Skip to content

Commit b1b9b1e

Browse files
laozclaozc
committed
Add supports to Crypto Spec in VMOp VirtualMachine and PVC
1 parent 3066ca2 commit b1b9b1e

17 files changed

+387
-20
lines changed

‎apis/vmware/v1beta1/types.go‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,67 @@ const (
7676
// state within the configured timeout (default 5m).
7777
VirtualMachinePowerOpModeTrySoft VirtualMachinePowerOpMode = "trySoft"
7878
)
79+
80+
// VirtualMachineCryptoSpec defines the desired state of a VirtualMachine's
81+
// encryption state.
82+
type VirtualMachineCryptoSpec struct {
83+
// +optional
84+
85+
// EncryptionClassName describes the name of the EncryptionClass resource
86+
// used to encrypt this VM.
87+
//
88+
// Please note, this field is not required to encrypt the VM. If the
89+
// underlying platform has a default key provider, the VM may still be fully
90+
// or partially encrypted depending on the specified storage and VM classes.
91+
//
92+
// If there is a default key provider and an encryption storage class is
93+
// selected, the files in the VM's home directory and non-PVC virtual disks
94+
// will be encrypted
95+
//
96+
// If there is a default key provider and a VM Class with a virtual, trusted
97+
// platform module (vTPM) is selected, the files in the VM's home directory,
98+
// minus any virtual disks, will be encrypted.
99+
//
100+
// If the underlying vSphere platform does not have a default key provider,
101+
// then this field is required when specifying an encryption storage class
102+
// and/or a VM Class with a vTPM.
103+
//
104+
// If this field is set, spec.storageClass must use an encryption-enabled
105+
// storage class.
106+
EncryptionClassName string `json:"encryptionClassName,omitempty"`
107+
108+
// +optional
109+
// +kubebuilder:default=true
110+
111+
// UseDefaultKeyProvider describes the desired behavior for when an explicit
112+
// EncryptionClass is not provided.
113+
//
114+
// When an explicit EncryptionClass is not provided and this value is true:
115+
//
116+
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
117+
// will be encrypted using the default key provider.
118+
//
119+
// - If a VirtualMachine is not encrypted, uses an encryption storage
120+
// policy or has a virtual, trusted platform module (vTPM), there is a
121+
// default key provider, the VM will be encrypted using the default key
122+
// provider.
123+
//
124+
// - If a VirtualMachine is encrypted with a provider other than the default
125+
// key provider, the VM will be rekeyed using the default key provider.
126+
//
127+
// When an explicit EncryptionClass is not provided and this value is false:
128+
//
129+
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
130+
// will fail.
131+
//
132+
// - If a VirtualMachine is encrypted with a provider other than the default
133+
// key provider, the VM will be not be rekeyed.
134+
//
135+
// Please note, this could result in a VirtualMachine that cannot be
136+
// powered on since it is encrypted using a provider or key that may have
137+
// been removed. Without the key, the VM cannot be decrypted and thus
138+
// cannot be powered on.
139+
//
140+
// Defaults to true if omitted.
141+
UseDefaultKeyProvider *bool `json:"useDefaultKeyProvider,omitempty"`
142+
}

‎apis/vmware/v1beta1/vspheremachine_types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,14 @@ type VSphereMachineVolume struct {
3535
// StorageClass defaults to VSphereMachineSpec.StorageClass
3636
// +optional
3737
StorageClass string `json:"storageClass,omitempty"`
38+
// EncryptionClassName describes the name of the EncryptionClass resource
39+
// used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
40+
//
41+
// Please note, this field is not required to encrypt the volume. If the
42+
// underlying platform has a default key provider, the volume may still be fully
43+
// or partially encrypted depending on the specified storage.
44+
// +optional
45+
EncryptionClassName string `json:"encryptionClassName,omitempty"`
3846
}
3947

4048
// VSphereMachineSpec defines the desired state of VSphereMachine.
@@ -63,6 +71,10 @@ type VSphereMachineSpec struct {
6371
// +optional
6472
StorageClass string `json:"storageClass,omitempty"`
6573

