Repository: vmware/govmomi
Pull request #3551 (2024-09-18 09:39:07)

fix: Use absolute path for reading manifest
## Description

Closes: #3550

Ensure the absolute path to the manifest is used.

Also stops any error from being printed on stderr.

## Type of change

Please mark options that are relevant:

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to
  not work as expected)
- [ ] This change requires a documentation update
- [ ] Build related change

## How Has This Been Tested?

Test case added.

## Checklist:

- [x] My code follows the `CONTRIBUTION` [guidelines] of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
- [x] I have added tests that prove my fix is effective or that my feature works
- [x] New and existing unit tests pass locally with my changes
- [x] Any dependent changes have been merged

[guidelines]: https://github.com/vmware/govmomi/blob/main/CONTRIBUTING.md



Patch:
diff --git a/crypto/manager_kmip.go b/crypto/manager_kmip.go
index 6fac3592..e0e51afb 100644
--- a/crypto/manager_kmip.go
+++ b/crypto/manager_kmip.go
@@ -229,7 +229,7 @@ func (m ManagerKmip) SetDefaultKmsClusterId(
 	return nil
 }
 
-func (m ManagerKmip) RegisterKmsCluster(
+func (m ManagerKmip) RegisterKmipCluster(
 	ctx context.Context,
 	providerID string,
 	managementType types.KmipClusterInfoKmsManagementType) error {
diff --git a/govc/USAGE.md b/govc/USAGE.md
index f4f59780..3c5a6c5f 100644
--- a/govc/USAGE.md
+++ b/govc/USAGE.md
@@ -218,11 +218,6 @@ but appear via `govc $cmd -h`:
  - [import.ovf](#importovf)
  - [import.spec](#importspec)
  - [import.vmdk](#importvmdk)
- - [kms.add](#kmsadd)
- - [kms.default](#kmsdefault)
- - [kms.ls](#kmsls)
- - [kms.rm](#kmsrm)
- - [kms.trust](#kmstrust)
  - [library.checkin](#librarycheckin)
  - [library.checkout](#librarycheckout)
  - [library.clone](#libraryclone)
@@ -3587,93 +3582,6 @@ Options:
   -pool=                 Resource pool [GOVC_RESOURCE_POOL]
 ```
 
-## kms.add
-
-```
-Usage: govc kms.add [OPTIONS] NAME
-
-Add KMS cluster.
-
-Server name and address are required, port defaults to 5696.
-
-Examples:
-  govc kms.add -n my-server -a kms.example.com my-kp
-
-Options:
-  -a=                    Server address
-  -n=                    Server name
-  -p=5696                Server port
-```
-
-## kms.default
-
-```
-Usage: govc kms.default [OPTIONS] NAME
-
-Set default KMS cluster.
-
-Examples:
-  govc kms.default my-kp
-  govc kms.default - # clear default
-  govc kms.default -e /dc/host/cluster my-kp
-  govc kms.default -e /dc/host/cluster my-kp - # clear default
-
-Options:
-  -e=                    Set entity default KMS cluster (cluster or host folder)
-```
-
-## kms.ls
-
-```
-Usage: govc kms.ls [OPTIONS] NAME
-
-Display KMS info.
-
-Examples:
-  govc kms.ls
-  govc kms.ls -json
-  govc kms.ls - # default provider
-  govc kms.ls ProviderName
-  govc kms.ls -json ProviderName
-
-Options:
-```
-
-## kms.rm
-
-```
-Usage: govc kms.rm [OPTIONS] NAME
-
-Remove KMS server or cluster.
-
-Examples:
-  govc kms.rm my-kp
-  govc kms.rm -s my-server my-kp
-
-Options:
-  -s=                    Server name
-```
-
-## kms.trust
-
-```
-Usage: govc kms.trust [OPTIONS] NAME
-
-Establish trust between KMS and vCenter.
-
-Examples:
-  # "Make vCenter Trust KMS"
-  govc kms.trust -server-cert "$(govc about.cert -show)" my-kp
-
-  # "Make KMS Trust vCenter" -> "KMS certificate and private key"
-  govc kms.trust -client-cert "$(cat crt.pem) -client-key "$(cat key.pem) my-kp
-
-  # "Download the vCenter certificate and upload it to the KMS"
-  govc about.cert -show > vcenter-cert.pem
-
-Options:
-```
-
 ## library.checkin
 
 ```
diff --git a/govc/kms/add.go b/govc/kms/add.go
deleted file mode 100644
index 12963832..00000000
--- a/govc/kms/add.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kms
-
-import (
-	"context"
-	"flag"
-
-	"github.com/vmware/govmomi/crypto"
-	"github.com/vmware/govmomi/govc/cli"
-	"github.com/vmware/govmomi/govc/flags"
-	"github.com/vmware/govmomi/vim25/types"
-)
-
-type add struct {
-	*flags.ClientFlag
-
-	types.KmipServerSpec
-}
-
-func init() {
-	cli.Register("kms.add", &add{})
-}
-
-func (cmd *add) Register(ctx context.Context, f *flag.FlagSet) {
-	cmd.ClientFlag, ctx = flags.NewClientFlag(ctx)
-	cmd.ClientFlag.Register(ctx, f)
-
-	f.StringVar(&cmd.Info.Name, "n", "", "Server name")
-	f.StringVar(&cmd.Info.Address, "a", "", "Server address")
-	cmd.Info.Port = 5696 // default
-	f.Var(flags.NewInt32(&cmd.Info.Port), "p", "Server port")
-}
-
-func (cmd *add) Usage() string {
-	return "NAME"
-}
-
-func (cmd *add) Description() string {
-	return `Add KMS cluster.
-
-Server name and address are required, port defaults to 5696.
-
-Examples:
-  govc kms.add -n my-server -a kms.example.com my-kp`
-}
-
-func (cmd *add) Run(ctx context.Context, f *flag.FlagSet) error {
-	id := f.Arg(0)
-	if id == "" {
-		return flag.ErrHelp
-	}
-
-	c, err := cmd.Client()
-	if err != nil {
-		return err
-	}
-
-	m, err := crypto.GetManagerKmip(c)
-	if err != nil {
-		return err
-	}
-
-	spec := types.KmipServerSpec{
-		ClusterId: types.KeyProviderId{Id: id},
-		Info:      cmd.Info,
-	}
-
-	return m.RegisterKmipServer(ctx, spec)
-}
diff --git a/govc/kms/ls.go b/govc/kms/ls.go
deleted file mode 100644
index 466316f4..00000000
--- a/govc/kms/ls.go
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kms
-
-import (
-	"context"
-	"flag"
-	"fmt"
-	"io"
-	"os"
-	"text/tabwriter"
-
-	"github.com/vmware/govmomi/crypto"
-	"github.com/vmware/govmomi/govc/cli"
-	"github.com/vmware/govmomi/govc/flags"
-	"github.com/vmware/govmomi/vim25/types"
-)
-
-type ls struct {
-	*flags.ClientFlag
-	*flags.OutputFlag
-}
-
-func init() {
-	cli.Register("kms.ls", &ls{})
-}
-
-func (cmd *ls) Register(ctx context.Context, f *flag.FlagSet) {
-	cmd.ClientFlag, ctx = flags.NewClientFlag(ctx)
-	cmd.ClientFlag.Register(ctx, f)
-
-	cmd.OutputFlag, ctx = flags.NewOutputFlag(ctx)
-	cmd.OutputFlag.Register(ctx, f)
-}
-
-func (cmd *ls) Process(ctx context.Context) error {
-	if err := cmd.ClientFlag.Process(ctx); err != nil {
-		return err
-	}
-	return cmd.OutputFlag.Process(ctx)
-}
-
-func (cmd *ls) Usage() string {
-	return "NAME"
-}
-
-func (cmd *ls) Description() string {
-	return `Display KMS info.
-
-Examples:
-  govc kms.ls
-  govc kms.ls -json
-  govc kms.ls - # default provider
-  govc kms.ls ProviderName
-  govc kms.ls -json ProviderName`
-}
-
-func (cmd *ls) Run(ctx context.Context, f *flag.FlagSet) error {
-	c, err := cmd.Client()
-	if err != nil {
-		return err
-	}
-
-	m, err := crypto.GetManagerKmip(c)
-	if err != nil {
-		return err
-	}
-
-	info, err := m.ListKmipServers(ctx, nil)
-	if err != nil {
-		return err
-	}
-
-	id := f.Arg(0)
-
-	if id == "" {
-		status, err := m.GetStatus(ctx, info...)
-		if err != nil {
-			return err
-		}
-		return cmd.WriteResult(&clusterResult{Info: info, Status: status})
-	}
-
-	if id == "-" {
-		for _, s := range info {
-			if s.UseAsDefault {
-				id = s.ClusterId.Id
-				break
-			}
-		}
-	}
-
-	status, err := m.GetClusterStatus(ctx, id)
-	if err != nil {
-		return err
-	}
-
-	format := &serverResult{Status: status}
-
-	for _, s := range info {
-		if s.ClusterId.Id == id {
-			format.Info = s
-		}
-	}
-
-	return cmd.WriteResult(format)
-}
-
-type serverResult struct {
-	Info   types.KmipClusterInfo                 `json:"info"`
-	Status *types.CryptoManagerKmipClusterStatus `json:"status"`
-}
-
-func (r *serverResult) status(name string) types.ManagedEntityStatus {
-	for _, server := range r.Status.Servers {
-		if server.Name == name {
-			return server.Status
-		}
-	}
-	return types.ManagedEntityStatusGray
-}
-
-func (r *serverResult) Write(w io.Writer) error {
-	tw := tabwriter.NewWriter(os.Stdout, 2, 0, 2, ' ', 0)
-
-	if r.Info.ManagementType == string(types.KmipClusterInfoKmsManagementTypeNativeProvider) {
-		boolVal := func(v *bool) bool {
-			if v == nil {
-				return false
-			}
-			return *v
-		}
-
-		fmt.Fprintf(tw, "Key ID: %s\tHas Backup: %t\tTPM Required: %t\n",
-			r.Info.KeyId, boolVal(r.Info.HasBackup), boolVal(r.Info.TpmRequired))
-	} else {
-		for _, s := range r.Info.Servers {
-			status := r.status(s.Name)
-			fmt.Fprintf(tw, "%s\t%s:%d\t%s\n", s.Name, s.Address, s.Port, status)
-		}
-	}
-
-	return tw.Flush()
-}
-
-type clusterResult struct {
-	Info   []types.KmipClusterInfo                `json:"info"`
-	Status []types.CryptoManagerKmipClusterStatus `json:"status"`
-}
-
-func (r *clusterResult) status(id types.KeyProviderId) types.ManagedEntityStatus {
-	for _, status := range r.Status {
-		if status.ClusterId == id {
-			return status.OverallStatus
-		}
-	}
-	return types.ManagedEntityStatusGray
-}
-
-func kmsType(kind string) string {
-	switch types.KmipClusterInfoKmsManagementType(kind) {
-	case types.KmipClusterInfoKmsManagementTypeVCenter:
-		return "Standard"
-	case types.KmipClusterInfoKmsManagementTypeNativeProvider:
-		return "Native"
-	default:
-		return kind
-	}
-}
-
-func (r *clusterResult) Write(w io.Writer) error {
-	tw := tabwriter.NewWriter(os.Stdout, 2, 0, 2, ' ', 0)
-
-	for _, info := range r.Info {
-		name := info.ClusterId.Id
-		kind := kmsType(info.ManagementType)
-		status := r.status(info.ClusterId)
-		fmt.Fprintf(tw, "%s\t%s\t%s\n", name, kind, status)
-	}
-
-	return tw.Flush()
-}
diff --git a/govc/kms/rm.go b/govc/kms/rm.go
deleted file mode 100644
index ef7ad9e8..00000000
--- a/govc/kms/rm.go
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kms
-
-import (
-	"context"
-	"flag"
-
-	"github.com/vmware/govmomi/crypto"
-	"github.com/vmware/govmomi/govc/cli"
-	"github.com/vmware/govmomi/govc/flags"
-)
-
-type rm struct {
-	*flags.ClientFlag
-
-	server string
-}
-
-func init() {
-	cli.Register("kms.rm", &rm{})
-}
-
-func (cmd *rm) Register(ctx context.Context, f *flag.FlagSet) {
-	cmd.ClientFlag, ctx = flags.NewClientFlag(ctx)
-	cmd.ClientFlag.Register(ctx, f)
-
-	f.StringVar(&cmd.server, "s", "", "Server name")
-}
-
-func (cmd *rm) Usage() string {
-	return "NAME"
-}
-
-func (cmd *rm) Description() string {
-	return `Remove KMS server or cluster.
-
-Examples:
-  govc kms.rm my-kp
-  govc kms.rm -s my-server my-kp`
-}
-
-func (cmd *rm) Run(ctx context.Context, f *flag.FlagSet) error {
-	id := f.Arg(0)
-	if id == "" {
-		return flag.ErrHelp
-	}
-
-	c, err := cmd.Client()
-	if err != nil {
-		return err
-	}
-
-	m, err := crypto.GetManagerKmip(c)
-	if err != nil {
-		return err
-	}
-
-	if cmd.server != "" {
-		return m.RemoveKmipServer(ctx, id, cmd.server)
-	}
-
-	return m.UnregisterKmsCluster(ctx, id)
-}
diff --git a/govc/kms/setdefault.go b/govc/kms/setdefault.go
deleted file mode 100644
index 989fadc2..00000000
--- a/govc/kms/setdefault.go
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kms
-
-import (
-	"context"
-	"flag"
-
-	"github.com/vmware/govmomi/crypto"
-	"github.com/vmware/govmomi/govc/cli"
-	"github.com/vmware/govmomi/govc/flags"
-	"github.com/vmware/govmomi/vim25/types"
-)
-
-type setdefault struct {
-	*flags.DatacenterFlag
-
-	entity string
-}
-
-func init() {
-	cli.Register("kms.default", &setdefault{})
-}
-
-func (cmd *setdefault) Register(ctx context.Context, f *flag.FlagSet) {
-	cmd.DatacenterFlag, ctx = flags.NewDatacenterFlag(ctx)
-	cmd.DatacenterFlag.Register(ctx, f)
-
-	f.StringVar(&cmd.entity, "e", "", "Set entity default KMS cluster (cluster or host folder)")
-}
-
-func (cmd *setdefault) Usage() string {
-	return "NAME"
-}
-
-func (cmd *setdefault) Description() string {
-	return `Set default KMS cluster.
-
-Examples:
-  govc kms.default my-kp
-  govc kms.default - # clear default
-  govc kms.default -e /dc/host/cluster my-kp
-  govc kms.default -e /dc/host/cluster my-kp - # clear default`
-}
-
-func (cmd *setdefault) Run(ctx context.Context, f *flag.FlagSet) error {
-	id := f.Arg(0)
-	if id == "" {
-		return flag.ErrHelp
-	}
-
-	if id == "-" {
-		id = "" // clear default
-	}
-
-	c, err := cmd.Client()
-	if err != nil {
-		return err
-	}
-
-	m, err := crypto.GetManagerKmip(c)
-	if err != nil {
-		return err
-	}
-
-	var entity *types.ManagedObjectReference
-
-	if cmd.entity != "" {
-		obj, err := cmd.ManagedObject(ctx, cmd.entity)
-		if err != nil {
-			return err
-		}
-
-		entity = types.NewReference(obj.Reference())
-	}
-
-	return m.SetDefaultKmsClusterId(ctx, id, entity)
-}
diff --git a/govc/kms/trust.go b/govc/kms/trust.go
deleted file mode 100644
index e51d0c4e..00000000
--- a/govc/kms/trust.go
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kms
-
-import (
-	"context"
-	"flag"
-
-	"github.com/vmware/govmomi/crypto"
-	"github.com/vmware/govmomi/govc/cli"
-	"github.com/vmware/govmomi/govc/flags"
-	"github.com/vmware/govmomi/vim25/methods"
-	"github.com/vmware/govmomi/vim25/types"
-)
-
-type trust struct {
-	*flags.ClientFlag
-
-	client types.UploadClientCert
-	server types.UploadKmipServerCert
-}
-
-func init() {
-	cli.Register("kms.trust", &trust{})
-}
-
-func (cmd *trust) Register(ctx context.Context, f *flag.FlagSet) {
-	cmd.ClientFlag, ctx = flags.NewClientFlag(ctx)
-	cmd.ClientFlag.Register(ctx, f)
-
-	f.StringVar(&cmd.client.Certificate, "client-cert", "", "Client public certificate")
-	f.StringVar(&cmd.client.PrivateKey, "client-key", "", "Client private key")
-	f.StringVar(&cmd.server.Certificate, "server-cert", "", "Server public certificate")
-}
-
-func (cmd *trust) Usage() string {
-	return "NAME"
-}
-
-func (cmd *trust) Description() string {
-	return `Establish trust between KMS and vCenter.
-
-Examples:
-  # "Make vCenter Trust KMS"
-  govc kms.trust -server-cert "$(govc about.cert -show)" my-kp
-
-  # "Make KMS Trust vCenter" -> "KMS certificate and private key"
-  govc kms.trust -client-cert "$(cat crt.pem) -client-key "$(cat key.pem) my-kp
-
-  # "Download the vCenter certificate and upload it to the KMS"
-  govc about.cert -show > vcenter-cert.pem`
-}
-
-func (cmd *trust) Run(ctx context.Context, f *flag.FlagSet) error {
-	id := f.Arg(0)
-	if id == "" {
-		return flag.ErrHelp
-	}
-
-	c, err := cmd.Client()
-	if err != nil {
-		return err
-	}
-
-	m, err := crypto.GetManagerKmip(c)
-	if err != nil {
-		return err
-	}
-
-	if cmd.client.Certificate != "" {
-		cmd.client.This = m.Reference()
-		cmd.client.Cluster.Id = id
-		_, err = methods.UploadClientCert(ctx, c, &cmd.client)
-		if err != nil {
-			return err
-		}
-	}
-
-	if cmd.server.Certificate != "" {
-		cmd.server.This = m.Reference()
-		cmd.server.Cluster.Id = id
-		_, err = methods.UploadKmipServerCert(ctx, c, &cmd.server)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
diff --git a/govc/main.go b/govc/main.go
index e3c4f923..5fb8de56 100644
--- a/govc/main.go
+++ b/govc/main.go
@@ -72,7 +72,6 @@ import (
 	_ "github.com/vmware/govmomi/govc/host/vnic"
 	_ "github.com/vmware/govmomi/govc/host/vswitch"
 	_ "github.com/vmware/govmomi/govc/importx"
-	_ "github.com/vmware/govmomi/govc/kms"
 	_ "github.com/vmware/govmomi/govc/library"
 	_ "github.com/vmware/govmomi/govc/library/policy"
 	_ "github.com/vmware/govmomi/govc/library/session"
diff --git a/ovf/importer/importer.go b/ovf/importer/importer.go
index 55382f06..7c639c95 100644
--- a/ovf/importer/importer.go
+++ b/ovf/importer/importer.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"os"
 	"path"
 	"path/filepath"
 	"strings"
@@ -58,15 +57,16 @@ type Importer struct {
 	Manifest map[string]*library.Checksum
 }
 
