platform/api/azure: Enable TPM for Gen2 instances

Now that our gallery images are created with trusted launch support, we
can enable trusted launch and TPM on the instance. At some point we'll
be able to pass custom secure boot keys too.

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>

platform/api/azure/instance.go

@@ -152,6 +152,16 @@ func (a *API) getVMParameters(name, userdata, sshkey, storageAccountURI string,
 		},
 	}
 
+	if a.Opts.HyperVGeneration == string(compute.HyperVGenerationTypeV2) && a.Opts.UseGallery {
+		vm.SecurityProfile = &compute.SecurityProfile{
+			SecurityType: compute.SecurityTypesTrustedLaunch,
+			UefiSettings: &compute.UefiSettings{
+				SecureBootEnabled: util.BoolToPtr(false),
+				VTpmEnabled:       util.BoolToPtr(true),
+			},
+		}
+	}
+
 	switch a.Opts.DiskController {
 	case "nvme":
 		vm.VirtualMachineProperties.StorageProfile.DiskControllerType = compute.NVMe