blob: 58f836dbe1d6958b966e0f89be88e2826e428b3c [file] [log] [blame]
Dong Ma2a8502c2024-12-13 03:35:14 +08001#######################################
2Emulated Trusted Platform Module (vTPM)
3#######################################
4
Mohammed Naserc1ae5f02024-12-12 23:59:43 -05005Atmosphere ships with the vTPM features enabled by default, so you just need
6to verify that it's setup optionally and either configure a flavor or an image
7to use it.
Dong Ma2a8502c2024-12-13 03:35:14 +08008
Mohammed Naserc1ae5f02024-12-12 23:59:43 -05009Verify the configuration (optional)
10===================================
Dong Ma2a8502c2024-12-13 03:35:14 +080011
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050012You can verify that the vTPM support is activated by inspecting the traits on
13the compute nodes resource provider:
Dong Ma2a8502c2024-12-13 03:35:14 +080014
15.. code-block:: console
16
17 $ COMPUTE_UUID=$(openstack resource provider list --name $HOST -f value -c uuid)
18 $ openstack resource provider trait list $COMPUTE_UUID | grep SECURITY_TPM
19 | COMPUTE_SECURITY_TPM_1_2 |
20 | COMPUTE_SECURITY_TPM_2_0 |
21
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050022In the example above, ``$HOST`` is the hostname of the compute node where you
23want to verify that vTPM support is enabled.
Dong Ma2a8502c2024-12-13 03:35:14 +080024
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050025Configuring vTPM
26================
Dong Ma2a8502c2024-12-13 03:35:14 +080027
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050028The vTPM can be configured using flavor extra specs (which requires an operator)
29or through image metadata properties which can be set by the user. There are two
30versions supported:
Dong Ma2a8502c2024-12-13 03:35:14 +080031
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050032- 1.2
33- 2.0
Dong Ma2a8502c2024-12-13 03:35:14 +080034
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050035In addition, there are two models supported:
36
37- TPM Interface Specification (TIS)
38- Command-Response Buffer (CRB)
39
40.. note::
41
42 The CRB model is only supported with version 2.0 which is the recommended
43 option as well.
44
45Flavor configuration
46--------------------
47
48You can use the ``hw:tpm_version`` and ``hw:tpm_model`` properties to configure
49the vTPM on a flavor. For example, to configure a flavor to use the TPM 2.0 with
50the CRB model:
Dong Ma2a8502c2024-12-13 03:35:14 +080051
52.. code-block:: console
53
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050054 $ openstack flavor create test.vtpm \
55 --ram 512 --disk 1 --vcpus 1 \
56 --property hw:tpm_version=2.0 \
57 --property hw:tpm_model=tpm-crb
Dong Ma2a8502c2024-12-13 03:35:14 +080058
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050059Image configuration
60-------------------
61
Dong Mac9be7092025-01-17 00:08:01 +000062You can also configure the vTPM on an image using the ``hw_tpm_version`` and
63``hw_tpm_model`` image metadata properties. For example, to configure an image
64to use the TPM 2.0 with CRB model:
Dong Ma2a8502c2024-12-13 03:35:14 +080065
66.. code-block:: console
67
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050068 $ openstack image set <image-name-or-uuid> \
Dong Mac9be7092025-01-17 00:08:01 +000069 --property hw_tpm_version=2.0 \
70 --property hw_tpm_model=tpm-crb
Dong Ma2a8502c2024-12-13 03:35:14 +080071
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050072This can be useful if you need to enable the vTPM feature without having operator
73access to the cloud or for specific images such as Windows versions that require
74a TPM to be present.
Dong Ma2a8502c2024-12-13 03:35:14 +080075
76Create an instance with vTPM
77============================
Mohammed Naserc1ae5f02024-12-12 23:59:43 -050078
79Once you've configured the vTPM, you can create an instance using the flavor or
80image you configured. For example, to create an instance using the flavor we
81created previously:
82
83.. code-block:: console
84
85 $ openstack server create --flavor test.vtpm test-instance
86
87Or using an image:
88
89.. code-block:: console
90
91 $ openstack server create --image <image-name-or-uuid> test-instance
92
93The instance should now have the vTPM device available.