-func (imp *Importer) ReadManifest(fpath string) error {
+func (imp *Importer) manifestPath(fpath string) string {
 	base := filepath.Base(fpath)
 	ext := filepath.Ext(base)
-	mfName := strings.Replace(base, ext, ".mf", 1)
+	return filepath.Join(filepath.Dir(fpath), strings.Replace(base, ext, ".mf", 1))
+}
 
-	mf, _, err := imp.Archive.Open(mfName)
+func (imp *Importer) ReadManifest(fpath string) error {
+	mf, _, err := imp.Archive.Open(imp.manifestPath(fpath))
 	if err != nil {
-		msg := fmt.Sprintf("manifest %q: %s", mf, err)
-		fmt.Fprintln(os.Stderr, msg)
+		msg := fmt.Sprintf("failed to read manifest %q: %s", mf, err)
 		return errors.New(msg)
 	}
 	imp.Manifest, err = library.ReadManifest(mf)
diff --git a/pbm/client.go b/pbm/client.go
index d8d2131c..3c7965ca 100644
--- a/pbm/client.go
+++ b/pbm/client.go
@@ -1,11 +1,11 @@
 /*
-Copyright (c) 2017-2024 VMware, Inc. All Rights Reserved.
+Copyright (c) 2017 VMware, Inc. All Rights Reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -313,35 +313,3 @@ func (c *Client) QueryAssociatedProfiles(ctx context.Context, entities []types.P
 
 	return res.Returnval, nil
 }
-
-func (c *Client) QueryIOFiltersFromProfileId(
-	ctx context.Context, profileID string) ([]types.PbmProfileToIofilterMap, error) {
-
-	req := types.PbmQueryIOFiltersFromProfileId{
-		This:       c.ServiceContent.ProfileManager,
-		ProfileIds: []types.PbmProfileId{{UniqueId: profileID}},
-	}
-	res, err := methods.PbmQueryIOFiltersFromProfileId(ctx, c, &req)
-	if err != nil {
-		return nil, err
-	}
-	return res.Returnval, nil
-}
-
-func (c *Client) SupportsEncryption(
-	ctx context.Context, profileID string) (bool, error) {
-
-	list, err := c.QueryIOFiltersFromProfileId(ctx, profileID)
-	if err != nil {
-		return false, err
-	}
-	for i := range list {
-		for j := range list[i].Iofilters {
-			f := list[i].Iofilters[j]
-			if f.FilterType == string(types.PbmIofilterInfoFilterTypeENCRYPTION) {
-				return true, nil
-			}
-		}
-	}
-	return false, nil
-}
diff --git a/pbm/methods/internal_methods.go b/pbm/methods/internal_methods.go
deleted file mode 100644
index 11b6fc50..00000000
--- a/pbm/methods/internal_methods.go
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package methods
-
-import (
-	"context"
-
-	"github.com/vmware/govmomi/pbm/types"
-	"github.com/vmware/govmomi/vim25/soap"
-)
-
-type PbmQueryIOFiltersFromProfileIdBody struct {
-	Req    *types.PbmQueryIOFiltersFromProfileId         `xml:"urn:pbm PbmQueryIOFiltersFromProfileId,omitempty"`
-	Res    *types.PbmQueryIOFiltersFromProfileIdResponse `xml:"urn:pbm PbmQueryIOFiltersFromProfileIdResponse,omitempty"`
-	Fault_ *soap.Fault                                   `xml:"http://schemas.xmlsoap.org/soap/envelope/ Fault,omitempty"`
-}
-
-func (b *PbmQueryIOFiltersFromProfileIdBody) Fault() *soap.Fault { return b.Fault_ }
-
-func PbmQueryIOFiltersFromProfileId(ctx context.Context, r soap.RoundTripper, req *types.PbmQueryIOFiltersFromProfileId) (*types.PbmQueryIOFiltersFromProfileIdResponse, error) {
-	var reqBody, resBody PbmQueryIOFiltersFromProfileIdBody
-
-	reqBody.Req = req
-
-	if err := r.RoundTrip(ctx, &reqBody, &resBody); err != nil {
-		return nil, err
-	}
-
-	return resBody.Res, nil
-}
diff --git a/pbm/simulator/profiles.go b/pbm/simulator/profiles.go
index 92f003b9..636090e4 100644
--- a/pbm/simulator/profiles.go
+++ b/pbm/simulator/profiles.go
@@ -1,11 +1,11 @@
 /*
-Copyright (c) 2018-2024 VMware, Inc. All Rights Reserved.
+Copyright (c) 2018 VMware, Inc. All Rights Reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,61 +23,8 @@ import (
 	vim "github.com/vmware/govmomi/vim25/types"
 )
 
