Kanika/sod 857/encryption

[kmathur-1]

adding encryptionAtHost in nodepool properties

[sbeecha]

Left one comment for clarification.

[sbeecha]

Should preferredVmSizes be strictly required when encryptionAtHost is set to true?

Since Azure exposes SKU capabilities via the Resource SKUs API (Microsoft.Compute/skus), Ocean's backend/autoscaler could automatically filter and select VM sizes that support EncryptionAtHost rather than offloading this requirement to the user.

If preferredVmSizes is intended as an optional override rather than a requirement, we should probably update the description to clarify that it's optional for scoping allowed sizes.

az vm list-skus --location eastus --size Standard_D4s_v3 --output json
[
  {
    "capabilities": [
      {
        "name": "MaxResourceVolumeMB",
        "value": "32768"
      },
      {
        "name": "OSVhdSizeMB",
        "value": "1047552"
      },
      {
        "name": "vCPUs",
        "value": "4"
      },
      {
        "name": "MemoryPreservingMaintenanceSupported",
        "value": "True"
      },
      {
        "name": "HyperVGenerations",
        "value": "V1,V2"
      },
      {
        "name": "SupportedCapacityReservationTypes",
        "value": "Open,Targeted"
      },
      {
        "name": "SupportedEphemeralOSDiskPlacements",
        "value": "ResourceDisk,CacheDisk"
      },
      {
        "name": "MemoryGB",
        "value": "16"
      },
      {
        "name": "MaxDataDiskCount",
        "value": "8"
      },
      {
        "name": "CpuArchitectureType",
        "value": "x64"
      },
      {
        "name": "LowPriorityCapable",
        "value": "True"
      },
      {
        "name": "PremiumIO",
        "value": "True"
      },
      {
        "name": "VMDeploymentTypes",
        "value": "IaaS"
      },
      {
        "name": "vCPUsConstraintsAllowed",
        "value": "1, 2, 4"
      },
      {
        "name": "vCPUsAvailable",
        "value": "4"
      },
      {
        "name": "ACUs",
        "value": "160"
      },
      {
        "name": "vCPUsPerCore",
        "value": "2"
      },
      {
        "name": "CombinedTempDiskAndCachedIOPS",
        "value": "8000"
      },
      {
        "name": "CombinedTempDiskAndCachedReadBytesPerSecond",
        "value": "65536000"
      },
      {
        "name": "CombinedTempDiskAndCachedWriteBytesPerSecond",
        "value": "65536000"
      },
      {
        "name": "CachedDiskBytes",
        "value": "107374182400"
      },
      {
        "name": "UncachedDiskIOPS",
        "value": "6400"
      },
      {
        "name": "UncachedDiskBytesPerSecond",
        "value": "96000000"
      },
      {
        "name": "EphemeralOSDiskSupported",
        "value": "True"
      },
      {
        "name": "EncryptionAtHostSupported",
        "value": "True"
      },
      {
        "name": "CapacityReservationSupported",
        "value": "True"
      },
      {
        "name": "AcceleratedNetworkingEnabled",
        "value": "True"
      },
      {
        "name": "RdmaEnabled",
        "value": "False"
      },
      {
        "name": "MaxNetworkInterfaces",
        "value": "2"
      }
    ],
    "family": "standardDSv3Family",
    "locationInfo": [
      {
        "location": "eastus",
        "zoneDetails": [
          {
            "capabilities": [
              {
                "name": "UltraSSDAvailable",
                "value": "True"
              }
            ],
            "name": [
              "3",
              "2",
              "1"
            ]
          }
        ],
        "zones": [
          "3",
          "2",
          "1"
        ]
      }
    ],
    "locations": [
      "eastus"
    ],
    "name": "Standard_D4s_v3",
    "resourceType": "virtualMachines",
    "restrictions": [],
    "size": "D4s_v3",
    "tier": "Standard"
  }
]

[kmathur-1]

it is a requirement, this feature is implemented in consistency to EG

[sbeecha]

I understand you are keeping this in sync with EG, Maybe this capability wasn't exposed in API that time so asking user to provide known SKUs makes sense but was this product team decision explicitly for ocean too to get values from user rather than we handling it?

[kmathur-1]

User enables encryptionAtHost=true
→ Ocean picks optimal size for pod (e.g., Standard_D2s_v3)
→ Size doesn't support EAH
→ Azure VM launch fails with capability error
→ Pods stuck pending

for EG
User provides exhaustive spotSizes + odSizes lists (required)
Elastigroup can ONLY launch from those explicit lists
List IS the constraint - no dynamic discovery

[sbeecha]

→ Ocean picks optimal size for pod (e.g., Standard_D2s_v3) - "but we should consider encrptionAtHost value as well from vm size api capabilities if true for VNG".

As you mentioned above for EG user provides spot and od list but not explicitly encriptionAtHost enabled vm size list. we would be filtering based on the vm capabilities.

[kmathur-1]

here we are filtering EAH sizes from spot vm sizes

[sbeecha]

Why don't we do the same in the ocean as well, based on the provided vmSizes instead of having one more preferredVmSizes list?