This repository has been archived by the owner on Mar 30, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 162
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Support both Key Encrypted Key and non- Key Encrypted Key encryption modes - Introduce templates for master, client and data nodes to support the two encryption modes - Introduce encrypt-vm template that encrypts the OS disk and attached data disks For disk encryption to be applied: 1. The VM resource is created, with any attached data disks 2. The Encryption extension for the VM is created 3. The VM is updated with encryption settings from the Encryption extension NOTES: - There is no encryptionSettings on Data disks and specifying it returns a BadRequest. Looking at examples for Azure Disk Encryption, the encryptionSettings only get applied to the osDisk and the volumeType (OS, Data. All) determines which disks get encrypted. - The dependency chain is set up to deploy the VM disk encryption extensions for VMs after all VM resources are created, and to update VM storageProfiles after all disk encryption extensions have run TODO: - return BitLocker secret for each encrypted VM Closes #73
- Loading branch information
Showing
50 changed files
with
6,793 additions
and
59 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
159 changes: 159 additions & 0 deletions
159
src/datanodes/data-nodes-0disk-encrypted-kek-resources.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| { | ||
| "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", | ||
| "contentVersion": "1.0.0.0", | ||
| "parameters": { | ||
| "templateBaseUrl": { | ||
| "type": "string", | ||
| "metadata": { | ||
| "description": "Base uri of resources" | ||
| } | ||
| }, | ||
| "vm": { | ||
| "type": "object", | ||
| "metadata": { | ||
| "description": "vm configuration" | ||
| } | ||
| }, | ||
| "storageSettings": { | ||
| "type": "object", | ||
| "metadata": { | ||
| "description": "Storage Account Settings" | ||
| } | ||
| }, | ||
| "diskEncryptionSettings": { | ||
| "type": "object", | ||
| "metadata": { | ||
| "description": "The encryption settings for Azure Disk Encryption" | ||
| } | ||
| } | ||
| }, | ||
| "variables": { | ||
| "namespace": "[parameters('vm').namespace]", | ||
| "avSetCount": "[add(div(sub(parameters('vm').count, 1), 100), 1)]" | ||
| }, | ||
| "resources": [ | ||
| { | ||
| "apiVersion": "2016-03-30", | ||
| "type": "Microsoft.Compute/availabilitySets", | ||
| "name": "[concat(variables('namespace'), copyindex(), '-av-set')]", | ||
| "location": "[parameters('vm').shared.location]", | ||
| "copy": { | ||
| "name": "[concat(variables('namespace'),'av-loop')]", | ||
| "count": "[variables('avSetCount')]" | ||
| }, | ||
| "properties": { | ||
| "platformUpdateDomainCount": 20, | ||
| "platformFaultDomainCount": 3 | ||
| } | ||
| }, | ||
| { | ||
| "name": "[concat(variables('namespace'), copyindex(), '-vm-creation')]", | ||
| "type": "Microsoft.Resources/deployments", | ||
| "apiVersion": "2016-02-01", | ||
| "dependsOn": [ | ||
| "[concat('Microsoft.Compute/availabilitySets/', variables('namespace'), mod(copyindex(),variables('avSetCount')), '-av-set')]" | ||
| ], | ||
| "copy": { | ||
| "name": "[concat(variables('namespace'),'vm-creation-loop')]", | ||
| "count": "[parameters('vm').count]" | ||
| }, | ||
| "properties": { | ||
| "mode": "Incremental", | ||
| "templateLink": { | ||
| "uri": "[concat(parameters('templateBaseUrl'), '/partials/vm.json')]", | ||
| "contentVersion": "1.0.0.0" | ||
