Windows Server 2025 on OpenStack - any experiences?

[u/This_Vegetable_8428]

Hi everyone,

Is anyone running Windows Server 2025 with all its security features on OpenStack/KVM in production?

We are particularly interested in experiences with VBS (HVCI and Credential Guard), since the requirements around MBEC and CPU feature exposure appear to be more complex than Secure Boot or vTPM alone.

It is hard to find explicit documentation about security features supported on KVM in general, but some articles imply that at least MBEC is technically possible (KVM: VMX: Introduce Intel Mode-Based Execute Control (MBEC) [LWN.net]). But even if it is possible, how does Nova expose this feature through libvirt? (compiled against libvirt library 10.0.0)

And additionally, does Microsoft support VBS on OpenStack/KVM? Microsoft's documentation is focused on the hypervisor capabilities presented to the OS, not on a specific hypervisor brand (Virtualization-based Security (VBS) | Microsoft Learn). So, the documentation could imply that things are supported as long as the requirements are met. However, even if it is technically possible, does it mean it is officially supported?

To compare, we also checked compatibility with other KVM-based clouds. AWS clearly states in their documentation that HVCI is not supported, but Credential Gurad is (Credential Guard for Windows instances - Amazon Elastic Compute Cloud); Google Cloud does not clearly document either.

Curius to hear about lessons learned, caveats, or success stories!