Azure / Azure/azure-libraries-for-java

Encrypting the VM fails due to invalid secret URL "Preparing machine for bitlocker".

未关闭
#656 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
Compute Compute - VM customer-reported
主要语言
Java
星标
97
派生
102
PR 合并指标
30 天内没有已合并 PR

描述

Steps to reproduce
1. Created a win10 VM with osDisk and encrypt the VM.
2. Took the snapshot of the osDisk after the encryption.
3. Deleted the original VM and original osDisk
4. Recreated the VM with the same name in the same RG from the encrypted snapshot.
5. Added a datadisk to the new VM and then tried to encrypt the data disk using the following.

```
WindowsVMDiskEncryptionConfiguration config =
new WindowsVMDiskEncryptionConfiguration(
keyVault.id(),
applicationId,
applicationSecretEncrypted)
.withVolumeType(DiskVolumeType.DATA);
DiskVolumeEncryptionMonitor monitor = vm.diskEncryption().enable(config);
```

Azure throws the following exception

> com.microsoft.azure.CloudException:
> Preparing machine for bitlocker is not a valid versioned Key Vault Secret URL. It should be in the format `https:///secrets//.:` Preparing machine for bitlocker is not a valid versioned Key Vault Secret URL. It should be in the format `https:///secrets//.`

But retrying it after few minutes once it fails works.

I guess it's trying to re-install the "AzureDiskEncryption" extension since this was deleted as part of the original VM delete. But not waiting for extension's provisioning state to succeed (which will set the status message correctly to the secret URL) and using an intermediate status message "Preparing machine for bitlocker" as the secret URL.

贡献指南

打开贡献指南

调研方向

从 WindowsVMDiskEncryptionConfiguration 和 vm.diskEncryption().enable(config) 入口点开始,然后跟踪 AzureDiskEncryption 扩展的预配状态如何提供机密 URL。复现基于快照的 VM 重建流程,并验证加密不会使用中间消息“Preparing machine for bitlocker”;完成的标准是第一次加密尝试无需重试即可成功。

由索引模型根据 Issue 内容生成。

评估

技术栈
azure, java
领域
cloud, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。