vsphere-clone: Add support for Virtualization-based Security (VBS)

[Geo-Ron]

Code of Conduct

• I have read and agree to the project's Code of Conduct.
• Vote on this discussion by adding a 👍 reaction to the original description to help the maintainers prioritize.
• Do not leave "+1" or other comments that do not add relevant information or questions.

Description

The vsphere-iso builder has support for Virtualization-based Security (VBS).

I would really like the same settings ported to the vsphere-clone builder as well.

Use Case(s)

We have created a multi-stage CI/CD pipeline for our Omnissa Horizon environment.

In the last stage, created using a vsphere-clone step, we would like to configure VBS for a specific pool of machines.

Potential Configuration

The same configs as used on the vsphere-iso builder.

Flag Configuration

Optional:

• vbs_enabled (bool) - Enable Virtualization Based Security option for virtual machine. Defaults to false. Requires vvtd_enabled and NestedHV to be set to true. Requires firmware to be set to efi-secure.
• vvtd_enabled (bool) - Enable IO/MMU option for virtual machine. Defaults to false.

References

No response

[tenthirtyam]

Hi @Geo-Ron,

Thank you for opening a discussion for this enhancement opportunity.

We'll take this into consideration for a future release and open a tracking issue once it's planned.

Ryan Johnson, Broadcom

[tenthirtyam]

Hi @Geo-Ron,

Thank you for the request. vsphere-clone already supports Virtualization-based Security using the same Flag Configuration options as vsphere-iso. I'd added support for this in PR #318 which shipped in v1.2.3 (November 2023).

You can enable it on a clone build with:

source "vsphere-clone" "example" {
  # ... other configuration ...
  firmware     = "efi-secure"
  NestedHV     = true
  vbs_enabled  = true
  vvtd_enabled = true
}

vbs_enabled requires vvtd_enabled and NestedHV to be true, and firmware to be efi-secure. Those values are validated from the builder configuration and are not inferred from the source template.

The clone builder documentation currently omits the Flag Configuration section, which is why this is easy to miss.

I’ve updated the vsphere-clone docs in #849 to include it in the next patch release.

Ryan Johnson, Broadcom