Skip to content

Kanika/sod 857/encryption #851

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kmathur-1 merged 1 commit into from
Aug 19, 2026
Merged

Kanika/sod 857/encryption #851

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion api/services/ocean/aks/schemas/ocean-nodePoolProperties.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,4 +69,14 @@ properties:
linuxOSConfig:
$ref: "ocean-linuxOSConfig.yaml"
localDnsProfile:
$ref: "ocean-localDnsProfile.yaml"
$ref: "ocean-localDnsProfile.yaml"
encryptionAtHost:
type: boolean
description: |
Whether to enable host-based encryption for nodes launched from this virtual node group.
When set to true, use vmSizes.preferredVmSizes to provide compatible VM sizes.

IMPORTANT: This setting is immutable at the Azure infrastructure level once nodes are launched.
Changing this value requires a roll operation for new nodes to reflect the updated configuration.
example: true
default: false
8 changes: 8 additions & 0 deletions api/services/ocean/aks/schemas/ocean-vmSizes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,14 @@ title: Ocean AKS VM Sizes
description: >
The Ocean AKS VM Sizes object.
properties:
preferredVmSizes:

@sbeecha sbeecha Aug 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should preferredVmSizes be strictly required when encryptionAtHost is set to true?

Since Azure exposes SKU capabilities via the Resource SKUs API (Microsoft.Compute/skus), Ocean's backend/autoscaler could automatically filter and select VM sizes that support EncryptionAtHost rather than offloading this requirement to the user.

If preferredVmSizes is intended as an optional override rather than a requirement, we should probably update the description to clarify that it's optional for scoping allowed sizes.

az vm list-skus --location eastus --size Standard_D4s_v3 --output json
[
  {
    "capabilities": [
      {
        "name": "MaxResourceVolumeMB",
        "value": "32768"
      },
      {
        "name": "OSVhdSizeMB",
        "value": "1047552"
      },
      {
        "name": "vCPUs",
        "value": "4"
      },
      {
        "name": "MemoryPreservingMaintenanceSupported",
        "value": "True"
      },
      {
        "name": "HyperVGenerations",
        "value": "V1,V2"
      },
      {
        "name": "SupportedCapacityReservationTypes",
        "value": "Open,Targeted"
      },
      {
        "name": "SupportedEphemeralOSDiskPlacements",
        "value": "ResourceDisk,CacheDisk"
      },
      {
        "name": "MemoryGB",
        "value": "16"
      },
      {
        "name": "MaxDataDiskCount",
        "value": "8"
      },
      {
        "name": "CpuArchitectureType",
        "value": "x64"
      },
      {
        "name": "LowPriorityCapable",
        "value": "True"
      },
      {
        "name": "PremiumIO",
        "value": "True"
      },
      {
        "name": "VMDeploymentTypes",
        "value": "IaaS"
      },
      {
        "name": "vCPUsConstraintsAllowed",
        "value": "1, 2, 4"
      },
      {
        "name": "vCPUsAvailable",
        "value": "4"
      },
      {
        "name": "ACUs",
        "value": "160"
      },
      {
        "name": "vCPUsPerCore",
        "value": "2"
      },
      {
        "name": "CombinedTempDiskAndCachedIOPS",
        "value": "8000"
      },
      {
        "name": "CombinedTempDiskAndCachedReadBytesPerSecond",
        "value": "65536000"
      },
      {
        "name": "CombinedTempDiskAndCachedWriteBytesPerSecond",
        "value": "65536000"
      },
      {
        "name": "CachedDiskBytes",
        "value": "107374182400"
      },
      {
        "name": "UncachedDiskIOPS",
        "value": "6400"
      },
      {
        "name": "UncachedDiskBytesPerSecond",
        "value": "96000000"
      },
      {
        "name": "EphemeralOSDiskSupported",
        "value": "True"
      },
      {
        "name": "EncryptionAtHostSupported",
        "value": "True"
      },
      {
        "name": "CapacityReservationSupported",
        "value": "True"
      },
      {
        "name": "AcceleratedNetworkingEnabled",
        "value": "True"
      },
      {
        "name": "RdmaEnabled",
        "value": "False"
      },
      {
        "name": "MaxNetworkInterfaces",
        "value": "2"
      }
    ],
    "family": "standardDSv3Family",
    "locationInfo": [
      {
        "location": "eastus",
        "zoneDetails": [
          {
            "capabilities": [
              {
                "name": "UltraSSDAvailable",
                "value": "True"
              }
            ],
            "name": [
              "3",
              "2",
              "1"
            ]
          }
        ],
        "zones": [
          "3",
          "2",
          "1"
        ]
      }
    ],
    "locations": [
      "eastus"
    ],
    "name": "Standard_D4s_v3",
    "resourceType": "virtualMachines",
    "restrictions": [],
    "size": "D4s_v3",
    "tier": "Standard"
  }
]

@kmathur-1 kmathur-1 Aug 19, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is a requirement, this feature is implemented in consistency to EG

@sbeecha sbeecha Aug 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand you are keeping this in sync with EG, Maybe this capability wasn't exposed in API that time so asking user to provide known SKUs makes sense but was this product team decision explicitly for ocean too to get values from user rather than we handling it?

@kmathur-1 kmathur-1 Aug 19, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

User enables encryptionAtHost=true
→ Ocean picks optimal size for pod (e.g., Standard_D2s_v3)
→ Size doesn't support EAH
→ Azure VM launch fails with capability error
→ Pods stuck pending

for EG
User provides exhaustive spotSizes + odSizes lists (required)
Elastigroup can ONLY launch from those explicit lists
List IS the constraint - no dynamic discovery

@sbeecha sbeecha Aug 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

→ Ocean picks optimal size for pod (e.g., Standard_D2s_v3) - "but we should consider encrptionAtHost value as well from vm size api capabilities if true for VNG".

As you mentioned above for EG user provides spot and od list but not explicitly encriptionAtHost enabled vm size list. we would be filtering based on the vm capabilities.

@kmathur-1 kmathur-1 Aug 19, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here we are filtering EAH sizes from spot vm sizes

@sbeecha sbeecha Aug 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why don't we do the same in the ocean as well, based on the provided vmSizes instead of having one more preferredVmSizes list?

type: array
description: |
Preferred VM sizes for this virtual node group.
Used when nodePoolProperties.encryptionAtHost is true to constrain launches to compatible sizes.
items:
type: string
example: [ "Standard_D4s_v3", "Standard_D8s_v3" ]
filters:
type: object
description: |
Expand Down
12 changes: 11 additions & 1 deletion api/services/ocean/aks/schemas/update/ocean-nodePoolProperties.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,4 +58,14 @@ properties:
linuxOSConfig:
$ref: "../ocean-linuxOSConfig.yaml"
localDnsProfile:
$ref: "../ocean-localDnsProfile.yaml"
$ref: "../ocean-localDnsProfile.yaml"
encryptionAtHost:
type: boolean
description: |
Whether to enable host-based encryption for nodes launched from this virtual node group.
When set to true, use vmSizes.preferredVmSizes to provide compatible VM sizes.

IMPORTANT: This setting is immutable at the Azure infrastructure level once nodes are launched.
Changing this value requires a roll operation for new nodes to reflect the updated configuration.
example: true
default: false
Loading