All disks encryption documentation- Azure

[erzetpe]

No description provided.

[plirglo]

Azure disk encription manual process is decribed in Azure documentation and it's quite easy
https://docs.microsoft.com/en-us/azure/security/fundamentals/azure-disk-encryption-vms-vmss

Basically firstly keyvault needs to be created where encryption key will be stored and than machine encryption is possible from az cli.

There is also possible to apply encryption using Terraform.
Kayvault creation:
https://www.terraform.io/docs/providers/azurerm/r/key_vault.html
But this doesn't work (for me) with azurerm 1.27 version which is setup in epicli 0.4.2. I needed to use version 1.38.0.

After when kayvault is created diskencrypt Terraform module should be used for disk encryption:
https://registry.terraform.io/modules/Azure/diskencrypt/azurerm/2.0.0

This needs to be checked. I haven't tested it well because of problems with my local environment.

[seriva]

As for the keyvault creation with Terraform there is/was an issue with the creation of azurerm_subnet_network_security_group_association with azurerm 1.28 when having more then 3 subnets. Some kind of order issues when it was creating the resources on Azure:

https://www.terraform.io/docs/providers/azurerm/r/subnet_network_security_group_association.html

Hense I locked it at 1.27. We might want to try if the latest Azurerm 1.38 fixes the problem. All the code is there:

https://github.com/epiphany-platform/epiphany/blob/3c4f284cd2426c58a6c36e7e49f553d1100fa8e0/core/src/epicli/cli/engine/providers/azure/InfrastructureBuilder.py#L66

And bumping the Azurerm version can be done here:

https://github.com/epiphany-platform/epiphany/blob/3c4f284cd2426c58a6c36e7e49f553d1100fa8e0/core/src/epicli/data/azure/terraform/epiphany-cluster.j2#L14

Rebuilding of devcontainer is required. Im not sure if Azurerm 1.38 needs any additional changes to the templates.

[alkaja]

Done.