diff --git a/.pipelines/.vsts-vhd-builder-release.yaml b/.pipelines/.vsts-vhd-builder-release.yaml index 22b14d8cdd9..18f78832fb0 100644 --- a/.pipelines/.vsts-vhd-builder-release.yaml +++ b/.pipelines/.vsts-vhd-builder-release.yaml @@ -1156,7 +1156,7 @@ stages: echo '##vso[task.setvariable variable=IMG_VERSION]latest' echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2' echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_DC16ads_v5' - echo '##vso[task.setvariable variable=FEATURE_FLAGS]None' + echo '##vso[task.setvariable variable=FEATURE_FLAGS]cvm' echo '##vso[task.setvariable variable=CONTAINER_RUNTIME]containerd' echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64' echo '##vso[task.setvariable variable=ENABLE_FIPS]False' @@ -1234,7 +1234,7 @@ stages: echo '##vso[task.setvariable variable=IMG_VERSION]latest' echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2' echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_DC16ads_v5' - echo '##vso[task.setvariable variable=FEATURE_FLAGS]None' + echo '##vso[task.setvariable variable=FEATURE_FLAGS]cvm' echo '##vso[task.setvariable variable=CONTAINER_RUNTIME]containerd' echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64' echo '##vso[task.setvariable variable=ENABLE_FIPS]False' diff --git a/.pipelines/templates/.builder-release-template.yaml b/.pipelines/templates/.builder-release-template.yaml index 7a5c63fa3ef..b883aee979d 100644 --- a/.pipelines/templates/.builder-release-template.yaml +++ b/.pipelines/templates/.builder-release-template.yaml @@ -103,7 +103,7 @@ steps: if [[ "${HYPERV_GENERATION,,}" == "v2" ]]; then SKU_NAME="${SKU_NAME}gen2"; fi && \ if [[ "${ARCHITECTURE,,}" == "arm64" ]]; then SKU_NAME="${SKU_NAME}arm64"; fi && \ if [[ "${ENABLE_FIPS,,}" == "true" ]]; then SKU_NAME="${SKU_NAME}fips"; fi && \ - if [[ "${IMG_SKU}" == "20_04-lts-cvm" || "${IMG_SKU}" == "cvm" ]]; then SKU_NAME="${SKU_NAME}CVM"; fi && \ + if grep -q "cvm" <<< "$FEATURE_FLAGS"; then SKU_NAME="${SKU_NAME}CVM"; fi && \ if [[ "${IMG_SKU}" == *"minimal"* ]]; then SKU_NAME="${SKU_NAME}minimal"; fi && \ if [[ "${ENABLE_TRUSTED_LAUNCH}" == "True" ]]; then SKU_NAME="${SKU_NAME}TL"; fi && \ if [[ ${OS_SKU} != "CBLMariner" && ${OS_SKU} != "AzureLinux" && "${CONTAINER_RUNTIME}" == "containerd" ]]; then SKU_NAME="${SKU_NAME}containerd"; fi && \ diff --git a/packer.mk b/packer.mk index cfbb46aa7d8..8bf2db32416 100755 --- a/packer.mk +++ b/packer.mk @@ -29,10 +29,7 @@ else $(error HYPERV_GENERATION was invalid ${HYPERV_GENERATION}) endif ifeq (${OS_SKU},Ubuntu) -ifeq (${IMG_SKU},20_04-lts-cvm) - @echo "Using packer template file vhd-image-builder-cvm.json" - @packer build -var-file=vhdbuilder/packer/settings.json vhdbuilder/packer/vhd-image-builder-cvm.json -else ifeq (${IMG_SKU},cvm) +ifeq ($(findstring cvm,$(FEATURE_FLAGS)),cvm) @echo "Using packer template file vhd-image-builder-cvm.json" @packer build -var-file=vhdbuilder/packer/settings.json vhdbuilder/packer/vhd-image-builder-cvm.json else diff --git a/vhdbuilder/packer/convert-sig-to-classic-storage-account-blob.sh b/vhdbuilder/packer/convert-sig-to-classic-storage-account-blob.sh index a9265cd648a..b988880ab3c 100755 --- a/vhdbuilder/packer/convert-sig-to-classic-storage-account-blob.sh +++ b/vhdbuilder/packer/convert-sig-to-classic-storage-account-blob.sh @@ -69,7 +69,7 @@ if [[ ${OS_TYPE} == "Linux" && ${ENABLE_TRUSTED_LAUNCH} == "True" ]]; then } \ } \ }" -elif [ "${OS_TYPE}" == "Linux" ] && [[ "${IMG_SKU}" == "20_04-lts-cvm" || "${IMG_SKU}" == "cvm" ]]; then +elif [ "${OS_TYPE}" == "Linux" ] && grep -q "cvm" <<< "$FEATURE_FLAGS"; then az resource create --id $disk_resource_id --is-full-object --location $LOCATION --properties "{\"location\": \"$LOCATION\", \ \"properties\": { \ \"osType\": \"$OS_TYPE\", \ diff --git a/vhdbuilder/packer/init-variables.sh b/vhdbuilder/packer/init-variables.sh index 9f2fba310b7..d3382a1858d 100755 --- a/vhdbuilder/packer/init-variables.sh +++ b/vhdbuilder/packer/init-variables.sh @@ -71,7 +71,7 @@ if [ "$MODE" == "linuxVhdMode" ] && [ -z "${PACKER_BUILD_LOCATION}" ]; then exit 1 fi -if [[ "${IMG_SKU,,}" == "20_04-lts-cvm" || "${IMG_SKU,,}" == "cvm" ]] && [ -n "${CVM_PACKER_BUILD_LOCATION}" ]; then +if grep -q "cvm" <<< "$FEATURE_FLAGS" && [ -n "${CVM_PACKER_BUILD_LOCATION}" ]; then PACKER_BUILD_LOCATION="${CVM_PACKER_BUILD_LOCATION}" echo "CVM: PACKER_BUILD_LOCATION is set to ${PACKER_BUILD_LOCATION}" fi @@ -172,7 +172,7 @@ if [[ "${MODE}" == "linuxVhdMode" ]]; then elif [[ "${IMG_OFFER,,}" == "azure-linux-3" ]]; then # for Azure Linux 3.0, only use AzureLinux prefix SIG_IMAGE_NAME="AzureLinux${SIG_IMAGE_NAME}" - elif [[ "${IMG_SKU,,}" == "20_04-lts-cvm" || "${IMG_SKU,,}" == "cvm" ]]; then + elif grep -q "cvm" <<< "$FEATURE_FLAGS"; then SIG_IMAGE_NAME+="Specialized" fi echo "No input for SIG_IMAGE_NAME was provided, defaulting to: ${SIG_IMAGE_NAME}" @@ -261,13 +261,13 @@ if [[ "$MODE" == "linuxVhdMode" || "$MODE" == "windowsVhdMode" ]]; then if [ -z "$id" ]; then echo "Creating image definition ${SIG_IMAGE_NAME} in gallery ${SIG_GALLERY_NAME} resource group ${AZURE_RESOURCE_GROUP_NAME}" # The following conditionals do not require NVMe tagging on disk controller type - if [[ ${ARCHITECTURE,,} == "arm64" ]] || [[ ${IMG_SKU} == "20_04-lts-cvm" ]] || [[ ${IMG_SKU} == "cvm" ]] || [[ ${HYPERV_GENERATION} == "V1" ]]; then - TARGET_COMMAND_STRING="" - if [[ ${ARCHITECTURE,,} == "arm64" ]]; then - TARGET_COMMAND_STRING+="--architecture Arm64" - elif [[ ${IMG_SKU} == "20_04-lts-cvm" ]] || [[ ${IMG_SKU} == "cvm" ]]; then - TARGET_COMMAND_STRING+="--os-state Specialized --features SecurityType=ConfidentialVM" - fi + if [[ ${ARCHITECTURE,,} == "arm64" ]] || grep -q "cvm" <<< "$FEATURE_FLAGS" || [[ ${HYPERV_GENERATION} == "V1" ]]; then + TARGET_COMMAND_STRING="" + if [[ ${ARCHITECTURE,,} == "arm64" ]]; then + TARGET_COMMAND_STRING+="--architecture Arm64" + elif grep -q "cvm" <<< "$FEATURE_FLAGS"; then + TARGET_COMMAND_STRING+="--os-state Specialized --features SecurityType=ConfidentialVM" + fi az sig image-definition create \ --resource-group ${AZURE_RESOURCE_GROUP_NAME} \ diff --git a/vhdbuilder/packer/install-dependencies.sh b/vhdbuilder/packer/install-dependencies.sh index 7a3cfcbd6aa..787faad1a18 100644 --- a/vhdbuilder/packer/install-dependencies.sh +++ b/vhdbuilder/packer/install-dependencies.sh @@ -36,7 +36,7 @@ capture_benchmark "${SCRIPT_NAME}_declare_variables_and_source_packer_files" echo "Logging the kernel after purge and reinstall + reboot: $(uname -r)" # fix grub issue with cvm by reinstalling before other deps # other VHDs use grub-pc, not grub-efi -if [[ "${UBUNTU_RELEASE}" == "20.04" && "$IMG_SKU" == "20_04-lts-cvm" ]] || [[ "${UBUNTU_RELEASE}" == "24.04" && "$IMG_SKU" == "cvm" ]]; then +if grep -q "cvm" <<< "$FEATURE_FLAGS"; then apt_get_update || exit $ERR_APT_UPDATE_TIMEOUT wait_for_apt_locks apt_get_install 30 1 600 grub-efi || exit 1 diff --git a/vhdbuilder/packer/test/run-test.sh b/vhdbuilder/packer/test/run-test.sh index 00aec692fcd..bce7b60bacf 100755 --- a/vhdbuilder/packer/test/run-test.sh +++ b/vhdbuilder/packer/test/run-test.sh @@ -74,7 +74,7 @@ if [ "${OS_TYPE}" == "Linux" ] && [ "${ENABLE_TRUSTED_LAUNCH}" == "True" ]; then TARGET_COMMAND_STRING+="--security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true" fi -if [ "${OS_TYPE}" == "Linux" ] && [[ "${IMG_SKU}" == "20_04-lts-cvm" || "${IMG_SKU}" == "cvm" ]]; then +if [ "${OS_TYPE}" == "Linux" ] && grep -q "cvm" <<< "$FEATURE_FLAGS"; then # We completely re-assign the TARGET_COMMAND_STRING string here to ensure that no artifacts from earlier conditionals are included TARGET_COMMAND_STRING="--size Standard_DC8ads_v5 --security-type ConfidentialVM --enable-secure-boot true --enable-vtpm true --os-disk-security-encryption-type VMGuestStateOnly --specialized true" fi diff --git a/vhdbuilder/packer/vhd-scanning.sh b/vhdbuilder/packer/vhd-scanning.sh index c24eba7473e..cb4c93c1e4e 100755 --- a/vhdbuilder/packer/vhd-scanning.sh +++ b/vhdbuilder/packer/vhd-scanning.sh @@ -63,7 +63,7 @@ if [[ "${OS_TYPE}" == "Linux" && "${ENABLE_TRUSTED_LAUNCH}" == "True" ]]; then VM_OPTIONS+=" --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true" fi -if [ "${OS_TYPE}" == "Linux" ] && [[ "${IMG_SKU}" == "20_04-lts-cvm" || "${IMG_SKU}" == "cvm" ]]; then +if [ "${OS_TYPE}" == "Linux" ] && grep -q "cvm" <<< "$FEATURE_FLAGS"; then # We completely re-assign the VM_OPTIONS string here to ensure that no artifacts from earlier conditionals are included VM_OPTIONS="--size Standard_DC8ads_v5 --security-type ConfidentialVM --enable-secure-boot true --enable-vtpm true --os-disk-security-encryption-type VMGuestStateOnly --specialized true" fi