vmm-cli: require --kms-url when using --env-file

Add validation to ensure --kms-url is provided when --env-file is used,
since environment variables need to be encrypted using the KMS public key.

Affected commands:
- deploy: requires --kms-url when --env-file is specified
- update: requires --kms-url when --env-file is specified
- update-env: requires --kms-url (always uses env file)

Author: kvinwang

vmm/src/vmm-cli.py

@@ -565,6 +565,10 @@ def create_vm(self, args) -> None:
 
         envs = parse_env_file(args.env_file)
 
+        # Validate: --env-file requires --kms-url
+        if envs and not args.kms_url:
+            raise Exception("--env-file requires --kms-url to encrypt environment variables")
+
         # Read user config file if provided
         user_config = ""
         if args.user_config:
@@ -620,6 +624,10 @@ def create_vm(self, args) -> None:
 
     def update_vm_env(self, vm_id: str, envs: Dict[str, str], kms_urls: Optional[List[str]] = None) -> None:
         """Update environment variables for a VM"""
+        # Validate: requires --kms-url
+        if not kms_urls:
+            raise Exception("--kms-url is required to encrypt environment variables")
+
         envs = envs or {}
         # First get the VM info to retrieve the app_id
         vm_info_response = self.rpc_call('GetInfo', {'id': vm_id})
@@ -709,6 +717,10 @@ def update_vm(
         no_tee: Optional[bool] = None,
     ) -> None:
         """Update multiple aspects of a VM in one command"""
+        # Validate: --env-file requires --kms-url
+        if env_file and not kms_urls:
+            raise Exception("--env-file requires --kms-url to encrypt environment variables")
+
         updates = []
 
         # handle resize operations (vcpu, memory, disk, image)