Using virtual Trusted Platform Module devices - Managing VMs | Virtualization

About vTPM devices
Adding a vTPM device to a virtual machine

Add a virtual Trusted Platform Module (vTPM) device to a new or existing virtual machine by editing the VirtualMachine (VM) or VirtualMachineInstance (VMI) manifest.

With OKD Virtualization 4.18 and newer, you can export virtual machines (VMs) with attached vTPM devices, create snapshots of these VMs, and restore VMs from these snapshots. However, cloning a VM with a vTPM device attached to it or creating a new VM from its snapshot is not supported.

About vTPM devices

A virtual Trusted Platform Module (vTPM) device functions like a physical Trusted Platform Module (TPM) hardware chip. You can use a vTPM device with any operating system, but Windows 11 requires the presence of a TPM chip to install or boot. A vTPM device allows VMs created from a Windows 11 image to function without a physical TPM chip.

OKD Virtualization supports persisting vTPM device state by using Persistent Volume Claims (PVCs) for VMs. If you do not specify the storage class for this PVC, OKD Virtualization uses the default storage class for virtualization workloads. If the default storage class for virtualization workloads is not set, OKD Virtualization uses the default storage class for the cluster.

The storage class that is marked as default for virtualization workloads has the annotation storageclass.kubevirt.io/is-default-virt-class set to "true". You can find this storage class by running the following command:

$ oc get sc -o jsonpath='{range .items[?(.metadata.annotations.storageclass\.kubevirt\.io/is-default-virt-class=="true")]}{.metadata.name}{"\n"}{end}'

Similarly, the default storage class for the cluster has the annotation storageclass.kubernetes.io/is-default-class set to "true". To find this storage class, run the following command:

$ oc get sc -o jsonpath='{range .items[?(.metadata.annotations.storageclass\.kubernetes\.io/is-default-class=="true")]}{.metadata.name}{"\n"}{end}'

To ensure consistent behavior, configure only one storage class as the default for virtualization workloads and for the cluster respectively.

It is recommended that you specify the storage class explicitly by setting the vmStateStorageClass attribute in the HyperConverged custom resource (CR):

kind: HyperConverged
metadata:
  name: kubevirt-hyperconverged
spec:
  vmStateStorageClass: <storage_class_name>

# ...

If you do not enable vTPM, then the VM does not recognize a TPM device, even if the node has one.

Adding a vTPM device to a virtual machine

Adding a virtual Trusted Platform Module (vTPM) device to a virtual machine (VM) allows you to run a VM created from a Windows 11 image without a physical TPM device. A vTPM device also stores secrets for that VM.

Prerequisites

You have installed the OpenShift CLI (oc).

Procedure

Run the following command to update the VM configuration:
```
$ oc edit vm <vm_name> -n <namespace>
```

Edit the VM specification to add the vTPM device. For example:

apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
    name: example-vm
spec:
  template:
    spec:
      domain:
        devices:
          tpm:  (1)
            persistent: true (2)
# ...

1	Adds the vTPM device to the VM.
2	Specifies that the vTPM device state persists after the VM is shut down. The default value is `false`.

To apply your changes, save and exit the editor.
Optional: If you edited a running virtual machine, you must restart it for the changes to take effect.