diff --git a/content/getting_started/understand_opennebula/opennebula_concepts/comparison.md b/content/getting_started/understand_opennebula/opennebula_concepts/comparison.md index 4a54dadb3..6847072e0 100644 --- a/content/getting_started/understand_opennebula/opennebula_concepts/comparison.md +++ b/content/getting_started/understand_opennebula/opennebula_concepts/comparison.md @@ -18,10 +18,10 @@ OpenNebula is a mature, open platform that provides complete cloud and virtualiz Unlike proprietary alternatives, OpenNebula offers: -* A predictable subscription model with full access to all features. -* Unified virtualization and cloud management. -* Native edge and hybrid cloud support, including automatic resource provisioning on public clouds such as AWS. -* Integrated Kubernetes orchestration via the OpenNebula Cluster API Provider. +* A predictable subscription model with full access to all features. +* Unified virtualization and cloud management. +* Native edge and hybrid cloud support, including automatic resource provisioning on public clouds such as AWS. +* Integrated Kubernetes orchestration via the OpenNebula Cluster API Provider. * Enterprise-grade scalability and automation, with high availability, multi-tenancy, and federation across sites. To assist with the preparation and completion of the numerous Requests for Proposal (RFPs) we receive every week, we have created the following table to help guide comparisons between OpenNebula and other cloud solutions. You will find three areas of interest: @@ -66,7 +66,7 @@ Thousands of organizations worldwide already rely on OpenNebula as an open alter | **Monitoring & Observability** | Built-in telemetry, Prometheus and Grafana integration, as well as NVIDIA DCGM for GPU metrics. | | **Secure Multi-tenancy** | Fine-grained ACLs, user/group roles, quotas, VDCs, network isolation, and hardware partitioning. | | **Container & Kubernetes Support** | Native integrations with Kubernetes through its Cluster API Provider (CAPONE), Cloud Provider Interface (CPI), and Container Storage Interface (CSI), along with fully certified support for SUSE Rancher Prime and RKE2. | -| **Confidential Computing** | Encrypted VM disks, and support for Confidential Computing and vTPM | +| **Confidential Computing** | Encrypted VM disks, encrypted VM memory and support for Confidential Computing and vTPM | | **Automation & Configuration** | Native support for Terraform and Ansible event hooks and APIs for DevOps integration. | | **Marketplace** | Public and private App Marketplaces for VM templates, OS images, and application stacks. | | **Graphical User Interface** | Modular and customizable interface with dynamic views, secure VNC, RDP, and SSH access, white-labeling, and intuitive tools for self-service, delegated administration, and resource organization. | diff --git a/content/getting_started/understand_opennebula/opennebula_concepts/key_features.md b/content/getting_started/understand_opennebula/opennebula_concepts/key_features.md index eed53dbec..a2e1bde14 100644 --- a/content/getting_started/understand_opennebula/opennebula_concepts/key_features.md +++ b/content/getting_started/understand_opennebula/opennebula_concepts/key_features.md @@ -28,32 +28,32 @@ For high-level overviews and in-depth technical guides, please refer to OpenNebu OpenNebula provides a unified and centralized control plane for the complete management, monitoring, and automation of virtual and cloud resources across the infrastructure. -* Web-based Management Interface (GUI): modern Sunstone GUI built on a responsive web framework for complete lifecycle management, monitoring, and accounting of all virtual infrastructure resources. -* Command-Line Interface (CLI): powerful and scriptable command-line tools that mirror Unix-style commands for fast automation and administration. +* Web-based Management Interface (GUI): modern Sunstone GUI built on a responsive web framework for complete lifecycle management, monitoring, and accounting of all virtual infrastructure resources. +* Command-Line Interface (CLI): powerful and scriptable command-line tools that mirror Unix-style commands for fast automation and administration. * Application Programming Interface (API): REST, gRPC, and XML-RPC APIs offering seamless integration with third-party systems and applications for complete automation and orchestration. ### Federation and Scalability OpenNebula