Error publishing an encrypted (SSE+CMK) image into an Azure Compute Gallery (fka. SIG) with TrustedLaunch enabled #418
Labels
Comments
|
So today I was able to reproduce this error without using Packer or the Azure plugin. I created a Windows Virtual Machine using trusted launch with a DES key using SSE+CMK. Then using the Azure CLI i ran tried to create an ACG image version and I see the same failure. When I try to re-create this through the Azure Portal the portal does not give me an option to set a disk encryption key, and so when I try to capture my encrypted VM through the portal, it just fails due to lack of encryption. Since we're calling the same API that the Azure CLI is calling I'm not sure if there is a good way to bypass this, I can not find clear Azure documentation that communicates if trusted launch SSE+CMK is supported on ACG at all, and the API tells me that there is a long running bug that breaks it. I know @oliverlabs had been talking to some internal contacts at Microsoft, but I feel like an OS Snapshot is an elaborate way to get around something the API seems like it should support based on the exposed fields. The error we get is an Internal error with a stack trace referring to internal Microsoft error, this makes me believe that either. A.) Azure does not support SSE+CMK Trusted Launch VMs being saved to ACG (I can find no documentation either way) B.) There is a long standing bug in the Azure API preventing the creation of Azure ACG images from Trusted Launch SSE+CMK Our next steps I think will be to try again to reach out to Azure support and get a clear answer on this error, whether it is expected, or even known about, I will follow up if I hear more from them on this Full error stack below for future context. |
|
Hi @JenGoldstrich, I haven't looked into this since the time I reported the original issue. Last time I looked into it, SSE+CMK Trusted Launch VMs were not supported in ACG. The product group said there was not enough interest from Customers to implement this. It might have changed since (although I doubt it). |
|
Hey @oliverlabs I hope you're well and I appreciate your response, I see, not ideal but good to know that its not officially supported, I will see if I can poke around to get this officially documented because its rather confusing for Azure users. At the very least they could add an error to the API to make this more clear its not supported So for now this is not able to be solved sadly, lets leave this issue open since the context for this is concise and useful for future maintainers/community members, thanks for opening the issue @j7lloyd |
JenGoldstrich
added
the
stage/waiting-on-upstream
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Overview of the Issue
Seemingly, this isn't the first time the error/bug has been reported. Almost a year ago, in issue #304, @oliverlabs shared an image that encapsulates and illustrates it perfectly, as follows:
Specifically, my Temp Packer VM represents the 2nd scenario. i.e. CMK using a Disk Encryption Set with Trusted Launch Security Type.
Reproduction Steps
Use of
disk_encryption_set_idandsecurity_type = "TrustedLaunch"together, as demonstrated in the below build file:Plugin and Packer version
Packer version:
1.10.3Plugin version:
2.1.4Simplified Packer Buildfile
Operating system and Environment details
RHEL X64
ADOP SHA
Log Fragments and crash.log files
The text was updated successfully, but these errors were encountered: