// Module included in the following assemblies:
//
// * machine_management/creating_machinesets/creating-machineset-azure.adoc
// * machine_management/control_plane_machine_management/cpmso_provider_configurations/cpmso-config-options-azure.adoc

ifeval::["{context}" == "cpmso-supported-features-azure"]
:cpmso:
endif::[]

:_mod-docs-content-type: PROCEDURE
[id="machineset-azure-trusted-launch_{context}"]
= Configuring trusted launch for {azure-short} virtual machines by using machine sets

[role="_abstract"]
By editing the machine set YAML file, you can configure the trusted launch for {azure-full} virtual machines (VMs) options that a machine set uses for machines that it deploys. 

For example, you can configure these machines to use UEFI security features such as Secure Boot or a dedicated virtual Trusted Platform Module (vTPM) instance.

[NOTE]
====
Some feature combinations result in an invalid configuration.
====

.UEFI feature combination compatibility
|====
|Secure Boot^[1]^ |vTPM^[2]^ |Valid configuration

|Enabled
|Enabled
|Yes

|Enabled
|Disabled
|Yes

|Enabled
|Omitted
|Yes

|Disabled
|Enabled
|Yes

|Omitted
|Enabled
|Yes

|Disabled
|Disabled
|No

|Omitted
|Disabled
|No

|Omitted
|Omitted
|No
|====
[.small]
--
1. Using the `secureBoot` field.
2. Using the `virtualizedTrustedPlatformModule` field.
--

For more information about related features and functionality, see the {azure-full} documentation about link:https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch[Trusted launch for {azure-short} virtual machines].

.Procedure

. In a text editor, open the YAML file for an existing machine set or create a new one.

. Edit the following section under the `providerSpec` field to provide a valid configuration:
+
.Sample valid configuration with UEFI Secure Boot and vTPM enabled
[source,yaml]
----
ifndef::cpmso[]
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
endif::cpmso[]
ifdef::cpmso[]
apiVersion: machine.openshift.io/v1
kind: ControlPlaneMachineSet
endif::cpmso[]
# ...
spec:
  template:
    machines_v1beta1_machine_openshift_io:
      spec:
        providerSpec:
          value:
            securityProfile:
              settings:
                securityType: TrustedLaunch
                trustedLaunch:
                  uefiSettings:
                    secureBoot: Enabled
                    virtualizedTrustedPlatformModule: Enabled
# ...
----
+
where:
+
`spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.securityProfile.settings.securityType`:: Enables the use of trusted launch for {azure-short} virtual machines. This value is required for all valid configurations.
`spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.securityProfile.settings.trustedLaunch.uefiSettings`:: Specifies which UEFI security features to use. This section is required for all valid configurations.
`spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.securityProfile.settings.trustedLaunch.uefiSettings.secureBoot`:: Enables UEFI Secure Boot.
`spec.template.machines_v1beta1_machine_openshift_io.spec.providerSpec.value.securityProfile.settings.trustedLaunch.uefiSettings.virtualizedTrustedPlatformModule`:: Enables the use of a vTPM.

.Verification

* On the {azure-full} portal, review the details for a machine deployed by the machine set and verify that the trusted launch options match the values that you configured.

ifeval::["{context}" == "cpmso-supported-features-azure"]
:!cpmso:
endif::[]