ensures large-scale deployment and distributed cloud operations with a flexible, federated architecture designed for scalability and isolation. -* Disaggregated Architecture: efficient management of highly distributed cloud and edge environments with clusters across multiple sites or data centers. -* Instance Federation: enables the federation of multiple OpenNebula control planes, allowing unified management across geographically distributed zones. +* Disaggregated Architecture: efficient management of highly distributed cloud and edge environments with clusters across multiple sites or data centers. +* Instance Federation: enables the federation of multiple OpenNebula control planes, allowing unified management across geographically distributed zones. * Scalability: proven scalability in production environments with over 2,500 hypervisor nodes managed within a single OpenNebula instance. ### Availability and Business Continuity Built-in high-availability features ensure continuous service operation and data protection with minimal downtime. -* High Availability of Control Plane: redundant front-end components with automatic failover for uninterrupted management services. -* High Availability of Hypervisor Nodes: cluster-based failover mechanisms to automatically restart workloads on surviving hosts. +* High Availability of Control Plane: redundant front-end components with automatic failover for uninterrupted management services. +* High Availability of Hypervisor Nodes: cluster-based failover mechanisms to automatically restart workloads on surviving hosts. * Disaster Recovery Across Data Centers: synchronous and asynchronous VM replication and recovery workflows to protect workloads across multiple sites. ### Hybrid and Edge Cloud Automates the provisioning and lifecycle management of clusters across private, public, and edge clouds. -* Dynamic Expansion: automatically scales clusters by extending private cloud capacity to public or edge environments. -* Multi-Cloud Federation: enables seamless access and workload mobility across clusters deployed in different clouds. +* Dynamic Expansion: automatically scales clusters by extending private cloud capacity to public or edge environments. +* Multi-Cloud Federation: enables seamless access and workload mobility across clusters deployed in different clouds. * Unified Management: provides a single control plane for orchestrating compute, storage, and networking resources across hybrid and distributed infrastructures. ## Infrastructure and Virtualization Layer @@ -62,30 +62,30 @@ Automates the provisioning and lifecycle management of clusters across private, Supports multiple hypervisors and container technologies to match diverse workload needs. -* Processor Architectures: certified compatibility with Intel and AMD x86 platforms, as well as ARM64-based processors, including Ampere and NVIDIA Grace, ensuring full flexibility across edge, data center, and AI infrastructure environments. -* Supported Operating Systems: runs on major Linux distributions, including Red Hat Enterprise Linux, Ubuntu, Debian, and Rocky Linux, ensuring flexibility and ease of integration across enterprise environments. -* KVM Virtualization: robust virtualization using Kernel-based Virtual Machine technology. +* Processor Architectures: certified compatibility with Intel and AMD x86 platforms, as well as ARM64-based processors, including Ampere and NVIDIA Grace, ensuring full flexibility across edge, data center, and AI infrastructure environments. +* Supported Operating Systems: runs on major Linux distributions, including Red Hat Enterprise Linux, Ubuntu, Debian, and Rocky Linux, ensuring flexibility and ease of integration across enterprise environments. +* KVM Virtualization: robust virtualization using Kernel-based Virtual Machine technology. * Container Virtualization (LXC): lightweight container-based virtualization for fast, efficient workloads. ### Enhanced Platform Awareness (EPA) OpenNebula leverages Intel’s Enhanced Platform Awareness (EPA) framework to provide precise hardware-level optimization and secure, performance-aware orchestration of virtualized workloads. -* NUMA & CPU Pinning: optimized workload placement through NUMA-aware scheduling, CPU pinning, and core isolation—ensuring deterministic performance and minimal latency for compute-intensive applications. -* PCI Passthrough & SR-IOV: enables