tests: Add Azure backend

Jakob-Naucke · uril · Yair Podemsky · commit 13f79808ed86 · 2026-02-10T10:16:34.000+02:00
Add integration tests backend for Azure (confidential VMs, no cluster
join). Use Azure CLI to create a resource group per test, same name as
the namespace (which can be prefixed). Auto-shutdown VMs after one
hour.

Signed-off-by: Jakob Naucke &lt;jnaucke@redhat.com&gt;
Co-authored-by: Uri Lublin &lt;uril@redhat.com&gt;
Assisted-by: Gemini, Claude
diff --git a/test_utils/src/lib.rs b/test_utils/src/lib.rs
@@ -45,6 +45,11 @@ pub fn compare_pcrs(actual: &[Pcr], expected: &[Pcr]) -> bool {
     true
 }
 
+// Large warning frame, e.g. for paid cloud resources that may not have been shut down correctly
+pub fn warn_frame(msg: &str) -> String {
+    format!("{YELLOW}=== WARNING ===\n{msg}{ANSI_RESET}")
+}
+
 #[macro_export]
 macro_rules! test_info {
     ($test_name:expr, $($arg:tt)*) => {{
diff --git a/test_utils/src/virt/azure.rs b/test_utils/src/virt/azure.rs
@@ -0,0 +1,201 @@
+// SPDX-FileCopyrightText: Jakob Naucke <jnaucke@redhat.com>
+//
+// SPDX-License-Identifier: MIT
+
+use anyhow::{Context, Result, anyhow};
+use k8s_openapi::chrono::{self, Utc};
+use serde_json::Value;
+use std::{env, time};
+use tokio::process::Command;
+
+use super::{VmBackend, VmConfig, generate_ignition, ssh_exec};
+use crate::{Poller, ensure_command, warn_frame};
+
+const KEEP_ALIVE_MINUTES: i64 = 60;
+
+pub struct AzureBackend {
+    config: VmConfig,
+    resource_group: String,
+}
+
+impl AzureBackend {
+    pub fn new(config: VmConfig) -> Result<Self> {
+        let resource_group = config.namespace.clone();
+        Ok(Self {
+            config,
+            resource_group,
+        })
+    }
+
+    async fn az(&self, args: &[&str]) -> Result<Value> {
+        ensure_command("az")?;
+        let out = ["--output", "json"];
+        let output = Command::new("az").args(args).args(out).output().await?;
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            return Err(anyhow!("az {} failed: {stderr}", args.join(" ")));
+        }
+
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        if stdout.trim().is_empty() {
+            return Ok(Value::Null);
+        }
+        serde_json::from_str(&stdout).context("Failed to parse az CLI output as JSON")
+    }
+
+    async fn az_rg(&self, mut args: Vec<&str>) -> Result<()> {
+        ensure_command("az")?;
+        args.extend(["--resource-group", &self.resource_group, "--output", "none"]);
+        let output = Command::new("az").args(&args).output().await?;
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            return Err(anyhow!("az {} failed: {stderr}", args.join(" ")));
+        }
+        Ok(())
+    }
+}
+
+#[async_trait::async_trait]
+impl VmBackend for AzureBackend {
+    async fn create_vm(&self) -> Result<()> {
+        let vm = &self.config.vm_name;
+        let vnet = &format!("{vm}-vnet");
+        let ip = &format!("{vm}-ip");
+        let nsg = &format!("{vm}-nsg");
+        let nic = &format!("{vm}-nic");
+
+        let location = env::var("AZURE_LOCATION").unwrap_or("eastus".to_string());
+        let mut args = vec!["group", "create", "--name", &self.resource_group];
+        args.extend(["--location", &location]);
+        let output = Command::new("az").args(args).output().await?;
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            return Err(anyhow!("az group create failed: {stderr}"));
+        }
+
+        let mut args = vec!["network", "vnet", "create", "--name", vnet];
+        args.extend(["--address-prefix", "10.0.0.0/16"]);
+        args.extend(["--subnet-name", "default", "--subnet-prefix", "10.0.0.0/24"]);
+        self.az_rg(args).await?;
+
+        let mut args = vec!["network", "public-ip", "create", "--name", ip];
+        args.extend(["--sku", "Standard", "--allocation-method", "Static"]);
+        self.az_rg(args).await?;
+
+        self.az_rg(vec!["network", "nsg", "create", "--name", nsg])
+            .await?;
+
+        let mut args = vec!["network", "nsg", "rule", "create", "--nsg-name", nsg];
+        args.extend(["--name", "AllowSSH", "--protocol", "Tcp"]);
+        args.extend(["--priority", "1000", "--destination-port-range", "22"]);
+        args.extend(["--access", "Allow", "--direction", "Inbound"]);
+        self.az_rg(args).await?;
+
+        let mut args = vec!["network", "nic", "create", "--name", nic];
+        args.extend(["--vnet-name", vnet, "--subnet", "default"]);
+        args.extend(["--network-security-group", nsg, "--public-ip-address", ip]);
