// Module included in the following assemblies:
//
// * virt/virtual_machines/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.adoc

:_mod-docs-content-type: PROCEDURE
[id="virt-launching-ibm-secure-execution-vm-using-cli-ibm-z_{context}"]
= Launching an {ibm-title} Secure Execution VM by using the CLI

[role="_abstract"]
You can launch an {ibm-name} Secure Execution VM on {ibm-z-name} and {ibm-linuxone-name} by using the command-line interface.

To launch {ibm-name} Secure Execution VMs, you must include the `launchSecurity` parameter to the `VirtualMachine` manifest. The rest of the VM manifest depends on your setup.

.Procedure

* Apply a `VirtualMachine` manifest similar to the following, to the cluster:
+
[source,yaml]
----
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  labels:
    kubevirt.io/vm: f41-se
  name: f41-se
spec:
  runStrategy: Always
  template:
    metadata:
      labels:
        kubevirt.io/vm: f41-se
    spec:
      domain:
        launchSecurity: {}
        devices:
          disks:
          - disk:
              bus: virtio
            name: rootfs
        machine:
          type: ""
        resources:
          requests:
            memory: 4Gi
      terminationGracePeriodSeconds: 0
      volumes:
        - name: rootfs
          dataVolume:
            name: f41-se
----
+
where:

`spec.template.spec.domain.launchSecurity`:: Specifies to enable hardware-based memory encryption. 
+
[NOTE]
====
Because the memory of the VM is protected, you cannot live migrate {ibm-name} Secure Execution VMs. The VMs can only be migrated offline.
====