Trusted Launch CLI Change Request - VM Disk Snapshot & Config #22275
Comments
ghost
added
the
|
@AjKundnani Hi, since our work in this sprint has been fully arranged, we don't have enough time to support more requirements. Can this feature request be postponed to the release of the next sprint (08-02)? |
|
@zhoxing-ms - Sorry no, we're planning for GA of Confidential VM by June 30th 2022, so we request to consider this feature requirement for current sprint of 07-05 please. |
@AjKundnani I suggest that users use |
@AjKundnani I concern that this design will lead to breaking change, because if the create option of disk queried in the CLI scripts are |
@zhoxing-ms - Agreed, we can use it as a switch rather than bool parameter. |
@zhoxing-ms - As discussed, CLI will query disk resources created using Additionally, |
|
@AjKundnani The |
@zhoxing-ms - Currently we do not have plans to support SecureOSUpload scenario for snapshots. I am checking more with team and if needed will setup new request for cc @lakmeedee |
@AjKundnani Actually, the If so, I suggest we could add a new parameter The benefits for this solution are:
What do you think of it? |
@zhoxing-ms - false value for For upload type, I am discussing internally what would be best option, will discuss proposed solution as well and get back on same. |
@zhoxing-ms - After internal discussion and understanding more from DiskRP team, I've edited the request to include new parameter for-upload-with-security-data in the request. No edit or modification needed to for-upload parameter at this point.
Only one of Hope this clarifies and simplifies request and ensures good end user experience. |
|
This is an improvement and along the lines of the issues I saw with the original proposal. However, there is one issue I have. We are looking at adding another Parameter to a command that already has appx 35 parameters. Is it possibnle to use an existing parameter to accomplish this? Currently, there is a az disk create --for-upload --security-type TrustedLaunchWith the combination of
Hope this helps. Let me know if anything isn't clear or if you disagree on any of my points. I'm open to discussion here and would like to see a minimal amount of customer friction, added complexity, or boxing ourselves into a certain corner we will have to break ourselves out of in the future and hurt the customer experience. |
@chasewilson, the limitation in this approach is when end user or customer would upload the VM Guest State Blob
|
|
Ok team, here's a thought. What if we adjusted it to something like this: az disk create --for-upload UploadPreparedSecure/VMGS # or some value along those lines to indicate the UploadPreparedSecure valueIn the above example, we adjust the current Benefits
Concerns
@zhoxing-ms @AjKundnani let me know what you think and thank you both for working on this so patiently with me. |
|
@chasewilson In fact, this idea is similar to the original design. The reason why we want to modify the design of using the
So, inspired by your idea, I have this proposal: if we want to avoid adding additional parameters to increase complexity, perhaps we can consider hiding the original parameter and deprecating it in the future, and adding a new parameter to support @chasewilson @AjKundnani What do you think of this solution? If you have any ideas or suggestions, I'm glad to hear them |
|
Hey @zhoxing-ms, I think that this is a good compromise and solid path forward! @AjKundnani, what do you think? For anyone here, if you have ideas on parameter names feel free to throw them out there. |
|
@AjKundnani I have two more questions to confirm with you:
|
|
@AjKundnani Could you show me the error messages from REST service? If the error message returned by service is appropriate and clear enough, I prefer to use the error message from service to avoid introducing complex judgment logic in client side.
Therefore, when |
|
@AjKundnani In fact, if there are no related restrictions on REST service, it is unreasonable to only add restrictions on CLI side. This cannot solve the problems of users who directly call the REST and users who use other clients (such as: PowerShell, Terraform, Python SDK...) Will the rest service add related restrictions later?
