You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "sl4sh73r (via GitHub)" <gi...@apache.org> on 2024/11/08 12:55:19 UTC
[D] Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security [cloudstack]
GitHub user sl4sh73r created a discussion: Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
### ISSUE TYPE
<!-- Pick one below and delete the rest -->
- [ ] Bug Report
- [x] Improvement Request
- [ ] Enhancement Request
- [x] Feature Idea
- [ ] Documentation Report
- [ ] Other
### COMPONENT NAME
<!-- Categorize the issue, e.g. API, VR, VPN, UI, etc. -->
Virtualization, Security
### CLOUDSTACK VERSION
<!-- New line separated list of affected versions, commit ID for issues on main branch. -->
**4.18.2.4**
### OS / ENVIRONMENT
<!-- Information about the environment if relevant, N/A otherwise -->
**Ubuntu 22.04**
### SUMMARY
CloudStack does not currently support **SEV-SNP** (Secure Encrypted Virtualization - Secure Nested Paging), a critical security feature for enhancing the protection of virtualized environments. SEV-SNP is designed to secure workloads by preventing hypervisor attacks and ensuring that VM memory remains encrypted even from the host.
I would like to know **when SEV-SNP will be supported in CloudStack**, and how it can be used once integrated. This feature is especially important for those utilizing AMD's SEV technology and seeking to ensure their VMs are as secure as possible.
### EXPECTED RESULTS
- CloudStack should provide support for **SEV-SNP** in an upcoming release, allowing users to take advantage of enhanced security for their virtualized workloads.
- Documentation or configuration options detailing how to enable and utilize **SEV-SNP** once available.
### ACTUAL RESULTS
Currently, there is **no support for SEV-SNP** in CloudStack, which limits the ability to fully leverage AMD's SEV capabilities for securing virtualized environments.
GitHub link: https://github.com/apache/cloudstack/discussions/9912
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security
from https://libvirt.org/kbase/launch_security_sev.html
you need to add an extra config for vm
```
<launchSecurity type='sev'>
<cbitpos>47</cbitpos>
<reducedPhysBits>1</reducedPhysBits>
<policy>0x0003</policy>
</launchSecurity>
```
you can refer to https://www.shapeblue.com/cloudstack-feature-first-look-enable-sending-of-arbitrary-configuration-data-to-vms/ on hot to add extra config to a vm.
GitHub link: https://github.com/apache/cloudstack/discussions/9912#discussioncomment-12794076
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
GitHub user boring-cyborg[bot] added a comment to the discussion: Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security
Thanks for opening your first issue here! Be sure to follow the issue template!
GitHub link: https://github.com/apache/cloudstack/discussions/9912#discussioncomment-11188879
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security [cloudstack]
Posted by "sl4sh73r (via GitHub)" <gi...@apache.org>.
GitHub user sl4sh73r closed a discussion: Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
### ISSUE TYPE
<!-- Pick one below and delete the rest -->
- [ ] Bug Report
- [x] Improvement Request
- [ ] Enhancement Request
- [x] Feature Idea
- [ ] Documentation Report
- [ ] Other
### COMPONENT NAME
<!-- Categorize the issue, e.g. API, VR, VPN, UI, etc. -->
Virtualization, Security
### CLOUDSTACK VERSION
<!-- New line separated list of affected versions, commit ID for issues on main branch. -->
**4.18.2.4**
### OS / ENVIRONMENT
<!-- Information about the environment if relevant, N/A otherwise -->
**Ubuntu 22.04**
### SUMMARY
CloudStack does not currently support **SEV-SNP** (Secure Encrypted Virtualization - Secure Nested Paging), a critical security feature for enhancing the protection of virtualized environments. SEV-SNP is designed to secure workloads by preventing hypervisor attacks and ensuring that VM memory remains encrypted even from the host.
I would like to know **when SEV-SNP will be supported in CloudStack**, and how it can be used once integrated. This feature is especially important for those utilizing AMD's SEV technology and seeking to ensure their VMs are as secure as possible.
### EXPECTED RESULTS
- CloudStack should provide support for **SEV-SNP** in an upcoming release, allowing users to take advantage of enhanced security for their virtualized workloads.
- Documentation or configuration options detailing how to enable and utilize **SEV-SNP** once available.
### ACTUAL RESULTS
Currently, there is **no support for SEV-SNP** in CloudStack, which limits the ability to fully leverage AMD's SEV capabilities for securing virtualized environments.
GitHub link: https://github.com/apache/cloudstack/discussions/9912
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security [cloudstack]
Posted by "btzq (via GitHub)" <gi...@apache.org>.
GitHub user btzq added a comment to the discussion: Request for SEV-SNP Support in CloudStack for Enhanced Virtualization Security
@sl4sh73r to my knowledge, SEV-SNP is a feature in the Server BIOS. Cloudstack is just an orchestrator of the KVM level.
You should be able to turn on the SEV-SNP, and Cloudstack doesnt need to know about it.
The only issue i think you will have is live migration. But this is not an issue to Cloudstack but to all Live Migration technologies with confidential computing. I remember even Google Cloud talks about this limitation in their docs.
GitHub link: https://github.com/apache/cloudstack/discussions/9912#discussioncomment-11188880
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org