-const DefaultEncryptionProfileID = "4d5f673c-536f-11e6-beb8-9e71128cae77"
-
-var defaultEncryptionProfile = &types.PbmCapabilityProfile{
-	PbmProfile: types.PbmProfile{
-		ProfileId: types.PbmProfileId{
-			UniqueId: DefaultEncryptionProfileID,
-		},
-		Name:            "VM Encryption Policy",
-		Description:     "Sample storage policy for VMware's VM and virtual disk encryption",
-		CreationTime:    time.Now(),
-		CreatedBy:       "Temporary user handle",
-		LastUpdatedTime: time.Now(),
-		LastUpdatedBy:   "Temporary user handle",
-	},
-	ProfileCategory: "REQUIREMENT",
-	ResourceType: types.PbmProfileResourceType{
-		ResourceType: "STORAGE",
-	},
-	Constraints: &types.PbmCapabilitySubProfileConstraints{
-		PbmCapabilityConstraints: types.PbmCapabilityConstraints{},
-		SubProfiles: []types.PbmCapabilitySubProfile{
-			{
-				Name: "sp-1",
-				Capability: []types.PbmCapabilityInstance{
-					{
-						Id: types.PbmCapabilityMetadataUniqueId{
-							Namespace: "com.vmware.storageprofile.dataservice",
-							Id:        "ad5a249d-cbc2-43af-9366-694d7664fa52",
-						},
-						Constraint: []types.PbmCapabilityConstraintInstance{
-							{
-								PropertyInstance: []types.PbmCapabilityPropertyInstance{
-									{
-										Id:       "ad5a249d-cbc2-43af-9366-694d7664fa52",
-										Operator: "",
-										Value:    "ad5a249d-cbc2-43af-9366-694d7664fa52",
-									},
-								},
-							},
-						},
-					},
-				},
-				ForceProvision: vim.NewBool(false),
-			},
-		},
-	},
-	GenerationId:             0,
-	IsDefault:                false,
-	SystemCreatedProfileType: "",
-	LineOfService:            "",
-}
-
-// vcenter67DefaultProfiles is a captured from vCenter 6.7's default set of PBM
-// profiles.
-var vcenter67DefaultProfiles = []types.BasePbmProfile{
+// profiles is a captured from vCenter 6.7's default set of PBM profiles.
+var profiles = []types.BasePbmProfile{
 	&types.PbmCapabilityProfile{
 		PbmProfile: types.PbmProfile{
 			ProfileId: types.PbmProfileId{
@@ -217,7 +164,55 @@ var vcenter67DefaultProfiles = []types.BasePbmProfile{
 		SystemCreatedProfileType: "VVolDefaultProfile",
 		LineOfService:            "",
 	},
-	defaultEncryptionProfile,
+	&types.PbmCapabilityProfile{
+		PbmProfile: types.PbmProfile{
+			ProfileId: types.PbmProfileId{
+				UniqueId: "4d5f673c-536f-11e6-beb8-9e71128cae77",
+			},
+			Name:            "VM Encryption Policy",
+			Description:     "Sample storage policy for VMware's VM and virtual disk encryption",
+			CreationTime:    time.Now(),
+			CreatedBy:       "Temporary user handle",
+			LastUpdatedTime: time.Now(),
+			LastUpdatedBy:   "Temporary user handle",
+		},
+		ProfileCategory: "REQUIREMENT",
+		ResourceType: types.PbmProfileResourceType{
+			ResourceType: "STORAGE",
+		},
+		Constraints: &types.PbmCapabilitySubProfileConstraints{
+			PbmCapabilityConstraints: types.PbmCapabilityConstraints{},
+			SubProfiles: []types.PbmCapabilitySubProfile{
+				{
+					Name: "sp-1",
+					Capability: []types.PbmCapabilityInstance{
+						{
+							Id: types.PbmCapabilityMetadataUniqueId{
+								Namespace: "com.vmware.storageprofile.dataservice",
+								Id:        "ad5a249d-cbc2-43af-9366-694d7664fa52",
+							},
+							Constraint: []types.PbmCapabilityConstraintInstance{
+								{
+									PropertyInstance: []types.PbmCapabilityPropertyInstance{
+										{
+											Id:       "ad5a249d-cbc2-43af-9366-694d7664fa52",
+											Operator: "",
+											Value:    "ad5a249d-cbc2-43af-9366-694d7664fa52",
+										},
+									},
+								},
+							},
+						},
+					},
+					ForceProvision: vim.NewBool(false),
+				},
+			},
+		},
+		GenerationId:             0,
+		IsDefault:                false,
+		SystemCreatedProfileType: "",
+		LineOfService:            "",
+	},
 	&types.PbmCapabilityProfile{
 		PbmProfile: types.PbmProfile{
 			ProfileId: types.PbmProfileId{
diff --git a/pbm/simulator/simulator.go b/pbm/simulator/simulator.go
index 7478b44f..8f4b3fc3 100644
--- a/pbm/simulator/simulator.go
+++ b/pbm/simulator/simulator.go
@@ -1,11 +1,11 @@
 /*
-Copyright (c) 2018-2024 VMware, Inc. All Rights Reserved.
+Copyright (c) 2018 VMware, Inc. All Rights Reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -17,7 +17,6 @@ limitations under the License.
 package simulator
 
 import (
-	"slices"
 	"time"
 
 	"github.com/google/uuid"
@@ -62,11 +61,9 @@ func New() *simulator.Registry {
 		Content:                content,
 	})
 
-	profileManager := &ProfileManager{
+	r.Put(&ProfileManager{
 		ManagedObjectReference: content.ProfileManager,
-	}
-	profileManager.init(r)
-	r.Put(profileManager)
+	})
 
 	r.Put(&PlacementSolver{
 		ManagedObjectReference: content.PlacementSolver,
@@ -91,34 +88,14 @@ func (s *ServiceInstance) PbmRetrieveServiceContent(_ *types.PbmRetrieveServiceC
 
 type ProfileManager struct {
 	vim.ManagedObjectReference
-
-	profiles       []types.BasePbmProfile
-	profileDetails map[string]types.PbmProfileDetails
-}
-
-func (m *ProfileManager) init(_ *simulator.Registry) {
-	m.profiles = slices.Clone(vcenter67DefaultProfiles)
-
-	// Ensure the default encryption profile has the encryption IOFILTER as this
-	// is required when detecting whether a policy supports encryption.
-	m.profileDetails = map[string]types.PbmProfileDetails{
-		defaultEncryptionProfile.ProfileId.UniqueId: {
-			Profile: defaultEncryptionProfile,
-			IofInfos: []types.PbmIofilterInfo{
-				{
-					FilterType: string(types.PbmIofilterInfoFilterTypeENCRYPTION),
-				},
-			},
-		},
-	}
 }
 
 func (m *ProfileManager) PbmQueryProfile(req *types.PbmQueryProfile) soap.HasFault {
 	body := new(methods.PbmQueryProfileBody)
 	body.Res = new(types.PbmQueryProfileResponse)
 
-	for i := range m.profiles {
-		b, ok := m.profiles[i].(types.BasePbmCapabilityProfile)
+	for i := range profiles {
+		b, ok := profiles[i].(types.BasePbmCapabilityProfile)
 		if !ok {
 			continue
 		}
@@ -166,7 +143,7 @@ func (m *ProfileManager) PbmRetrieveContent(req *types.PbmRetrieveContent) soap.
 	var res []types.BasePbmProfile
 
 	match := func(id string) bool {
-		for _, p := range m.profiles {
+		for _, p := range profiles {
 			if id == p.GetPbmProfile().ProfileId.UniqueId {
 				res = append(res, p)
 				return true
@@ -214,7 +191,7 @@ func (m *ProfileManager) PbmCreate(ctx *simulator.Context, req *types.PbmCreate)
 		LineOfService:            "",
 	}
 
-	m.profiles = append(m.profiles, profile)
+	profiles = append(profiles, profile)
 	body.Res.Returnval.UniqueId = profile.PbmProfile.ProfileId.UniqueId
 
 	return body
@@ -224,11 +201,11 @@ func (m *ProfileManager) PbmDelete(req *types.PbmDelete) soap.HasFault {
 	body := new(methods.PbmDeleteBody)
 
 	for _, id := range req.ProfileId {
-		for i, p := range m.profiles {
+		for i, p := range profiles {
 			pid := p.GetPbmProfile().ProfileId
 
 			if id == pid {
-				m.profiles = append(m.profiles[:i], m.profiles[i+1:]...)
+				profiles = append(profiles[:i], profiles[i+1:]...)
 				break
 			}
 		}
@@ -239,33 +216,6 @@ func (m *ProfileManager) PbmDelete(req *types.PbmDelete) soap.HasFault {
 	return body
 }
 
-func (m *ProfileManager) PbmQueryIOFiltersFromProfileId(req *types.PbmQueryIOFiltersFromProfileId) soap.HasFault {
-	body := methods.PbmQueryIOFiltersFromProfileIdBody{
-		Res: &types.PbmQueryIOFiltersFromProfileIdResponse{},
-	}
-
-	for i := range req.ProfileIds {
-		profileID := req.ProfileIds[i]
-		if profileDetails, ok := m.profileDetails[profileID.UniqueId]; ok {
-			body.Res.Returnval = append(
-				body.Res.Returnval,
-				types.PbmProfileToIofilterMap{
-					Key:       profileID,
-					Iofilters: profileDetails.IofInfos,
-				})
-		} else {
-			body.Fault_ = simulator.Fault("Invalid profile ID", &vim.RuntimeFault{})
-			break
-		}
-	}
-
-	if body.Fault_ != nil {
-		body.Res = nil
-	}
-
-	return &body
-}
-
 type PlacementSolver struct {
 	vim.ManagedObjectReference
 }
diff --git a/pbm/types/internal_types.go b/pbm/types/internal_types.go
deleted file mode 100644
index d166d9dc..00000000
--- a/pbm/types/internal_types.go
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
-Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package types
-
-import (
-	"reflect"
-
-	"github.com/vmware/govmomi/vim25/types"
-)
-
-type ArrayOfPbmIofilterInfo struct {
-	PbmIofilterInfo []PbmIofilterInfo `xml:"PbmIofilterInfo,omitempty" json:"_value"`
-}
-
-func init() {
-	types.Add("pbm:ArrayOfPbmIofilterInfo", reflect.TypeOf((*ArrayOfPbmIofilterInfo)(nil)).Elem())
-}
-
-type ArrayOfPbmProfileToIofilterMap struct {
-	PbmProfileToIofilterMap []PbmProfileToIofilterMap `xml:"PbmProfileToIofilterMap,omitempty" json:"_value"`
-}
-
-func init() {
-	types.Add("pbm:ArrayOfPbmProfileToIofilterMap", reflect.TypeOf((*ArrayOfPbmProfileToIofilterMap)(nil)).Elem())
-}
-
-type PbmQueryIOFiltersFromProfileId PbmQueryIOFiltersFromProfileIdRequestType
-
-func init() {
-	types.Add("pbm:PbmQueryIOFiltersFromProfileId", reflect.TypeOf((*PbmQueryIOFiltersFromProfileId)(nil)).Elem())
-}
-
-type PbmQueryIOFiltersFromProfileIdRequestType struct {
-	This       types.ManagedObjectReference `xml:"_this" json:"_this"`
-	ProfileIds []PbmProfileId               `xml:"profileIds,typeattr" json:"profileIds"`
-}
-
-func init() {
-	types.Add("pbm:PbmQueryIOFiltersFromProfileIdRequestType", reflect.TypeOf((*PbmQueryIOFiltersFromProfileIdRequestType)(nil)).Elem())
-}
-
-type PbmQueryIOFiltersFromProfileIdResponse struct {
-	Returnval []PbmProfileToIofilterMap `xml:"returnval" json:"returnval"`
-}
-
-type PbmIofilterInfo struct {
-	types.DynamicData
-
-	VibId      string `xml:"vibId" json:"vibId"`
-	FilterType string `xml:"filterType,omitempty" json:"filterType,omitempty"`
-}
-
-func init() {
-	types.Add("pbm:PbmIofilterInfo", reflect.TypeOf((*PbmIofilterInfo)(nil)).Elem())
-}
-
-type PbmProfileToIofilterMap struct {
-	types.DynamicData
-
-	Key       PbmProfileId                `xml:"key,typeattr" json:"key"`
-	Iofilters []PbmIofilterInfo           `xml:"iofilters,omitempty" json:"iofilters,omitempty"`
-	Fault     *types.LocalizedMethodFault `xml:"fault,omitempty" json:"fault,omitempty"`
-}
-
-func init() {
-	types.Add("pbm:PbmProfileToIofilterMap", reflect.TypeOf((*PbmProfileToIofilterMap)(nil)).Elem())
-}
-
-type PbmProfileDetails struct {
-	types.DynamicData
-
-	Profile             BasePbmCapabilityProfile    `xml:"profile,typeattr" json:"profile"`
-	IofInfos            []PbmIofilterInfo           `xml:"iofInfos,omitempty" json:"iofInfos,omitempty"`
-	IofMethodFault      *types.LocalizedMethodFault `xml:"iofMethodFault,omitempty" json:"iofMethodFault,omitempty"`
-	IsReplicationPolicy bool                        `xml:"isReplicationPolicy" json:"isReplicationPolicy"`
-	RepMethodFault      *types.LocalizedMethodFault `xml:"repMethodFault,omitempty" json:"repMethodFault,omitempty"`
-}
-
-func init() {
-	types.Add("pbm:PbmProfileDetails", reflect.TypeOf((*PbmProfileDetails)(nil)).Elem())
-}
diff --git a/simulator/crypto_manager_kmip.go b/simulator/crypto_manager_kmip.go
index ed0c2db5..021ce218 100644
--- a/simulator/crypto_manager_kmip.go
+++ b/simulator/crypto_manager_kmip.go
@@ -257,28 +257,15 @@ func (m *CryptoManagerKmip) SetDefaultKmsCluster(
 	return &body
 }
 
-// real vCenter only allows TrustAuthority, but we allow more to simplify test setup
-var validClusterTypes = []string{
-	string(types.KmipClusterInfoKmsManagementTypeTrustAuthority),
-	string(types.KmipClusterInfoKmsManagementTypeUnknown),
-	string(types.KmipClusterInfoKmsManagementTypeNativeProvider),
-}
-
 func (m *CryptoManagerKmip) RegisterKmsCluster(
 	ctx *Context, req *types.RegisterKmsCluster) soap.HasFault {
 
 	var body methods.RegisterKmsClusterBody
 
-	if slices.Contains(validClusterTypes, req.ManagementType) {
-		for i := range m.KmipServers {
-			if req.ClusterId.Id == m.KmipServers[i].ClusterId.Id {
-				body.Fault_ = Fault("Already registered", &types.RuntimeFault{})
-			}
+	for i := range m.KmipServers {
+		if req.ClusterId.Id == m.KmipServers[i].ClusterId.Id {
+			body.Fault_ = Fault("Already registered", &types.RuntimeFault{})
 		}
-	} else {
-		body.Fault_ = Fault("", &types.InvalidArgument{
-			InvalidProperty: "managementType",
-		})
 	}
 	if body.Fault_ == nil {
 		body.Res = &types.RegisterKmsClusterResponse{}
@@ -325,11 +312,6 @@ func (m *CryptoManagerKmip) RegisterKmipServer(
 		body              methods.RegisterKmipServerBody
 	)
 
-	if req.Server.Info.Name == "" {
-		body.Fault_ = Fault("", &types.InvalidArgument{InvalidProperty: "server.info.name"})
-		return &body
-	}
-
 	for i := range m.KmipServers {
 		c := &m.KmipServers[i]
 
@@ -351,20 +333,11 @@ func (m *CryptoManagerKmip) RegisterKmipServer(
 		}
 	}
 
-	if alreadyRegistered {
+	if !validClusterID {
+		body.Fault_ = Fault("Invalid cluster ID", &types.RuntimeFault{})
+	} else if alreadyRegistered {
 		body.Fault_ = Fault("Already registered", &types.RuntimeFault{})
 	} else {
-		if !validClusterID {
-			m.KmipServers = append(m.KmipServers,
-				types.KmipClusterInfo{
-					ClusterId: types.KeyProviderId{
-						Id: req.Server.ClusterId.Id,
-					},
-					ManagementType: string(types.KmipClusterInfoKmsManagementTypeVCenter),
-					Servers:        []types.KmipServerInfo{req.Server.Info},
-				})
-		}
-
 		body.Res = &types.RegisterKmipServerResponse{}
 	}
 
@@ -536,79 +509,3 @@ func (m *CryptoManagerKmip) ListKeys(
 
 	return &body
 }
-
-func getDefaultProvider(
-	ctx *Context,
-	vm *VirtualMachine,
-	generateKey bool) (string, string) {
-
-	m := ctx.Map.CryptoManager()
-	if m == nil {
-		return "", ""
-	}
-
-	var (
-		providerID string
-		keyID      string
-	)
-
-	ctx.WithLock(m, func() {
-		// Lookup the default provider ID via the VM's parent entities:
-		// host, host folder, cluster.
-		if host := vm.Runtime.Host; host != nil {
-			for i := range m.KmipServers {
-				kmipCluster := m.KmipServers[i]
-				for j := range kmipCluster.UseAsEntityDefault {
-					parent := host
-					for providerID == "" && parent != nil {
-						if kmipCluster.UseAsEntityDefault[j] == *parent {
-							providerID = kmipCluster.ClusterId.Id
-							break
-						} else {
-							// TODO (akutz): Support looking up the
-							//               default entity via the host
-							//               folder and cluster.
-							parent = nil
-						}
-					}
-					if providerID != "" {
-						break
-					}
-				}
-				if providerID != "" {
-					break
-				}
-			}
-		}
-
-		// If the default provider ID has not been discovered, see if
-		// any of the providers are the global default.
-		if providerID == "" {
-			for i := range m.KmipServers {
-				if providerID == "" && m.KmipServers[i].UseAsDefault {
-					providerID = m.KmipServers[i].ClusterId.Id
-					break
-				}
-			}
-		}
-	})
-
-	if providerID != "" && generateKey {
-		keyID = generateKeyForProvider(ctx, providerID)
-	}
-
-	return providerID, keyID
-}
-
-func generateKeyForProvider(ctx *Context, providerID string) string {
-	m := ctx.Map.CryptoManager()
-	if m == nil {
-		return ""
-	}
-	var keyID string
-	ctx.WithLock(m, func() {
-		keyID = uuid.NewString()
-		m.keyIDToProviderID[keyID] = providerID
-	})
-	return keyID
-}
diff --git a/simulator/folder.go b/simulator/folder.go
index b65917e4..74b9ac60 100644
--- a/simulator/folder.go
+++ b/simulator/folder.go
@@ -1,11 +1,11 @@
 /*
-Copyright (c) 2017-2024 VMware, Inc. All Rights Reserved.
+Copyright (c) 2017 VMware, Inc. All Rights Reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -402,32 +402,6 @@ func (c *createVM) Run(task *Task) (types.AnyType, types.BaseMethodFault) {
 		vm.Runtime.Host = c.req.Host
 	}
 
-	if cryptoSpec, ok := c.req.Config.Crypto.(*types.CryptoSpecEncrypt); ok {
-		if cryptoSpec.CryptoKeyId.KeyId == "" {
-			if cryptoSpec.CryptoKeyId.ProviderId == nil {
-				providerID, keyID := getDefaultProvider(c.ctx, vm, true)
-				if providerID == "" {
-					return nil, &types.InvalidVmConfig{Property: "configSpec.crypto"}
-				}
-				vm.Config.KeyId = &types.CryptoKeyId{
-					KeyId: keyID,
-					ProviderId: &types.KeyProviderId{
-						Id: providerID,
-					},
-				}
-			} else {
-				providerID := cryptoSpec.CryptoKeyId.ProviderId.Id
-				keyID := generateKeyForProvider(c.ctx, providerID)
-				vm.Config.KeyId = &types.CryptoKeyId{
-					KeyId: keyID,
-					ProviderId: &types.KeyProviderId{
-						Id: providerID,
-					},
-				}
-			}
-		}
-	}
-
 	vm.Guest = &types.GuestInfo{
 		ToolsStatus:        types.VirtualMachineToolsStatusToolsNotInstalled,
 		ToolsVersion:       "0",
diff --git a/simulator/virtual_machine.go b/simulator/virtual_machine.go
index 2ba287ee..fb5d3d30 100644
--- a/simulator/virtual_machine.go
+++ b/simulator/virtual_machine.go
@@ -1662,32 +1662,23 @@ func (vm *VirtualMachine) updateCrypto(
 		if err := assertEncrypted(); err != nil {
 			return err
 		}
-
 		var providerID *types.KeyProviderId
-		if pid := newKeyID.ProviderId; pid != nil {
+		if pid := vm.Config.KeyId.ProviderId; pid != nil {
 			providerID = &types.KeyProviderId{
 				Id: pid.Id,
 			}
 		}
-
-		keyID := newKeyID.KeyId
-		if providerID == nil {
-			if p, k := getDefaultProvider(ctx, vm, true); p != "" && k != "" {
-				providerID = &types.KeyProviderId{
-					Id: p,
-				}
-				keyID = k
+		if pid := newKeyID.ProviderId; pid != nil {
+			providerID = &types.KeyProviderId{
+				Id: pid.Id,
 			}
-		} else if keyID == "" {
-			keyID = generateKeyForProvider(ctx, providerID.Id)
 		}
-
 		ctx.Map.Update(vm, []types.PropertyChange{
 			{
 				Name: configKeyId,
 				Op:   types.PropertyChangeOpAssign,
 				Val: &types.CryptoKeyId{
-					KeyId:      keyID,
+					KeyId:      newKeyID.KeyId,
 					ProviderId: providerID,
 				},
 			},
@@ -1747,24 +1738,12 @@ func (vm *VirtualMachine) updateCrypto(
 			}
 		}
 
-		keyID := tspec.CryptoKeyId.KeyId
-		if providerID == nil {
-			if p, k := getDefaultProvider(ctx, vm, true); p != "" && k != "" {
-				providerID = &types.KeyProviderId{
-					Id: p,
-				}
-				keyID = k
-			}
-		} else if keyID == "" {
-			keyID = generateKeyForProvider(ctx, providerID.Id)
-		}
-
 		ctx.Map.Update(vm, []types.PropertyChange{
 			{
 				Name: configKeyId,
 				Op:   types.PropertyChangeOpAssign,
 				Val: &types.CryptoKeyId{
-					KeyId:      keyID,
+					KeyId:      tspec.CryptoKeyId.KeyId,
 					ProviderId: providerID,
 				},
 			},


Test patch:
diff --git a/crypto/manager_kmip_test.go b/crypto/manager_kmip_test.go
index 9bd67016..ca044f6b 100644
--- a/crypto/manager_kmip_test.go
+++ b/crypto/manager_kmip_test.go
@@ -44,7 +44,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 
 			providerID := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -53,7 +53,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.NoError(t, err)
 			assert.True(t, isValid)
 
-			err = m.RegisterKmsCluster(
+			err = m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown)
@@ -73,7 +73,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.EqualError(t, err, "invalid cluster ID")
 			assert.Nil(t, status)
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -96,7 +96,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.EqualError(t, err, "ServerFaultCode: Invalid cluster ID")
 			assert.True(t, fault.Is(err, &types.RuntimeFault{}))
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -124,7 +124,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.NoError(t, err)
 			assert.False(t, ok)
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -144,15 +144,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			provider2ID := uuid.NewString()
 			provider3ID := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider1ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider2ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider3ID,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -230,11 +230,14 @@ func TestCryptoManagerKmip(t *testing.T) {
 				},
 			}
 
-			err = m.RegisterKmsCluster(
+			err = m.RegisterKmipServer(ctx, serverSpec)
+			assert.EqualError(t, err, "ServerFaultCode: Invalid cluster ID")
+			assert.True(t, fault.Is(err, &types.RuntimeFault{}))
+
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
-				types.KmipClusterInfoKmsManagementTypeVCenter)
-			assert.True(t, fault.Is(err, &types.InvalidArgument{}))
+				types.KmipClusterInfoKmsManagementTypeUnknown))
 
 			assert.NoError(t, m.RegisterKmipServer(ctx, serverSpec))
 
@@ -260,7 +263,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.EqualError(t, err, "invalid cluster ID")
 			assert.Nil(t, status)
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -305,15 +308,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			provider2serverName3 := uuid.NewString()
 			provider3serverName1 := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider1ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider2ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider3ID,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -451,7 +454,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			providerID := uuid.NewString()
 			serverName := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -521,7 +524,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.EqualError(t, err, "ServerFaultCode: Invalid cluster ID")
 			assert.True(t, fault.Is(err, &types.RuntimeFault{}))
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -559,7 +562,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			providerID := uuid.NewString()
 			serverName := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -605,15 +608,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			provider2serverName3 := uuid.NewString()
 			provider3serverName1 := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider1ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider2ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider3ID,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -720,15 +723,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			provider2ID := uuid.NewString()
 			provider3ID := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider1ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider2ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider3ID,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -755,15 +758,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			provider2ID := uuid.NewString()
 			provider3ID := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider1ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider2ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider3ID,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -800,15 +803,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			provider2ID := uuid.NewString()
 			provider3ID := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider1ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider2ID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				provider3ID,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -848,7 +851,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			providerID1 := uuid.NewString()
 			providerID2 := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID1,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -866,7 +869,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.True(t, fault.Is(err, &types.RuntimeFault{}))
 			assert.Empty(t, keyID)
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID2,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
@@ -896,15 +899,15 @@ func TestCryptoManagerKmip(t *testing.T) {
 			assert.NoError(t, err)
 			assert.Len(t, keys, 0)
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID1,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID2,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID3,
 				types.KmipClusterInfoKmsManagementTypeNativeProvider))
@@ -976,7 +979,7 @@ func TestCryptoManagerKmip(t *testing.T) {
 
 			providerID := uuid.NewString()
 
-			assert.NoError(t, m.RegisterKmsCluster(
+			assert.NoError(t, m.RegisterKmipCluster(
 				ctx,
 				providerID,
 				types.KmipClusterInfoKmsManagementTypeUnknown))
diff --git a/govc/test/kms.bats b/govc/test/kms.bats
deleted file mode 100755
index 071ed9b9..00000000
--- a/govc/test/kms.bats
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bats
-
-load test_helper
-
-@test "kms" {
-  vcsim_env
-
-  run govc kms.ls
-  assert_success
-
-  run govc kms.ls -json
-  assert_success
-
-  run govc kms.ls enoent
-  assert_failure
-
-  host=$(govc env -x GOVC_URL_HOST)
-
-  run govc kms.add vcsim-kp
-  assert_failure # InvalidProperty server.info.name
-
-  run govc kms.add -n my-server -a "$host" vcsim-kp
-  assert_success
-
-  run govc kms.add -n my-server vcsim-kp
-  assert_failure # already registered
-
-  run govc kms.ls
-  assert_success
-  assert_matches vcsim-kp
-
-  run govc kms.ls vcsim-kp
-  assert_success
-
-  run govc kms.default
-  assert_failure
-
-  run govc kms.default vcsim-kp
-  assert_success
-
-  run govc kms.default -
-  assert_success
-
-  run govc kms.rm -s my-server vcsim-kp
-  assert_success
-
-  run govc kms.add -n my-server -a "$host" vcsim-kp
-  assert_success
-
-  run govc kms.rm vcsim-kp
-  assert_success
-
-  run govc kms.rm vcsim-kp
-  assert_failure # does not exist
-}
diff --git a/ovf/importer/importer_test.go b/ovf/importer/importer_test.go
new file mode 100644
index 00000000..aff02af7
--- /dev/null
+++ b/ovf/importer/importer_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright (c) 2024-2024 VMware, Inc. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package importer
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestImporter_manifestPath(t *testing.T) {
+	// We can only test filepath operations on the target OS
+	manifestTests := []struct {
+		goos     string
+		name     string
+		path     string
+		expected string
+	}{
+		{
+			goos:     "linux",
+			name:     "linux path",
+			path:     "/home/user/foo/bar/qux.ovf",
+			expected: "/home/user/foo/bar/qux.mf",
+		},
+		{
+			goos:     "darwin",
+			name:     "darwin path",
+			path:     "/home/user/foo/bar/qux.ovf",
+			expected: "/home/user/foo/bar/qux.mf",
+		},
+		{
+			goos:     "windows",
+			name:     "windows path",
+			path:     "C:\\ProgramData\\Foo\\Bar\\Qux.ovf",
+			expected: "C:\\ProgramData\\Foo\\Bar\\Qux.mf",
+		},
+	}
+
+	imp := Importer{}
+
+	for _, test := range manifestTests {
+		if test.goos == runtime.GOOS {
+			manifestPath := imp.manifestPath(test.path)
+			if manifestPath != test.expected {
+				t.Fatalf("'%s' failed: expected '%s', got '%s'", test.name, test.expected, manifestPath)
+			}
+		}
+	}
+}
diff --git a/pbm/client_test.go b/pbm/client_test.go
index 0500e050..a3666e94 100644
--- a/pbm/client_test.go
+++ b/pbm/client_test.go
@@ -1,11 +1,11 @@
 /*
-Copyright (c) 2017-2024 VMware, Inc. All Rights Reserved.
+Copyright (c) 2017 VMware, Inc. All Rights Reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package pbm_test
+package pbm
 
