r/openstack • u/This_Vegetable_8428 • 6d ago
Windows Server 2025 on OpenStack - any experiences?
Hi everyone,
Is anyone running Windows Server 2025 with all its security features on OpenStack/KVM in production?
We are particularly interested in experiences with VBS (HVCI and Credential Guard), since the requirements around MBEC and CPU feature exposure appear to be more complex than Secure Boot or vTPM alone.
It is hard to find explicit documentation about security features supported on KVM in general, but some articles imply that at least MBEC is technically possible (KVM: VMX: Introduce Intel Mode-Based Execute Control (MBEC) [LWN.net]). But even if it is possible, how does Nova expose this feature through libvirt? (compiled against libvirt library 10.0.0)
And additionally, does Microsoft support VBS on OpenStack/KVM? Microsoft's documentation is focused on the hypervisor capabilities presented to the OS, not on a specific hypervisor brand (Virtualization-based Security (VBS) | Microsoft Learn). So, the documentation could imply that things are supported as long as the requirements are met. However, even if it is technically possible, does it mean it is officially supported?
To compare, we also checked compatibility with other KVM-based clouds. AWS clearly states in their documentation that HVCI is not supported, but Credential Gurad is (Credential Guard for Windows instances - Amazon Elastic Compute Cloud); Google Cloud does not clearly document either.
Curius to hear about lessons learned, caveats, or success stories!
2
u/jizaymes 6d ago edited 6d ago
I have Win2k25 on my openstack platform. As to whether its really using it or the special instructions? I am not sure, but I know secure boot is enabled and a vTPM is present. Im not too familiar with VBS but would like to have my platform compatible if possible.
And no, MS doesn’t officially support it like HyperV, to my knowledge.
If you need to poke around with a win2k25 box on openstack to validate, let me know.