govc: add vm.change -migrate-encryption and -ft-encryption-mode options

govc/USAGE.md

@@ -6476,6 +6476,7 @@ Options:
   -cpu.shares=                   CPU shares level or number
   -e=[]                          ExtraConfig. <key>=<value>
   -f=[]                          ExtraConfig. <key>=<absolute path to file>
+  -ft-encryption-mode=           Encrypted fault tolerance mode (ftEncryptionDisabled|ftEncryptionOpportunistic|ftEncryptionRequired)
   -g=                            Guest OS
   -iommu-enabled=<nil>           Enable IOMMU
   -latency=                      Latency sensitivity (low|normal|medium|high|custom)
@@ -6486,6 +6487,7 @@ Options:
   -mem.shares=                   Memory shares level or number
   -memory-hot-add-enabled=<nil>  Enable memory hot add
   -memory-pin=<nil>              Reserve all guest memory
+  -migrate-encryption=           Encrypted vMotion mode (disabled|opportunistic|required)
   -name=                         Display name
   -nested-hv-enabled=<nil>       Enable nested hardware-assisted virtualization
   -scheduled-hw-upgrade-policy=  Schedule hardware upgrade policy (never|onSoftPowerOff|always)

govc/test/vm.bats

@@ -212,6 +212,15 @@ load test_helper
   run govc object.collect -s "vm/$id" config.managedBy
   assert_success ""
 
+  run govc vm.change -vm $id -migrate-encryption required -ft-encryption-mode ftEncryptionRequired
+  assert_success
+
+  run govc collect -s "vm/$id" config.migrateEncryption
+  assert_success "required"
+
+  run govc collect -s "vm/$id" config.FtEncryptionMode
+  assert_success "ftEncryptionRequired"
+
   nid=$(new_id)
   run govc vm.change -name $nid -vm $id
   assert_success

govc/vm/change.go

@@ -103,7 +103,11 @@ func (cmd *change) setLatency() error {
 	return fmt.Errorf("latency must be one of: %s", strings.Join(latencyLevels, "|"))
 }
 
-var hwUpgradePolicies = types.ScheduledHardwareUpgradeInfoHardwareUpgradePolicy("").Strings()
+var (
+	hwUpgradePolicies      = types.ScheduledHardwareUpgradeInfoHardwareUpgradePolicy("").Strings()
+	ftEncryptionModes      = types.VirtualMachineConfigSpecEncryptedFtModes("").Strings()
+	migrateEncryptionModes = types.VirtualMachineConfigSpecEncryptedVMotionModes("").Strings()
+)
 
 // setHwUpgradePolicy validates hwUpgradePolicy if set
 func (cmd *change) setHwUpgradePolicy() error {
@@ -176,6 +180,9 @@ func (cmd *change) Register(ctx context.Context, f *flag.FlagSet) {
 	f.Var(flags.NewOptionalBool(&cmd.Flags.VvtdEnabled), "iommu-enabled", "Enable IOMMU")
 
 	f.StringVar(&cmd.hwUpgradePolicy, "scheduled-hw-upgrade-policy", "", fmt.Sprintf("Schedule hardware upgrade policy (%s)", strings.Join(hwUpgradePolicies, "|")))
+
+	f.StringVar(&cmd.FtEncryptionMode, "ft-encryption-mode", "", fmt.Sprintf("Encrypted fault tolerance mode (%s)", strings.Join(ftEncryptionModes, "|")))
+	f.StringVar(&cmd.MigrateEncryption, "migrate-encryption", "", fmt.Sprintf("Encrypted vMotion mode (%s)", strings.Join(migrateEncryptionModes, "|")))
 }
 
 func (cmd *change) Description() string {

simulator/virtual_machine.go

@@ -238,6 +238,8 @@ func (vm *VirtualMachine) apply(spec *types.VirtualMachineConfigSpec) {
 		{spec.Files.SnapshotDirectory, &vm.Config.Files.SnapshotDirectory},
 		{spec.Files.SuspendDirectory, &vm.Config.Files.SuspendDirectory},
 		{spec.Files.LogDirectory, &vm.Config.Files.LogDirectory},
+		{spec.FtEncryptionMode, &vm.Config.FtEncryptionMode},
+		{spec.MigrateEncryption, &vm.Config.MigrateEncryption},
 	}
 
 	for _, f := range apply {