[Trusted launch VMSS] Roll-back support from TrustedLaunch to Standard

[AjKundnani]

[Trusted launch VMSS] Roll-back support from TrustedLaunch to Standard

[yanzhudd]

Hi @AjKundnani
Thanks for your confirmation! Sure, I'll add the warning message when rolling back to the Standard.

However, I cannot reproduce the second issue you mentioned:

Also, following command did not work while going from Gen1 OS image to Gen2 OS image with Trusted launch.

Could you please help to provide the az vmss create command you used to create the resource clivmss01?
BTW, I think this issue may not be related to this feature. I'll merge the PR firstly and then open another PR to fix this issue.

[AjKundnani]

Hi @AjKundnani Thanks for your confirmation! Sure, I'll add the warning message when rolling back to the Standard.

However, I cannot reproduce the second issue you mentioned:

Also, following command did not work while going from Gen1 OS image to Gen2 OS image with Trusted launch.

Could you please help to provide the az vmss create command you used to create the resource clivmss01? BTW, I think this issue may not be related to this feature. I'll merge the PR firstly and then open another PR to fix this issue.

Created VMSS through portal. But did multiple roll backs and roll forwards which could've caused this issue.
Attempted with new Gen1 VMSS and upgraded to Trusted launch successfully using same command.

az vmss update -g cli-vmss-rg -n clivmss02 --security-type TrustedLaunch --set virtualMachineProfile.storageProfile.imageReference.sku=2022-datacenter-azure-edition

[yonzhan]

Thank you for opening this issue, we will look into it.

[yanzhudd]

Hi @AjKundnani
could you please help to use this private package to verify if the changes meet your expectation?

[AjKundnani]

Hi @AjKundnani could you please help to use this private package to verify if the changes meet your expectation?

@yanzhudd , request to add following warning message when user is rolling back from TrustedLaunch to Standard security type.
Turning off Trusted launch disables foundational security for your VMs. For more information, visit https://aka.ms/TrustedLaunch

Also, following command did not work while going from Gen1 OS image to Gen2 OS image with Trusted launch.

az vmss update -g cli-vmss-rg -n clivmss01 --security-type TrustedLaunch --set virtualMachineProfile.storageProfile.imageReference.sku=2022-datacenter-azure-edition
Trusted Launch security type is supported on Hyper-V Generation 2 OS Images. To know more please visit https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch
(InvalidParameter) Disk Controller Type is only supported for VMs that are created from a Generation 2 Image or OS disk and VM Size that supports the same, refer to https://docs.microsoft.com/en-us/azure/virtual-machines/generation-2#creating-a-generation-2-vm for more details about creating Generation 2 VM.
Code: InvalidParameter
Message: Disk Controller Type is only supported for VMs that are created from a Generation 2 Image or OS disk and VM Size that supports the same, refer to https://docs.microsoft.com/en-us/azure/virtual-machines/generation-2#creating-a-generation-2-vm for more details about creating Generation 2 VM.
Target: storageProfile.diskControllerType

Validated following commands succesfully:

• az vmss update -g cli-vmss-rg -n clivmss01 --security-type Standard --set virtualMachineProfile.storageProfile.imageReference.sku=2019-datacenter
• az vmss update -g cli-vmss-rg -n clivmss01 --security-type Standard
• az vmss update -g cli-vmss-rg -n clivmss01 --security-type TrustedLaunch