Implement gMSA support in V2 schema

[jterry75]

[jterry75]

@jhowardmsft - Want to take a shot at this one?

[jterry75]

Roughly speaking the general workflow is like this:

1. Setup a CCG instance by calling HcsModifyServiceSettings in the internal/vmcompute package to with a ContainerCredentialGuardModifyOperation of type ContainerCredentialGuardAddInstanceRequest.
2. When creating the Container set the matching ContainerCredentialGuard here.
3. If creating a Hypervisor container when creating the V2 UVM we need to set the Devices to include a ServiceTable entry for a HvSocketConfig that matches the ID of the created instance. Then in the hosted system do what Move use to avoid GC problem in GLMP #2 did.
4. When done remove the instance by issuing a HcsModifyServiceSettings with a ContainerCredentialGuardModifyOperation of type ContainerCredentialGuardRemoveInstanceRequest

And here is a definition of the types

type ContainerCredentialGuardTransport string

const (
    CcgtLRPC ContainerCredentialGuardTransport = "LRPC"
    CcgtHvSocket ContainerCredentialGuardTransport = "HvSocket"
)

type ContainerCredentialGuardState struct {
	//  Authentication cookie for calls to a Container Credential Guard instance.
	Cookie string `json:"Cookie,omitempty"`

	//  Name of the RPC endpoint of the Container Credential Guard instance.
	RpcEndpoint string `json:"RpcEndpoint,omitempty"`

	//  Transport used for the configured Container Credential Guard instance.
	Transport string `json:"Transport,omitempty"`

	//  Credential spec used for the configured Container Credential Guard instance.
	CredentialSpec string `json:"CredentialSpec,omitempty"`
}

type ContainerCredentialGuardHvSocketServiceConfig struct {
    ServiceID Guid `json:"ServiceId"`
    ServiceConfig *HvSocketServiceConfig `json:"ServiceConfig,omitempty"`
}

type ContainerCredentialGuardInstance struct {
    ID string `json:"Id"`
    CredentialGuard ContainerCredentialGuardState `json:"CredentialGuard"`
    HvSocketConfig *ContainerCredentialGuardHvSocketServiceConfig `json:"HvSocketConfig,omitempty"`
}

type ContainerCredentialGuardSystemInfo struct {
    Instances []ContainerCredentialGuardInstance `json:"Instances"`
}

type ContainerCredentialGuardAddInstanceRequest struct {
    ID string `json:"Id"`
    CredentialSpec string `json:"CredentialSpec"`
    Transport ContainerCredentialGuardTransport `json:"Transport"`
}

type ContainerCredentialGuardRemoveInstanceRequest struct {
    ID string `json:"Id"`
}

type ContainerCredentialGuardModifyOperation string

const (
    CcgmoAddInstance ContainerCredentialGuardModifyOperation = "AddInstance"
    CcgmoRemoveInstance ContainerCredentialGuardModifyOperation = "RemoveInstance"
)

type ContainerCredentialGuardOperationRequest struct {
    Operation ContainerCredentialGuardModifyOperation `json:"Operation"`
    OperationDetails interface{} `json:"OperationDetails"`
}

[jterry75]

@dmcgowan / @ddebroy - Here are some really rough notes. Some of this is already defined in internal/schema2 some needs to be added. But in general this is what is required here

[jterry75]

@vikramhh - FYI as well

[ddebroy]

Thanks a lot! Will take a look

[dcantah]

Closing as this work was merged awhile ago.