Azure / Azure/azure-cli

Request for CLI Support on Confidential Large OS Disk Encryption for CVM Workloads

Open
#32,224 4 comments 0 reactions 2 assignees Claimed by @zhoxing-ms View on GitHub
act-observability-squad Azure CLI Team Compute feature-request Similar-Issue
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Preconditions

- [ ] No need to upgrade Python SDK or the Python SDK is ready.

### Related command

_No response_

### Resource Provider

NA

### Description of Feature or Work Requested

The Ask: When creating large OS disk (>127 GB) with confidential OS disk encryption, we should serve the customer an error message and direct customer them to the new solution: Confidential Disk Encryption extension.
1. The error should point them to a page with instructions.
2. CLI must support new encryption type for CVM OS disk creation i.e., ConfidentialVM_VMGuestStateOnlyEncryptedWithCustomerKey
Note: currently CVM creation supported only with PMK for securityEncryptionType: VMGuestStateOnly, this requirement extends support for Customer Managed Keys (CMK) in CVM creation where the VMGuestStateOnly encryption type is used. Thus, CVM OS disk creation needed a new security type support: ConfidentialVM_VMGuestStateOnlyEncryptedWithCustomerKey

[Technical Requirement Overview - G42 CVM Large OS disk encryption.docx](https://microsoftapc-my.sharepoint.com/:w:/r/personal/pankajjoshi_microsoft_com/_layouts/15/Doc2.aspx?action=edit&sourcedoc=%7ba0174cda-d34e-4eec-8764-2e0e21e4f2d7%7d&wdOrigin=TEAMS-MAGLEV.undefined_ns.rwc&wdExp=TEAMS-TREATMENT&wdhostclicktime=1753128277266&web=1)

Business justification: Azure Confidential Compute does not support confidential encryption for operating systems larger than 127GB (will be referred to as ‘large OS disks’ in this doc). This requirement is critical for ensuring data confidentiality and integrity where sensitive workloads are being moved via Azure Migrate ‘lift & shift’ migrations. Many on-premises workloads migrating to Azure leveraging Azure Migrate will have OS disks > 127GB. For example: 43% of G42 VMs onboarding to CC have large OS disks.​

### Minimum API Version Required

NA

### Swagger PR link / SDK link

NA

### Request Example

_No response_

### Target Date

NA

### PM Contact

kartikg@microsoft.com

### Engineer Contact

pankajjoshi@microsoft.com

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.