Skip to content

feat: enable customer-managed key for nodePool OS disk encryption#5682

Open
cadenmarchese wants to merge 4 commits into
Azure:mainfrom
cadenmarchese:cadenmarchese/pass-des-to-cluster-service
Open

feat: enable customer-managed key for nodePool OS disk encryption#5682
cadenmarchese wants to merge 4 commits into
Azure:mainfrom
cadenmarchese:cadenmarchese/pass-des-to-cluster-service

Conversation

@cadenmarchese

Copy link
Copy Markdown
Member

https://redhat.atlassian.net/browse/ARO-27738

What

allows BYOK for nodePool OS disk encryption. Currently, since we don't pass the diskEncryptionSet ID to cluster service, all nodePool OS disks fall back to platform-managed keys.

This also unblocks mHSM support.

This requires service managed identity (or the mock) to have Reader role over the disk encryption set.

Why

This is required to get BYOK working, both for regular keyvaults, and mHSM keyvaults.

Testing

Special notes for your reviewer

PR Checklist

  • PR is scoped to a single task (no mixed concerns)
  • Title follows Conventional Commits format
  • Summary explains the "Why" behind the change
  • Linked to relevant ticket/issue
  • Screenshots included (if graph/UI/metrics changes)
  • Self-reviewed the diff
  • CI/CD checks are passing (ignore Tide)
  • Draft PR used for WIP (if applicable)
  • Commit history is clean (rebased/squashed)
  • Tricky code blocks are commented
  • Specific reviewers tagged
  • All comment threads resolved before merge

allows BYOK for nodePool OS disk encryption, unblocks mHSM support
requires service managed identity to have Reader role over the
disk encryption set
Copilot AI review requested due to automatic review settings June 16, 2026 21:45
@openshift-ci openshift-ci Bot requested review from mbarnes and miguelsorianod June 16, 2026 21:45

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR adds support for propagating an OS disk Disk Encryption Set (DES) resource ID from the RP node pool model into the Cluster Service (CS) node pool representation.

Changes:

  • Added a dedicated helper to build the CS OS disk builder, including optional SSE encryption-set wiring.
  • Updated BuildCSNodePool to use the new OS disk builder helper.
  • Added test coverage to verify DES ID propagation and the nil case.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
internal/ocm/convert.go Introduces buildCSOsDisk and uses it in BuildCSNodePool to set SseEncryptionSetResourceId when present.
internal/ocm/convert_test.go Adds test cases validating the DES resource ID mapping and ensuring the field is omitted when EncryptionSetID is nil.

Comment thread internal/ocm/convert.go
Comment on lines +191 to +200
func buildCSOsDisk(osDisk api.OSDiskProfile, storageAccountType, persistence string) *arohcpv1alpha1.AzureNodePoolOsDiskBuilder {
builder := arohcpv1alpha1.NewAzureNodePoolOsDisk().
SizeGibibytes(int(*osDisk.SizeGiB)).
StorageAccountType(storageAccountType).
Persistence(persistence)
if osDisk.EncryptionSetID != nil {
builder.SseEncryptionSetResourceId(osDisk.EncryptionSetID.String())
}
return builder
}

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is carry-over from current behavior. I am not familiar enough with the HCP API to know if this truly needs a nil check or not, but I guess it can't hurt. Deferring to others for input.

@bennerv

bennerv commented Jun 16, 2026

Copy link
Copy Markdown
Member

Can you add an e2e test that creates a nodepool with os disk encryption set, and uses an azure client to confirm they're actually set when the node pools are created?

@openshift-ci

openshift-ci Bot commented Jun 17, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cadenmarchese
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI review requested due to automatic review settings June 17, 2026 15:02

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Comment on lines +73 to +80
By("creating a KeyVault and DES for OS disk encryption")
subscriptionID, err := tc.SubscriptionID(ctx)
Expect(err).NotTo(HaveOccurred(), "failed to get subscription ID")

desResourceID := fmt.Sprintf(
"/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Compute/diskEncryptionSets/%s-des",
subscriptionID, *resourceGroup.Name, customerClusterName,
)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm going to let e2e run first to identify any other potential issues before proceeding with fixing this.

Comment on lines 280 to 284
// AutoScaling enables nodepool autoscaling. When set, Replicas is ignored.
AutoScaling *NodePoolAutoScalingParams
AvailabilityZone string
EncryptionSetID string
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants