Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

r/azurerm_windows_virtual_machine and r/azurerm_windows_virtual_machine_scale_set - secure_boot_enabled, security_type, vtpm_enabled #13713

Merged
merged 18 commits into from
Nov 17, 2021
Merged

r/azurerm_windows_virtual_machine and r/azurerm_windows_virtual_machine_scale_set - secure_boot_enabled, security_type, vtpm_enabled #13713

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
9fba5fc
Added additional SecurityProfile parameters for windows_virtual_machi…
Oct 12, 2021
ed55cc8
Fixup from Acceptance Tests
Oct 12, 2021
ca718da
refactor and add documentation
Oct 13, 2021
8de2b33
Fixed Lint issues
Oct 13, 2021
5d778d8
Implement requested changes
Oct 15, 2021
19295eb
re-run checks
Oct 22, 2021
a12c8be
Update internal/services/compute/windows_virtual_machine_resource_oth…
amccullough84 Nov 2, 2021
1db6732
Update internal/services/compute/windows_virtual_machine_resource_oth…
amccullough84 Nov 2, 2021
660f9df
Update internal/services/compute/windows_virtual_machine_scale_set_ot…
amccullough84 Nov 2, 2021
6b25033
Update internal/services/compute/windows_virtual_machine_resource.go
amccullough84 Nov 2, 2021
137d0f2
Update internal/services/compute/windows_virtual_machine_resource.go
amccullough84 Nov 2, 2021
bd92eaf
Update internal/services/compute/windows_virtual_machine_resource.go
amccullough84 Nov 2, 2021
7b4f7e3
Update internal/services/compute/windows_virtual_machine_scale_set_re…
amccullough84 Nov 2, 2021
37ef830
Update internal/services/compute/windows_virtual_machine_scale_set_ot…
Nov 2, 2021
31371fb
Remove security_type from internal/services/compute/windows_virtual_m…
Nov 2, 2021
e0046ab
Update internal/services/compute/windows_virtual_machine_scale_set_re…
tombuildsstuff Nov 16, 2021
1ffdf87
Update internal/services/compute/windows_virtual_machine_resource.go
tombuildsstuff Nov 16, 2021
aa1b7dd
make fmt
tombuildsstuff Nov 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 89 additions & 9 deletions internal/services/compute/windows_virtual_machine_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,17 @@ func resourceWindowsVirtualMachine() *pluginsdk.Resource {

"secret": windowsSecretSchema(),

"secure_boot_enabled": {
Type: pluginsdk.TypeBool,
Optional: true,
ForceNew: true,
},

"security_type": {
Type: pluginsdk.TypeString,
Computed: true,
},
amccullough84 marked this conversation as resolved.
Show resolved Hide resolved

"source_image_id": {
Type: pluginsdk.TypeString,
Optional: true,
Expand Down Expand Up @@ -282,6 +293,12 @@ func resourceWindowsVirtualMachine() *pluginsdk.Resource {
ValidateFunc: validation.IntAtLeast(-1),
},

"vtpm_enabled": {
Type: pluginsdk.TypeBool,
Optional: true,
ForceNew: true,
},

"winrm_listener": winRmListenerSchema(),

"zone": {
Expand Down Expand Up @@ -480,9 +497,45 @@ func resourceWindowsVirtualMachineCreate(d *pluginsdk.ResourceData, meta interfa
}

if encryptionAtHostEnabled, ok := d.GetOk("encryption_at_host_enabled"); ok {
params.VirtualMachineProperties.SecurityProfile = &compute.SecurityProfile{
EncryptionAtHost: utils.Bool(encryptionAtHostEnabled.(bool)),
if params.SecurityProfile == nil {
params.SecurityProfile = &compute.SecurityProfile{}
}
params.SecurityProfile.EncryptionAtHost = utils.Bool(encryptionAtHostEnabled.(bool))
}

if securebootEnabled, ok := d.GetOk("secure_boot_enabled"); ok {
if params.SecurityProfile == nil {
params.SecurityProfile = &compute.SecurityProfile{}
}

if params.SecurityProfile.UefiSettings == nil {
params.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}

secureboot := d.Get("secure_boot_enabled").(bool)
if secureboot {
securityType := "TrustedLaunch"
params.SecurityProfile.SecurityType = compute.SecurityTypes(securityType)
amccullough84 marked this conversation as resolved.
Show resolved Hide resolved
}

params.SecurityProfile.UefiSettings.SecureBootEnabled = utils.Bool(securebootEnabled.(bool))
}

if vtpmEnabled, ok := d.GetOk("vtpm_enabled"); ok {
if params.SecurityProfile == nil {
params.SecurityProfile = &compute.SecurityProfile{}
}

if params.SecurityProfile.UefiSettings == nil {
params.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}
vtpm := d.Get("vtpm_enabled").(bool)
if vtpm {
securityType := "TrustedLaunch"
params.SecurityProfile.SecurityType = compute.SecurityTypes(securityType)
amccullough84 marked this conversation as resolved.
Show resolved Hide resolved
}