+        self.az_rg(args).await?;
+
+        let ign = generate_ignition(&self.config, false).await?;
+        let custom_data = ign.to_string();
+        if !self.config.image.starts_with('/') && self.config.image.split(':').count() < 4 {
+            let err = "Invalid Image URN. Expected 'Publisher:Offer:Sku:Version'";
+            return Err(anyhow!(err));
+        }
+
+        let mut args = vec!["vm", "create", "--name", vm, "--nics", nic];
+        args.extend(["--image", &self.config.image, "--size", "Standard_DC2as_v5"]);
+        args.extend(["--os-disk-delete-option", "Delete"]);
+        args.extend(["--storage-sku", "StandardSSD_LRS"]);
+        args.extend(["--admin-username", "core"]);
+        args.extend(["--ssh-key-values", &self.config.ssh_public_key]);
+        args.extend(["--custom-data", &custom_data]);
+        args.extend(["--security-type", "ConfidentialVM"]);
+        args.extend(["--enable-secure-boot", "true", "--enable-vtpm", "true"]);
+        args.extend(["--os-disk-security-encryption-type", "VMGuestStateOnly"]);
+
+        let err = format!(
+            "Request to create the VM {vm} has failed, but it may still have been created. \
+             Log in manually to verify the VM does not keep running."
+        );
+        self.az_rg(args).await.context(warn_frame(&err))?;
+
+        // Schedule auto-shutdown to control costs if cleanup fails
+        let shutdown_time = Utc::now() + chrono::Duration::minutes(KEEP_ALIVE_MINUTES);
+        let shutdown_str = shutdown_time.format("%H%M").to_string();
+        let mut args = vec!["vm", "auto-shutdown", "--name", vm];
+        args.extend(["--time", &shutdown_str]);
+        let err = format!(
+            "Request to auto-shutdown the VM {vm} has failed. \
+             Log in manually to verify the VM was removed correctly."
+        );
+        self.az_rg(args).await.context(warn_frame(&err))?;
+
+        Ok(())
+    }
+
+    async fn wait_for_running(&self, timeout_secs: u64) -> Result<()> {
+        let vm_name = &self.config.vm_name;
+        let poller = Poller::new()
+            .with_timeout(time::Duration::from_secs(timeout_secs))
+            .with_interval(time::Duration::from_secs(5))
+            .with_error_message(format!(
+                "virtualMachine {vm_name} did not reach PowerState/running after {timeout_secs}s",
+            ));
+
+        let args = [
+            "vm",
+            "get-instance-view",
+            "--resource-group",
+            &self.resource_group,
+            "--name",
+            &self.config.vm_name,
+        ];
+        let check_fn = || async move {
+            let result = self.az(&args).await?;
+            let statuses = result["instanceView"]["statuses"].as_array().unwrap();
+            let check = |s: &&Value| s["code"] == "PowerState/running";
+            let err = anyhow!("virtualMachine {vm_name} is not in running PowerState yet",);
+            statuses.iter().find(check).map(|_| ()).ok_or(err)
+        };
+        poller.poll_async(check_fn).await
+    }
+
+    async fn ssh_exec(&self, command: &str) -> Result<String> {
+        let (rg, ip_name) = (&self.resource_group, format!("{}-ip", self.config.vm_name));
+        let mut args = vec!["network", "public-ip", "show", "--resource-group", rg];
+        args.extend(["--name", &ip_name]);
+        let result = self.az(&args).await?;
+
+        let public_ip = result["ipAddress"].as_str().unwrap();
+        ssh_exec(&format!(
+            "ssh -i {} -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null core@{public_ip} '{command}'",
+            self.config.ssh_private_key.display()
+        )).await
+    }
+
+    async fn get_root_key(&self) -> Result<Option<Vec<u8>>> {
+        Ok(None)
+    }
+
+    async fn cleanup(&self) -> Result<()> {
+        self.config.cleanup();
+        let rg = &self.resource_group;
+
+        let args1 = ["group", "delete", "--name", rg];
+        let args2 = ["--yes", "--no-wait"];
+        let output = Command::new("az").args(args1).args(args2).output().await?;
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            let err = format!(
+                "Request to cleanup the Azure resource group {rg} failed. \
+                 Log in manually to verify the resource group was removed correctly."
+            );
+            return Err(anyhow!("az group delete failed: {stderr}").context(warn_frame(&err)));
+        }
+        Ok(())
+    }
+}
diff --git a/test_utils/src/virt/mod.rs b/test_utils/src/virt/mod.rs
@@ -3,6 +3,7 @@
 //
 // SPDX-License-Identifier: MIT
 
+pub mod azure;
 pub mod kubevirt;
 
 use anyhow::{Context, Result, anyhow};
@@ -179,14 +180,16 @@ pub async fn get_root_key(config: &VmConfig, ip: &str) -> Result<Vec<u8>> {
 pub enum VirtProvider {
     #[default]
     Kubevirt,
+    Azure,
 }
 
 fn get_virt_provider() -> Result<VirtProvider> {
     match env::var(VIRT_PROVIDER_ENV) {
         Ok(val) => match val.to_lowercase().as_str() {
             "kubevirt" => Ok(VirtProvider::Kubevirt),
+            "azure" => Ok(VirtProvider::Azure),
             v => Err(anyhow!(
-                "Unknown {VIRT_PROVIDER_ENV} '{v}'. Supported providers: kubevirt"
+                "Unknown {VIRT_PROVIDER_ENV} '{v}'. Supported providers: kubevirt, azure"
             )),
         },
         Err(env::VarError::NotPresent) => Ok(VirtProvider::default()),
@@ -212,6 +215,7 @@ pub fn create_backend(
     };
     match provider {
         VirtProvider::Kubevirt => Ok(Box::new(kubevirt::KubevirtBackend(config))),
+        VirtProvider::Azure => Ok(Box::new(azure::AzureBackend::new(config)?)),
     }
 }
 