secure, high-performance access to GPUs, network interfaces, and accelerators with direct I/O and SR-IOV virtualization, supporting low-overhead multi-tenant environments. +* NUMA & CPU Pinning: optimized workload placement through NUMA-aware scheduling, CPU pinning, and core isolation—ensuring deterministic performance and minimal latency for compute-intensive applications. +* PCI Passthrough & SR-IOV: enables secure, high-performance access to GPUs, network interfaces, and accelerators with direct I/O and SR-IOV virtualization, supporting low-overhead multi-tenant environments. * Memory and HugePages Management: advanced memory allocation and hugepage configuration improve throughput and latency for virtual network functions (VNFs), AI inference, and HPC workloads.Native integration with Intel EPA for NFV, AI, and HPC workloads. ### Accelerated Computing Native integration with NVIDIA technologies to deliver GPU and DPU-accelerated NFV, AI, and HPC workloads. -* GPU Support: full compatibility with NVIDIA Hopper and Blackwell architectures. -* GPU Scheduling: efficient sharing and allocation using vGPU and MIG. -* NVLink Integration: optimized multi-GPU communication for high-performance AI training. -* Enhanced Networking: support for Infiniband, Spectrum-X, and BlueField DPU fabrics. -* GPU Passthrough: secure, high-performance GPU access for multi-tenant environments. -* DPU Integration (BF-3): hardware offload for networking, security, and encryption tasks. -* GPU Telemetry: real-time GPU monitoring via NVIDIA DCGM and gpu-tools. +* GPU Support: full compatibility with NVIDIA Hopper and Blackwell architectures. +* GPU Scheduling: efficient sharing and allocation using vGPU and MIG. +* NVLink Integration: optimized multi-GPU communication for high-performance AI training. +* Enhanced Networking: support for Infiniband, Spectrum-X, and BlueField DPU fabrics. +* GPU Passthrough: secure, high-performance GPU access for multi-tenant environments. +* DPU Integration (BF-3): hardware offload for networking, security, and encryption tasks. +* GPU Telemetry: real-time GPU monitoring via NVIDIA DCGM and gpu-tools. * Inference Applications: pre-built apps optimized for fast inference, with native integration of vLLM and Hugging Face frameworks for efficient deployment of AI and LLM workloads. * NVIDIA Ecosystem Integration: seamless integration with the NVIDIA AI software stack, including platforms such as Run:ai and Dynamo, enabling unified orchestration, scheduling, and monitoring of AI workloads. @@ -93,27 +93,27 @@ Native integration with NVIDIA technologies to deliver GPU and DPU-accelerated N Comprehensive networking support, including software-defined networking (SDN), virtual, and physical appliances, supporting multiple backends for isolation and performance. -* Linux Bridge Networks: simple, native networking for basic virtualization scenarios. -* 802.1Q VLANs: tagged VLAN networks for tenant separation with support for QinQ -* VXLAN Networks: overlay networks for large-scale multi-tenant deployments using multicast or BGP EVPN. +* Linux Bridge Networks: simple, native networking for basic virtualization scenarios. +* 802.1Q VLANs: tagged VLAN networks for tenant separation with support for QinQ +* VXLAN Networks: overlay networks for large-scale multi-tenant deployments using multicast or BGP EVPN. * Open vSwitch and DPDK: advanced SDN integration for high-speed VNF complex network topologies and network functions. ### Storage Full support for both software-defined storage (SDS) and appliance-based storage solutions, covering environments ranging from local disks to enterprise-grade storage systems. -* Raw device mapping (RDM): use the directly attached devices in the hypervisors in your VMS. -* NFS/NAS: shared network storage with full image management support. -* Local storage with multi-tier caching: cost-efficient, high-performance storage using local disks with support for image caching across clusters and hypervisors in multi-cluster or hybrid configurations, -* Disaggregated and HCI Ceph: scalable distributed storage with block and image replication. -* SAN/LVM: high-performance block storage with thin provisioning, with specific guides for NetApp, Pure Storage, and generic SAN appliances. +* Raw device mapping (RDM): use the directly attached devices in the hypervisors in your VMS. +* NFS/NAS: shared network storage with full image management support. +* Local storage with multi-tier caching: cost-efficient, high-performance storage using local disks with support for image caching across clusters and hypervisors in multi-cluster or hybrid configurations, +* Disaggregated and HCI Ceph: scalable distributed storage with block and image replication. +* SAN/LVM: high-performance block storage with thin provisioning, with specific guides for NetApp, Pure Storage, and generic SAN appliances. * NetApp: optimized driver for NetApp All-Flash systems and ONTAP features. ### Backup Integrated and third-party backup solutions ensure data protection and recovery. -* Built-in Backup: native CBT (change block tracking) and snapshot-based backup with full, incremental, and differential options for all storage solutions (Section B.4). +* Built-in Backup: native CBT (change block tracking) and snapshot-based backup with full, incremental, and differential options for all storage solutions (Section B.4). * Veeam Integration: seamless integration with Veeam for enterprise-grade incremental and full backup and restore, ensuring data protection, fast recovery, and compliance with corporate retention policies. ## Cloud and Workload Orchestration @@ -122,38 +122,38 @@ Integrated and third-party backup solutions ensure data protection and recovery. A self-service model enabling users to deploy and manage multi-tier applications easily. -* Self-Service Portal: a simple web portal allowing users to deploy virtual machines and services from a predefined catalog. -* Elastic Multi-VM Services: auto-scaling of application components based on customizable elasticity rules. +* Self-Service Portal: a simple web portal allowing users to deploy virtual machines and services from a predefined catalog. +* Elastic Multi-VM Services: auto-scaling of application components based on customizable elasticity rules. * Application Insight: real-time application metrics and state monitoring for informed scaling and resource decisions. ### Capacity and Performance Management Advanced scheduling and resource optimization ensure efficient use of compute and storage resources. -* Live Migration: seamless movement of running VMs between hosts for maintenance or load balancing. -* Dynamic Resource Scheduling (DRS): cluster-wide automated & semi-automated load balancing, and generation of migration plans. -* AI-driven Predictive Scheduler: multi-policy scheduling engine supporting priorities, affinity, and cost-aware placement. -* Affinity/Anti-Affinity Rules: policy-driven placement of VMs to optimize locality or fault tolerance. +* Live Migration: seamless movement of running VMs between hosts for maintenance or load balancing. +* Dynamic Resource Scheduling (DRS): cluster-wide automated & semi-automated load balancing, and generation of migration plans. +* AI-driven Predictive Scheduler: multi-policy scheduling engine supporting priorities, affinity, and cost-aware placement. +* Affinity/Anti-Affinity Rules: policy-driven placement of VMs to optimize locality or fault tolerance. * Host Overcommitment: maximize resource utilization and efficiency. ### Observability and Monitoring Integrated telemetry and analytics tools for proactive monitoring and performance visibility. -* Built-in Monitoring: native monitoring subsystem that provides real-time visibility into virtual machines, hosts, and services directly from the OpenNebula control plane—no external tools required. -* Predictive Monitoring: built-in health and capacity forecasting to anticipate performance issues. +* Built-in Monitoring: native monitoring subsystem that provides real-time visibility into virtual machines, hosts, and services directly from the OpenNebula control plane—no external tools required. +* Predictive Monitoring: built-in health and capacity forecasting to anticipate performance issues. * External Integration: export of metrics and events to Prometheus and Grafana for unified observability. ### Secure Multi-Tenancy Comprehensive isolation, quota management, and access controls ensure secure multi-user environments. -* Application Sharing: secure sharing of templates and applications across users, groups, and projects. -* Authentication Realms: integration with LDAP, Active Directory, SAML, and other identity backends for centralized access control. -* Fine-Grained ACLs: per-resource access permissions for complete control of user and group