_disk_security_encryption_type', None):
+            if namespace.security_type.lower() == 'confidentialvm' and \
+                    namespace.os_disk_security_encryption_type is None:
+                raise ArgumentUsageError('usage error: --os-disk-security-encryption-type is required'
+                                         ' when --security-type is specified as ConfidentialVM')
+            if namespace.os_disk_security_encryption_type != 'DiskWithVMGuestState' and \
+                    namespace.os_disk_secure_vm_disk_encryption_set is not None:
+                raise ArgumentUsageError(
+                    'usage error: The --os-disk-secure-vm-disk-encryption-set can only be passed in '
+                    'when --os-disk-security-encryption-type is DiskWithVMGuestState')
+        confidential_vm_sku = ['standard_dc2as_v5', 'standard_dc4as_v5', 'standard_dc8as_v5', 'standard_dc16as_v5',
+                               'standard_dc32as_v5', 'standard_dc48as_v5', 'standard_dc64as_v5', 'standard_dc96as_v5',
+                               'standard_dc2ads_v5', 'standard_dc4ads_v5', 'standard_dc8ads_v5', 'standard_dc16ads_v5',
+                               'standard_dc32ads_v5', 'standard_dc48ads_v5', 'standard_dc64ads_v5',
+                               'standard_dc96ads_v5', 'standard_ec2as_v5', 'standard_ec4as_v5', 'standard_ec8as_v5',
+                               'standard_ec16as_v5', 'standard_ec32as_v5', 'standard_ec48as_v5', 'standard_ec64as_v5',
+                               'standard_ec96as_v5', 'standard_ec2ads_v5', 'standard_ec4ads_v5', 'standard_ec8ads_v5',
+                               'standard_ec16ads_v5', 'standard_ec32ads_v5', 'standard_ec48ads_v5',
+                               'standard_ec64ads_v5', 'standard_ec96ads_v5',
+                               ]
+        if namespace.security_type.lower() == 'confidentialvm' and getattr(namespace, 'size', None):
+            if namespace.size.lower() not in confidential_vm_sku:
+                raise ArgumentUsageError('usage error: when --security-type is set to ConfidentialVM,'
+                                         ' the --size should be one of the following: {}'.format(confidential_vm_sku))
+        if namespace.security_type.lower() == 'confidentialvm' and getattr(namespace, 'vm_sku', None):
+            if namespace.vm_sku.lower() not in confidential_vm_sku:
+                raise ArgumentUsageError('usage error: when --security-type is set to ConfidentialVM,'
+                                         ' the --vm-sku should be one of the following: {}'.format(confidential_vm_sku))
     if not namespace.os_type:
         namespace.os_type = 'windows' if 'windows' in namespace.os_offer.lower() else 'linux'
 

src/azure-cli/azure/cli/command_modules/vm/custom.py

@@ -796,7 +796,8 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_
               enable_hotpatching=None, platform_fault_domain=None, security_type=None, enable_secure_boot=None,
               enable_vtpm=None, count=None, edge_zone=None, nic_delete_option=None, os_disk_delete_option=None,
               data_disk_delete_option=None, user_data=None, capacity_reservation_group=None, enable_hibernation=None,
-              v_cpus_available=None, v_cpus_per_core=None, accept_term=None, disable_integrity_monitoring=False):
+              v_cpus_available=None, v_cpus_per_core=None, accept_term=None, disable_integrity_monitoring=False,
+              os_disk_security_encryption_type=None, os_disk_secure_vm_disk_encryption_set=None):
 
     from azure.cli.core.commands.client_factory import get_subscription_id
     from azure.cli.core.util import random_string, hash_string
@@ -826,6 +827,11 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_
         os_disk_encryption_set = resource_id(
             subscription=subscription_id, resource_group=resource_group_name,
             namespace='Microsoft.Compute', type='diskEncryptionSets', name=os_disk_encryption_set)
+    if os_disk_secure_vm_disk_encryption_set is not None and\
+            not is_valid_resource_id(os_disk_secure_vm_disk_encryption_set):
+        os_disk_secure_vm_disk_encryption_set = resource_id(
+            subscription=subscription_id, resource_group=resource_group_name,
+            namespace='Microsoft.Compute', type='diskEncryptionSets', name=os_disk_secure_vm_disk_encryption_set)
 