74+
// Crypto describes the desired encryption state of the VirtualMachine.
75+
// +optional
76+
Crypto *VirtualMachineCryptoSpec `json:"crypto,omitempty"`
77+
6678
// Volumes is the set of PVCs to be created and attached to the VSphereMachine
6779
// +optional
6880
Volumes []VSphereMachineVolume `json:"volumes,omitempty"`

‎apis/vmware/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachines.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,69 @@ spec:
5959
ClassName is the name of the class used when specifying the underlying
6060
virtual machine
6161
type: string
62+
crypto:
63+
description: Crypto describes the desired encryption state of the
64+
VirtualMachine.
65+
properties:
66+
encryptionClassName:
67+
description: |-
68+
EncryptionClassName describes the name of the EncryptionClass resource
69+
used to encrypt this VM.
70+
71+
Please note, this field is not required to encrypt the VM. If the
72+
underlying platform has a default key provider, the VM may still be fully
73+
or partially encrypted depending on the specified storage and VM classes.
74+
75+
If there is a default key provider and an encryption storage class is
76+
selected, the files in the VM's home directory and non-PVC virtual disks
77+
will be encrypted
78+
79+
If there is a default key provider and a VM Class with a virtual, trusted
80+
platform module (vTPM) is selected, the files in the VM's home directory,
81+
minus any virtual disks, will be encrypted.
82+
83+
If the underlying vSphere platform does not have a default key provider,
84+
then this field is required when specifying an encryption storage class
85+
and/or a VM Class with a vTPM.
86+
87+
If this field is set, spec.storageClass must use an encryption-enabled
88+
storage class.
89+
type: string
90+
useDefaultKeyProvider:
91+
default: true
92+
description: |-
93+
UseDefaultKeyProvider describes the desired behavior for when an explicit
94+
EncryptionClass is not provided.
95+
96+
When an explicit EncryptionClass is not provided and this value is true:
97+
98+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
99+
will be encrypted using the default key provider.
100+
101+
- If a VirtualMachine is not encrypted, uses an encryption storage
102+
policy or has a virtual, trusted platform module (vTPM), there is a
103+
default key provider, the VM will be encrypted using the default key
104+
provider.
105+
106+
- If a VirtualMachine is encrypted with a provider other than the default
107+
key provider, the VM will be rekeyed using the default key provider.
108+
109+
When an explicit EncryptionClass is not provided and this value is false:
110+
111+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
112+
will fail.
113+
114+
- If a VirtualMachine is encrypted with a provider other than the default
115+
key provider, the VM will be not be rekeyed.
116+
117+
Please note, this could result in a VirtualMachine that cannot be
118+
powered on since it is encrypted using a provider or key that may have
119+
been removed. Without the key, the VM cannot be decrypted and thus
120+
cannot be powered on.
121+
122+
Defaults to true if omitted.
123+
type: boolean
124+
type: object
62125
failureDomain:
63126
description: |-
64127
FailureDomain is the failure domain the machine will be created in.
@@ -344,6 +407,15 @@ spec:
344407
x-kubernetes-int-or-string: true
345408
description: Capacity is the PVC capacity
346409
type: object
410+
encryptionClassName:
411+
description: |-
412+
EncryptionClassName describes the name of the EncryptionClass resource
413+
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
414+
415+
Please note, this field is not required to encrypt the volume. If the
416+
underlying platform has a default key provider, the volume may still be fully
417+
or partially encrypted depending on the specified storage.
418+
type: string
347419
name:
348420
description: 'Name is suffix used to name this PVC as: VSphereMachine.Name
349421
+ "-" + Name'