 import (
 	"context"
@@ -23,17 +23,10 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
 	"github.com/vmware/govmomi"
-	"github.com/vmware/govmomi/fault"
-	"github.com/vmware/govmomi/pbm"
-	pbmsim "github.com/vmware/govmomi/pbm/simulator"
 	"github.com/vmware/govmomi/pbm/types"
 	"github.com/vmware/govmomi/property"
-	"github.com/vmware/govmomi/simulator"
 	"github.com/vmware/govmomi/view"
-	"github.com/vmware/govmomi/vim25"
 	"github.com/vmware/govmomi/vim25/mo"
 	"github.com/vmware/govmomi/vim25/soap"
 	vim "github.com/vmware/govmomi/vim25/types"
@@ -59,7 +52,7 @@ func TestClient(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	pc, err := pbm.NewClient(ctx, c.Client)
+	pc, err := NewClient(ctx, c.Client)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -171,27 +164,27 @@ func TestClient(t *testing.T) {
 
 	// user spec for the profile.
 	// VSAN profile with 2 capability instances - hostFailuresToTolerate = 2, stripeWidth = 1
-	pbmCreateSpecForVSAN := pbm.CapabilityProfileCreateSpec{
+	pbmCreateSpecForVSAN := CapabilityProfileCreateSpec{
 		Name:        "Kubernetes-VSAN-TestPolicy",
 		Description: "VSAN Test policy create",
 		Category:    string(types.PbmProfileCategoryEnumREQUIREMENT),
-		CapabilityList: []pbm.Capability{
-			{
+		CapabilityList: []Capability{
+			Capability{
 				ID:        "hostFailuresToTolerate",
 				Namespace: "VSAN",
-				PropertyList: []pbm.Property{
-					{
+				PropertyList: []Property{
+					Property{
 						ID:       "hostFailuresToTolerate",
 						Value:    "2",
 						DataType: "int",
 					},
 				},
 			},
-			{
+			Capability{
 				ID:        "stripeWidth",
 				Namespace: "VSAN",
-				PropertyList: []pbm.Property{
-					{
+				PropertyList: []Property{
+					Property{
 						ID:       "stripeWidth",
 						Value:    "1",
 						DataType: "int",
@@ -202,7 +195,7 @@ func TestClient(t *testing.T) {
 	}
 
 	// Create PBM capability spec for the above defined user spec.
-	createSpecVSAN, err := pbm.CreateCapabilityProfileSpec(pbmCreateSpecForVSAN)
+	createSpecVSAN, err := CreateCapabilityProfileSpec(pbmCreateSpecForVSAN)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -236,37 +229,37 @@ func TestClient(t *testing.T) {
 
 	// user spec for the profile.
 	// VSAN profile with 2 capability instances - stripeWidth = 1 and an SIOC profile.
-	pbmCreateSpecVSANandSIOC := pbm.CapabilityProfileCreateSpec{
+	pbmCreateSpecVSANandSIOC := CapabilityProfileCreateSpec{
 		Name:        "Kubernetes-VSAN-SIOC-TestPolicy",
 		Description: "VSAN-SIOC-Test policy create",
 		Category:    string(types.PbmProfileCategoryEnumREQUIREMENT),
-		CapabilityList: []pbm.Capability{
-			{
+		CapabilityList: []Capability{
+			Capability{
 				ID:        "stripeWidth",
 				Namespace: "VSAN",
-				PropertyList: []pbm.Property{
-					{
+				PropertyList: []Property{
+					Property{
 						ID:       "stripeWidth",
 						Value:    "1",
 						DataType: "int",
 					},
 				},
 			},
-			{
+			Capability{
 				ID:        "spm@DATASTOREIOCONTROL",
 				Namespace: "spm",
-				PropertyList: []pbm.Property{
-					{
+				PropertyList: []Property{
+					Property{
 						ID:       "limit",
 						Value:    "200",
 						DataType: "int",
 					},
-					{
+					Property{
 						ID:       "reservation",
 						Value:    "1000",
 						DataType: "int",
 					},
-					{
+					Property{
 						ID:       "shares",
 						Value:    "2000",
 						DataType: "int",
@@ -277,7 +270,7 @@ func TestClient(t *testing.T) {
 	}
 