If so, the |
|
@AjKundnani Besides, I have another question: are the verification logics in the below two places applicable to
|
@zhoxing-ms - As per Disk RP team "uploadpreparedsecure has same verifications which are applicable to upload create option" |
|
@AjKundnani I see. Thanks for your confirmation！
We'd better not only add this verification on the CLI side, otherwise it may be inconsistent with the experience of other sides. We may consider adding this restriction information to the help message to let users aware of this restriction. (it will be automatically synchronized to our public doc)
I see. It sounds like a good solution not to expose the parameter |
Thanks @zhoxing-ms - Adding help message about restriction of OS disk only for VMGS should be helpful. For parameter |
@AjKundnani Could you give me a good example? I will consider adding it in an appropriate way |
|
Hi @AjKundnani when I use strorage contaniner blob as uri for test, if use |
@zhoxing-ms @PARADISSEEKR - Based on our conversation about Confidential VM, new scenario has come out where end users might need to export the VMGS vhd file. If we can expose the parameter to
|
Related command
az snapshot showaz disk createaz disk grant-accessResource Provider
Microsoft.Compute/disks
Microsoft.Compute/snapshots
Description of Feature or Work Requested
feature request to add output value, new parameter and add values into existing parameters for following commands to support Trusted Launch VM Disks:
Feature request is to provide customers with completion of Trusted Launch VM (already GA) disk management:
--for-uploadAdditional Output Value
az snapshot showWhen customer use
az snapshot showcommand, the output should return SecurityProfile of the snapshot. SecurityProfile output is already supported inaz disk showcommand, same needs to be extended to snapshots as well.New Parameter
--security-data-uri (
az disk create)New string parameter --security-data-uri for command
az disk create:--upload-type (
az disk create)New string parameter --upload-type to replace
--for-uploadparameter inaz disk create:--security-type, DiskRP will create new VM Guest State blobaz disk grant-access--secure-vm-guest-state-sas (
az disk grant-access)New switch parameter --secure-vm-guest-state-sas for
az disk grant-access:az disk createcommand, which'll set CreateOption to UploadPreparedSecureEnd to End Usage
Scenario 1 - Get Trusted Launch VM Disk Snapshot
Get Virtual Machine Disk snapshot.
az snapshot show --id $snapshotResourceId{ "completionPercent": null, "creationData": { "createOption": "Copy", "galleryImageReference": null, "imageReference": null, "logicalSectorSize": null, "sourceResourceId": "/subscriptions/390a3e32-6963-47d8-bcef-ee8db1c22720/resourceGroups/tvm-cli-change-rg/providers/Microsoft.Compute/disks/tvm-cli-change-vm_OsDisk_1_78358962d0b645a0a3899f18c98b099a", "sourceUniqueId": "78358962-d0b6-45a0-a389-9f18c98b099a", "sourceUri": null, "storageAccountId": null, "uploadSizeBytes": null }, "diskAccessId": null, "diskSizeBytes": 32213303296, "diskSizeGb": 30, "diskState": "Unattached", "encryption": { "diskEncryptionSetId": null, "type": "EncryptionAtRestWithPlatformKey" }, "encryptionSettingsCollection": null, "extendedLocation": null, "hyperVGeneration": "V2", "id": "/subscriptions/390a3e32-6963-47d8-bcef-ee8db1c22720/resourceGroups/tvm-cli-change-rg/providers/Microsoft.Compute/snapshots/test01", "incremental": false, "location": "southeastasia", "managedBy": null, "name": "test01", "networkAccessPolicy": "AllowAll", "osType": "Linux", "provisioningState": "Succeeded", "publicNetworkAccess": "Enabled", "purchasePlan": null, "resourceGroup": "tvm-cli-change-rg", "securityProfile": { "securityType": "TrustedLaunch" }, "sku": { "name": "Standard_LRS", "tier": "Standard" }, "supportedCapabilities": { "acceleratedNetwork": true, "architecture": "x64" }, "supportsHibernation": null, "tags": {}, "timeCreated": "2022-04-29T12:48:54.475669+00:00", "type": "Microsoft.Compute/snapshots", "uniqueId": "8e845670-5c0f-4153-a178-9a544ba4b7e1" }Scenario 2 - Secure Import of Trusted Launch VM OS Disk
Create disk with --security-data-uri parameter:
Scenario 3 - Secure Upload of Trusted Launch VM OS Disk
Create an empty disk with --Upload-Type parameter:
Grant access to generate accessSas and securityDataAccessSAS using --secure-vm-guest-state-sas parameter
Returned value schema:
{ "accessSas": "https://md-impexp-t0rdsfgsdfg4.blob.core.windows.net/w2c3mj0ksfgl/abcd?sv=2017-04-17&sr=b&si=600a9281-d39e-4cc3-91d2-923c4a696537&sig=xXaT6mFgf139ycT87CADyFxb%2BnPXBElYirYRlbnJZbs%3D", "securityDataAccessSas": "<VM Guest State Sas URI>" }Copy Disk Content from Local Disk:
AzCopy.exe copy "c:\somewhere\mydisk.vhd" $diskSas.AccessSAS --blob-type PageBlobCopy VM Guest State content from a local VHD:
AzCopy.exe copy "c:\somewhere\myvmgs.vhd" $diskSas.securityDataAccessSAS --blob-type PageBlobMinimum API Version Required
2021-08-01
Swagger PR link
Azure/azure-rest-api-specs#17118
Request Example
Target Date
2022-07-05
Additional context
Request for Trusted Launch VM feature.
Contacts
The text was updated successfully, but these errors were encountered: