Skip to content

Commit 228ec14

Browse files
laozclaozc
committed
Add supports to Crypto Spec in VMOp VirtualMachine and PVC
1 parent 3066ca2 commit 228ec14

18 files changed

+389
-21
lines changed

‎apis/vmware/v1beta1/types.go‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,65 @@ const (
7676
// state within the configured timeout (default 5m).
7777
VirtualMachinePowerOpModeTrySoft VirtualMachinePowerOpMode = "trySoft"
7878
)
79+
80+
// VirtualMachineCryptoSpec defines the desired state of a VirtualMachine's
81+
// encryption state.
82+
type VirtualMachineCryptoSpec struct {
83+
// encryptionClassName describes the name of the EncryptionClass resource
84+
// used to encrypt this VM.
85+
//
86+
// Please note, this field is not required to encrypt the VM. If the
87+
// underlying platform has a default key provider, the VM may still be fully
88+
// or partially encrypted depending on the specified storage and VM classes.
89+
//
90+
// If there is a default key provider and an encryption storage class is
91+
// selected, the files in the VM's home directory and non-PVC virtual disks
92+
// will be encrypted
93+
//
94+
// If there is a default key provider and a VM Class with a virtual, trusted
95+
// platform module (vTPM) is selected, the files in the VM's home directory,
96+
// minus any virtual disks, will be encrypted.
97+
//
98+
// If the underlying vSphere platform does not have a default key provider,
99+
// then this field is required when specifying an encryption storage class
100+
// and/or a VM Class with a vTPM.
101+
//
102+
// If this field is set, spec.storageClass must use an encryption-enabled
103+
// storage class.
104+
// +optional
105+
// +kubebuilder:validation:MaxLength=253
106+
EncryptionClassName string `json:"encryptionClassName,omitempty"`
107+
108+
// useDefaultKeyProvider describes the desired behavior for when an explicit
109+
// EncryptionClass is not provided.
110+
//
111+
// When an explicit encryptionClass is not provided and this value is true:
112+
//
113+
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
114+
// will be encrypted using the default key provider.
115+
//
116+
// - If a VirtualMachine is not encrypted, uses an encryption storage
117+
// policy or has a virtual, trusted platform module (vTPM), there is a
118+
// default key provider, the VM will be encrypted using the default key
119+
// provider.
120+
//
121+
// - If a VirtualMachine is encrypted with a provider other than the default
122+
// key provider, the VM will be rekeyed using the default key provider.
123+
//
124+
// When an explicit EncryptionClass is not provided and this value is false:
125+
//
126+
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
127+
// will fail.
128+
//
129+
// - If a VirtualMachine is encrypted with a provider other than the default
130+
// key provider, the VM will be not be rekeyed.
131+
//
132+
// Please note, this could result in a VirtualMachine that cannot be
133+
// powered on since it is encrypted using a provider or key that may have
134+
// been removed. Without the key, the VM cannot be decrypted and thus
135+
// cannot be powered on.
136+
//
137+
// Defaults to true if omitted.
138+
// +optional
139+
UseDefaultKeyProvider *bool `json:"useDefaultKeyProvider,omitempty"`
140+
}

‎apis/vmware/v1beta1/vspheremachine_types.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,15 @@ type VSphereMachineVolume struct {
3535
// StorageClass defaults to VSphereMachineSpec.StorageClass
3636
// +optional
3737
StorageClass string `json:"storageClass,omitempty"`
38+
// encryptionClassName describes the name of the EncryptionClass resource
39+
// used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
40+
//
41+
// Please note, this field is not required to encrypt the volume. If the
42+
// underlying platform has a default key provider, the volume may still be fully
43+
// or partially encrypted depending on the specified storage.
44+
// +optional
45+
// +kubebuilder:validation:MaxLength=253
46+
EncryptionClassName *string `json:"encryptionClassName,omitempty"`
3847
}
3948

4049
// VSphereMachineSpec defines the desired state of VSphereMachine.
@@ -63,6 +72,10 @@ type VSphereMachineSpec struct {
6372
// +optional
6473
StorageClass string `json:"storageClass,omitempty"`
6574

75+
// crypto describes the desired encryption state of the VirtualMachine.
76+
// +optional
77+
Crypto *VirtualMachineCryptoSpec `json:"crypto,omitempty"`
78+
6679
// Volumes is the set of PVCs to be created and attached to the VSphereMachine
6780
// +optional
6881
Volumes []VSphereMachineVolume `json:"volumes,omitempty"`

‎apis/vmware/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachines.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,68 @@ spec:
5959
ClassName is the name of the class used when specifying the underlying
6060
virtual machine
6161
type: string
62+
crypto:
63+
description: crypto describes the desired encryption state of the
64+
VirtualMachine.
65+
properties:
66+
encryptionClassName:
67+
description: |-
68+
encryptionClassName describes the name of the EncryptionClass resource
69+
used to encrypt this VM.
70+
71+
Please note, this field is not required to encrypt the VM. If the
72+
underlying platform has a default key provider, the VM may still be fully
73+
or partially encrypted depending on the specified storage and VM classes.
74+
75+
If there is a default key provider and an encryption storage class is
76+
selected, the files in the VM's home directory and non-PVC virtual disks
77+
will be encrypted
78+
79+
If there is a default key provider and a VM Class with a virtual, trusted
80+
platform module (vTPM) is selected, the files in the VM's home directory,
81+
minus any virtual disks, will be encrypted.
82+
83+
If the underlying vSphere platform does not have a default key provider,
84+
then this field is required when specifying an encryption storage class
85+
and/or a VM Class with a vTPM.
86+
87+
If this field is set, spec.storageClass must use an encryption-enabled
88+
storage class.
89+
type: string
90+
useDefaultKeyProvider:
91+
description: |-
92+
useDefaultKeyProvider describes the desired behavior for when an explicit
93+
EncryptionClass is not provided.
94+
95+
When an explicit encryptionClass is not provided and this value is true:
96+
97+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
98+
will be encrypted using the default key provider.
99+
100+
- If a VirtualMachine is not encrypted, uses an encryption storage
101+
policy or has a virtual, trusted platform module (vTPM), there is a
102+
default key provider, the VM will be encrypted using the default key
103+
provider.
104+
105+
- If a VirtualMachine is encrypted with a provider other than the default
106+
key provider, the VM will be rekeyed using the default key provider.
107+
108+
When an explicit EncryptionClass is not provided and this value is false:
109+
110+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
111+
will fail.
112+
113+
- If a VirtualMachine is encrypted with a provider other than the default
114+
key provider, the VM will be not be rekeyed.
115+
116+
Please note, this could result in a VirtualMachine that cannot be
117+
powered on since it is encrypted using a provider or key that may have
118+
been removed. Without the key, the VM cannot be decrypted and thus
119+
cannot be powered on.
120+
121+
Defaults to true if omitted.
122+
type: boolean
123+
type: object
62124
failureDomain:
63125
description: |-
64126
FailureDomain is the failure domain the machine will be created in.
@@ -344,6 +406,15 @@ spec:
344406
x-kubernetes-int-or-string: true
345407
description: Capacity is the PVC capacity
346408
type: object
409+
encryptionClassName:
410+
description: |-
411+
encryptionClassName describes the name of the EncryptionClass resource
412+
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
413+
414+
Please note, this field is not required to encrypt the volume. If the
415+
underlying platform has a default key provider, the volume may still be fully
416+
or partially encrypted depending on the specified storage.
417+
type: string
347418
name:
348419
description: 'Name is suffix used to name this PVC as: VSphereMachine.Name
349420
+ "-" + Name'

‎config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachinetemplates.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,68 @@ spec:
5555
ClassName is the name of the class used when specifying the underlying
5656
virtual machine
5757
type: string
58+
crypto:
59+
description: crypto describes the desired encryption state
60+
of the VirtualMachine.
61+
properties:
62+
encryptionClassName:
63+
description: |-
64+
encryptionClassName describes the name of the EncryptionClass resource
65+
used to encrypt this VM.
66+
67+
Please note, this field is not required to encrypt the VM. If the
68+
underlying platform has a default key provider, the VM may still be fully
69+
or partially encrypted depending on the specified storage and VM classes.
70+
71+
If there is a default key provider and an encryption storage class is
72+
selected, the files in the VM's home directory and non-PVC virtual disks
73+
will be encrypted
74+
75+
If there is a default key provider and a VM Class with a virtual, trusted
76+
platform module (vTPM) is selected, the files in the VM's home directory,
77+
minus any virtual disks, will be encrypted.
78+
79+
If the underlying vSphere platform does not have a default key provider,
80+
then this field is required when specifying an encryption storage class
81+
and/or a VM Class with a vTPM.
82+
83+
If this field is set, spec.storageClass must use an encryption-enabled
84+
storage class.
85+
type: string
86+
useDefaultKeyProvider:
87+
description: |-
88+
useDefaultKeyProvider describes the desired behavior for when an explicit
89+
EncryptionClass is not provided.
90+
91+
When an explicit encryptionClass is not provided and this value is true:
92+
93+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
94+
will be encrypted using the default key provider.
95+
96+
- If a VirtualMachine is not encrypted, uses an encryption storage
97+
policy or has a virtual, trusted platform module (vTPM), there is a
98+
default key provider, the VM will be encrypted using the default key
99+
provider.
100+
101+
- If a VirtualMachine is encrypted with a provider other than the default
102+
key provider, the VM will be rekeyed using the default key provider.
103+
104+
When an explicit EncryptionClass is not provided and this value is false:
105+
106+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
107+
will fail.
108+
109+
- If a VirtualMachine is encrypted with a provider other than the default
110+
key provider, the VM will be not be rekeyed.
111+
112+
Please note, this could result in a VirtualMachine that cannot be
113+
powered on since it is encrypted using a provider or key that may have
114+
been removed. Without the key, the VM cannot be decrypted and thus
115+
cannot be powered on.
116+
117+
Defaults to true if omitted.
118+
type: boolean
119+
type: object
58120
failureDomain:
59121
description: |-
60122
FailureDomain is the failure domain the machine will be created in.
@@ -341,6 +403,15 @@ spec:
341403
x-kubernetes-int-or-string: true
342404
description: Capacity is the PVC capacity
343405
type: object
406+
encryptionClassName:
407+
description: |-
408+
encryptionClassName describes the name of the EncryptionClass resource
409+
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
410+
411+
Please note, this field is not required to encrypt the volume. If the
412+
underlying platform has a default key provider, the volume may still be fully
413+
or partially encrypted depending on the specified storage.
414+
type: string
344415
name:
345416
description: 'Name is suffix used to name this PVC as:
346417
VSphereMachine.Name + "-" + Name'

‎controllers/vmware/vspherecluster_reconciler_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ var _ = Describe("Cluster Controller Tests", func() {
5353
className = "test-className"
5454
imageName = "test-imageName"
5555
storageClass = "test-storageClass"
56+
encryptionClass = "test-encryptionClass"
5657
testIP = "127.0.0.1"
5758
)
5859
var (
@@ -69,7 +70,7 @@ var _ = Describe("Cluster Controller Tests", func() {
6970
cluster = util.CreateCluster(clusterName)
7071
vsphereCluster = util.CreateVSphereCluster(clusterName)
7172
clusterCtx, controllerManagerContext = util.CreateClusterContext(cluster, vsphereCluster)
72-
vsphereMachine = util.CreateVSphereMachine(machineName, clusterName, className, imageName, storageClass, controlPlaneLabelTrue)
73+
vsphereMachine = util.CreateVSphereMachine(machineName, clusterName, className, imageName, storageClass, encryptionClass, controlPlaneLabelTrue)
7374

7475
reconciler = &ClusterReconciler{
7576
Client: controllerManagerContext.Client,

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ replace sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.12.0-beta.0
77
replace github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels => github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels v0.0.0-20240404200847-de75746a9505
88

99
// The version of vm-operator should be kept in sync with the manifests at: config/deployments/integration-tests
10-
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.8.6
10+
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719
1111

1212
require (
1313
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,8 @@ github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d h1:c
241241
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d/go.mod h1:JbFOh22iDsT5BowJe0GgpMI5e2/S7cWaJlv9LdURVQM=
242242
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d h1:z9lrzKVtNlujduv9BilzPxuge/LE2F0N1ms3TP4JZvw=
243243
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d/go.mod h1:Q4JzNkNMvjo7pXtlB5/R3oME4Nhah7fAObWgghVmtxk=
244-
github.com/vmware-tanzu/vm-operator/api v1.8.6 h1:NIndORjcnSmIlQsCMIewpIwg/ocRVDh2lYjOroTVLrU=
245-
github.com/vmware-tanzu/vm-operator/api v1.8.6/go.mod h1:HHA2SNI9B5Yqtyp5t+Gt9WTWBi/fIkM6+MukDDSf11A=
244+
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719 h1:nb/5ytRj7E/5eo9UzLfaR29JytMtbGpqMVs3hjaRwZ0=
245+
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719/go.mod h1:nWTPpxfe4gHuuYuFcrs86+NMxfkqPk3a3IlvI8TCWak=
246246
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505 h1:y4wXx1FUFqqSgJ/xUOEM1DLS2Uu0KaeLADWpzpioGTU=
247247
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505/go.mod h1:5rqRJ9zGR+KnKbkGx373WgN8xJpvAj99kHnfoDYRO5I=
248248
github.com/vmware/govmomi v0.52.0 h1:JyxQ1IQdllrY7PJbv2am9mRsv3p9xWlIQ66bv+XnyLw=

‎pkg/services/network/netop_provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ func (np *netopNetworkProvider) ConfigureVirtualMachine(ctx context.Context, clu
136136
// Set the VM primary interface
137137
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
138138
Name: PrimaryInterfaceName,
139-
Network: vmoprv1common.PartialObjectRef{
139+
Network: &vmoprv1common.PartialObjectRef{
140140
TypeMeta: metav1.TypeMeta{
141141
Kind: NetworkGVKNetOperator.Kind,
142142
APIVersion: NetworkGVKNetOperator.GroupVersion().String(),

‎pkg/services/network/nsxt_provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ func (np *nsxtNetworkProvider) ConfigureVirtualMachine(_ context.Context, cluste
223223
}
224224
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
225225
Name: fmt.Sprintf("eth%d", len(vm.Spec.Network.Interfaces)),
226-
Network: vmoprv1common.PartialObjectRef{
226+
Network: &vmoprv1common.PartialObjectRef{
227227
TypeMeta: metav1.TypeMeta{
228228
Kind: NetworkGVKNSXT.Kind,
229229
APIVersion: NetworkGVKNSXT.GroupVersion().String(),

0 commit comments

Comments
 (0)