From 2d5af58377113441629c63b29f4a4d78f1d438a7 Mon Sep 17 00:00:00 2001
From: Kanika Mathur <kmathur>
Date: Wed, 19 Aug 2026 13:32:53 +0530
Subject: [PATCH] SOD-857 update encryption schemas

---
 .../ocean/aks/schemas/ocean-nodePoolProperties.yaml  | 12 +++++++++++-
 api/services/ocean/aks/schemas/ocean-vmSizes.yaml    |  8 ++++++++
 .../aks/schemas/update/ocean-nodePoolProperties.yaml | 12 +++++++++++-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/api/services/ocean/aks/schemas/ocean-nodePoolProperties.yaml b/api/services/ocean/aks/schemas/ocean-nodePoolProperties.yaml
index 9aa5ed65c..d652ba177 100644
--- a/api/services/ocean/aks/schemas/ocean-nodePoolProperties.yaml
+++ b/api/services/ocean/aks/schemas/ocean-nodePoolProperties.yaml
@@ -69,4 +69,14 @@ properties:
   linuxOSConfig:
     $ref: "ocean-linuxOSConfig.yaml"
   localDnsProfile:
-    $ref: "ocean-localDnsProfile.yaml"
\ No newline at end of file
+    $ref: "ocean-localDnsProfile.yaml"
+  encryptionAtHost:
+    type: boolean
+    description: |
+      Whether to enable host-based encryption for nodes launched from this virtual node group.
+      When set to true, use vmSizes.preferredVmSizes to provide compatible VM sizes.
+      
+      IMPORTANT: This setting is immutable at the Azure infrastructure level once nodes are launched.
+      Changing this value requires a roll operation for new nodes to reflect the updated configuration.
+    example: true
+    default: false
\ No newline at end of file
diff --git a/api/services/ocean/aks/schemas/ocean-vmSizes.yaml b/api/services/ocean/aks/schemas/ocean-vmSizes.yaml
index 9189d5f22..d62773169 100644
--- a/api/services/ocean/aks/schemas/ocean-vmSizes.yaml
+++ b/api/services/ocean/aks/schemas/ocean-vmSizes.yaml
@@ -3,6 +3,14 @@ title: Ocean AKS VM Sizes
 description: >
   The Ocean AKS VM Sizes object.
 properties:
+  preferredVmSizes:
+    type: array
+    description: |
+      Preferred VM sizes for this virtual node group.
+      Used when nodePoolProperties.encryptionAtHost is true to constrain launches to compatible sizes.
+    items:
+      type: string
+    example: [ "Standard_D4s_v3", "Standard_D8s_v3" ]
   filters:
     type: object
     description: |
diff --git a/api/services/ocean/aks/schemas/update/ocean-nodePoolProperties.yaml b/api/services/ocean/aks/schemas/update/ocean-nodePoolProperties.yaml
index 5603e44ac..ea989fb80 100644
--- a/api/services/ocean/aks/schemas/update/ocean-nodePoolProperties.yaml
+++ b/api/services/ocean/aks/schemas/update/ocean-nodePoolProperties.yaml
@@ -58,4 +58,14 @@ properties:
   linuxOSConfig:
     $ref: "../ocean-linuxOSConfig.yaml"
   localDnsProfile:
-    $ref: "../ocean-localDnsProfile.yaml"
\ No newline at end of file
+    $ref: "../ocean-localDnsProfile.yaml"
+  encryptionAtHost:
+    type: boolean
+    description: |
+      Whether to enable host-based encryption for nodes launched from this virtual node group.
+      When set to true, use vmSizes.preferredVmSizes to provide compatible VM sizes.
+      
+      IMPORTANT: This setting is immutable at the Azure infrastructure level once nodes are launched.
+      Changing this value requires a roll operation for new nodes to reflect the updated configuration.
+    example: true
+    default: false
\ No newline at end of file