[ZSV-12866] migrate vTPM/KMS zstack support - #4682

Open

ZStack-Robot wants to merge 122 commits into

feature-5.5.38-kms-vtpmfrom

sync/zhong.zhou/zsv-kms-vtpm-migration@@3

Commits on Aug 17, 2026

<fix>[kvm]: add VM edk tags

Zhang Wenhao
authored and
zhong.zhou
committed
960b0d7
<feature>[header]: add TPM depandency

Zhang Wenhao
authored and
zhong.zhou
committed
aedb011
<feature>[compute]: support create VM with TPM

Zhang Wenhao
authored and
zhong.zhou
committed
b49144f
<feature>[compute]: add secure boot dependency

Zhang Wenhao
authored and
zhong.zhou
committed
9dc0572
<feature>[kms]: support kms

tao.yang
authored and
zhong.zhou
committed
da8f115
<fix>[kvm]: update KVMGlobalConfig default value to "None"

Zhang Wenhao
authored and
zhong.zhou
committed
cd084cd
<fix>[kvm]: continue to update KVMGlobalConfig default value to "None"

Zhang Wenhao
authored and
zhong.zhou
committed
0f1a23c
<fix>[conf]: update default value of secure.boot global config to false

Zhang Wenhao
authored and
zhong.zhou
committed
21c1014

Commits on Aug 18, 2026

<feature>[compute]: introduce NvRam type volume

Zhang Wenhao
authored and
zhong.zhou
committed
05c3bc8
<feature>[localstorage]: support create empty volume in raw types

Zhang Wenhao
authored and
zhong.zhou
committed
84b4024
<fix>[localstorage]: remame CreateEmptyVolumeCmd.format to volumeFormat

Zhang Wenhao
authored and
zhong.zhou
committed
3821c6d
<feature>[header]: introduce VmHostFileVO

Zhang Wenhao
authored and
zhong.zhou
committed
6204533
<feature>[header]: merge TpmHostRefVO to VmHostFileVO

Zhang Wenhao
authored and
zhong.zhou
committed
51b34cb
<fix>[sdk]: rekey API and root key synchronization

tao.yang
authored and
zhong.zhou
committed
6ffd613
<fix>[header]: Envelope wrapper dek to compute
zhong.zhou
committed
32803e7
<fix>[kvm]: Remove rotate public key in initial pingHook
zhong.zhou
committed
74e85a6
<fix>[header]: Hide dek in log
zhong.zhou
committed
c64e794
<fix>[kvm]: fix swtpm path error

Zhang Wenhao
authored and
zhong.zhou
committed
637ff5c
<fix>[kvm]: Move some logic to premium
zhong.zhou
committed
1cf6a8d
<fix>[kvm]: update condition write VM host file

Zhang Wenhao
authored and
zhong.zhou
committed
e92a56e
<fix>[kvm]: Remove unused envelopeDekBase64
zhong.zhou
committed
a43134d
<feature>[kvm]: support clone for TPM VM

Zhang Wenhao
authored and
zhong.zhou
committed
28f4c3d
<feature>[kvm]: support to start VM with VmHostBackupFileVO

Zhang Wenhao
authored and
zhong.zhou
committed
c6c189b
<feature>[kvm]: clean VmHostFileVO after VM destroy

Zhang Wenhao
authored and
zhong.zhou
committed
12a86fd
<feature>[kvm]: introduce VmHostBackupFileVO

Zhang Wenhao
authored and
zhong.zhou
committed
7df8afa
<feature>[compute]: persist resource key when creating VM

Zhang Wenhao
authored and
zhong.zhou
committed
768078a
<fix>[header]: fix reference error in VmHostFileContentVO

Zhang Wenhao
authored and
zhong.zhou
committed
e3b2d3a
<feature>[compute]: prepare DEK on instantiating VM resource

Zhang Wenhao
authored and
zhong.zhou
committed
82a00b6
<fix>[kvm]: prepare nvram folder before migrate VM

Zhang Wenhao
authored and
zhong.zhou
committed
c7789c0
<fix>[conf]: move premium errors xml to premium module

Zhang Wenhao
authored and
zhong.zhou
committed
398f63b
<feature>[kvm]: support take snapshot on VM offline

Zhang Wenhao
authored and
zhong.zhou
committed
e6e7921
<feature>[kvm]: introduce SyncVmHostFilesFromHostMsg

Zhang Wenhao
authored and
zhong.zhou
committed
07e8e14
<feature>[kvm]: reset TPM state after VM reimage

Zhang Wenhao
authored and
zhong.zhou
committed
9f72347
<feature>[keyprovider]: Add DEK provisioning for TPM

tao.yang
authored and
zhong.zhou
committed
68a9f9d
<feature>[kvm]: refactor VmHostFileTO to support different operations

Zhang Wenhao
authored and
zhong.zhou
committed
a64f204
<feature>[kvm]: sync VM host files when releasing VM resource

Zhang Wenhao
authored and
zhong.zhou
committed
608269c
<feature>[kvm]: sync VM host files after migration

Zhang Wenhao
authored and
zhong.zhou
committed
e4d8ad5
<feature>[kvm]: reset TPM state on VM reimage

Zhang Wenhao
authored and
zhong.zhou
committed
d8a90fd
<refactor>[kvm]: batch query VM host file content

Zhang Wenhao
authored and
zhong.zhou
committed
22de7bb
<feature>[kvm]: reset TPM state after VM clone

Zhang Wenhao
authored and
zhong.zhou
committed
5c0425f
<feature>[kvm]: use SQLBatch for TPM state reset

Zhang Wenhao
authored and
zhong.zhou
committed
a4ed577
<feature>[kvm]: add VM host file periodic sync tracker

Zhang Wenhao
authored and
zhong.zhou
committed
6479d74
<feature>[kvm]: make VM host file sync configurable

Zhang Wenhao
authored and
zhong.zhou
committed
7348552
<feature>[kvm]: add lastSyncReason to track VM host file sync

Zhang Wenhao
authored and
zhong.zhou
committed
6cb5d33
<feature>[kvm]: add key provider binding to TPM operations

Zhang Wenhao
authored and
zhong.zhou
committed
244b5d9
<refactor>[kvm]: move VM host file cleanup to new extension point

Zhang Wenhao
authored and
zhong.zhou
committed
0721139
<test>[kvm]: remove NvRam volume supports

Zhang Wenhao
authored and
zhong.zhou
committed
71ac0f1
<feature>[vm]: add TPM and NvRam restore support for snapshot group

Zhang Wenhao
authored and
zhong.zhou
committed
67fdf88
<refactor>[kvm]: introduce VM host file base classes for backup tracking

Zhang Wenhao
authored and
zhong.zhou
committed
8206383
<feature>[kvm]: support TPM key provider restore from snapshot group

Zhang Wenhao
authored and
zhong.zhou
committed
db489a3
<fix>[compute]: add opaque on check root disk settings failed

Zhang Wenhao
authored and
zhong.zhou
committed
a9c94ff
<chore>[storage]: improve error message in VolumeSnapshotApiInterceptor

Zhang Wenhao
authored and
zhong.zhou
committed
c833fcf
<refactor>[header]: add APINoSee to backupFileUuid fields

Zhang Wenhao
authored and
zhong.zhou
committed
c4b057b
<feature>[kvm]: add online snapshot support for VM host files

Zhang Wenhao
authored and
zhong.zhou
committed
0ea2d67
<fix>[header]: remove invalid notes on VmHostFileBackupJob

Zhang Wenhao
authored and
zhong.zhou
committed
2d0c250
<feature>[kvm]: register VolumeSnapshotCreationExtensionPoint

Zhang Wenhao
authored and
zhong.zhou
committed
ec4346d
<feature>[kvm]: add hostfile backup agent command

Zhang Wenhao
authored and
zhong.zhou
committed
d77894e
<fix>[kvm]: fix invalid edk version tag error

Zhang Wenhao
authored and
zhong.zhou
committed
c13c24b
<refactor>[kvm]: reorganize vm host file management packages

Zhang Wenhao
authored and
zhong.zhou
committed
9deb209
<feature>[kvm]: add os spec machine type support

Zhang Wenhao
authored and
zhong.zhou
committed
80301ad
<feature>[kvm]: persist machine type to system tag

Zhang Wenhao
authored and
zhong.zhou
committed
2ddb3cd
<refactor>[vm]: move nvram to devices spec and add backup support

Zhang Wenhao
authored and
zhong.zhou
committed
62a4505
<fix>[compute]: add allowed.tpm.vm.without.kms global config

Zhang Wenhao
authored and
zhong.zhou
committed
6b49d62
<fix>[kvm]: support secure boot for primary storage migration

Zhang Wenhao
authored and
zhong.zhou
committed
65dee6e
<feature>[kvm]: add periodic cleanup for expired VM host files

Zhang Wenhao
authored and
zhong.zhou
committed
acc71b8
<refactor>[kvm]: improve TPM removal by cleaning host files before DB deletion

Zhang Wenhao
authored and
zhong.zhou
committed
ea17721
<feature>[log]: add LongText type for logging long content safely

Zhang Wenhao
authored and
zhong.zhou
committed
8e54fa4
<fix>[kvm]: add null check for dstHostUuid in secure boot

Zhang Wenhao
authored and
zhong.zhou
committed
9b1894e
<fix>[core]: enforce propagateExceptionTo before lambda handlers

Zhang Wenhao
authored and
zhong.zhou
committed
524e6e7
<refactor>[kvm]: reset TPM via data plane before DB cleanup

Zhang Wenhao
authored and
zhong.zhou
committed
02509d6
<fix>[kvm]: skip key provider attach when no KMS

Zhang Wenhao
authored and
zhong.zhou
committed
eb7c707
<refactor>[kvm]: use enum for vm host file sync reasons

Zhang Wenhao
authored and
zhong.zhou
committed
66232d7
<refactor>[kvm]: prepare NvRam host-file before migration

Zhang Wenhao
authored and
zhong.zhou
committed
a71678b
<feature>[kvm]: sync VM host files before HA start

Zhang Wenhao
authored and
zhong.zhou
committed
d793e4c
<fix>[crypto]: keep TPM key ref until VM removed from DB
zhong.zhou
committed
06fbd77
<feature>[kvm]: periodic check and sync for VM host files

Zhang Wenhao
authored and
zhong.zhou
committed
393a445
<fix>[kvm]: remove TPM from VM individually instead of batch delete

Zhang Wenhao
authored and
zhong.zhou
committed
234ee58
<feature>[kvm]: support TPM revert without KMS

Zhang Wenhao
authored and
zhong.zhou
committed
28b349e
<fix>[kvm]: fix NVRAM migration handler duplicate call

Zhang Wenhao
authored and
zhong.zhou
committed
5d95b73
<fix>[kvm]: clone resource ref when revert snapshot
zhong.zhou
committed
e0d8a11
<fix>[crypto]: secret get in vm pre instantiate
zhong.zhou
committed
0984367
<fix>[kvm]: remove TPM when VM deleted from DB

Zhang Wenhao
authored and
zhong.zhou
committed
bbcb140
<fix>[kms]: add delete secret for vm

zsphere-opensource
authored and
zhong.zhou
committed
06b6e15
<fix>[kms]: add test case for delete secret

zsphere-opensource
authored and
zhong.zhou
committed
38c4ab6
<fix>[crypto]: fix conflict and review

Zhang Wenhao
authored and
zhong.zhou
committed
90b9b50
<fix>[kvm]: fix NPE in VmHostFileTracker sync

Zhang Wenhao
authored and
zhong.zhou
committed
f43d587
<fix>[kvm]: disable host status check when syncing VM host files

Zhang Wenhao
authored and
zhong.zhou
committed
7144190
<fix>[kvm]: mark TPM VM host files changed on start/shutdown

Zhang Wenhao
authored and
zhong.zhou
committed
fa7c72c
<fix>[kvm]: define secret on migrate destination
zhong.zhou
committed
f6c1e5b
<fix>[kvm]: fail VM start when host file changed but sync fails

Zhang Wenhao
authored and
zhong.zhou
committed
004e22c
<fix>[header]: add Tpm cascade extensions

Zhang Wenhao
authored and
zhong.zhou
committed
4ccdb71
<fix>[kvm]: revert block vm start if TPM is not latest

Zhang Wenhao
authored and
zhong.zhou
committed
6b0b439
<fix>[kvm]: add auto-completer for VM host file TPM reset config

Zhang Wenhao
authored and
zhong.zhou
committed
106cc39
<feature>[kvm]: add allocator filter for VM with unsynchronized host files

Zhang Wenhao
authored and
zhong.zhou
committed
d33279d
<fix>[kvm]: Fix vm start fail after nkp restore

zsphere-opensource
authored and
zhong.zhou
committed
71bc787
<fix>[kvm]: create key when attach tpm
zhong.zhou
committed
1e23ed6
<fix>[kvm]: skip sync VM host file is not changed

Zhang Wenhao
authored and
zhong.zhou
committed
b6c16b6
<fix>[kvm]: remove bad check in KvmSecureBootManager syncing step

Zhang Wenhao
authored and
zhong.zhou
committed
964b435
<fix>[kvm]: save EncryptedResourceKeyRefVO when sync VmHostFile to backup

Zhang Wenhao
authored and
zhong.zhou
committed
adfedfa
<fix>[kvm]: use domain XML secret UUID for vTPM migrate
zhong.zhou
committed
fb8f287
<fix>[kvm]: rename RemoveTpmMsg to TpmDeletionMsg

Zhang Wenhao
authored and
zhong.zhou
committed
65bb75d
<fix>[kvm]: support to handle "/vm/hostfile/changed" event from kvmagent

Zhang Wenhao
authored and
zhong.zhou
committed
115d61c
<fix>[kvm]: wrapper createBackupBase step by try...catch

Zhang Wenhao
authored and
zhong.zhou
committed
22eba67
<fix>[kvm]: add ignoreSyncError in CloneVmHostFileMsg

Zhang Wenhao
authored and
zhong.zhou
committed
8d1085b
<fix>[kvm]: sync VM host files before migration based on changeDate

Zhang Wenhao
authored and
zhong.zhou
committed
912b1ec
<fix>[kvm]: simplify resetTpm checker in SnapshotGroupRevertTpmHelper

Zhang Wenhao
authored and
zhong.zhou
committed
5fe5e00
<fix>[kvm]: sync dirty vm host files for stopped VMs

Zhang Wenhao
authored and
zhong.zhou
committed
96f0722
<fix>[kvm]: reject stale vm host file in secure boot flow

Zhang Wenhao
authored and
zhong.zhou
committed
1b72062
<fix>[kvm]: support reset tpm to a new default key provider
zhong.zhou
committed
77c95c0
<fix>[kvm]: clean resource key before sync VmHostFile to backup

Zhang Wenhao
authored and
zhong.zhou
committed
59fcfc6
<fix>[kvm]: KvmSecureBootExt no longer implement JustBeforeDeleteExtension

Zhang Wenhao
authored and
zhong.zhou
committed
5a39c8a
<feature>[compute]: introduce VmExpungeVmResourceCascadeFlow

Zhang Wenhao
authored and
zhong.zhou
committed
218838b
<fix>[kvm]: clean VmHostFile by message in VmHostFileTracker

Zhang Wenhao
authored and
zhong.zhou
committed
9239eaf
<fix>[kvm]: detach resource key from VmHostBackupFileVO when remove TpmVO

Zhang Wenhao
authored and
zhong.zhou
committed
a379d81
<fix>[storage]: clean VmHostBackupFileVO when VolumeSnapshot ungroup

Zhang Wenhao
authored and
zhong.zhou
committed
5001214
<fix>[compute]: hard delete host file if created state vm destroyed

Zhang Wenhao
authored and
zhong.zhou
committed
1374b5c
<fix>[header]: backup resource key after taking memory snapshot group

Zhang Wenhao
authored and
zhong.zhou
committed
9818cff
<feature>[storage]: support restore TPM when reverting snapshot group

Zhang Wenhao
authored and
zhong.zhou
committed
de571b9
<fix>[header]: rename BackupVmTpmMsg and RestoreVmTpmMsg

Zhang Wenhao
authored and
zhong.zhou
committed
f4762b0
<feature>[header]: Add TPM key backup for snapshot revert and rollback

Zhang Wenhao
authored and
zhong.zhou
committed
6abea6e
<fix>[generated]: collect vTPM and KMS schema and SDK artifacts
zhong.zhou
committed
ef52edd
<fix>[zstack]: adapt vTPM migration compile issues
zhong.zhou
committed
4ead394