vTPM Live Migration
When Nova first added vTPM support, all non-spawn operations were
rejected [1] at the API level. Extra work was necessary to manage the
vTPM state file whe moving an instance. This work was eventually
completed for resize and cold migration, and those
operations were unblocked [2]. The live migration block has remained
in place to this day.
A TPM device is required for certain features [3] of Windows Server
2022 and 2025, most notably BitLocker Drive Encryption. The inability
to live migrate instances with vTPM is a major roadblock for anyone
operating Windows guests in an OpenStack cloud.
Libvirt support for vTPM live migration now exists, but Nova changes
are necessary before being able to remove the API block. This spec
describes those changes.
[1] https:/
[2] https:/
[3] https:/
Blueprint information
- Status:
- Not started
- Approver:
- sean mooney
- Priority:
- Undefined
- Drafter:
- Artom Lifshitz
- Direction:
- Approved
- Assignee:
- melanie witt
- Definition:
- Approved
- Series goal:
- Accepted for 2025.2
- Implementation:
-
Deferred
- Milestone target:
- None
- Started by
- Completed by
Related branches
Related bugs
Sprints
Whiteboard
Gerrit topic: https:/
Addressed by: https:/
WIP: vTPM live migration
[20250114 bauzas] Spec was approved for the Epoxy cycle
Addressed by: https:/
WIP: Allow vTPM live migrations for admins
Addressed by: https:/
WIP: Add [libvirt]
Addressed by: https:/
WIP: Add [libvirt]
Addressed by: https:/
WIP: Add hw_tpm_
Addressed by: https:/
WIP: Add hw:tpm_
Addressed by: https:/
WIP: Set default TPM secret security upon svc upgrade
Addressed by: https:/
WIP: Modify vTPM LM block to block legacy instances
Addressed by: https:/
WIP: TPM: support instances with `host` secret security
Addressed by: https:/
WIP: TPM: support instances with `deployment` secret security
Addressed by: https:/
TPM: migrate legacy instances to new security policy
Addressed by: https:/
TPM: support booting instances with `user` secret security
Addressed by: https:/
Re-propose vTPM live migration
Addressed by: https:/
Add vtpm_secret_
Addressed by: https:/
TPM: test live migration between hosts with different security
Addressed by: https:/
TPM: update instance request_spec with secret security
Addressed by: https:/
TPM: confirm secret security via hard reboot
Addressed by: https:/
TPM: add late check for supported TPM secret security
Addressed by: https:/
DNM vtpm tempest
[2025MMDD bauzas] spec got approved for Flamingo
[20250829 uggla] Spec is deferred. Mainly due to concerns that require reworking the series seen just before the FF.
Addressed by: https:/
Re-propose vTPM live migration
Addressed by: https:/
TPM: bump service version and require it for live migration
Addressed by: https:/
WIP Opt-in to new TPM secret security via resize
Addressed by: https:/
FUP for vTPM live migration
Addressed by: https:/
Move cleanup of vTPM secret from driver to compute
Addressed by: https:/
TPM: add documentation and reno for live migration
Addressed by: https:/
Add handling for vTPM secret permission error
Addressed by: https:/
TPM: add RequestContext checks to functional tests
