Using a virtual TPM

A virtual Trusted Platform Module (vTPM) provides a TPM device to an instance. Use TPM 2.0 for Windows 11 or features such as TPM-backed BitLocker key protection. Other guest operating systems can also use vTPM; it isn’t restricted to Intel hosts.

Before you begin

Ask your cloud operator to confirm Emulated Trusted Platform Module (vTPM) support and whether a TPM-enabled flavor is available. If you configure image properties, use an image you own or have permission to modify. Its TPM settings must be compatible with the selected flavor.

Configure an image

Set TPM 2.0 with the CRB model before creating instances:

$ openstack image set <image-name-or-uuid> \
    --property hw_tpm_version=2.0 \
    --property hw_tpm_model=tpm-crb

Create an instance using that image and a compatible flavor:

$ openstack server create <instance-name> \
    --image <image-name-or-uuid> \
    --flavor <flavor-name-or-uuid> \
    --network <network-name-or-uuid>

If your operator provides a TPM-enabled flavor, you can use it without setting TPM image properties. Changing image properties doesn’t update existing instances.

Related Windows features

See Windows guests for Windows security and performance guidance. vTPM provides a TPM device; eVMCS reduces nested Hyper-V overhead on Intel hosts. They can be configured independently, and neither setting enables VBS or BitLocker inside the guest.