Add support for emulated virtual TPM
There are a class of applications which expect to use a TPM device to store
secrets. In order to run these applications in a virtual machine, it would be
useful to expose a virtual TPM device within the guest. Accordingly, the
suggestion is to add a placement resource which could be requested in the
flavor which would cause such a device to be added to the VM.
Blueprint information
- Status:
- Complete
- Approver:
- Stephen Finucane
- Priority:
- Low
- Drafter:
- Eric Fried
- Direction:
- Approved
- Assignee:
- Stephen Finucane
- Definition:
- Approved
- Series goal:
- Accepted for victoria
- Implementation:
-
Implemented
- Milestone target:
-
victoria-3
- Started by
- melanie witt
- Completed by
- Balazs Gibizer
Related branches
Related bugs
Sprints
Whiteboard
Gerrit topic: https:/
Addressed by: https:/
Add support for emulated virtual TPM
Approved for Stein. -- mriedem 20181106
Addressed by: https:/
Add emulated TPM support to Nova
Addressed by: https:/
Split up _is_storage_
Addressed by: https:/
Add support for resize and cold migration of emulated TPM files
Addressed by: https:/
Add emulated TPM support to Nova -- testcase test only
This did not complete in the Stein release so I am deferring to the Train release. Remember to re-propose the spec for Train as necessary: https:/
Addressed by: https:/
Re-propose emulated virtual TPM spec to train
efried 20190402 Fast-approved for train, spec unchanged
Gerrit topic: https:/
Addressed by: https:/
Add emulated TPM support to Nova
Addressed by: https:/
Add support for resize and cold migration of emulated TPM files
Addressed by: https:/
WIP: vTPM request_filter
Gerrit topic: https:/
[efried 20190905] This has seen no activity, and we're a week from feature freeze, so I'm deferring it to ussuri.
[efried 20191004] Reopening for Ussuri, changing ownership from cfriesen to efried.
Addressed by: https:/
WIP: Spec: Ussuri: Emulated Virtual TPM
[efried 20200114] Setting Definition:Approved as the spec has merged.
[efried 20200220] Agreed in the Nova meeting to Direction:Approve all Definition:Approved blueprints http://
[efried 20200220] Stephen has agreed to take over the implementation for Ussuri.
[gibi 20200414] we hit feature freeze in Ussuri, so it is deferred to Victoria
Addressed by: https:/
Encrypted Emulated Virtual TPM
Addressed by: https:/
virt: Add 'context', drop 'network_info' parameters for 'unrescue'
Addressed by: https:/
crypto: Add type hints
Addressed by: https:/
libvirt: Split '_create_domain' function
Addressed by: https:/
libvirt: Add vTPM config support
Addressed by: https:/
scheduler: Request vTPM trait based on flavor or image
Addressed by: https:/
crypto: Add support for creating, destroying vTPM secrets
Addressed by: https:/
manager: Prevent compute startup on invalid vTPM config
Addressed by: https:/
docs: Add docs for vTPM support
Addressed by: https:/
utils: Move 'get_bdm_
Addressed by: https:/
libvirt: Re-enable live snapshot for paused instances
Addressed by: https:/
libvirt: Remove workaround for really old QEMU
Addressed by: https:/
WIP: Attempt to restore some sanity to snapshot
Addressed by: https:/
tests: Rename tests for '_create_
Addressed by: https:/
libvirt: Use better variable names for '_create_guest'
Addressed by: https:/
tests: Move single use constants to their callers
Addressed by: https:/
tests: Define constants in '_IntegratedTes
Addressed by: https:/
tests: Remove 'test_servers.
Addressed by: https:/
tests: Add 'PlacementHelpe
Addressed by: https:/
tests: Make '_IntegratedTes
Addressed by: https:/
tests: Add helpers for suspend, resume and reboot of server
Addressed by: https:/
libvirt: Pass context, instance to '_create_domain'
Addressed by: https:/
api: Reject non-spawn operations for vTPM
Addressed by: https:/
Don't unset Instance.
Addressed by: https:/
trivial: Test object backporting against correct version
Addressed by: https:/
scheduler: Default request group to None
Addressed by: https:/
Add type hints to 'nova.compute.
Addressed by: https:/
privsep: Add support for recursive chown, move_tree operations
Addressed by: https:/
Add type hints to 'nova.virt.
Addressed by: https:/
tests: Further usage of new server helpers
Addressed by: https:/
tests: Define constants in '_IntegratedTes
Addressed by: https:/
[Trivial] Remove wrong format_message() conversion
Addressed by: https:/
tests: Add helpers for rebuild, cold migrate, and shelve/unshelve
Addressed by: https:/
releasenotes: Detail support for server ops with vTPM
Addressed by: https:/
Expand generic reproducer for bug #1879878
Addressed by: https:/
Set 'old_flavor', 'new_flavor' on source before resize
Addressed by: https:/
docs: Remove resize, cold migration from vTPM limitations
[2020-09-10 gibi]: implemented in Victoria
