Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
173 changes: 56 additions & 117 deletions data/data/install.openshift.io_installconfigs.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -359,39 +359,24 @@ spec:
disk encryption set resource id for the managed
disk.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
name:
description: Name is the name of the disk encryption
set.
type: string
type: object
securityProfile:
description: SecurityProfile specifies the security
profile for the managed disk.
properties:
diskEncryptionSet:
resourceGroup:
description: |-
DiskEncryptionSet specifies the customer-managed disk encryption set resource id for the
managed disk that is used for Customer Managed Key encrypted ConfidentialVM OS Disk and
VMGuest blob.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
type: string
type: object
securityEncryptionType:
ResourceGroup defines the Azure resource group used by the disk
encryption set.
type: string
subscriptionId:
description: |-
SecurityEncryptionType specifies the encryption type of the managed disk.
It is set to DiskWithVMGuestState to encrypt the managed disk along with the VMGuestState
blob, and to VMGuestStateOnly to encrypt the VMGuestState blob only.
When set to VMGuestStateOnly, VirtualizedTrustedPlatformModule should be set to Enabled.
When set to DiskWithVMGuestState, EncryptionAtHost should be disabled, SecureBoot and
VirtualizedTrustedPlatformModule should be set to Enabled.
It can be set only for Confidential VMs.
enum:
- VMGuestStateOnly
- DiskWithVMGuestState
SubscriptionID defines the Azure subscription the disk encryption
set is in.
type: string
required:
- name
- resourceGroup
- subscriptionId
type: object
storageAccountType:
type: string
Expand Down Expand Up @@ -1919,40 +1904,24 @@ spec:
disk encryption set resource id for the managed
disk.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
name:
description: Name is the name of the disk
encryption set.
type: string
type: object
securityProfile:
description: SecurityProfile specifies the security
profile for the managed disk.
properties:
diskEncryptionSet:
resourceGroup:
description: |-
DiskEncryptionSet specifies the customer-managed disk encryption set resource id for the
managed disk that is used for Customer Managed Key encrypted ConfidentialVM OS Disk and
VMGuest blob.
properties:
id:
description: ID defines resourceID for
diskEncryptionSet resource. It must
be in the same subscription
type: string
type: object
securityEncryptionType:
ResourceGroup defines the Azure resource group used by the disk
encryption set.
type: string
subscriptionId:
description: |-
SecurityEncryptionType specifies the encryption type of the managed disk.
It is set to DiskWithVMGuestState to encrypt the managed disk along with the VMGuestState
blob, and to VMGuestStateOnly to encrypt the VMGuestState blob only.
When set to VMGuestStateOnly, VirtualizedTrustedPlatformModule should be set to Enabled.
When set to DiskWithVMGuestState, EncryptionAtHost should be disabled, SecureBoot and
VirtualizedTrustedPlatformModule should be set to Enabled.
It can be set only for Confidential VMs.
enum:
- VMGuestStateOnly
- DiskWithVMGuestState
SubscriptionID defines the Azure subscription the disk encryption
set is in.
type: string
required:
- name
- resourceGroup
- subscriptionId
type: object
storageAccountType:
type: string
Expand Down Expand Up @@ -3419,39 +3388,24 @@ spec:
disk encryption set resource id for the managed
disk.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
name:
description: Name is the name of the disk encryption
set.
type: string
type: object
securityProfile:
description: SecurityProfile specifies the security
profile for the managed disk.
properties:
diskEncryptionSet:
resourceGroup:
description: |-
DiskEncryptionSet specifies the customer-managed disk encryption set resource id for the
managed disk that is used for Customer Managed Key encrypted ConfidentialVM OS Disk and
VMGuest blob.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
type: string
type: object
securityEncryptionType:
ResourceGroup defines the Azure resource group used by the disk
encryption set.
type: string
subscriptionId:
description: |-
SecurityEncryptionType specifies the encryption type of the managed disk.
It is set to DiskWithVMGuestState to encrypt the managed disk along with the VMGuestState
blob, and to VMGuestStateOnly to encrypt the VMGuestState blob only.
When set to VMGuestStateOnly, VirtualizedTrustedPlatformModule should be set to Enabled.
When set to DiskWithVMGuestState, EncryptionAtHost should be disabled, SecureBoot and
VirtualizedTrustedPlatformModule should be set to Enabled.
It can be set only for Confidential VMs.
enum:
- VMGuestStateOnly
- DiskWithVMGuestState
SubscriptionID defines the Azure subscription the disk encryption
set is in.
type: string
required:
- name
- resourceGroup
- subscriptionId
type: object
storageAccountType:
type: string
Expand Down Expand Up @@ -5361,39 +5315,24 @@ spec:
disk encryption set resource id for the managed
disk.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
name:
description: Name is the name of the disk encryption
set.
type: string
type: object
securityProfile:
description: SecurityProfile specifies the security
profile for the managed disk.
properties:
diskEncryptionSet:
resourceGroup:
description: |-
DiskEncryptionSet specifies the customer-managed disk encryption set resource id for the
managed disk that is used for Customer Managed Key encrypted ConfidentialVM OS Disk and
VMGuest blob.
properties:
id:
description: ID defines resourceID for diskEncryptionSet
resource. It must be in the same subscription
type: string
type: object
securityEncryptionType:
ResourceGroup defines the Azure resource group used by the disk
encryption set.
type: string
subscriptionId:
description: |-
SecurityEncryptionType specifies the encryption type of the managed disk.
It is set to DiskWithVMGuestState to encrypt the managed disk along with the VMGuestState
blob, and to VMGuestStateOnly to encrypt the VMGuestState blob only.
When set to VMGuestStateOnly, VirtualizedTrustedPlatformModule should be set to Enabled.
When set to DiskWithVMGuestState, EncryptionAtHost should be disabled, SecureBoot and
VirtualizedTrustedPlatformModule should be set to Enabled.
It can be set only for Confidential VMs.
enum:
- VMGuestStateOnly
- DiskWithVMGuestState
SubscriptionID defines the Azure subscription the disk encryption
set is in.
type: string
required:
- name
- resourceGroup
- subscriptionId
type: object
storageAccountType:
type: string
Expand Down
4 changes: 1 addition & 3 deletions pkg/asset/installconfig/azure/metadata.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ import (
"sort"
"sync"

"sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"

"github.com/openshift/installer/pkg/types"
typesazure "github.com/openshift/installer/pkg/types/azure"
azuredefaults "github.com/openshift/installer/pkg/types/azure/defaults"
Expand Down Expand Up @@ -179,7 +177,7 @@ func (m *Metadata) GenerateZonesSubnetMap(subnetSpec []typesazure.SubnetSpec, de
return subnetSpec[i].Name < subnetSpec[j].Name
})
for _, subnet := range subnetSpec {
if subnet.Role == v1beta1.SubnetNode {
if subnet.Role == typesazure.SubnetNode {
computeSubnets = append(computeSubnets, subnet.Name)
}
}
Expand Down
9 changes: 4 additions & 5 deletions pkg/asset/installconfig/azure/validation.go
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ import (
"github.com/sirupsen/logrus"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/validation/field"
capz "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"

"github.com/openshift/installer/pkg/types"
aztypes "github.com/openshift/installer/pkg/types/azure"
Expand Down Expand Up @@ -563,9 +562,9 @@ func validateNetworks(client API, p *aztypes.Platform, fieldPath *field.Path) fi
var computeSubnetName string
var controlPlaneSubnetName string
for _, subnet := range p.Subnets {
if subnet.Role == capz.SubnetControlPlane && controlPlaneSubnetName == "" {
if subnet.Role == aztypes.SubnetControlPlane && controlPlaneSubnetName == "" {
controlPlaneSubnetName = subnet.Name
} else if subnet.Role == capz.SubnetNode && computeSubnetName == "" {
} else if subnet.Role == aztypes.SubnetNode && computeSubnetName == "" {
computeSubnetName = subnet.Name
}
}
Expand Down Expand Up @@ -954,7 +953,7 @@ func validateBootDiagnostics(client API, ic *types.InstallConfig) (allErrs field
func checkBootDiagnosticsURI(client API, diag *aztypes.BootDiagnostics, region string) error {
missingErrorMessage := "missing %s for user managed boot diagnostics"
errorField := ""
if diag != nil && diag.Type == capz.UserManagedDiagnosticsStorage {
if diag != nil && diag.Type == aztypes.UserManagedDiagnosticsStorage {
if diag.StorageAccountName != "" && diag.ResourceGroup != "" {
return client.CheckIfExistsStorageAccount(context.TODO(), diag.ResourceGroup, diag.StorageAccountName, region)
}
Expand All @@ -970,7 +969,7 @@ func checkBootDiagnosticsURI(client API, diag *aztypes.BootDiagnostics, region s
}

// validateSubnetNatGateway checks whether a NAT Gateway is already attached to a compute subnet.
func validateSubnetNatGateway(client API, fieldPath *field.Path, subnet *aznetwork.Subnet, outboundType aztypes.OutboundType, role capz.SubnetRole, resourceGroup, virtualNetwork string) field.ErrorList {
func validateSubnetNatGateway(client API, fieldPath *field.Path, subnet *aznetwork.Subnet, outboundType aztypes.OutboundType, role aztypes.SubnetRole, resourceGroup, virtualNetwork string) field.ErrorList {
var allErrs field.ErrorList
if outboundType != aztypes.NATGatewayMultiZoneOutboundType && outboundType != aztypes.NATGatewaySingleZoneOutboundType {
return allErrs
Expand Down
7 changes: 3 additions & 4 deletions pkg/asset/installconfig/azure/validation_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ import (
"go.uber.org/mock/gomock"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/validation/field"
capz "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"

"github.com/openshift/installer/pkg/asset/installconfig/azure/mock"
"github.com/openshift/installer/pkg/ipnet"
Expand Down Expand Up @@ -390,7 +389,7 @@ var (
validBootDiagnosticsResourceGroup = "valid-resource-group"
validStorageAccountValues = func(ic *types.InstallConfig) {
ic.ControlPlane.Platform.Azure.BootDiagnostics = &azure.BootDiagnostics{
Type: capz.UserManagedDiagnosticsStorage,
Type: azure.UserManagedDiagnosticsStorage,
ResourceGroup: validBootDiagnosticsResourceGroup,
StorageAccountName: validBootDiagnosticsStorageAccount,
}
Expand All @@ -412,10 +411,10 @@ func validInstallConfig() *types.InstallConfig {
DefaultMachinePlatform: &azure.MachinePool{},
Subnets: []azure.SubnetSpec{{
Name: validControlPlaneSubnet,
Role: capz.SubnetControlPlane,
Role: azure.SubnetControlPlane,
}, {
Name: validComputeSubnet,
Role: capz.SubnetNode,
Role: azure.SubnetNode,
}},
},
},
Expand Down
Loading