     if data_disk_encryption_sets is None:
         data_disk_encryption_sets = []
@@ -1015,7 +1021,9 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_
         platform_fault_domain=platform_fault_domain, security_type=security_type, enable_secure_boot=enable_secure_boot,
         enable_vtpm=enable_vtpm, count=count, edge_zone=edge_zone, os_disk_delete_option=os_disk_delete_option,
         user_data=user_data, capacity_reservation_group=capacity_reservation_group,
-        enable_hibernation=enable_hibernation, v_cpus_available=v_cpus_available, v_cpus_per_core=v_cpus_per_core)
+        enable_hibernation=enable_hibernation, v_cpus_available=v_cpus_available, v_cpus_per_core=v_cpus_per_core,
+        os_disk_security_encryption_type=os_disk_security_encryption_type,
+        os_disk_secure_vm_disk_encryption_set=os_disk_secure_vm_disk_encryption_set)
 
     vm_resource['dependsOn'] = vm_dependencies
 
@@ -2883,7 +2891,8 @@ def create_vmss(cmd, vmss_name, resource_group_name, image=None,
                 user_data=None, network_api_version=None, enable_spot_restore=None, spot_restore_timeout=None,
                 capacity_reservation_group=None, enable_auto_update=None, patch_mode=None, enable_agent=None,
                 security_type=None, enable_secure_boot=None, enable_vtpm=None, automatic_repairs_action=None,
-                v_cpus_available=None, v_cpus_per_core=None, accept_term=None, disable_integrity_monitoring=False):
+                v_cpus_available=None, v_cpus_per_core=None, accept_term=None, disable_integrity_monitoring=False,
+                os_disk_security_encryption_type=None, os_disk_secure_vm_disk_encryption_set=None):
 
     from azure.cli.core.commands.client_factory import get_subscription_id
     from azure.cli.core.util import random_string, hash_string
@@ -2921,6 +2930,11 @@ def create_vmss(cmd, vmss_name, resource_group_name, image=None,
             os_disk_encryption_set = resource_id(
                 subscription=subscription_id, resource_group=resource_group_name,
                 namespace='Microsoft.Compute', type='diskEncryptionSets', name=os_disk_encryption_set)
+        if os_disk_secure_vm_disk_encryption_set is not None and\
+                not is_valid_resource_id(os_disk_secure_vm_disk_encryption_set):
+            os_disk_secure_vm_disk_encryption_set = resource_id(
+                subscription=subscription_id, resource_group=resource_group_name,
+                namespace='Microsoft.Compute', type='diskEncryptionSets', name=os_disk_secure_vm_disk_encryption_set)
 
         if data_disk_encryption_sets is None:
             data_disk_encryption_sets = []
@@ -3159,7 +3173,8 @@ def _get_public_ip_address_allocation(value, sku):
             patch_mode=patch_mode, enable_agent=enable_agent, security_type=security_type,
             enable_secure_boot=enable_secure_boot, enable_vtpm=enable_vtpm,
             automatic_repairs_action=automatic_repairs_action, v_cpus_available=v_cpus_available,
-            v_cpus_per_core=v_cpus_per_core)
+            v_cpus_per_core=v_cpus_per_core, os_disk_security_encryption_type=os_disk_security_encryption_type,
+            os_disk_secure_vm_disk_encryption_set=os_disk_secure_vm_disk_encryption_set)
 
         vmss_resource['dependsOn'] = vmss_dependencies
 

src/azure-cli/azure/cli/command_modules/vm/linter_exclusions.yml

@@ -30,6 +30,12 @@ vmss create:
         disable_integrity_monitoring:
             rule_exclusions:
             - option_length_too_long
+        os_disk_security_encryption_type:
+            rule_exclusions:
+                - option_length_too_long
+        os_disk_secure_vm_disk_encryption_set:
+            rule_exclusions:
+                - option_length_too_long
 vmss update:
     parameters:
         enable_cross_zone_upgrade:
@@ -63,6 +69,12 @@ vm create:
         disable_integrity_monitoring:
             rule_exclusions:
                 - option_length_too_long
+        os_disk_security_encryption_type:
+            rule_exclusions:
+                - option_length_too_long
+        os_disk_secure_vm_disk_encryption_set:
+            rule_exclusions:
+                - option_length_too_long
 vm unmanaged-disk attach:
     parameters:
         size_gb: