Windows 11 and 2k22 use TPMs without persistent storage

[lyarwood]

What happened:

$subject, this can result in unbootable guests when using BitLocker encryption.

What you expected to happen:

Persistent TPM storage to be provided by the Windows 11 and 2k22 preferences to avoid guests using BitLocker encryption becoming unbootable.

How to reproduce it (as minimally and precisely as possible):

• Boot a Windows 11/2k22 VM using the associated preferences
• Use BitLocker encryption within the guest
• Reboot

Additional context:

Reported downstream against CNV v4.16.0 https://issues.redhat.com/browse/CNV-39710

Environment:

• KubeVirt version (use virtctl version): N/A
• Kubernetes version (use kubectl version): N/A
• VM or VMI specifications: N/A
• Cloud provider or hardware configuration: N/A
• OS (e.g. from /etc/os-release): N/A
• Kernel (e.g. uname -a): N/A
• Install tools: N/A
• Others: N/A

[lyarwood]

The PR has been closed as this isn't something we can enable by default in our Windows preferences at the moment. It might be in the future so I'm going to leave this issue open to remind us to revisit.

[fabiand]

@lyarwood we should actually enable this for Windows 11 as vTPM is a requirement there.

Win 10 is a different situation.

Can we work with core KubeVirt in order to GA persistent vTPM and get the FG removed in order to then add it to preferences?

[lyarwood]

@lyarwood we should actually enable this for Windows 11 as vTPM is a requirement there.

@fabiand I didn't think it required the vTPM to be persistent outside of the BitLocker use case but we can of course enable it and document the requirement for the FG.

Win 10 is a different situation.

Can we work with core KubeVirt in order to GA persistent vTPM and get the FG removed in order to then add it to preferences?

Yeah I can follow up with that today.

[fabiand]

BitLocker is part of Windows VBS, and VBS is something which we should support out of the box, therefore it is important to fix this issue quickly.

[lyarwood]

/reopen

[kubevirt-bot]

@lyarwood: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.