privileges. -* Quota Management: enforces CPU, GPU, storage, and network usage limits per user or tenant to ensure fair resource allocation and policy compliance, including cluster-level quotas and custom quota items for granular governance and control. -* Cluster and VDC: logical partitioning of resources into isolated clusters and Virtual Data Centers. -* Users & Groups: logical grouping of users and projects for efficient policy administration. +* Application Sharing: secure sharing of templates and applications across users, groups, and projects. +* Authentication Realms: integration with LDAP, Active Directory, SAML, and other identity backends for centralized access control. +* Fine-Grained ACLs: per-resource access permissions for complete control of user and group privileges. +* Quota Management: enforces CPU, GPU, storage, and network usage limits per user or tenant to ensure fair resource allocation and policy compliance, including cluster-level quotas and custom quota items for granular governance and control. +* Cluster and VDC: logical partitioning of resources into isolated clusters and Virtual Data Centers. +* Users & Groups: logical grouping of users and projects for efficient policy administration. * Network Isolation: VLANs and overlays ensure tenant traffic separation. ## Extensibility, Automation, and Hybrid Operations @@ -162,34 +162,35 @@ Comprehensive isolation, quota management, and access controls ensure secure mul Enterprise-grade Kubernetes management and orchestration through built-in add-ons. -* Cluster API: native support for Cluster API Provider for OpenNebula (CAPONE) to provision and manage clusters. -* Cloud Provider Interface (CPI): direct integration for OpenNebula-managed resources in Kubernetes. -* Container Storage Interface (CSI): persistent volume provisioning from OpenNebula storage backends. -* Rancher Integration: fully certified integration with SUSE Rancher Prime and RKE2, providing enterprise-grade multi-cluster lifecycle management and unified governance of Kubernetes environments. +* Cluster API: native support for Cluster API Provider for OpenNebula (CAPONE) to provision and manage clusters. +* Cloud Provider Interface (CPI): direct integration for OpenNebula-managed resources in Kubernetes. +* Container Storage Interface (CSI): persistent volume provisioning from OpenNebula storage backends. +* Rancher Integration: fully certified integration with SUSE Rancher Prime and RKE2, providing enterprise-grade multi-cluster lifecycle management and unified governance of Kubernetes environments. * Unified KaaS Model: simplifies the operation of Kubernetes environments by offering a consistent management experience, built-in automation, and end-to-end support through OpenNebula’s Enterprise Subscription. ### Confidential Computing Secure execution environments ensure data privacy and integrity during processing. -* Confidential Computing: encrypted processing for protecting sensitive workloads in use. -* vTPM: virtual Trusted Platform Module support for attestation and secure boot. +* Confidential Computing: encrypted processing for protecting sensitive workloads in use. +* vTPM: virtual Trusted Platform Module support for attestation and secure boot. * Encrypted Datastores: native support for encrypted storage backends to safeguard data at rest and ensure compliance with enterprise security standards. +* Encrypted Memory: native support for encrypted Virtual Machine memory. The hypervisor is not able to read the VM memory, guaranteeing runtime privacy. ### Automation Comprehensive automation and orchestration capabilities ensure consistent, repeatable, and policy-driven operations across environments. -* Infrastructure as Code: Full support for automation frameworks such as Terraform for declarative infrastructure provisioning and lifecycle management. +* Infrastructure as Code: Full support for automation frameworks such as Terraform for declarative infrastructure provisioning and lifecycle management. * Configuration Management: Seamless integration with tools like Ansible for configuration control, post-deployment automation, and compliance enforcement. ### App Marketplaces Distribute and reuse cloud-ready applications within and across organizations. -* Guest Operating Systems: broad support for Windows and Linux guests, ensuring full compatibility for enterprise, development, and AI workloads across heterogeneous