params.SecurityProfile.UefiSettings.VTpmEnabled = utils.Bool(vtpmEnabled.(bool))
}

if evictionPolicyRaw, ok := d.GetOk("eviction_policy"); ok {
Expand Down Expand Up @@ -724,11 +777,37 @@ func resourceWindowsVirtualMachineRead(d *pluginsdk.ResourceData, meta interface
}
}

encryptionAtHostEnabled := false
if props.SecurityProfile != nil && props.SecurityProfile.EncryptionAtHost != nil {
encryptionAtHostEnabled = *props.SecurityProfile.EncryptionAtHost
if secprofile := props.SecurityProfile; secprofile != nil {
if secprofile.EncryptionAtHost != nil {
d.Set("encryption_at_host_enabled", secprofile.EncryptionAtHost)
} else {
d.Set("encryption_at_host_enabled", false)
}
if secprofile.SecurityType != "" {
d.Set("security_type", secprofile.SecurityType)
} else {
d.Set("security_type", "")
}
if uefi := props.SecurityProfile.UefiSettings; uefi != nil {
if uefi.VTpmEnabled != nil {
d.Set("vtpm_enabled", uefi.VTpmEnabled)
} else {
d.Set("vtpm_enabled", false)
}
if uefi.SecureBootEnabled != nil {
d.Set("secure_boot_enabled", uefi.SecureBootEnabled)
} else {
d.Set("secure_boot_enabled", false)
}
} else {
d.Set("vtpm_enabled", false)
d.Set("secure_boot_enabled", false)
}
} else {
d.Set("encryption_at_host_enabled", false)
d.Set("vtpm_enabled", false)
d.Set("secure_boot_enabled", false)
}
amccullough84 marked this conversation as resolved.
Show resolved Hide resolved
d.Set("encryption_at_host_enabled", encryptionAtHostEnabled)

d.Set("virtual_machine_id", props.VMID)

Expand Down Expand Up @@ -1009,10 +1088,11 @@ func resourceWindowsVirtualMachineUpdate(d *pluginsdk.ResourceData, meta interfa
if d.HasChange("encryption_at_host_enabled") {
shouldUpdate = true
shouldDeallocate = true // API returns the following error if not deallocate: 'securityProfile.encryptionAtHost' can be updated only when VM is in deallocated state

update.VirtualMachineProperties.SecurityProfile = &compute.SecurityProfile{
EncryptionAtHost: utils.Bool(d.Get("encryption_at_host_enabled").(bool)),
if update.SecurityProfile == nil {
update.SecurityProfile = &compute.SecurityProfile{}
}
update.SecurityProfile.EncryptionAtHost = utils.Bool(d.Get("encryption_at_host_enabled").(bool))

}

if d.HasChange("license_type") {
Expand Down
168 changes: 168 additions & 0 deletions internal/services/compute/windows_virtual_machine_resource_other_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -865,6 +865,110 @@ func TestAccWindowsVirtualMachine_otherEncryptionAtHostEnabledUpdate(t *testing.
})
}

func TestAccWindowsVirtualMachine_otherSecureBootEnabled(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherSecureBootEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
})
}

func TestAccWindowsVirtualMachine_otherSecureBootEnabledUpdate(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherSecureBootEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
{
Config: r.otherSecureBootEnabled(data, false),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
{
Config: r.otherSecureBootEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
})
}
amccullough84 marked this conversation as resolved.
Show resolved Hide resolved

func TestAccWindowsVirtualMachine_otherVTpmEnabledUpdate(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherVTpmEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
{
Config: r.otherVTpmEnabled(data, false),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
{
Config: r.otherVTpmEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
})
}
amccullough84 marked this conversation as resolved.
Show resolved Hide resolved

func TestAccWindowsVirtualMachine_otherVTpmEnabled(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherVTpmEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
})
}

func TestAccWindowsVirtualMachine_otherEncryptionAtHostEnabledWithCMK(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}
Expand Down Expand Up @@ -2394,6 +2498,70 @@ resource "azurerm_windows_virtual_machine" "test" {
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineResource) otherSecureBootEnabled(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s

resource "azurerm_windows_virtual_machine" "test" {
name = local.vm_name
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
size = "Standard_DS3_v2"
admin_username = "adminuser"
admin_password = "P@$$w0rd1234!"
network_interface_ids = [
azurerm_network_interface.test.id,
]

os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}

source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter-gensecond"
version = "latest"
}

secure_boot_enabled = %t
}
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineResource) otherVTpmEnabled(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s

resource "azurerm_windows_virtual_machine" "test" {
name = local.vm_name
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
size = "Standard_DS3_v2"
admin_username = "adminuser"
admin_password = "P@$$w0rd1234!"
network_interface_ids = [
azurerm_network_interface.test.id,
]

os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}

source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter-gensecond"
version = "latest"
}

vtpm_enabled = %t
}
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineResource) otherEncryptionAtHostEnabledWithCMK(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s
Expand Down
Loading