diff --git a/tests/README.md b/tests/README.md
@@ -26,3 +26,78 @@ Each test can also be run independently using cargo test. Example:
 ```bash
 $ cargo test test_trusted_execution_cluster_uninstall  -- --no-capture
 ```
+
+## Run integration tests distributedly
+
+When running integration tests elsewhere than on a local Kind cluster, set `$PLATFORM` to something else than `kind`.
+Take into consideration:
+
+- how VMs you are attesting can connect to services like Trustee
+- how container images can be made available to the cluster
+
+For enabling connection, you can export `$CLUSTER_URL`.
+On OpenShift, you can instead export `PLATFORM=openshift` and the integration tests will use `oc expose` to expose services automatically.
+
+For container images, you can export `REGISTRY` to something non-local, e.g. something public like quay.io.
+On OpenShift, you can also use the internal registry:
+
+```bash
+# Define a namespace to push images to. Here, we name it after the user itself.
+NAMESPACE=$(oc whoami)
+oc create ns $NAMESPACE
+HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')
+podman login $HOST -u $(oc whoami) -p $(oc whoami -t)
+export REGISTRY=$HOST/$NAMESPACE
+make push
+# Export REGISTRY to the internal URL
+export REGISTRY=image-registry.openshift-image-registry.svc:5000/$NAMESPACE
+```
+
+### Run integration tests on Azure
+
+Like the KubeVirt tests, the Azure integration tests create CoreOS VMs that retrieve a disk encryption key from Trustee, but do not execute a cluster join.
+They rely on real [Azure Confidential VMs](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview) and Trustee's az-snp-vtpm attester.
+
+#### Preparing an image
+
+The image to boot the VM from must reside in a _storage container_ inside a _storage account_ and be referenced to from a _compute gallery_, all of which exist in a _resource group_.
+This guide assumes that you have created the Azure resources in italics, and that you are logged in with the Azure CLI.
+
+Create a CoreOS Azure image VHD, e.g. as per the [investigations repository](https://github.com/trusted-execution-clusters/investigations), **without the `tpm-attester` feature** in its trustee-attester until [trustee-gc#1277](https://github.com/confidential-containers/guest-components/issues/1277) is resolved.
+Upload this blob and create an image definition and version based on it:
+
+```bash
+# Export $AZURE_SUBSCRIPTION_ID
+# Set $resource_group, $storage_account, $storage_container, $compute_gallery
+# Set $image, e.g. fedora-coreos-<version>-azure.x86_64.vhd
+# Set image definition name, e.g. image_definition=fcos-cvm, and image version, e.g. image_version=0.1.0
+
+# Retrieve connection string & storage account ID
+cs=$(az storage account show-connection-string -g $resource_group -n $storage_account | jq -r .connectionString)
+# Upload blob. We keep the file name here, but you can set the blob name in Azure
+# to something else by changing the argument to -n.
+az storage blob upload --connection-string $cs -c $storage_container -f $image -n $image
+# Create image definition
+az sig image-definition create -g $resource_group -r $compute_gallery -i $image_definition \
+  --publisher example --offer example --sku standard \
+  --features SecurityType=ConfidentialVmSupported --os-type Linux --hyper-v-generation V2
+# Create image version. Adapt the name of the blob accordingly if you changed it above.
+az sig image-version create -g $resource_group -r $compute_gallery -i $image_definition -e $image_version \
+  --os-vhd-storage-account /subscriptions/$AZURE_SUBSCRIPTION_ID/resourceGroups/$resource_group/providers/Microsoft.Storage/storageAccounts/$storage_account \
+  --os-vhd-uri https://$storage_account.blob.core.windows.net/$storage_container/$image
+
+# Set $TEST_IMAGE for the test
+export TEST_IMAGE=/subscriptions/$AZURE_SUBSCRIPTION_ID/resourceGroups/$resource_group/providers/Microsoft.Compute/galleries/$compute_gallery/images/$image_definition/versions/$image_version
+```
+
+#### Running the tests
+
+To avoid confusion on shared subscriptions and/or clusters, you can export `TEST_NAMESPACE_PREFIX` and the created namespaces and resource groups will bear that prefix.
+
+```bash
+# Export $AZURE_SUBSCRIPTION_ID, $TEST_IMAGE as above
+# Set VIRT_PROVIDER
+export VIRT_PROVIDER=azure
+# Run tests, or run individual tests as described above
+make integration-tests
+```
diff --git a/tests/attestation.rs b/tests/attestation.rs
@@ -44,7 +44,7 @@ impl SingleAttestationContext {
         backend.create_vm().await?;
 
         test_ctx.info(format!("Waiting for VM {} to reach Running state", vm_name));
-        backend.wait_for_running(300).await?;
+        backend.wait_for_running(600).await?;
         test_ctx.info(format!("VM {} is Running", vm_name));
 
         test_ctx.info(format!("Waiting for SSH access to VM {}", vm_name));
@@ -101,8 +101,8 @@ async fn test_parallel_vm_attestation() -> anyhow::Result<()> {
     // Wait for both VMs to reach Running state in parallel
     test_ctx.info("Waiting for both VMs to reach Running state");
     let (vm1_running, vm2_running) = tokio::join!(
-        backend1.wait_for_running(300),
-        backend2.wait_for_running(300)
+        backend1.wait_for_running(600),
+        backend2.wait_for_running(600)
     );
 
     vm1_running?;
