Configuring Azure confidential virtual machines by using machine sets

You can enable Microsoft Azure confidential virtual machines (VMs) to use memory encryption to improve data confidentiality.

Note

Confidential VMs are currently not supported on 64-bit ARM architectures.

By editing the machine set YAML file, you can configure the confidential VM options that a machine set uses for machines that it deploys. For example, you can configure these machines to use UEFI security features such as Secure Boot or a dedicated virtual Trusted Platform Module (vTPM) instance.

For more information about related features and functionality, see the Microsoft Azure documentation about Confidential virtual machines.

Procedure

  1. In a text editor, open the YAML file for an existing machine set or create a new one.

  2. Edit the following section under the providerSpec field:

    apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
# ...
spec:
  template:
    spec:
      providerSpec:
        value:
          osDisk:
            # ...
            managedDisk:
              securityProfile:
                securityEncryptionType: VMGuestStateOnly
            # ...
          securityProfile:
            settings:
                securityType: ConfidentialVM
                confidentialVM:
                  uefiSettings:
                    secureBoot: Disabled
                    virtualizedTrustedPlatformModule: Enabled
          vmSize: Standard_DC16ads_v5
# ...

    where:

    spec.template.spec.providerSpec.value.osDisk.managedDisk.securityProfile

    Specifies security profile settings for the managed disk when using a confidential VM.

    spec.template.spec.providerSpec.value.osDisk.managedDisk.securityProfile.securityEncryptionType

    Enables encryption of the Microsoft Azure VM Guest State (VMGS) blob. This setting requires the use of vTPM.

    spec.template.spec.providerSpec.value.securityProfile

    Specifies security profile settings for the confidential VM.

    spec.template.spec.providerSpec.value.securityProfile.settings.securityType

    Enables the use of confidential VMs. This value is required for all valid configurations.

    spec.template.spec.providerSpec.value.securityProfile.settings.confidentialVM.uefiSettings

    Specifies which UEFI security features to use. This section is required for all valid configurations.

    spec.template.spec.providerSpec.value.securityProfile.settings.confidentialVM.uefiSettings.secureBoot

    Disables UEFI Secure Boot.

    spec.template.spec.providerSpec.value.securityProfile.settings.confidentialVM.uefiSettings.virtualizedTrustedPlatformModule

    Enables the use of a vTPM.

    spec.template.spec.providerSpec.value.vmSize

    Specifies an instance type that supports confidential VMs.

Verification

  • On the Microsoft Azure portal, review the details for a machine deployed by the machine set and verify that the confidential VM options match the values that you configured.

↑ Up: Configure confidential VMs | ⌂ Home: Red Hat OpenShift Container Platform | Next: Configuring Confidential VM by using machine sets →