Skip to content

✨ Add supports to Crypto Spec in VMOp VirtualMachine and PVC #3680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+631 −22
Open

✨ Add supports to Crypto Spec in VMOp VirtualMachine and PVC #3680

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6fd2c41
Add supports to Crypto Spec in VMOp VirtualMachine and PVC
laozc Nov 7, 2025
ce9801b
Add Encryption Class to the vcsim test
laozc Nov 17, 2025
4df5cf4
Address comments
laozc Nov 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions apis/vmware/v1beta1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,3 +76,65 @@ const (
// state within the configured timeout (default 5m).
VirtualMachinePowerOpModeTrySoft VirtualMachinePowerOpMode = "trySoft"
)

// VirtualMachineCryptoSpec defines the desired state of a VirtualMachine's
// encryption state.
type VirtualMachineCryptoSpec struct {
// encryptionClassName describes the name of the EncryptionClass resource
// used to encrypt this VM.
//
// Please note, this field is not required to encrypt the VM. If the
// underlying platform has a default key provider, the VM may still be fully
// or partially encrypted depending on the specified storage and VM classes.
//
// If there is a default key provider and an encryption storage class is
// selected, the files in the VM's home directory and non-PVC virtual disks
// will be encrypted
//
// If there is a default key provider and a VM Class with a virtual, trusted
// platform module (vTPM) is selected, the files in the VM's home directory,
// minus any virtual disks, will be encrypted.
//
// If the underlying vSphere platform does not have a default key provider,
// then this field is required when specifying an encryption storage class
// and/or a VM Class with a vTPM.
//
// If this field is set, spec.storageClass must use an encryption-enabled
// storage class.
// +optional
// +kubebuilder:validation:MaxLength=253
EncryptionClassName *string `json:"encryptionClassName,omitempty"`

// useDefaultKeyProvider describes the desired behavior for when an explicit
// EncryptionClass is not provided.
//
// When an explicit encryptionClass is not provided and this value is true:
//
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
// will be encrypted using the default key provider.
//
// - If a VirtualMachine is not encrypted, uses an encryption storage
// policy or has a virtual, trusted platform module (vTPM), there is a
// default key provider, the VM will be encrypted using the default key
// provider.
//
// - If a VirtualMachine is encrypted with a provider other than the default
// key provider, the VM will be rekeyed using the default key provider.
//
// When an explicit EncryptionClass is not provided and this value is false:
//
// - Deploying a VirtualMachine with an encryption storage policy or vTPM
// will fail.
//
// - If a VirtualMachine is encrypted with a provider other than the default
// key provider, the VM will be not be rekeyed.
//
// Please note, this could result in a VirtualMachine that cannot be
// powered on since it is encrypted using a provider or key that may have
// been removed. Without the key, the VM cannot be decrypted and thus
// cannot be powered on.
//
// Defaults to true if omitted.
// +optional
UseDefaultKeyProvider *bool `json:"useDefaultKeyProvider,omitempty"`
}
13 changes: 13 additions & 0 deletions apis/vmware/v1beta1/vspheremachine_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,15 @@ type VSphereMachineVolume struct {
// StorageClass defaults to VSphereMachineSpec.StorageClass
// +optional
StorageClass string `json:"storageClass,omitempty"`
// encryptionClassName describes the name of the EncryptionClass resource
// used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
//
// Please note, this field is not required to encrypt the volume. If the
// underlying platform has a default key provider, the volume may still be fully
// or partially encrypted depending on the specified storage.
// +optional
// +kubebuilder:validation:MaxLength=253
EncryptionClassName *string `json:"encryptionClassName,omitempty"`
}

// VSphereMachineSpec defines the desired state of VSphereMachine.
Expand Down Expand Up @@ -63,6 +72,10 @@ type VSphereMachineSpec struct {
// +optional
StorageClass string `json:"storageClass,omitempty"`

// crypto describes the desired encryption state of the VirtualMachine.
// +optional
Crypto *VirtualMachineCryptoSpec `json:"crypto,omitempty"`

// Volumes is the set of PVCs to be created and attached to the VSphereMachine
// +optional
Volumes []VSphereMachineVolume `json:"volumes,omitempty"`
Expand Down
35 changes: 35 additions & 0 deletions apis/vmware/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

