)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"b07d93b4ff17fd5cead08bb2bfab28b040c8b63b","unresolved":false,"context_lines":[{"line_number":15,"context_line":"shielded VMs, offering the users an environment where the protection"},{"line_number":16,"context_line":"of the virtual machine data is enhanced against threats like malware,"},{"line_number":17,"context_line":"compromised storage, network and even host administrators."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Change-Id: I4b242faeb6c94285df37133828ca4c0231e64a3b"},{"line_number":20,"context_line":"Implements: blueprint hyper-v-shielded-vms"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"fa32b979_5a78c4f8","line":18,"updated":"2015-06-19 17:10:57.000000000","message":"Should add a \"SecurityImpact\" flag here so the OpenStack Security Group (OSSG) sees it.","commit_id":"99edf25cbf5b46f44e9234dc4192130635af3d00"}],"specs/liberty/approved/hyper-v-shielded-vms.rst":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"1e24564b636a5fc665ec1b75a86b0d9bf9c253a8","unresolved":false,"context_lines":[{"line_number":45,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_shielding`` is set to True."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":51,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_f6f2cc99","line":48,"updated":"2015-06-22 20:53:26.000000000","message":"Do we think that other hypervisors are likely to introduce similar functionality any time in the near future? If so, perhaps we should go with a more generic attribute name? Perhaps os_requires_encrypted_vm?","commit_id":"56c761f0c575b9f62b88c3b2061b672c6d9378a4"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"a5a8ab7a219f0926df11786ae25e622337b78bf3","unresolved":false,"context_lines":[{"line_number":45,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_shielding`` is set to True."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":51,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_faaa94d1","line":48,"in_reply_to":"fa32b979_f6f2cc99","updated":"2015-06-23 11:28:01.000000000","message":"I don\u0027t know about other hypervisors, but it is a feature that will eventually be implemented by other hypervisors, if they haven\u0027t already, IMO.","commit_id":"56c761f0c575b9f62b88c3b2061b672c6d9378a4"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"6d0dbeea0825b86a0ada8282494f34ec04056f5f","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Shielded VMs should be used in cases where the security of the spawned"},{"line_number":28,"context_line":"instances is essential. Shielded VMs are encrypted (BitLocker or other means),"},{"line_number":29,"context_line":"ensuring that only the designated owners can access the virtual machine. [2]"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"A few features of the Shielded VMs are:"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_7aca041c","line":29,"updated":"2015-06-23 11:39:53.000000000","message":"What does this disk encryption cover. ie local ephemeral images vs cinder persistent volumes ?","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"3acf1c282ba84dce3e51c2499c98b89841fee622","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Shielded VMs should be used in cases where the security of the spawned"},{"line_number":28,"context_line":"instances is essential. Shielded VMs are encrypted (BitLocker or other means),"},{"line_number":29,"context_line":"ensuring that only the designated owners can access the virtual machine. [2]"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"A few features of the Shielded VMs are:"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_11d364d6","line":29,"in_reply_to":"fa32b979_20466d4f","updated":"2015-06-24 12:56:00.000000000","message":"You are thinking about this solely from the POV of hyperv though.  Consider that the user has a heterogeneous hypervisor cloud deployment. How would libvirt know whether the image is something it is able to boot or not without knowing something about the encryption mechanism the image is built to work with.","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":3185,"name":"Alessandro Pilotti","email":"apilotti@cloudbasesolutions.com","username":"alexpilotti"},"change_message_id":"35a8168bfa13b33994d60f694af957286c24cb57","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Shielded VMs should be used in cases where the security of the spawned"},{"line_number":28,"context_line":"instances is essential. Shielded VMs are encrypted (BitLocker or other means),"},{"line_number":29,"context_line":"ensuring that only the designated owners can access the virtual machine. [2]"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"A few features of the Shielded VMs are:"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_b8b89112","line":29,"in_reply_to":"fa32b979_7aca041c","updated":"2015-06-23 13:22:04.000000000","message":"Both local storage and volumes: this is transparent for Cinder as the image comes already encrypted from the user in Glance.","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"a2f38f3aad571c1111b7e103cc83e7a08a462807","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Shielded VMs should be used in cases where the security of the spawned"},{"line_number":28,"context_line":"instances is essential. Shielded VMs are encrypted (BitLocker or other means),"},{"line_number":29,"context_line":"ensuring that only the designated owners can access the virtual machine. [2]"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"A few features of the Shielded VMs are:"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_20466d4f","line":29,"in_reply_to":"fa32b979_9b55871f","updated":"2015-06-23 21:55:08.000000000","message":"Yeah, the decryption key is present in the vTPM device (see Proposed Change). That should be provided by the user. Good point!\n\nAs for the encryption format, it is not useful information for Hyper-V at all. It doesn\u0027t care in what format the encryption was done, as long as it was done using the attached vTPM and it has a guest OS TPM driver.\n\nIMO, less information about the image, the better. :)","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"948953068cab533580136baf754d6862e38cccd2","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Shielded VMs should be used in cases where the security of the spawned"},{"line_number":28,"context_line":"instances is essential. Shielded VMs are encrypted (BitLocker or other means),"},{"line_number":29,"context_line":"ensuring that only the designated owners can access the virtual machine. [2]"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"A few features of the Shielded VMs are:"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_9b55871f","line":29,"in_reply_to":"fa32b979_b8b89112","updated":"2015-06-23 13:39:40.000000000","message":"Oh, so the user has to encrypt the image themselves ? Where does the decryption key come from ?\n\nThere is another open spec about general image encryption with glance\n\nhttps://review.openstack.org/#/c/188874/\n\nI feel that we need a consistent way to deal with encrypted images - specifically a standard property to denote the type of encryption used for the image in glance.\n\neg, we might need\n\n  img_encryption_format\u003dblock-aes|qcow2|luks|bitlocker|.....\n\nSo I think that other spec needs to be a dependency of this one","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"6d0dbeea0825b86a0ada8282494f34ec04056f5f","unresolved":false,"context_lines":[{"line_number":45,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":51,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_5a04e07c","line":48,"updated":"2015-06-23 11:39:53.000000000","message":"I\u0027m not really convinced that we need to make this configurable per image. it seems to me that as a cloud admin, that if i\u0027m going to enable this feature, I\u0027d want all VMs on a compute host to use it, not have a mixture of unsheilded and shielded VMs.\n\nThe cloud admin may decide to have some set of hosts running unshielded VMs and some set of hosts running sheilded VMs. They could achieve that by setting up host aggregates and creating separate flavours, and potentially charge higher price for the flavour that enables shielded VMs.","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":3185,"name":"Alessandro Pilotti","email":"apilotti@cloudbasesolutions.com","username":"alexpilotti"},"change_message_id":"35a8168bfa13b33994d60f694af957286c24cb57","unresolved":false,"context_lines":[{"line_number":45,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":51,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_78a769bd","line":48,"in_reply_to":"fa32b979_5a04e07c","updated":"2015-06-23 13:22:04.000000000","message":"The image needs to be marked as well, as trying to deploy it as \"unshielded\" would fail.\n\nWe definitely agree on the host aggregates idea, that\u0027s exactly where the design leads from a deployer perspective.","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"6d0dbeea0825b86a0ada8282494f34ec04056f5f","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Alternatives"},{"line_number":75,"context_line":"------------"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"None"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Data model impact"},{"line_number":80,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_5a606035","line":77,"updated":"2015-06-23 11:39:53.000000000","message":"In Nova we already have a global flag\n\n[ephemeral_storage_encryption]\nenabled\u003dtrue|false\n\nto turn on use of encryption for emphemeral disks on a per-host basis.\n\nThe cinder API for creating volumes also supports a flag to say whether the volume is encrypted or not. Currently this is only implemented for Linux LUKS encryption, but is intended to be flexible to other approaches.\n\nSo I\u0027m really wondering how we reconcile what\u0027s already designed in Nova/Cinder with HyperV disk encryption","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":3185,"name":"Alessandro Pilotti","email":"apilotti@cloudbasesolutions.com","username":"alexpilotti"},"change_message_id":"35a8168bfa13b33994d60f694af957286c24cb57","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Alternatives"},{"line_number":75,"context_line":"------------"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"None"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Data model impact"},{"line_number":80,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_383d61dd","line":77,"in_reply_to":"fa32b979_5a606035","updated":"2015-06-23 13:22:04.000000000","message":"In this case encryption is handled at the guest level (bitlocker) using a vTPM.\n\nThe host needs to have a TPM, which is required by the vTPM but there\u0027s no explicit action for encrypting the disk on the host side.\n\nI don\u0027t think the ephemeral_storage_encryption flag can be used in this context unless we want to extend its role.","commit_id":"816655e1718223f775c3fe0f730ec124a7c8f5bc"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"798bd9c6eafdd6f37703b380acfa966fab4481f1","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True (default is False) and"},{"line_number":49,"context_line":"``os_encryption_key`` (string) is set. If ``os_requires_encrypted_vm`` is True,"},{"line_number":50,"context_line":"but ``os_encryption_key`` is not set, an exception will be raised."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":53,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_838ac762","line":50,"updated":"2015-06-24 13:03:15.000000000","message":"The glance image properties are treated as holding non-confidential data. As such it is not acceptable to store the (de|en)cryption key as an image property, as that would compromise its secrecy. Keys need to be stored and managed by barbican and then associated with the image in some way - i\u0027m not too familiar with barbican to say exactly how, but I\u0027d presume each key provided to barbican has a unique ID of some kind which you could reference from glance properties\n\nSecond, as mentioned in the previous version, I think that just having a \u0027os_requires_encrypted_vm\u0027 property is not going to be sufficient. I think we need to consider how we express encryption support of images in a more general manner, so a hypervisor driver in nova can reliably determine whether it is able to boot the image or not.","commit_id":"5b678ddb6177e0f118905f267c6d5654eaef68d4"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"5973a2fae138cf46a9aee92d0068b5f6ea4a5f63","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True (default is False) and"},{"line_number":49,"context_line":"``os_encryption_key`` (string) is set. If ``os_requires_encrypted_vm`` is True,"},{"line_number":50,"context_line":"but ``os_encryption_key`` is not set, an exception will be raised."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":53,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_fea6c1a9","line":50,"in_reply_to":"fa32b979_5e6c8dcf","updated":"2015-06-24 16:16:03.000000000","message":"Also, you will be entitled to an \"I told you so!\". :D","commit_id":"5b678ddb6177e0f118905f267c6d5654eaef68d4"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"fe71c463828a61bd93ffcb31afb01bc9f7243312","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True (default is False) and"},{"line_number":49,"context_line":"``os_encryption_key`` (string) is set. If ``os_requires_encrypted_vm`` is True,"},{"line_number":50,"context_line":"but ``os_encryption_key`` is not set, an exception will be raised."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This feature is not available in earlier versions than Windows / Hyper-V Server"},{"line_number":53,"context_line":"Technical Preview. Spawning a Shielded VM in a previous version will result in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_5e6c8dcf","line":50,"in_reply_to":"fa32b979_838ac762","updated":"2015-06-24 16:10:04.000000000","message":"Good to know about the glance image properties. I\u0027m going to go with the Barbican route.\n\nAs for the encyption format, there is no way to tell Hyper-V in what format a vhdx is encrypted, as you can see in the references [1]. Also, the VHDX metadata should still be available, since the encryption is done within the guest OS, it doesn\u0027t have access to the VHDX metadata.\n\nI\u0027m no expert in this area, but the decryption part is performed by the guest itself. The full-disk encryption programs should provide a mechanism to decrypt it in the \"pre-boot\" phase, using the vTPM.\n\nThe usage should mimic the already existing TPM devices and OSes used on physical machines. The encryption format shouldn\u0027t matter to the hypervisor host.\n\nIf, by any chance, after approval, I\u0027m wrong about my arguments, and the encryption type is indeed a necessary information that should be included as an image property, I would gladly ammend this spec.","commit_id":"5b678ddb6177e0f118905f267c6d5654eaef68d4"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"798bd9c6eafdd6f37703b380acfa966fab4481f1","unresolved":false,"context_lines":[{"line_number":97,"context_line":"The ``os_encryption_key`` image property must be protected. This is done in"},{"line_number":98,"context_line":"glance by adding this property in ``glance-api.conf``:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    property_protection_file \u003d /etc/glance/property_protection.txt"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In the specified file, this should be added:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_e354f3c6","line":100,"updated":"2015-06-24 13:03:15.000000000","message":"This is not sufficient - the glance image metadata is printed / logged in countless areas of the code.\n\nThis protection mechanism is really intended to control who is permitted to create/delete properties - it is not intended to ensure secrecy of confidential data in general.","commit_id":"5b678ddb6177e0f118905f267c6d5654eaef68d4"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"fe71c463828a61bd93ffcb31afb01bc9f7243312","unresolved":false,"context_lines":[{"line_number":97,"context_line":"The ``os_encryption_key`` image property must be protected. This is done in"},{"line_number":98,"context_line":"glance by adding this property in ``glance-api.conf``:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    property_protection_file \u003d /etc/glance/property_protection.txt"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In the specified file, this should be added:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_73218a9d","line":100,"in_reply_to":"fa32b979_e354f3c6","updated":"2015-06-24 16:10:04.000000000","message":"I see. Replaced with Barbican.","commit_id":"5b678ddb6177e0f118905f267c6d5654eaef68d4"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0d83ffec4949d01a59edc774facd7c1aa1f79f49","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True (default is False) and"},{"line_number":49,"context_line":"``os_encryption_key`` (string) is set. If ``os_requires_encrypted_vm`` is True,"},{"line_number":50,"context_line":"but ``os_encryption_key_ref`` is not set, an exception will be raised."