[Trusted launch VMSS] Roll-back support from TrustedLaunch to Standard

[AjKundnani]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

az vmss update

Resource Provider

Microsoft.Compute/virtualMachineScaleSets

Description of Feature or Work Requested

Roll-back support with 'Standard' security type

Request to support roll-back of VMSS model from Trusted launch to non-Trusted launch using parameter --security-type with new value Standard.

VMSS already supports forward upgrade from Standard (Gen1/Gen2) to TrustedLaunch.

--security-type

Current supported values	New supported values
TrustedLaunch	TrustedLaunch Standard

When --security-type is set as Standard, request to send following API body to VMSS Compute API for initiating roll-back from Trusted launch to Non-Trusted launch (Gen2/Gen1 OS image):

"securityProfile": { 
    "securityType": "Standard",
    "uefiSettings": "[null()]"
} 

Example

az vmss update -g cli-vmss-rg -n clivmss01 --security-type Standard

Minimum API Version Required

2020-06-01

Swagger PR link / SDK link

NA

Request Example

Available on Microsoft internal, please reach out to PM contact on teams for link to same.

Target Date

2024-06-30

PM Contact

ajkundna

Engineer Contact

shankarma

Additional context

VMSS already supports upgrading from Non-Trusted launch (Gen1/Gen2 OS image) to Trusted launch. This request is to enable roll-back support for seamless end user experience in event of any error or failure.

[yonzhan]

Thank you for opening this issue, we will look into it.

[yanzhudd]

Hi @AjKundnani
could you please help to use this private package to verify if the changes meet your expectation?

[AjKundnani]

Hi @AjKundnani could you please help to use this private package to verify if the changes meet your expectation?

@yanzhudd , request to add following warning message when user is rolling back from TrustedLaunch to Standard security type.
Turning off Trusted launch disables foundational security for your VMs. For more information, visit https://aka.ms/TrustedLaunch

Also, following command did not work while going from Gen1 OS image to Gen2 OS image with Trusted launch.

az vmss update -g cli-vmss-rg -n clivmss01 --security-type TrustedLaunch --set virtualMachineProfile.storageProfile.imageReference.sku=2022-datacenter-azure-edition
Trusted Launch security type is supported on Hyper-V Generation 2 OS Images. To know more please visit https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch
(InvalidParameter) Disk Controller Type is only supported for VMs that are created from a Generation 2 Image or OS disk and VM Size that supports the same, refer to https://docs.microsoft.com/en-us/azure/virtual-machines/generation-2#creating-a-generation-2-vm for more details about creating Generation 2 VM.
Code: InvalidParameter
Message: Disk Controller Type is only supported for VMs that are created from a Generation 2 Image or OS disk and VM Size that supports the same, refer to https://docs.microsoft.com/en-us/azure/virtual-machines/generation-2#creating-a-generation-2-vm for more details about creating Generation 2 VM.
Target: storageProfile.diskControllerType

Validated following commands succesfully:

• az vmss update -g cli-vmss-rg -n clivmss01 --security-type Standard --set virtualMachineProfile.storageProfile.imageReference.sku=2019-datacenter
• az vmss update -g cli-vmss-rg -n clivmss01 --security-type Standard
• az vmss update -g cli-vmss-rg -n clivmss01 --security-type TrustedLaunch

[yanzhudd]

Hi @AjKundnani
Thanks for your confirmation! Sure, I'll add the warning message when rolling back to the Standard.

However, I cannot reproduce the second issue you mentioned:

Also, following command did not work while going from Gen1 OS image to Gen2 OS image with Trusted launch.

Could you please help to provide the az vmss create command you used to create the resource clivmss01?
BTW, I think this issue may not be related to this feature. I'll merge the PR firstly and then open another PR to fix this issue.

[AjKundnani]

Hi @AjKundnani Thanks for your confirmation! Sure, I'll add the warning message when rolling back to the Standard.

However, I cannot reproduce the second issue you mentioned:

Also, following command did not work while going from Gen1 OS image to Gen2 OS image with Trusted launch.

Could you please help to provide the az vmss create command you used to create the resource clivmss01? BTW, I think this issue may not be related to this feature. I'll merge the PR firstly and then open another PR to fix this issue.

Created VMSS through portal. But did multiple roll backs and roll forwards which could've caused this issue.
Attempted with new Gen1 VMSS and upgraded to Trusted launch successfully using same command.

az vmss update -g cli-vmss-rg -n clivmss02 --security-type TrustedLaunch --set virtualMachineProfile.storageProfile.imageReference.sku=2022-datacenter-azure-edition