environments. -* Public Marketplace: access to a broad catalog of pre-built templates for common operating systems, application stacks, and services, enabling rapid deployment and standardization across environments. -* Private Marketplace: internal catalog for sharing and distributing certified applications. +* Guest Operating Systems: broad support for Windows and Linux guests, ensuring full compatibility for enterprise, development, and AI workloads across heterogeneous environments. +* Public Marketplace: access to a broad catalog of pre-built templates for common operating systems, application stacks, and services, enabling rapid deployment and standardization across environments. +* Private Marketplace: internal catalog for sharing and distributing certified applications. * Third-Party Integration: support for external marketplaces such as Linux Containers. ## Usability, Interoperability, and Migration @@ -198,27 +199,27 @@ Distribute and reuse cloud-ready applications within and across organizations. Modern, intuitive interface for both administrators and end users. -* Dynamic Tabs: modular interface views for efficient navigation and operation. -* VNC Console: secure, browser-based remote access to virtual machines through integrated VNC sessions. -* White Labeling: customizable branding and visual identity for organizations. -* Self-Service Cloud View: simplified interface for end users and developers. -* Group Admin View: delegated administration for project or departmental management. +* Dynamic Tabs: modular interface views for efficient navigation and operation. +* VNC Console: secure, browser-based remote access to virtual machines through integrated VNC sessions. +* White Labeling: customizable branding and visual identity for organizations. +* Self-Service Cloud View: simplified interface for end users and developers. +* Group Admin View: delegated administration for project or departmental management. * Sunstone Labels: tag-based organization and filtering of resources. ### Interfaces and Integration Extensible and open architecture designed for seamless interoperability. -* Modular Architecture: Flexible design allowing custom extensions and third-party integrations. -* Hooking System: Event-driven hooks for workflow automation and external triggers. +* Modular Architecture: Flexible design allowing custom extensions and third-party integrations. +* Hooking System: Event-driven hooks for workflow automation and external triggers. * Rich API Set: Multi-language APIs for integration with third-party systems and applications for complete automation and orchestration. ### Migration from VMware Comprehensive tools and workflows to enable a smooth transition from VMware environments to OpenNebula with minimal downtime and configuration effort. -* OneSwap: streamlines virtual machine migration from VMware into OpenNebula with minimal reconfiguration and downtime. -* OVA Import: enables direct import of OVA appliances and templates, simplifying workload onboarding and ensuring compatibility across virtualization environments. +* OneSwap: streamlines virtual machine migration from VMware into OpenNebula with minimal reconfiguration and downtime. +* OVA Import: enables direct import of OVA appliances and templates, simplifying workload onboarding and ensuring compatibility across virtualization environments. * Minimal Disruption: migration workflows designed to ensure business continuity, avoiding downtime and configuration drift. @@ -229,4 +230,4 @@ Comprehensive tools and workflows to enable a smooth transition from VMware envi - *Not all platform configurations exhibit similar performance and stability* - *The features may change to offer users more features and integration with other virtualization and cloud components* - *The features may change due to changes in the functionality provided by underlying virtualization services* -{{< /alert >}} \ No newline at end of file +{{< /alert >}} diff --git a/content/product/virtual_machines_operation/virtual_machines/vm_templates.md b/content/product/virtual_machines_operation/virtual_machines/vm_templates.md index 903ba2e82..5be79cdda 100644 --- a/content/product/virtual_machines_operation/virtual_machines/vm_templates.md +++ b/content/product/virtual_machines_operation/virtual_machines/vm_templates.md @@ -138,6 +138,82 @@ ones depending on a TPM state. [See TPM Section in the VM Template reference]({{% relref "../../operation_references/configuration_references/template#tpm-section" %}}). +### Memory Encryption + +Memory encryption can be enabled in Virtual Machines by adding the following information to the VM Template + +```none +MEMORY_ENCRYPTION=[ + TYPE="SEV" +] +``` + +There are several **virtualization security types**. We currently support `SEV` and `SEV-ES`. The KVM driver monitoring will automatically detect the memory encryption supported by each host. Depending on the CPU capabilities and BIOS configuration, different values can be shown by the monitoring probe. + +```none +oneadmin@one-fe:~$ onehost show 5 -j | jq .HOST.TEMPLATE.MEMORY_ENCRYPTION +"SEV" +``` + +Possible values are: `NONE|SEV|SEV-ES|SEV-SNP|TDX` + +More template configuration is required, otherwise the Guest OS might not load correctly. + +```none +CPU_MODEL=[ + MODEL="host-passthrough" ] +OS=[ + FIRMWARE="UEFI", + MACHINE="q35" ] +``` + +The VM will be automatically deployed to hosts with the desired memory encryption. + +A VM with encrypted memory will have a report in the Guest OS kernel message + +```none +localhost:~ # dmesg | grep -i sev +[ 0.054053] Memory Encryption Features active: AMD SEV +``` + +#### Host Preparation - SEV + +You need a CPU in the KVM host that is able to encrypt memory. You can check this capability on the CPU flags. Note the following AMD CPU includes `sev` and `sev_es` + +```none +oneadmin@sm23:~$ lscpu | grep -i sev +Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good amd_lbr_v2 nopl nonstop_tsc cpuid extd_apicid aperfmperf rapl pni pclmulqdq monitor ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 hw_pstate ssbd mba perfmon_v2 ibrs ibpb stibp ibrs_enhanced vmmcall fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local user_shstk avx_vnni avx512_bf16 clzero irperf xsaveerptr rdpru wbnoinvd amd_ppin cppc amd_ibpb_ret arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif x2avic v_spec_ctrl vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq la57 rdpid bus_lock_detect movdiri movdir64b overflow_recov succor smca fsrm avx512_vp2intersect flush_l1d sev sev_es debug_swap +``` + +Then you need to make sure the capability is enabled in the BIOS. The following host has SEV enabled but SEV-ES disabled + +```none +root@sm23:/home/one# dmesg | grep -i sev +[ 7.284091] ccp 0000:a3:00.5: sev enabled +[ 7.705036] ccp 0000:a3:00.5: SEV API:1.55 build:61 +[ 7.719788] kvm_amd: SEV enabled (ASIDs 1 - 1006) +[ 7.719791] kvm_amd: SEV-ES disabled (ASIDs 0 - 0) +``` + +Now check if libvirt is able to make use of this feature. To do this, you can run the `virsh domcapabilities` command. + +```none +oneadmin@sm23:~$ virsh domcapabilities | xmllint --xpath "/domainCapabilities/features/sev" - + + 51 + 1 + 1006 + 0 + ey5j9CwuSUE= + +``` + +After that, both oneadmin and libvirt need to be able to use the `/dev/sev` device. +- Set `/dev/sev rw,` in `/etc/apparmor.d/abstractions/libvirt-qemu` if using an Operating System that relies on apparmor. +- Run the command `chmod o+wr /dev/sev` to allow oneadmin to use that device. + - These permissions will not persist. You can automate them with [udev rules](https://www.freedesktop.org/software/systemd/man/latest/udev.html) + - You can also restrict the ownership so that just oneadmin and libvirt are able to read and write `/dev/sev` instead of every other non root group user. + ### A Complete Example The following example shows a VM Template file with a couple of disks and a network interface. A VNC section and an alias were also added: diff --git a/content/software/release_information/release_notes_72/whats_new.md b/content/software/release_information/release_notes_72/whats_new.md index 9005052da..a013e9d07 100644 --- a/content/software/release_information/release_notes_72/whats_new.md +++ b/content/software/release_information/release_notes_72/whats_new.md @@ -61,6 +61,7 @@ We encourage you to review the [Known Issues]({{% relref "known_issues" %}}) and ## KVM & Networking - [Transparent proxying](../../../product/virtual_machines_operation/virtual_machines_networking/tproxy) allows VMs to access external services like OneGate without requiring complex networking setup. +- [Virtual Machine memory encryption](../../../product/virtual_machines_operation/virtual_machines/vm_templates#memory-encryption) allows VM workloads whose memory cannot be read by the hypervisor. ## LXC