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"``os_encryption_key_ref`` image property contains the reference to the Barbican"},{"line_number":53,"context_line":"stored secret. If it cannot be fetched, an exception will be raised and the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa32b979_d1bbabc2","line":50,"updated":"2015-06-24 17:42:45.000000000","message":"So based on your previous response to me, and from the VTPM spec, it appears that HyperV itself is actually not doing anything related to disk encryption at all. The only thing HyperV needs to do is to provide the VTPM device, populated with the user\u0027s key, so the guest OS can deal with disk encryption if it desires.\n\nFrom that, it seems that HyperV should be able to just unconditionally turn on the shielded VM feature for all instances it launches. The performance hit only occurs if the guest image has actually chosen to make use of the disk encryption feature.\n\nIOW, it feels like the VTPM spec document should be able to cover the request for VTPM hardware device, and populating the VTPM with data (such as one or more keys). This shielded VMs spec can just talk about enablement of the sheilding feature. Neither spec appears to need to consider disk encryption - that\u0027s just something that the guest image can use when the VTPM is present with suitable keys.\n\nSo for this spec I\u0027m not seeing a need for any image properties at all. The encryption key reference(s) can be dealt with in the vTPM spec I think.","commit_id":"c20ab58bd0c85cc618570ca19921730f436d73cf"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"a2352e81ad4844e2d012d4bb56c742c5672e344f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True (default is False) and"},{"line_number":49,"context_line":"``os_encryption_key`` (string) is set. If ``os_requires_encrypted_vm`` is True,"},{"line_number":50,"context_line":"but ``os_encryption_key_ref`` is not set, an exception will be raised."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"``os_encryption_key_ref`` image property contains the reference to the Barbican"},{"line_number":53,"context_line":"stored secret. If it cannot be fetched, an exception will be raised and the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa32b979_f5b1de01","line":50,"in_reply_to":"fa32b979_4c061587","updated":"2015-06-25 09:33:48.000000000","message":"Ok, I understand the reason to not enable shielded VMs unconditionally. It looks sufficient to do that based on whether a vTPM and/or keys was requested, though I wonder if there is a use case where users want to use the shield VMs feature, but not do disk encryption. In such a case we\u0027d need a  way to enable sheilded VMs independently of enabling vTPMs.\n\nUltimately it appears that the os_encryption_key_ref is used  to populate the vTPM with a key provided by the end user. What I\u0027m saying, is that rather than special case this key provision for disk encryption, we should provide a general property for populating vTPM keys, in the vTPM spec, rather than in this spec","commit_id":"c20ab58bd0c85cc618570ca19921730f436d73cf"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"d1265e6c1db5ca3710fb4a44dd2c08073dd48d35","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The Hyper-V Driver should create a Shielded VM if the instance image property"},{"line_number":48,"context_line":"``os_requires_encrypted_vm`` is set to True (default is False) and"},{"line_number":49,"context_line":"``os_encryption_key`` (string) is set. If ``os_requires_encrypted_vm`` is True,"},{"line_number":50,"context_line":"but ``os_encryption_key_ref`` is not set, an exception will be raised."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"``os_encryption_key_ref`` image property contains the reference to the Barbican"},{"line_number":53,"context_line":"stored secret. If it cannot be fetched, an exception will be raised and the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa32b979_4c061587","line":50,"in_reply_to":"fa32b979_d1bbabc2","updated":"2015-06-24 22:57:16.000000000","message":"So, after some pondering about this feature, I found a couple of reasons why vTPM should not be added by default.\n\nWell, first of all, not all guests can actually make use of the vTPM device, so adding it would be pointless.\n\nSecondly, it could complicate things for the user / guest OS. For example, if you add the vTPM, you will use it. You can\u0027t then just migrate the VM to Hyper-V Server 2012 R2, there is vTPM support on it. This can cause various problems in the guest OS.\n\nThirdly, adding the vTPM will also add a restriction. A VM with vTPM should and will not be migrated outside of the Active Directory it curently resides in. The problem is that the KeyProtector is registered and encrypted using the Active Directory\u0027s HGS Key Protection Service. The vTPM\u0027s KeyProtector cannot be used in another AD.\n\n\nAnyways, it is true that this spec and the vTPM spec are very similar and will have similar implementation. The key difference is that the shielded VMs spec requires / relies on the ``os_encryption_key_ref``, since it will contain the encryption key used by the full disk encryption software (BitLocker). Without this, the software can\u0027t decrypt and the guest won\u0027t start. While for vTPM spec, it doesn\u0027t require anything and the vTPM will not have any keys in it. Keys will be added to it by the guest.\n\nAlso, there isn\u0027t any good reason why we should have both ``os_requires_encrypted_vm`` and ``os_vtpm``. Shielded VM is basically configured by using the ``os_encryption_key_ref``.\n\nAlso, this spec is also useful for the Other Deployer section.\n\nI will include this into the Other Deployer Section.","commit_id":"c20ab58bd0c85cc618570ca19921730f436d73cf"}]}