Support Azure Trusted Launch security profiles

[s4heid]

Checklist:

Please check each of the boxes below for which you have completed the corresponding task:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• All unit tests pass locally (after my changes)
• Rubocop reports zero errors (after my changes)

Changelog

• Add an opt-in security_profile VM cloud property supporting Azure TrustedLaunch and Standard.
• When Trusted Launch is requested, enable vTPM and default Secure Boot to enabled, while allowing Secure Boot to be disabled for unsigned kernels or drivers

Azure Trusted Launch protects the VM boot chain and supports measured-boot attestation. This change allows compatible Gen2 stemcells (must include the signed binaries: cloudfoundry/bosh-linux-stemcell-builder#697) to use those protections by including the required securityProfile in Azure VM creation requests. Preserves existing behavior when security_profile is omitted in the cloud_properties.

Example cloud config

vm_types:
  - name: secure
    cloud_properties:
      instance_type: Standard_D2as_v6
      security_profile:                # optional
        security_type: TrustedLaunch   # optional. accepts "Standard" and "TrustedLaunch".
        secure_boot_enabled: true      # optional. defaults to true for TrustedLaunch and false for Standard

[coderabbitai]

Walkthrough

Adds a validated Azure security profile model supporting Trusted Launch and Standard configurations. VM properties now parse optional security profiles, VM creation propagates them through VM parameters, and Azure requests serialize security type, Secure Boot, and vTPM settings. The compute API version is updated to 2025-11-01, with unit coverage for validation, property parsing, VM parameter generation, and request payloads.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding Azure Trusted Launch security profile support.
Description check	✅ Passed	The description is directly related to the changeset and accurately describes the new security_profile feature and behavior.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/bosh_azure_cpi/lib/cloud/azure/vms/vm_manager.rb`:
- Around line 142-147: Validate Trusted Launch in the VM creation flow after
stemcell_info and vm_props.instance_type are resolved, before security_profile
is added to vm_params. Reject TrustedLaunch when the source stemcell is not Gen2
or the resolved instance_type does not support Trusted Launch, returning the CPI
validation error rather than proceeding to ARM provisioning; add coverage for
both unsupported source and SKU cases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bf579769-171d-4871-9245-6c0128ccc498

📥 Commits

Reviewing files that changed from the base of the PR and between 1022631 and 04d922e.

📒 Files selected for processing (11)

• src/bosh_azure_cpi/lib/cloud/azure.rb
• src/bosh_azure_cpi/lib/cloud/azure/models/security_profile.rb
• src/bosh_azure_cpi/lib/cloud/azure/models/vm_cloud_props.rb
• src/bosh_azure_cpi/lib/cloud/azure/restapi/azure_client.rb
• src/bosh_azure_cpi/lib/cloud/azure/utils/helpers.rb
• src/bosh_azure_cpi/lib/cloud/azure/vms/vm_manager.rb
• src/bosh_azure_cpi/spec/spec_helper.rb
• src/bosh_azure_cpi/spec/unit/azure_client/create_virtual_machine_spec.rb
• src/bosh_azure_cpi/spec/unit/models/security_profile_spec.rb
• src/bosh_azure_cpi/spec/unit/models/vm_cloud_props_spec.rb
• src/bosh_azure_cpi/spec/unit/vm_manager/create/security_profile_spec.rb