Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable encryption at host for vms #4263

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Enable encryption at host for vms #4263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7d55c11
enable encryption at host for vms
yuvalyaron Jan 8, 2025
9f176eb
update template versions
yuvalyaron Jan 8, 2025
e503c07
Merge branch 'main' into enable-encryption-at-host-for-vms
yuvalyaron Jan 8, 2025
8a3e60f
update versions
yuvalyaron Jan 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion core/terraform/resource_processor/vmss_porter/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ resource "azurerm_linux_virtual_machine_scale_set" "vm_linux" {
disable_password_authentication = false
admin_password = random_password.password.result
custom_data = data.template_cloudinit_config.config.rendered
encryption_at_host_enabled = false
encryption_at_host_enabled = true
Copy link
Collaborator Author

@yuvalyaron yuvalyaron Jan 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we enable this encryption always (similar to infrastructure_encryption_enabled), or only when enable_cmk_encryption is set to true? @marrobi @jonnyry @tamirkamara

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@SvenAelterman wdyt?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like it has value whether CMK are being used or not.

upgrade_mode = "Automatic"
tags = local.tre_core_tags

Expand Down
5 changes: 3 additions & 2 deletions core/terraform/servicebus.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,9 @@ resource "azurerm_servicebus_namespace" "sb" {
dynamic "customer_managed_key" {
for_each = var.enable_cmk_encryption ? [1] : []
content {
key_vault_key_id = azurerm_key_vault_key.tre_encryption[0].id
identity_id = azurerm_user_assigned_identity.encryption[0].id
key_vault_key_id = azurerm_key_vault_key.tre_encryption[0].id
identity_id = azurerm_user_assigned_identity.encryption[0].id
infrastructure_encryption_enabled = true
}
}

Expand Down
2 changes: 1 addition & 1 deletion core/version.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.11.17"
__version__ = "0.11.18"
2 changes: 1 addition & 1 deletion resource_processor/_version.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.11.0"
__version__ = "0.11.1"
2 changes: 1 addition & 1 deletion templates/shared_services/admin-vm/porter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-shared-service-admin-vm
version: 0.5.1
version: 0.5.2
description: "An admin vm shared service"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
1 change: 1 addition & 0 deletions templates/shared_services/admin-vm/terraform/admin-jumpbox.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ resource "azurerm_windows_virtual_machine" "jumpbox" {
admin_username = "adminuser"
admin_password = random_password.password.result
tags = local.tre_shared_service_tags
encryption_at_host_enabled = true

source_image_reference {
publisher = "MicrosoftWindowsDesktop"
Expand Down
2 changes: 1 addition & 1 deletion templates/shared_services/sonatype-nexus-vm/porter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-shared-service-sonatype-nexus
version: 3.3.1
version: 3.3.2
description: "A Sonatype Nexus shared service"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
1 change: 1 addition & 0 deletions templates/shared_services/sonatype-nexus-vm/terraform/vm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ resource "azurerm_linux_virtual_machine" "nexus" {
admin_username = "adminuser"
admin_password = random_password.nexus_vm_password.result
tags = local.tre_shared_service_tags
encryption_at_host_enabled = true

custom_data = data.template_cloudinit_config.nexus_config.rendered

Expand Down
2 changes: 1 addition & 1 deletion ...s/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole-export-reviewvm
version: 0.2.1
version: 0.2.2
description: "An Azure TRE User Resource Template for reviewing Airlock export requests"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
1 change: 1 addition & 0 deletions ..._services/guacamole/user_resources/guacamole-azure-export-reviewvm/terraform/windowsvm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {
allow_extension_operations = true
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true

custom_data = base64encode(data.template_file.download_review_data_script.rendered)

Expand Down
2 changes: 1 addition & 1 deletion ...s/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole-import-reviewvm
version: 0.3.1
version: 0.3.2
description: "An Azure TRE User Resource Template for reviewing Airlock import requests"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
1 change: 1 addition & 0 deletions ..._services/guacamole/user_resources/guacamole-azure-import-reviewvm/terraform/windowsvm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {
allow_extension_operations = true
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true

custom_data = base64encode(data.template_file.download_review_data_script.rendered)

Expand Down
2 changes: 1 addition & 1 deletion templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole-linuxvm
version: 1.2.3
version: 1.2.4
description: "An Azure TRE User Resource Template for Guacamole (Linux)"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
1 change: 1 addition & 0 deletions .../workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/terraform/linuxvm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ resource "azurerm_linux_virtual_machine" "linuxvm" {
disable_password_authentication = false
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true

custom_data = data.template_cloudinit_config.config.rendered

Expand Down
1 change: 1 addition & 0 deletions ...kspace_services/guacamole/user_resources/guacamole-azure-windowsvm/terraform/windowsvm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {
allow_extension_operations = true
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true

custom_data = base64encode(templatefile(
"${path.module}/vm_config.ps1", {
Expand Down
Loading