[Trusted launch VMs] Gen1 VM to Trusted launch upgrade support

[AjKundnani]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

az vm update --security-type

Resource Provider

Microsoft.Compute/virtualMachines

Description of Feature or Work Requested

Azure Gen1 VM to Trusted launch Upgrade

Virtual machine API now supports upgrade of existing Azure Gen1 VMs to Trusted launch in private preview (AFEC Name: Gen1ToTLMigrationPreview).

ASK: Request to unblock az vm update command to set --security-type to TrustedLaunch if VM is Gen1 VM. This will allow customers to upgrade their Gen1 VMs to Trusted launch using CLI.

az vm update

Current behavior

Requested behavior

User runs following command: az vm update -n win2019vm01 -g testrg --security-type TrustedLaunch User receives following error Trusted Launch security configuration can be enabled only with Azure Gen2 VMs. Please visit https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch for more details

User runs following command: az vm update -n win2019vm01 -g testrg --security-type TrustedLaunch CLI accepts the request. CLI sets --enable-secure-boot and --enable-vtpm to true by default unless specified by user. CLI sends VM update with following attributes: securityType: TrustedLaunch SecureBoot: true (or user provided value) vTPM: true (or user provided value) If required AFEC Gen1ToTLMigrationPreview is registered for subscription, API will execute control plane operation and update following VM properties: HyperVGeneration: v2 securityType: TrustedLaunch secureBoot: as per default/user value vTPM: as per default/user value Else API returns error response as operation not supported for given subscription. CLI returns API response and update VM JSON to end user.

NOTE

• Gen1 to Trusted launch upgrade requires multiple data-plane operations as pre-requisites. Please refer to documentation for more details.
• AFEC Gen1ToTLMigrationPreview is currently set to private, i.e., engineering team needs to on-board subscription manually. This AFEC will be made public during public preview release.
• --enable-secure-boot and --enable-vtpm should be set to true by default. User provided values take precedence over defaults.

Minimum API Version Required

2023-07-01

Swagger PR link / SDK link

NA

Request Example

NA

Target Date

2024-06-30

PM Contact

ajkundna

Engineer Contact

poaggar

Additional context

Gen1 to Trusted launch upgrade support is currently in private preview.
Public preview is tentatively targeted for July 2024 release.

[yonzhan]

Thank you for opening this issue, we will look into it.

[zhoxing-ms]

Target Date
2024-06-30

@AjKundnani Sorry, as this sprint is already fully planned, could we schedule it in the next sprint? The estimated release time is 08-06, does it meet your expectations?

[AjKundnani]

Target Date
2024-06-30

@AjKundnani Sorry, as this sprint is already fully planned, could we schedule it in the next sprint? The estimated release time is 08-06, does it meet your expectations?

@zhoxing-ms - That works, thanks.