73 changes: 73 additions & 0 deletions config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachines.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,69 @@ spec:
ClassName is the name of the class used when specifying the underlying
virtual machine
type: string
crypto:
description: crypto describes the desired encryption state of the
VirtualMachine.
properties:
encryptionClassName:
description: |-
encryptionClassName describes the name of the EncryptionClass resource
used to encrypt this VM.
Please note, this field is not required to encrypt the VM. If the
underlying platform has a default key provider, the VM may still be fully
or partially encrypted depending on the specified storage and VM classes.
If there is a default key provider and an encryption storage class is
selected, the files in the VM's home directory and non-PVC virtual disks
will be encrypted
If there is a default key provider and a VM Class with a virtual, trusted
platform module (vTPM) is selected, the files in the VM's home directory,
minus any virtual disks, will be encrypted.
If the underlying vSphere platform does not have a default key provider,
then this field is required when specifying an encryption storage class
and/or a VM Class with a vTPM.
If this field is set, spec.storageClass must use an encryption-enabled
storage class.
maxLength: 253
type: string
useDefaultKeyProvider:
description: |-
useDefaultKeyProvider describes the desired behavior for when an explicit
EncryptionClass is not provided.
When an explicit encryptionClass is not provided and this value is true:
- Deploying a VirtualMachine with an encryption storage policy or vTPM
will be encrypted using the default key provider.
- If a VirtualMachine is not encrypted, uses an encryption storage
policy or has a virtual, trusted platform module (vTPM), there is a
default key provider, the VM will be encrypted using the default key
provider.
- If a VirtualMachine is encrypted with a provider other than the default
key provider, the VM will be rekeyed using the default key provider.
When an explicit EncryptionClass is not provided and this value is false:
- Deploying a VirtualMachine with an encryption storage policy or vTPM
will fail.
- If a VirtualMachine is encrypted with a provider other than the default
key provider, the VM will be not be rekeyed.
Please note, this could result in a VirtualMachine that cannot be
powered on since it is encrypted using a provider or key that may have
been removed. Without the key, the VM cannot be decrypted and thus
cannot be powered on.
Defaults to true if omitted.
type: boolean
type: object
failureDomain:
description: |-
FailureDomain is the failure domain the machine will be created in.
Expand Down Expand Up @@ -344,6 +407,16 @@ spec:
x-kubernetes-int-or-string: true
description: Capacity is the PVC capacity
type: object
encryptionClassName:
description: |-
encryptionClassName describes the name of the EncryptionClass resource
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
Please note, this field is not required to encrypt the volume. If the
underlying platform has a default key provider, the volume may still be fully
or partially encrypted depending on the specified storage.
maxLength: 253
type: string
name:
description: 'Name is suffix used to name this PVC as: VSphereMachine.Name
+ "-" + Name'
Expand Down
73 changes: 73 additions & 0 deletions .../supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachinetemplates.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,69 @@ spec:
ClassName is the name of the class used when specifying the underlying
virtual machine
type: string
crypto:
description: crypto describes the desired encryption state
of the VirtualMachine.
properties:
encryptionClassName:
description: |-
encryptionClassName describes the name of the EncryptionClass resource
used to encrypt this VM.
Please note, this field is not required to encrypt the VM. If the
underlying platform has a default key provider, the VM may still be fully
or partially encrypted depending on the specified storage and VM classes.
If there is a default key provider and an encryption storage class is
selected, the files in the VM's home directory and non-PVC virtual disks
will be encrypted
If there is a default key provider and a VM Class with a virtual, trusted
platform module (vTPM) is selected, the files in the VM's home directory,
minus any virtual disks, will be encrypted.
If the underlying vSphere platform does not have a default key provider,
then this field is required when specifying an encryption storage class
and/or a VM Class with a vTPM.
If this field is set, spec.storageClass must use an encryption-enabled
storage class.
maxLength: 253
type: string
useDefaultKeyProvider:
description: |-
useDefaultKeyProvider describes the desired behavior for when an explicit
EncryptionClass is not provided.
When an explicit encryptionClass is not provided and this value is true:
- Deploying a VirtualMachine with an encryption storage policy or vTPM
will be encrypted using the default key provider.
- If a VirtualMachine is not encrypted, uses an encryption storage
policy or has a virtual, trusted platform module (vTPM), there is a
default key provider, the VM will be encrypted using the default key
provider.
- If a VirtualMachine is encrypted with a provider other than the default
key provider, the VM will be rekeyed using the default key provider.
When an explicit EncryptionClass is not provided and this value is false:
- Deploying a VirtualMachine with an encryption storage policy or vTPM
will fail.
- If a VirtualMachine is encrypted with a provider other than the default
key provider, the VM will be not be rekeyed.
Please note, this could result in a VirtualMachine that cannot be
powered on since it is encrypted using a provider or key that may have
been removed. Without the key, the VM cannot be decrypted and thus
cannot be powered on.
Defaults to true if omitted.
type: boolean
type: object
failureDomain:
description: |-
FailureDomain is the failure domain the machine will be created in.
Expand Down Expand Up @@ -341,6 +404,16 @@ spec:
x-kubernetes-int-or-string: true
description: Capacity is the PVC capacity
type: object
encryptionClassName:
description: |-
encryptionClassName describes the name of the EncryptionClass resource
used to encrypt this volume. Defaults to VSphereMachineSpec.Crypto.EncryptionClassName.
Please note, this field is not required to encrypt the volume. If the
underlying platform has a default key provider, the volume may still be fully
or partially encrypted depending on the specified storage.
maxLength: 253
type: string
name:
description: 'Name is suffix used to name this PVC as:
VSphereMachine.Name + "-" + Name'
Expand Down
3 changes: 2 additions & 1 deletion controllers/vmware/vspherecluster_reconciler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ var _ = Describe("Cluster Controller Tests", func() {
className = "test-className"
imageName = "test-imageName"
storageClass = "test-storageClass"
encryptionClass = "test-encryptionClass"
testIP = "127.0.0.1"
)
var (
Expand All @@ -69,7 +70,7 @@ var _ = Describe("Cluster Controller Tests", func() {
cluster = util.CreateCluster(clusterName)
vsphereCluster = util.CreateVSphereCluster(clusterName)
clusterCtx, controllerManagerContext = util.CreateClusterContext(cluster, vsphereCluster)
vsphereMachine = util.CreateVSphereMachine(machineName, clusterName, className, imageName, storageClass, controlPlaneLabelTrue)
vsphereMachine = util.CreateVSphereMachine(machineName, clusterName, className, imageName, storageClass, encryptionClass, controlPlaneLabelTrue)

