[Compute] az vm/vmss create: Install guest attestation extension and turn on system MSI by default when Trusted Launch configuration is met
#22048
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ghost
requested a review
from 
ghost
added
the
|
Compute |
zhoxing-ms
reviewed
Apr 13, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
zhoxing-ms
reviewed
Apr 18, 2022
src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py
Outdated
Show resolved
Hide resolved
zhoxing-ms
reviewed
Apr 19, 2022
zhoxing-ms
reviewed
Apr 19, 2022
zhoxing-ms
reviewed
Apr 19, 2022
sirfamelin
reviewed
Apr 19, 2022
sirfamelin
reviewed
Apr 19, 2022
sirfamelin
reviewed
Apr 19, 2022
Comment on lines
6978
to
6983
| self.cmd('vm show -g {rg} -n {vm2}', checks=[ | ||
| self.check('resources', None), | ||
| self.check('securityProfile.securityType', 'TrustedLaunch'), | ||
| self.check('securityProfile.uefiSettings.secureBootEnabled', True), | ||
| self.check('securityProfile.uefiSettings.vTpmEnabled', True) | ||
| ]) |
There was a problem hiding this comment.
Can we add an explicit check to ensure that the extension does not show up in the extension list when --disable-integrity-monitoring is passed in? Same for identity?
There was a problem hiding this comment.
Good suggestion! We can also add an explicit check whether MSI is enabled
There was a problem hiding this comment.
self.check('resources', None) means no extension, self.check('identity', None) will be added.
sirfamelin
reviewed
Apr 19, 2022
src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py
Show resolved
Hide resolved
Co-authored-by: Sirfame Lin <64871536+sirfamelin@users.noreply.github.com>
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
reviewed
Apr 21, 2022
zhoxing-ms
approved these changes
Apr 21, 2022
|
Hi @zhoxing-ms, is there a way for me to test this package out before it is officially published? |
|
@sirfamelin In fact, this feature has been released in the last sprint. You can update the CLI to the latest version (2.36.0) and then try it |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Guest Attestation Extension and enable System Assigned MSI by default when Trusted Launch configuration is met #21395
Testing Guide
History Notes
[Compute]
az vm/vmss create: Install guest attestation extension and enable system managed identity by default when Trusted Launch configuration is met[Compute]
az vm/vmss create: Add new parameter--disable-integrity-monitoringto disable the default behavior (installing guest attestation extension and turning on MSI) when creating VM/VMSS compliant with Trusted LaunchThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.