# Enable Virtual Trusted Platform Module (vTPM) for all virtual machines in the cluster

> Configure CubeCOS to provide Virtual Trust Platform Module (vTPM) capabilities to newly created virtual machines. This guide walks you through configuring a key store and add vTPM to virtual machine templates.

## Summary {#summary}

Trusted Platform Modules (TPMs) provide hardware-backed cryptographic support for system integrity, data encryption, and device authentication, and CubeCOS extends these protections to virtual machines through virtual TPM (vTPM) support.

## Details {#details}

### Issues description {#issues-description}

Trusted Platform Modules (TPMs) perform cryptographic operations that enhance system security by providing hardware-backed support for system integrity, data encryption, and device authentication. CubeCOS extends these capabilities to virtual machines by providing virtual TPM (vTPM) support for cryptographic operations.

You configure options in the Nova compute service that orchestrate and support vTPM operations for virtual machines.

### Applicable versions {#applicable-versions}

CubeCOS 3.0.0.

This article applies to environments running CubeCOS version 3.0.0.

## Resolution {#resolution}

### Configure Nova computing service to support vTPM {#configure-nova-computing-service-to-support-vtpm}

In order to configure the Nova computing service with vTPM functionality, you must create a vTPM configuration file. This action must be performed with root privileges and applied to all compute service hosts within the cluster. Create a new vTPM configuration file, sync it across all nodes, restart the computing service, and configure vTPM-backed virtual machines.

1. Open a terminal session.
2. Log into the cluster VIP as the `root` user via SSH.

   ```bash
   ssh root@<your-cluster-vip>
   ```

3. Create a new configuration file to enable vTPM on all compute and control-converged hosts.

   ```bash
   touch /etc/nova/nova.d/vtpm.conf
   ```

4. Oepn the Nova configuration using the command:

   ```bash
   vim /etc/nova/conf.d/vtpm.conf
   ```

5. Enter the following value into `vtpm.conf`.

   ```bash
   # Enable the emulated vTPM in virtual machines
   [libvirt]
   swtpm_enabled = true
   ovmf_path = /usr/share/edk2/ovmf/OVMF_CODE.secboot.fd
   ```

   ![vTPM Nova additional metadata configuration](/assets/knowledge-base/cubecos/4_1-vtpm-nova-configuration.png)

6. Save and exit the editor after making changes.

### Sync the vTPM configuration file to all computing nodes {#sync-the-vtpm-configuration-file-to-all-computing-nodes}

To ensure that all compute nodes can provide the vTPM service by syncing the vTPM with a cluster-wide synchronization task.

1. Sync the configuration file to all CubeCOS nodes.

   ```bash
   cubectl node -r compute rsync /etc/nova/nova.d/vtpm.conf
   ```

:::warning

Before proceeding you must check and confirm that the synchronization process has completed for all compute nodes.

:::

### Restart the Nova computing service on all computing nodes {#restart-the-nova-computing-service-on-all-computing-nodes}

In order to implement the vTPM configuration, finish syncing the configuration file and then execute the following command to restart the service:

1. Restart the Nova compute service on all nodes hosting the compute service.

   ```bash
   cubectl node -r compute exec -p "hex_config restart_nova"
   ```

2. Check the Nova service health on all compute service nodes.

   ```bash
   cubectl node -r compute exec -p "systemctl status openstack-nova-compute | grep Active"
   ```

3. The `openstack-nova-compute` service status must return `Active` for all compute role nodes.

### Configure virtual machine images to support vTPM configuration {#configure-virtual-machine-images-to-support-vtpm-configuration}

1. Import an image via CLI, see [Import image (CLI)](https://docs.bigstack.co/docs/cubecos/compute/images/import-images-via-cli) for more.
2. After importing the image via CLI, open the OpenStack Skyline UI. Select `Administrator` in the top-right corner to enter administrator mode. For more information, see [How to navigate to the CubeCOS Administrative panel](https://docs.bigstack.co/docs/cubecos/identity/administrator-view#enter-the-administration-panel) for more.
3. Navigate to `Compute > Image` and locate the target image, select `More` to access the image details.

   ![vtpm virtual machine more metadata dropdown options](/assets/knowledge-base/cubecos/4_2-vtpm-virtual-machine-metadata-edit.png)

4. Under the `More` drop down, select `Manage Metadata` to begin configuring the virtual machine image metadata.

   ![vtpm virtual machine more metadata dropdown options](/assets/knowledge-base/cubecos/4_3-vtpm-more-metadata-dropdown-options.png)

5. To support `vTPMs`, set the following metadata for the new image.
   1. **hw_tpm_version** = 2.0
   2. **hw_tpm_model** = tpm-crb

   ![vtpm virtual machine configure metadata](/assets/knowledge-base/cubecos/4_4-vtpm-configure-metadata-fields.png)

6. Click `OK` to apply the configurations.
7. Refresh the `Image Detail` page and verify that the vTPM metadata properties are set succcessfully.

   ![verify virtual machine metadata configuration](/assets/knowledge-base/cubecos/4_5-vtpm-verify-virtual-machine-metadata.png)

8. The configured image will now support vTPM usage.