๐๐ก๐๐ญโ๐ฌ ๐ ๐ฏ๐๐๐?
- The vTPM module is the virtual equivalent of a physical TPM chip.
- It securely stores cryptographic keys used for BitLocker drive encryption, Windows Secure Boot, measured boot & attestation features.
- Each vTPM holds unique cryptographic material, and without those keys, a VM may not decrypt its disks or boot securely.
๐๐ก๐ฒ ๐๐จ๐๐ฌ ๐๐ซ๐จ๐ญ๐๐๐ญ๐ข๐จ๐ง ๐๐จ๐ฆ๐๐ข๐ง (๐๐)-๐๐๐ฌ๐๐ ๐๐ ๐๐๐ข๐ฅ ๐ฐ๐ข๐ญ๐ก ๐ฏ๐๐๐ ๐๐๐ฌ?
- Legacy Protection Domains were built before vTPM was introduced, so PDs replicate only VM disks + metadata, not the vTPM device or its secure state.
- vTPM keys are encrypted and tied to the local clusterโs KMS.
- During PD-based replication, those keys cannot be transferred to the DR site.
- As a result, a vTPM-enabled VM fails to boot or loses access to encrypted volumes after DR failover.
๐๐ก๐ฒ ๐๐จ๐๐ฌ ๐๐ซ๐จ๐ญ๐๐๐ญ๐ข๐จ๐ง ๐๐จ๐ฅ๐ข๐๐ฒ (๐๐)-๐๐๐ฌ๐๐ ๐๐ ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ ๐ฏ๐๐๐ ๐๐๐ฌ?
- Modern Protection Policy-based DR introduces full vTPM awareness.
- Replicates vTPM state + keys alongside VM data.
- Integrates with Nutanix KMS or external KMS to ensure key availability at the DR site
- Ensures that after failover, the vTPM device and its associated secure keys are restored correctly, allowing the VM to boot securely.
ย