feat(fleet): add Azure.Fleet.SecureBoot rule (AZR-000545)#3863
feat(fleet): add Azure.Fleet.SecureBoot rule (AZR-000545)#3863l46983284-cpu wants to merge 4 commits into
Conversation
polatengin
left a comment
polatengin
left a comment
There was a problem hiding this comment.
The rule matches issue #3729 and follows the existing VM and VMSS Secure Boot rules. The rule ID, 2026_09 rule set, metadata, messages, documentation, examples, and changelog all look correct.
I have one request about test coverage and one question about the generated mapping file.
| It 'Azure.Fleet.SecureBoot' { | ||
| $filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.Fleet.SecureBoot' }; | ||
|
|
||
| # Fail | ||
| $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' }); | ||
| $ruleResult | Should -Not -BeNullOrEmpty; | ||
| $ruleResult.Length | Should -Be 3; | ||
| $ruleResult.TargetName | Should -BeIn 'fleet-001', 'fleet-002', 'fleet-003'; | ||
|
|
||
| # Pass | ||
| $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' }); | ||
| $ruleResult | Should -Not -BeNullOrEmpty; | ||
| $ruleResult.Length | Should -Be 2; | ||
| $ruleResult.TargetName | Should -BeIn 'fleet-004', 'fleet-005'; | ||
| } |
There was a problem hiding this comment.
Could you add separate test cases for the two checks? The three failing fleets are missing the whole security profile, so they fail both checks at the same time. The test still passes if the secureBootEnabled assertion is removed.
Please add these cases:
TrustedLaunchwithsecureBootEnabled: falseshould fail.- An invalid or missing
securityTypewithsecureBootEnabled: trueshould fail. ConfidentialVMwithsecureBootEnabled: trueshould pass.
This will confirm that both properties are checked and that ConfidentialVM is supported.
There was a problem hiding this comment.
Is the full update to this generated mapping file needed in this PR? It changes 920 lines, but when the entries are compared without considering their order, the only new entry is Azure.Fleet.SecureBoot. What I understand from recent rule PRs have left this file to the separate mapping maintenance process.
@BernieWhite should we remove this file from the PR, or explain why it needs to be included?
What you think?
eb9eeaa to
b3603c9
Compare
|
Thanks for the review — agreed on both points. Updates on the latest head:
Happy to adjust further if you’d like different fixture names/layout. |
Can you also rebase your PR branch with the main, please? |
Signed-off-by: Alex Chen <l46983284@gmail.com>
Signed-off-by: Alex Chen <l46983284@gmail.com>
Signed-off-by: Alex Chen <l46983284@gmail.com>
Signed-off-by: Alex Chen <l46983284@gmail.com>
496e1a5 to
28db766
Compare
|
Rebased onto latest Head is now |
2 participants
PR Summary
Fixes: #3729
Adds
Azure.Fleet.SecureBootso Azure Fleet base VM profiles require Trusted Launch or Confidential VM with Secure Boot enabled.Path checked:
properties.computeProfile.baseVirtualMachineProfile.securityProfile.securityType∈TrustedLaunch|ConfidentialVMproperties.computeProfile.baseVirtualMachineProfile.securityProfile.uefiSettings.secureBootEnabled=trueMirrors existing
Azure.VM.SecureBoot/Azure.VMSS.SecureBootguidance for fleet profiles.PR Checklist