‎config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachinetemplates.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,69 @@ spec:
5555
ClassName is the name of the class used when specifying the underlying
5656
virtual machine
5757
type: string
58+
crypto:
59+
description: Crypto describes the desired encryption state
60+
of the VirtualMachine.
61+
properties:
62+
encryptionClassName:
63+
description: |-
64+
EncryptionClassName describes the name of the EncryptionClass resource
65+
used to encrypt this VM.
66+
67+
Please note, this field is not required to encrypt the VM. If the
68+
underlying platform has a default key provider, the VM may still be fully
69+
or partially encrypted depending on the specified storage and VM classes.
70+
71+
If there is a default key provider and an encryption storage class is
72+
selected, the files in the VM's home directory and non-PVC virtual disks
73+
will be encrypted
74+
75+
If there is a default key provider and a VM Class with a virtual, trusted
76+
platform module (vTPM) is selected, the files in the VM's home directory,
77+
minus any virtual disks, will be encrypted.
78+
79+
If the underlying vSphere platform does not have a default key provider,
80+
then this field is required when specifying an encryption storage class
81+
and/or a VM Class with a vTPM.
82+
83+
If this field is set, spec.storageClass must use an encryption-enabled
84+
storage class.
85+
type: string
86+
useDefaultKeyProvider:
87+
default: true
88+
description: |-
89+
UseDefaultKeyProvider describes the desired behavior for when an explicit
90+
EncryptionClass is not provided.
91+
92+
When an explicit EncryptionClass is not provided and this value is true:
93+
94+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
95+
will be encrypted using the default key provider.
96+
97+
- If a VirtualMachine is not encrypted, uses an encryption storage
98+
policy or has a virtual, trusted platform module (vTPM), there is a
99+
default key provider, the VM will be encrypted using the default key
100+
provider.
101+
102+
- If a VirtualMachine is encrypted with a provider other than the default
103+
key provider, the VM will be rekeyed using the default key provider.
104+
105+
When an explicit EncryptionClass is not provided and this value is false:
106+
107+
- Deploying a VirtualMachine with an encryption storage policy or vTPM
108+
will fail.
109+
110+
- If a VirtualMachine is encrypted with a provider other than the default
111+
key provider, the VM will be not be rekeyed.
112+
113+
Please note, this could result in a VirtualMachine that cannot be
114+
powered on since it is encrypted using a provider or key that may have
115+
been removed. Without the key, the VM cannot be decrypted and thus
116+
cannot be powered on.
117+
118+
Defaults to true if omitted.
119+
type: boolean
120+
type: object
58121
failureDomain:
59122
description: |-
60123
FailureDomain is the failure domain the machine will be created in.
@@ -341,6 +404,15 @@ spec:
341404
x-kubernetes-int-or-string: true
342405
description: Capacity is the PVC capacity
343406
type: object
407+
encryptionClassName:
408+
description: |-
409+
EncryptionClassName describes the name of the EncryptionClass resource
410+
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
411+
412+
Please note, this field is not required to encrypt the volume. If the
413+
underlying platform has a default key provider, the volume may still be fully
414+
or partially encrypted depending on the specified storage.
415+
type: string
344416
name:
345417
description: 'Name is suffix used to name this PVC as:
346418
VSphereMachine.Name + "-" + Name'

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ replace sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.12.0-beta.0
77
replace github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels => github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels v0.0.0-20240404200847-de75746a9505
88

99
// The version of vm-operator should be kept in sync with the manifests at: config/deployments/integration-tests
10-
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.8.6
10+
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719
1111

1212
require (
1313
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,8 @@ github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d h1:c
241241
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d/go.mod h1:JbFOh22iDsT5BowJe0GgpMI5e2/S7cWaJlv9LdURVQM=
242242
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d h1:z9lrzKVtNlujduv9BilzPxuge/LE2F0N1ms3TP4JZvw=
243243
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d/go.mod h1:Q4JzNkNMvjo7pXtlB5/R3oME4Nhah7fAObWgghVmtxk=
244-
github.com/vmware-tanzu/vm-operator/api v1.8.6 h1:NIndORjcnSmIlQsCMIewpIwg/ocRVDh2lYjOroTVLrU=
245-
github.com/vmware-tanzu/vm-operator/api v1.8.6/go.mod h1:HHA2SNI9B5Yqtyp5t+Gt9WTWBi/fIkM6+MukDDSf11A=
244+
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719 h1:nb/5ytRj7E/5eo9UzLfaR29JytMtbGpqMVs3hjaRwZ0=
245+
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719/go.mod h1:nWTPpxfe4gHuuYuFcrs86+NMxfkqPk3a3IlvI8TCWak=
246246
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505 h1:y4wXx1FUFqqSgJ/xUOEM1DLS2Uu0KaeLADWpzpioGTU=
247247
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505/go.mod h1:5rqRJ9zGR+KnKbkGx373WgN8xJpvAj99kHnfoDYRO5I=
248248
github.com/vmware/govmomi v0.52.0 h1:JyxQ1IQdllrY7PJbv2am9mRsv3p9xWlIQ66bv+XnyLw=

‎pkg/services/network/netop_provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ func (np *netopNetworkProvider) ConfigureVirtualMachine(ctx context.Context, clu
136136
// Set the VM primary interface
137137
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
138138
Name: PrimaryInterfaceName,
139-
Network: vmoprv1common.PartialObjectRef{
139+
Network: &vmoprv1common.PartialObjectRef{
140140
TypeMeta: metav1.TypeMeta{
141141
Kind: NetworkGVKNetOperator.Kind,
142142
APIVersion: NetworkGVKNetOperator.GroupVersion().String(),

‎pkg/services/network/nsxt_provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ func (np *nsxtNetworkProvider) ConfigureVirtualMachine(_ context.Context, cluste
223223
}
224224
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
225225
Name: fmt.Sprintf("eth%d", len(vm.Spec.Network.Interfaces)),
226-
Network: vmoprv1common.PartialObjectRef{
226+
Network: &vmoprv1common.PartialObjectRef{
227227
TypeMeta: metav1.TypeMeta{
228228
Kind: NetworkGVKNSXT.Kind,
229229
APIVersion: NetworkGVKNSXT.GroupVersion().String(),

‎pkg/services/network/nsxt_vpc_provider.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ func (vp *nsxtVPCNetworkProvider) ConfigureVirtualMachine(_ context.Context, clu
224224
networkName := clusterCtx.VSphereCluster.Name
225225
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
226226
Name: PrimaryInterfaceName,
227-
Network: vmoprv1common.PartialObjectRef{
227+
Network: &vmoprv1common.PartialObjectRef{
228228
TypeMeta: metav1.TypeMeta{
229229
Kind: NetworkGVKNSXTVPCSubnetSet.Kind,
230230
APIVersion: NetworkGVKNSXTVPCSubnetSet.GroupVersion().String(),
@@ -243,7 +243,7 @@ func (vp *nsxtVPCNetworkProvider) ConfigureVirtualMachine(_ context.Context, clu
243243
}
244244
vmInterface := vmoprv1.VirtualMachineNetworkInterfaceSpec{
245245
Name: PrimaryInterfaceName,
246-
Network: vmoprv1common.PartialObjectRef{
246+
Network: &vmoprv1common.PartialObjectRef{
247247
TypeMeta: metav1.TypeMeta{
248248
Kind: primary.Network.Kind,
249249
APIVersion: primary.Network.APIVersion,
@@ -281,7 +281,7 @@ func setVMSecondaryInterfaces(machine *vmwarev1.VSphereMachine, vm *vmoprv1.Virt
281281
}
282282
vmInterface := vmoprv1.VirtualMachineNetworkInterfaceSpec{
283283
Name: secondaryInterface.Name,
284-
Network: vmoprv1common.PartialObjectRef{
284+
Network: &vmoprv1common.PartialObjectRef{
285285
TypeMeta: metav1.TypeMeta{
286286
Kind: secondaryInterface.Network.Kind,
287287
APIVersion: secondaryInterface.Network.APIVersion,

0 commit comments

Comments
 (0)