Emulated Trusted Platform Module (vTPM) in nova

[Noel Ashford]

This bug tracker is for errors with the documentation, use the following as a template and remove or add fields as you see fit. Convert [ ] into [x] to check boxes:

- [x] This doc is inaccurate in this way: There is no resource provider command + the compute nodes do not seem to register these traits (assumed)
- [ ] This is a doc addition request.
- [ ] I have a fix to the document that I can paste below including example: input and output.

If you have a troubleshooting or support issue, use the following resources:

 - The mailing list: https://lists.openstack.org
 - IRC: 'openstack' channel on OFTC

-----------------------------------
Release: 28.1.0.dev183 on 2021-02-22 15:44:45
SHA: e03d3dab063fa8a525beeb1cdfa4390c90530210
Source: https://opendev.org/openstack/nova/src/doc/source/admin/emulated-tpm.rst
URL: https://docs.openstack.org/nova/latest/admin/emulated-tpm.html

[Elod Illes (elod-illes)]

Hi Noel, i think this is a configuration issue. If the environment plus the openstack client is configured properly, then the command should be there. example:

# openstack resource provider list
+--------------------------------------+------------+------------+--------------------------------------+----------------------+
| uuid | name | generation | root_provider_uuid | parent_provider_uuid |
+--------------------------------------+------------+------------+--------------------------------------+----------------------+
| 9c588496-57df-49e9-9f56-bdae11075fa2 | devstackvm | 2 | 9c588496-57df-49e9-9f56-bdae11075fa2 | None |
+--------------------------------------+------------+------------+--------------------------------------+----------------------+

Can you please elaborate what is the exact issue?

[Noel Ashford (nashford77)]

(kolla-2023.1) root@cube-server:~# which openstack
/root/VirtualENV/kolla-2023.1/bin/openstack
(kolla-2023.1) root@cube-server:~# openstack --version
openstack 6.4.0
(kolla-2023.1) root@cube-server:~# openstack endpoint list | grep -i internal | grep _5_N
| 194c3b6d8c01407c8cf88f925fa613ed | TN_DEV_NY_5_NET | placement | placement | True | internal | https://int.noel.openstack.tunninet.com:8780 |
| 205e30a1180b46a19710c7ec39fa4863 | TN_DEV_NY_5_NET | skyline | panel | True | internal | https://int.noel.openstack.tunninet.com:9998 |
| 383c394f5a014c729d3a8362f86fbf48 | TN_DEV_NY_5_NET | barbican | key-manager | True | internal | https://int.noel.openstack.tunninet.com:9311 |
| 3b79f8260d9743dfa767122fd3d55385 | TN_DEV_NY_5_NET | magnum | container-infra | True | internal | https://int.noel.openstack.tunninet.com:9511/v1 |
| 5565da9ccf1f49ff822bba91579d2cbc | TN_DEV_NY_5_NET | heat-cfn | cloudformation | True | internal | https://int.noel.openstack.tunninet.com:8000/v1 |
| 6540448c8a204573bca0c3eb5ea7e713 | TN_DEV_NY_5_NET | heat | orchestration | True | internal | https://int.noel.openstack.tunninet.com:8004/v1/%(tenant_id)s |
| 869c9ba3b4554e34a403454816bd0e7e | TN_DEV_NY_5_NET | swift | object-store | True | internal | https://int.noel.openstack.tunninet.com:8080/v1/AUTH_%(tenant_id)s |
| 9b15ea7fd828405d951d61af871607d9 | TN_DEV_NY_5_NET | neutron | network | True | internal | https://int.noel.openstack.tunninet.com:9696 |
| c2ee0f041f744d599e6c86c6fb22d062 | TN_DEV_NY_5_NET | nova | compute | True | internal | https://int.noel.openstack.tunninet.com:8774/v2.1 |
| cca6faec8e40409caf8d3a30f9065d34 | TN_DEV_NY_5_NET | cinderv3 | volumev3 | True | internal | https://int.noel.openstack.tunninet.com:8776/v3/%(tenant_id)s |
| d2412af3527340fda4185085d36e0fd8 | TN_DEV_NY_5_NET | octavia | load-balancer | True | internal | https://int.noel.openstack.tunninet.com:9876 |
| e83ccfc49c9941feb0dfc83a6ac2928a | TN_DEV_NY_5_NET | glance | image | True | internal | https://int.noel.openstack.tunninet.com:9292 |
| f58ee2e6bf0d482eb0bb3b493c963405 | TN_DEV_NY_5_NET | keystone | identity | True | internal | https://int.noel.openstack.tunninet.com:5000 |

[Noel Ashford (nashford77)]

Sorry, i hit enter too quickly.... I also tried via CURL API calls, same - I use Kolla Ansible.

(kolla-2023.1) root@cube-server:~# openstack resource provider list
openstack: 'resource provider list' is not an openstack command. See 'openstack --help'.
Did you mean one of these?
  service create
  service delete
  service list
  service provider create
  service provider delete
  service provider list
  service provider set
  service provider show
  service set
  service show

[Noel Ashford (nashford77)]

I was assuming this was deprecated in 2023.1 ? https://docs.openstack.org/python-openstackclient/latest/ shows 6.4 to be current. How are you seeing the above ? are yo on an older build ?

[Noel Ashford (nashford77)]

https://bugzilla.redhat.com/show_bug.cgi?id=1876798 Ah ... Is there a plugin ?! :)

Installing collected packages: osc-placement
Successfully installed osc-placement-4.2.0
(kolla-2023.1) root@cube-server:~#

It isn't listed on the requirements for kolla-ansible & vTPM ;0

(kolla-2023.1) root@cube-server:~# openstack resource provider list
+--------------------------------------+----------------------+------------+--------------------------------------+----------------------+
| uuid | name | generation | root_provider_uuid | parent_provider_uuid |
+--------------------------------------+----------------------+------------+--------------------------------------+----------------------+
| 11c10425-d19d-482d-a4bc-e1892e07d575 | tunninet-server-noel | 47 | 11c10425-d19d-482d-a4bc-e1892e07d575 | None |
+--------------------------------------+----------------------+------------+--------------------------------------+----------------------+
(kolla-2023.1) root@cube-server:~# openstack resource provider trait list 11c10425-d19d-482d-a4bc-e1892e07d575 | grep SECURITY_TPM
| COMPUTE_SECURITY_TPM_2_0 |
| COMPUTE_SECURITY_TPM_1_2 |

However when i try to use this now.... IT does not seem to boot ...

(kolla-2023.1) root@cube-server:~# openstack flavor set ee9b48f9-fb55-49c8-b13d-48d232e8ea21 --property hw:tpm_version=2.0 --property hw:tpm_model=tpm-crb

I then try to create a VM with this trait and no go....

Error: Failed to perform requested operation on instance "Test", the instance has an error status: Please try again later [Error: Exceeded maximum number of retries. Exhausted all hosts available for retrying build failures for instance 7647a767-897b-4075-9552-71073ed62456.].

"libvirt.libvirtError: internal error: Could not run '/usr/bin/swtpm_setup'. exitstatus: 1; Check error log '/var/log/swtpm/libvirt/qemu/instance-0000001e-swtpm.log'

  The TPM's state will be encrypted using a key derived from a passphrase (fd).
Starting vTPM manufacturing as tss:tss @ Tue 23 Jan 2024 09:03:51 PM EST
Successfully created RSA 2048 EK with handle 0x81010001.
  Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type ek --ek b4d31dd5c8150e76b03764c69d989f880a9aca35ed9662cda61c3c7226042d3446857b603da0241c11194fd72280e7b405313d843f30c27d269523560ed5ce2d9e350243568321e98b337f8ad19f814549d0297b4855fb644ce43f140539a2f51c86ff1effb574233cd6f29bf2ce0fb6185aaa52af71424cc48f3937bb7e2dc06dd713c8d72598aec85799c93f49ce14faed14cdd121824d1c626230cf5e94a31a1057b66d180d2772dd729bde7fd40b7bfefa07dd6f67e7474ad93dda3000f21c5147e38807c5e814806606d9db6754e6aafe04a0c32ebfec2dd8090824d066c90ebd579907d457c3f1327d46276df7c942100a34c6e7efd6ba96d25af2294b --dir /var/lib/libvirt/swtpm/7647a767-897b-4075-9552-71073ed62456/tpm2 --logfile /var/log/swtpm/libvirt/qemu/instance-0000001e-swtpm.log --vmid instance-0000001e:7647a767-897b-4075-9552-71073ed62456 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.optio...

[Noel Ashford (nashford77)]

OK, after chowning to TSS:TSS on the dir above, success.... another bug in the kolla images. How do I do an MR and where to correct their images on Quay? I want to get this added to master to help others using kolla ansible with this issue

[Noel Ashford (nashford77)]

it had swtpm as the owner out of the box btw with their images... and root group vs tss:tss