| }, | ||
| "parameters": { | ||
| "templateBaseUrl": { | ||
| "value": "[parameters('templateBaseUrl')]" | ||
| }, | ||
| "vm": { | ||
| "value": "[parameters('vm')]" | ||
| }, | ||
| "index": { | ||
| "value": "[copyindex()]" | ||
| }, | ||
| "availabilitySet": { | ||
| "value": "[concat(variables('namespace'), mod(copyindex(),variables('avSetCount')), '-av-set')]" | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "type": "Microsoft.Compute/virtualMachines/extensions", | ||
| "name": "[concat(variables('namespace'), copyindex(), '/', parameters('diskEncryptionSettings').extensionName)]", | ||
| "apiVersion": "2015-06-15", | ||
| "dependsOn": [ | ||
| "[concat(variables('namespace'),'vm-creation-loop')]" | ||
| ], | ||
| "location": "[parameters('vm').shared.location]", | ||
| "copy": { | ||
| "name": "[concat(variables('namespace'),'vm-encryption')]", | ||
| "count": "[parameters('vm').count]" | ||
| }, | ||
| "properties": { | ||
| "protectedSettings": { | ||
| "AADClientSecret": "[parameters('diskEncryptionSettings').activeDirectoryClientSecret]", | ||
| "Passphrase": "[parameters('diskEncryptionSettings').passphrase]" | ||
| }, | ||
| "publisher": "Microsoft.Azure.Security", | ||
| "settings": { | ||
| "AADClientID": "[parameters('diskEncryptionSettings').activeDirectoryClientId]", | ||
| "EncryptionOperation": "EnableEncryption", | ||
| "KeyEncryptionAlgorithm": "[parameters('diskEncryptionSettings').keyEncryptionAlgorithm]", | ||
| "KeyEncryptionKeyURL": "[parameters('diskEncryptionSettings').keyEncryptionKeyUrl]", | ||
| "KeyVaultURL": "[concat('https://', parameters('diskEncryptionSettings').keyVaultName, '.vault.azure.net/')]", | ||
| "SequenceVersion": "[parameters('diskEncryptionSettings').sequenceVersion]", | ||
| "VolumeType": "All" | ||
| }, | ||
| "type": "[parameters('diskEncryptionSettings').extensionName]", | ||
| "typeHandlerVersion": "[parameters('diskEncryptionSettings').extensionVersion]" | ||
| } | ||
| }, | ||
| { | ||
| "name": "[concat(variables('namespace'), copyindex(), '-vm-update')]", | ||
| "type": "Microsoft.Resources/deployments", | ||
| "apiVersion": "2016-02-01", | ||
| "dependsOn": [ | ||
| "[concat(variables('namespace'),'vm-encryption')]" | ||
| ], | ||
| "copy": { | ||
| "name": "[concat(variables('namespace'),'vm-update-loop')]", | ||
| "count": "[parameters('vm').count]" | ||
| }, | ||
| "properties": { | ||
| "mode": "Incremental", | ||
| "templateLink": { | ||
| "uri": "[concat(parameters('templateBaseUrl'), '/partials/encrypt-vm.json')]", | ||
| "contentVersion": "1.0.0.0" | ||
| }, | ||
| "parameters": { | ||
| "vm": { | ||
| "value": "[parameters('vm')]" | ||
| }, | ||
| "index": { | ||
| "value": "[copyindex()]" | ||
| }, | ||
| "diskEncryptionSettings": { | ||
| "value": { | ||
| "encryptionSettings": { | ||
| "diskEncryptionKey": { | ||
| "sourceVault": { | ||
| "id": "[parameters('diskEncryptionSettings').keyVaultResourceId]" | ||
| }, | ||
| "secretUrl": "[reference(resourceId('Microsoft.Compute/virtualMachines/extensions', concat(variables('namespace'), copyindex()), parameters('diskEncryptionSettings').extensionName)).instanceView.statuses[0].message]" | ||
| }, | ||
| "keyEncryptionKey": { | ||
| "sourceVault": { | ||
| "id": "[parameters('diskEncryptionSettings').keyVaultResourceId]" | ||
| }, | ||
| "keyUrl": "[parameters('diskEncryptionSettings').keyEncryptionKeyUrl]" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } |
Oops, something went wrong.