reconciler = &ClusterReconciler{
Client: controllerManagerContext.Client,
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ replace sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.12.0-beta.1
replace github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels => github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels v0.0.0-20240404200847-de75746a9505

// The version of vm-operator should be kept in sync with the manifests at: config/deployments/integration-tests
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.8.6
replace github.com/vmware-tanzu/vm-operator/api => github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719
Copy link
Contributor

@zhanggbj zhanggbj Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since Encryption Class is backported to VMOP API later than VM AF/AAF, will update PR #3655 to use this commit.

Also CC @fabriziopandini @sbueringer for awareness.


require (
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,8 +241,8 @@ github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d h1:c
github.com/vmware-tanzu/net-operator-api v0.0.0-20240326163340-1f32d6bf7f9d/go.mod h1:JbFOh22iDsT5BowJe0GgpMI5e2/S7cWaJlv9LdURVQM=
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d h1:z9lrzKVtNlujduv9BilzPxuge/LE2F0N1ms3TP4JZvw=
github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20241112044858-9da8637c1b0d/go.mod h1:Q4JzNkNMvjo7pXtlB5/R3oME4Nhah7fAObWgghVmtxk=
github.com/vmware-tanzu/vm-operator/api v1.8.6 h1:NIndORjcnSmIlQsCMIewpIwg/ocRVDh2lYjOroTVLrU=
github.com/vmware-tanzu/vm-operator/api v1.8.6/go.mod h1:HHA2SNI9B5Yqtyp5t+Gt9WTWBi/fIkM6+MukDDSf11A=
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719 h1:nb/5ytRj7E/5eo9UzLfaR29JytMtbGpqMVs3hjaRwZ0=
github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20251029150609-93918c59a719/go.mod h1:nWTPpxfe4gHuuYuFcrs86+NMxfkqPk3a3IlvI8TCWak=
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505 h1:y4wXx1FUFqqSgJ/xUOEM1DLS2Uu0KaeLADWpzpioGTU=
github.com/vmware-tanzu/vm-operator/external/ncp v0.0.0-20240404200847-de75746a9505/go.mod h1:5rqRJ9zGR+KnKbkGx373WgN8xJpvAj99kHnfoDYRO5I=
github.com/vmware/govmomi v0.52.0 h1:JyxQ1IQdllrY7PJbv2am9mRsv3p9xWlIQ66bv+XnyLw=
Expand Down
2 changes: 1 addition & 1 deletion pkg/services/network/netop_provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ func (np *netopNetworkProvider) ConfigureVirtualMachine(ctx context.Context, clu
// Set the VM primary interface
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
Name: PrimaryInterfaceName,
Network: vmoprv1common.PartialObjectRef{
Network: &vmoprv1common.PartialObjectRef{
TypeMeta: metav1.TypeMeta{
Kind: NetworkGVKNetOperator.Kind,
APIVersion: NetworkGVKNetOperator.GroupVersion().String(),
Expand Down
2 changes: 1 addition & 1 deletion pkg/services/network/nsxt_provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@ func (np *nsxtNetworkProvider) ConfigureVirtualMachine(_ context.Context, cluste
}
vm.Spec.Network.Interfaces = append(vm.Spec.Network.Interfaces, vmoprv1.VirtualMachineNetworkInterfaceSpec{
Name: fmt.Sprintf("eth%d", len(vm.Spec.Network.Interfaces)),
Network: vmoprv1common.PartialObjectRef{
Network: &vmoprv1common.PartialObjectRef{
TypeMeta: metav1.TypeMeta{
Kind: NetworkGVKNSXT.Kind,
APIVersion: NetworkGVKNSXT.GroupVersion().String(),
Expand Down
Loading