Add CVM configurable cluster quickstart template with confidentialVmIntent parameter

Author: rajeshkumarar

quickstarts/microsoft.azurestackhci/create-cvm-configurable-cluster/README.md

@@ -0,0 +1,101 @@
+---
+description: This template creates a Confidential VM (CVM) ready Azure Stack HCI cluster using an ARM template.
+page_type: sample
+products:
+- azure
+- azure-resource-manager
+urlFragment: create-cvm-configurable-cluster
+languages:
+- json
+---
+# Deploy a Confidential VM (CVM) ready Azure Stack HCI Cluster
+
+## Introduction
+
+Confidential VMs (CVM) offer strong security and confidentiality benefits over standard VMs. CVMs provide a robust hardware-based isolation between other virtual machines, the hypervisor, and host management code.
+
+This template deploys an Azure Stack HCI cluster configured with the `confidentialVmIntent` parameter set to **Enable**, which is required for deploying Confidential VMs on Azure Local.
+
+Without specifying this parameter, the creation of CVMs will fail. Additionally, setting this parameter may slightly impact the CPU performance for some workloads (both CVMs and standard VMs).
+
+[![Deploy To Azure](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazure.svg?sanitize=true)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.azurestackhci%2Fcreate-cvm-configurable-cluster%2Fazuredeploy.json)
+[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.azurestackhci%2Fcreate-cvm-configurable-cluster%2Fazuredeploy.json)
+
+## Prerequisites
+
+### Hardware Requirements
+
+CVM deployment has been validated on Lenovo servers with AMD Genoa Gen 4 CPU:
+
+1. ThinkAgile MX455 V3 Edge PR
+2. ThinkSystem SR665 V3 Validated Node
+
+### BIOS/UEFI Settings (Lenovo)
+
+Ensure the following BIOS/UEFI settings are applied to enable AMD SEV-SNP:
+
+**Processor Settings:**
+- SEV-SNP Support = Enabled
+- SNP Memory (RMP Table) Coverage = Disabled
+
+**Memory Settings:**
+- SMEE = Enabled
+- SEV-ES ASID Space Limit = 1007
+- SEV Control = Enabled
+
+### Azure Prerequisites
+
+- Arc-enabled server(s) with mandatory extensions installed
+- Register these resource providers:
+    - Microsoft.HybridCompute
+    - Microsoft.GuestConfiguration
+    - Microsoft.HybridConnectivity
+    - Microsoft.AzureStackHCI
+- Note the HCI Resource Provider SPNs Object ID in the tenant
+
+## Deployment
+
+The ARM template includes the `confidentialVmIntent` parameter:
+
+```json
+"confidentialVmIntent": {
+    "defaultValue": "Disable",
+    "type": "string",
+    "metadata": {
+        "description": "Customer Intent to update the ConfidentialVm intent on the cluster or edgeDevice, can be Enable or Disable"
+    }
+}
+```
+
+The parameter file sets this to **Enable**:
+
+```json
+"confidentialVmIntent": {
+    "value": "Enable"
+}
+```
+
+First deploy the template in **Validate** mode to confirm parameters at the device. Once passed, re-deploy with mode set to **Deploy**.
+
+## Post-Deployment: CVM Lifecycle
+
+After the cluster is deployed, follow these steps:
+
+1. **Create and import CVM image** – Prepare an Ubuntu 22.04 VHDX with required packages (`linux-azure`, `libtss2-dev`, `linux-cloud-tools-virtual`, `openssh-server`). Refer to [Prepare an Ubuntu image for Azure Local VMs enabled by Azure Arc](https://learn.microsoft.com/en-us/azure-stack/hci/manage/virtual-machine-image-linux).
+
+2. **Create logical network** – Create or reuse a logical network and virtual NIC. Refer to [Create logical networks](https://learn.microsoft.com/en-us/azure-stack/hci/manage/create-logical-networks) and [Create network interfaces](https://learn.microsoft.com/en-us/azure-stack/hci/manage/create-network-interfaces).
+
+3. **Create Arc-enabled CVM** – Use `az stack-hci-vm` CLI extension (version >= 1.9.1). CVMs can be created with guest management enabled (Mode 5) or disabled (Mode 11) depending on your security requirements.
+
+4. **Verify deployment** – Confirm `"SecurityType": "ConfidentialVM"` and `"ProvisioningState": "Succeeded"`.
+
+5. **Attestation** – Retrieve the Microsoft Azure Attestation (MAA) endpoint of the cluster and verify the CVM using the CVM Attest App.
+
+## References
+
+- [Azure Stack HCI Overview](https://learn.microsoft.com/en-us/azure-stack/hci/overview)
+- [Deploy Azure Resources with ARM templates](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/overview)
+- [ARM template deployment for Azure Local](https://learn.microsoft.com/en-us/azure-stack/hci/deploy/deployment-azure-resource-manager-template)
+- [Azure Attestation claim sets (SEV-SNP)](https://learn.microsoft.com/en-us/azure/attestation/claim-sets#sev-snp-attestation)
+
+`Tags: Microsoft.AzureStackHCI/clusters, hci, confidential-vm, cvm`