Add Confidential VM (CVM) configurable cluster quickstart template

[rajeshkumarar]

PR Checklist

Check these items before submitting a PR...

Contribution Guide

Best Practice Guide

• - Please check this box once you've submitted the PR if you've read through the Contribution Guide and best practices checklist.

Changelog

• Added new quickstart template create-cvm-configurable-cluster under quickstarts/microsoft.azurestackhci
• Includes confidentialVmIntent parameter in ARM template (defaultValue: Disable) referenced in optionalServices section
• Parameter file sets confidentialVmIntent to Enable for CVM-ready cluster deployment
• README documents CVM prerequisites (BIOS settings, hardware requirements) and post-deployment lifecycle

[alex-frankel]

/validate

[github-actions]

🤖 Quickstart Sample Summary

Sample Summary

• This sample deploys an Azure Stack HCI cluster configured for Confidential VM (CVM) readiness by enabling the confidentialVmIntent parameter.

• It uses an ARM template (azuredeploy.json) and accompanying parameter file to configure and deploy a CVM ready cluster.

• The deployment requires setting the confidentialVmIntent parameter to "Enable" to ensure the cluster supports Confidential VMs, which provide hardware-based isolation for enhanced security and confidentiality.

• To deploy, users need to customize the template parameter confidentialVmIntent to "Enable", then deploy using Azure Resource Manager with API version 2026-04-01-preview.

• Verification can be done via REST API or through registry checks and Azure portal cluster properties after deployment.

Resources Deployed

• Microsoft.AzureStackHCI/clusters: Represents the Azure Stack HCI cluster resource configured for Confidential VM intent. Main cluster resource defined in azuredeploy.json.
• Microsoft.Storage/storageAccounts: Storage accounts used for things like diagnostic storage and possibly cluster witness storage, defined in the main azuredeploy.json (used to store audit logs and witness data).
• Microsoft.KeyVault/vaults: Key Vault resource used to store secrets involved in the deployment, defined in azuredeploy.json.
• There may be configurations related to diagnostic settings or security settings, but the primary resource types are the cluster, storage accounts, and key vault defined in the main template.

Security Findings

• High Severity Findings:

  1. AZR-000202: Storage accounts accept connections from any network by default (file: azuredeploy.json, line ~505). Recommendation to change default action from Allow to Deny and configure specific access rules.
  2. AZR-000198: Potential anonymous public access enabled on Blob containers in storage accounts (file: azuredeploy.json, line ~705). Suggest setting allowBlobPublicAccess to false to restrict anonymous access.
  3. AZR-000355: Key Vault default allows connections from any network (file: azuredeploy.json, line ~725). Recommendation is to change default to deny and configure specific network rules, also ensure trusted Microsoft services are allowed to bypass the firewall for necessary services.

• No explicit secrets detected in file content read, but sensitive parameters like passwords and keys are handled as secure strings. The template includes parameters for passwords and secrets but they appear parameterized properly.

Key Parameters

• confidentialVmIntent: Enables or disables Confidential VM intent on the cluster. Allowed values: "Enable", "Disable".
• clusterName: Name of the Azure Stack HCI cluster to be created.
• keyVaultName: Name of the Azure Key Vault used for storing secrets.
• localAdminPassword: Local administrator password (secure string).
• diagnosticStorageAccountName: Name of the storage account used for diagnostics and Key Vault audit logs.

Notes for Reviewers

• The sample properly parameterizes sensitive credentials using secure strings.
• The storage account and Key Vault configurations raise networking security concerns per Template Analyzer high-severity rules, with no restrictive network firewall rules applied by default.
• The README clearly explains the purpose and deployment steps for Confidential VM readiness in Azure Stack HCI.
• The sample requires API version 2026-04-01-preview for the cluster resource to enable CVM intent.
• No nested or linked templates detected; all resources are defined within azuredeploy.json.
• No suspicious or malicious instructions found in the template or README.

Files Touched

• quickstarts/microsoft.azurestackhci/create-cluster-cvm-intent/README.md
• quickstarts/microsoft.azurestackhci/create-cluster-cvm-intent/azuredeploy.json
• quickstarts/microsoft.azurestackhci/create-cluster-cvm-intent/azuredeploy.parameters.json
• quickstarts/microsoft.azurestackhci/create-cluster-cvm-intent/metadata.json

---

Generated by the quickstart summarizer agent (v2 — agentic + MSDO security) · triggered by /validate

[alex-frankel]

Thanks @rajeshkumarar! Good news first: the sample is structurally valid and ADX did find your deployment (correlationId 72778ddb-…, executionStatus = Succeeded). 👍

But /validate failed on a templateHash mismatch:

• Hash of the azuredeploy.json in this PR: 8001657693122135047
• Hash ADX recorded for your deployment: 480091045342194120

That means the azuredeploy.json committed here isn't byte-for-byte the template that was actually deployed — it looks like the file was edited after the July 8 deployment. The validator recomputes the hash from the committed JSON and requires it to match the deployed template exactly.

To fix:

1. Deploy the exact azuredeploy.json that's in this PR (no post-deploy edits), e.g. az deployment group create -g <rg> -n <name> -f azuredeploy.json -p @azuredeploy.parameters.json.
2. Capture the new correlationId and deploymentName from that deployment.
3. Update metadata.json → testResult.deployments with those new values and bump dateUpdated.
4. Push, and I'll re-run /validate.

(Wait ~10–15 min after deploying before pinging me, so the record lands in ADX.) Thanks!

[alex-frankel]

/validate

[alex-frankel]

Merging despite ADX Failure due to urgency of request. Template Deployment shows as passing, but with an older version of this template.