 	// Create PBM capability spec for the above defined user spec.
-	createSpecVSANandSIOC, err := pbm.CreateCapabilityProfileSpec(pbmCreateSpecVSANandSIOC)
+	createSpecVSANandSIOC, err := CreateCapabilityProfileSpec(pbmCreateSpecVSANandSIOC)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -320,29 +313,3 @@ func TestClient(t *testing.T) {
 	}
 	t.Logf("Profile: %+v successfully deleted", []types.PbmProfileId{*vsanProfileID, *vsansiocProfileID})
 }
-
-func TestSupportsEncryption(t *testing.T) {
-	t.Run("valid profile id", func(t *testing.T) {
-		simulator.Test(func(ctx context.Context, c *vim25.Client) {
-			pbmc, err := pbm.NewClient(ctx, c)
-			assert.NoError(t, err)
-			assert.NotNil(t, pbmc)
-
-			ok, err := pbmc.SupportsEncryption(ctx, pbmsim.DefaultEncryptionProfileID)
-			assert.NoError(t, err)
-			assert.True(t, ok)
-		})
-	})
-	t.Run("invalid profile id", func(t *testing.T) {
-		simulator.Test(func(ctx context.Context, c *vim25.Client) {
-			pbmc, err := pbm.NewClient(ctx, c)
-			assert.NoError(t, err)
-			assert.NotNil(t, pbmc)
-
-			ok, err := pbmc.SupportsEncryption(ctx, "invalid")
-			assert.EqualError(t, err, "ServerFaultCode: Invalid profile ID")
-			assert.True(t, fault.Is(err, &vim.RuntimeFault{}))
-			assert.False(t, ok)
-		})
-	})
-}
diff --git a/pbm/simulator/simulator_test.go b/pbm/simulator/simulator_test.go
index a8198c41..1ff82f71 100644
--- a/pbm/simulator/simulator_test.go
+++ b/pbm/simulator/simulator_test.go
@@ -172,22 +172,22 @@ func TestSimulator(t *testing.T) {
 		Description: "VSAN Test policy create",
 		Category:    string(types.PbmProfileCategoryEnumREQUIREMENT),
 		CapabilityList: []pbm.Capability{
-			{
+			pbm.Capability{
 				ID:        "hostFailuresToTolerate",
 				Namespace: "VSAN",
 				PropertyList: []pbm.Property{
-					{
+					pbm.Property{
 						ID:       "hostFailuresToTolerate",
 						Value:    "2",
 						DataType: "int",
 					},
 				},
 			},
-			{
+			pbm.Capability{
 				ID:        "stripeWidth",
 				Namespace: "VSAN",
 				PropertyList: []pbm.Property{
-					{
+					pbm.Property{
 						ID:       "stripeWidth",
 						Value:    "1",
 						DataType: "int",
@@ -247,32 +247,32 @@ func TestSimulator(t *testing.T) {
 		Description: "VSAN-SIOC-Test policy create",
 		Category:    string(types.PbmProfileCategoryEnumREQUIREMENT),
 		CapabilityList: []pbm.Capability{
-			{
+			pbm.Capability{
 				ID:        "stripeWidth",
 				Namespace: "VSAN",
 				PropertyList: []pbm.Property{
-					{
+					pbm.Property{
 						ID:       "stripeWidth",
 						Value:    "1",
 						DataType: "int",
 					},
 				},
 			},
-			{
+			pbm.Capability{
 				ID:        "spm@DATASTOREIOCONTROL",
 				Namespace: "spm",
 				PropertyList: []pbm.Property{
-					{
+					pbm.Property{
 						ID:       "limit",
 						Value:    "200",
 						DataType: "int",
 					},
-					{
+					pbm.Property{
 						ID:       "reservation",
 						Value:    "1000",
 						DataType: "int",
 					},
-					{
+					pbm.Property{
 						ID:       "shares",
 						Value:    "2000",
 						DataType: "int",
diff --git a/simulator/virtual_machine_test.go b/simulator/virtual_machine_test.go
index 30079b90..3309e284 100644
--- a/simulator/virtual_machine_test.go
+++ b/simulator/virtual_machine_test.go
@@ -25,12 +25,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/vmware/govmomi"
-	"github.com/vmware/govmomi/crypto"
-	"github.com/vmware/govmomi/fault"
 	"github.com/vmware/govmomi/find"
 	"github.com/vmware/govmomi/object"
 	"github.com/vmware/govmomi/property"
@@ -2684,7 +2681,6 @@ func TestEncryptDecryptVM(t *testing.T) {
 		name                string
 		initStateFn         func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error
 		configSpec          types.VirtualMachineConfigSpec
-		isGeneratedKey      bool
 		expectedCryptoKeyId *types.CryptoKeyId
 		expectedErr         error
 	}{
@@ -2707,49 +2703,6 @@ func TestEncryptDecryptVM(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "encrypt w default key provider",
-			configSpec: types.VirtualMachineConfigSpec{
-				Crypto: &types.CryptoSpecEncrypt{},
-			},
-			isGeneratedKey: true,
-			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
-				Map.WithLock(ctx, ctx.Map.CryptoManager(), func() {
-					m := ctx.Map.CryptoManager()
-					m.KmipServers = append(m.KmipServers, types.KmipClusterInfo{
-						ClusterId: types.KeyProviderId{
-							Id: "key-provider",
-						},
-						UseAsDefault: true,
-					})
-				})
-				return nil
-			},
-		},
-		{
-			name: "encrypt w generated key",
-			configSpec: types.VirtualMachineConfigSpec{
-				Crypto: &types.CryptoSpecEncrypt{
-					CryptoKeyId: types.CryptoKeyId{
-						ProviderId: &types.KeyProviderId{
-							Id: "key-provider",
-						},
-					},
-				},
-			},
-			isGeneratedKey: true,
-			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
-				Map.WithLock(ctx, ctx.Map.CryptoManager(), func() {
-					m := ctx.Map.CryptoManager()
-					m.KmipServers = append(m.KmipServers, types.KmipClusterInfo{
-						ClusterId: types.KeyProviderId{
-							Id: "key-provider",
-						},
-					})
-				})
-				return nil
-			},
-		},
 		{
 			name: "encrypt w already encrypted",
 			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
@@ -2924,65 +2877,6 @@ func TestEncryptDecryptVM(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "deep recrypt w default key provider",
-			configSpec: types.VirtualMachineConfigSpec{
-				Crypto: &types.CryptoSpecDeepRecrypt{},
-			},
-			isGeneratedKey: true,
-			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
-				Map.WithLock(ctx, vmRef, func() {
-					Map.Get(vmRef).(*VirtualMachine).Config.KeyId = &types.CryptoKeyId{
-						KeyId: "123",
-						ProviderId: &types.KeyProviderId{
-							Id: "abc",
-						},
-					}
-				})
-				Map.WithLock(ctx, ctx.Map.CryptoManager(), func() {
-					m := ctx.Map.CryptoManager()
-					m.KmipServers = append(m.KmipServers, types.KmipClusterInfo{
-						ClusterId: types.KeyProviderId{
-							Id: "key-provider",
-						},
-						UseAsDefault: true,
-					})
-				})
-				return nil
-			},
-		},
-		{
-			name: "deep recrypt w generated key",
-			configSpec: types.VirtualMachineConfigSpec{
-				Crypto: &types.CryptoSpecDeepRecrypt{
-					NewKeyId: types.CryptoKeyId{
-						ProviderId: &types.KeyProviderId{
-							Id: "key-provider",
-						},
-					},
-				},
-			},
-			isGeneratedKey: true,
-			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
-				Map.WithLock(ctx, vmRef, func() {
-					Map.Get(vmRef).(*VirtualMachine).Config.KeyId = &types.CryptoKeyId{
-						KeyId: "key",
-						ProviderId: &types.KeyProviderId{
-							Id: "key-provider",
-						},
-					}
-				})
-				Map.WithLock(ctx, ctx.Map.CryptoManager(), func() {
-					m := ctx.Map.CryptoManager()
-					m.KmipServers = append(m.KmipServers, types.KmipClusterInfo{
-						ClusterId: types.KeyProviderId{
-							Id: "key-provider",
-						},
-					})
-				})
-				return nil
-			},
-		},
 		{
 			name: "deep recrypt w same provider id",
 			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
@@ -3000,9 +2894,6 @@ func TestEncryptDecryptVM(t *testing.T) {
 				Crypto: &types.CryptoSpecDeepRecrypt{
 					NewKeyId: types.CryptoKeyId{
 						KeyId: "456",
-						ProviderId: &types.KeyProviderId{
-							Id: "abc",
-						},
 					},
 				},
 			},
@@ -3119,65 +3010,6 @@ func TestEncryptDecryptVM(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "shallow recrypt w default key provider",
-			configSpec: types.VirtualMachineConfigSpec{
-				Crypto: &types.CryptoSpecShallowRecrypt{},
-			},
-			isGeneratedKey: true,
-			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
-				Map.WithLock(ctx, vmRef, func() {
-					Map.Get(vmRef).(*VirtualMachine).Config.KeyId = &types.CryptoKeyId{
-						KeyId: "123",
-						ProviderId: &types.KeyProviderId{
-							Id: "abc",
-						},
-					}
-				})
-				Map.WithLock(ctx, ctx.Map.CryptoManager(), func() {
-					m := ctx.Map.CryptoManager()
-					m.KmipServers = append(m.KmipServers, types.KmipClusterInfo{
-						ClusterId: types.KeyProviderId{
-							Id: "key-provider",
-						},
-						UseAsDefault: true,
-					})
-				})
-				return nil
-			},
-		},
-		{
-			name: "shallow recrypt w generated key",
-			configSpec: types.VirtualMachineConfigSpec{
-				Crypto: &types.CryptoSpecShallowRecrypt{
-					NewKeyId: types.CryptoKeyId{
-						ProviderId: &types.KeyProviderId{
-							Id: "key-provider",
-						},
-					},
-				},
-			},
-			isGeneratedKey: true,
-			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
-				Map.WithLock(ctx, vmRef, func() {
-					Map.Get(vmRef).(*VirtualMachine).Config.KeyId = &types.CryptoKeyId{
-						KeyId: "key",
-						ProviderId: &types.KeyProviderId{
-							Id: "key-provider",
-						},
-					}
-				})
-				Map.WithLock(ctx, ctx.Map.CryptoManager(), func() {
-					m := ctx.Map.CryptoManager()
-					m.KmipServers = append(m.KmipServers, types.KmipClusterInfo{
-						ClusterId: types.KeyProviderId{
-							Id: "key-provider",
-						},
-					})
-				})
-				return nil
-			},
-		},
 		{
 			name: "shallow recrypt w same provider id",
 			initStateFn: func(ctx *Context, c *vim25.Client, vmRef types.ManagedObjectReference) error {
@@ -3195,9 +3027,6 @@ func TestEncryptDecryptVM(t *testing.T) {
 				Crypto: &types.CryptoSpecShallowRecrypt{
 					NewKeyId: types.CryptoKeyId{
 						KeyId: "456",
-						ProviderId: &types.KeyProviderId{
-							Id: "abc",
-						},
 					},
 				},
 			},
@@ -3381,6 +3210,7 @@ func TestEncryptDecryptVM(t *testing.T) {
 			model.Host = 1
 
 			Test(func(ctx context.Context, c *vim25.Client) {
+
 				ref := Map.Any("VirtualMachine").Reference()
 				vm := object.NewVirtualMachine(c, ref)
 
@@ -3403,10 +3233,7 @@ func TestEncryptDecryptVM(t *testing.T) {
 					if err := vm.Properties(ctx, ref, []string{"config.keyId"}, &moVM); err != nil {
 						t.Fatalf("fetching properties failed: %v", err)
 					}
-					if tc.isGeneratedKey {
-						assert.NotEmpty(t, moVM.Config.KeyId.KeyId)
-						assert.Equal(t, "key-provider", moVM.Config.KeyId.ProviderId.Id)
-					} else if tc.expectedCryptoKeyId != nil {
+					if tc.expectedCryptoKeyId != nil {
 						assert.Equal(t, tc.expectedCryptoKeyId, moVM.Config.KeyId)
 					} else {
 						assert.Nil(t, moVM.Config)
@@ -3416,215 +3243,3 @@ func TestEncryptDecryptVM(t *testing.T) {
 		})
 	}
 }
-
-func TestCreateVmWithDefaultKeyProvider(t *testing.T) {
-
-	t.Run("when default key provider exists", func(t *testing.T) {
-		Test(func(ctx context.Context, c *vim25.Client) {
-			providerID := uuid.NewString()
-			m := crypto.NewManagerKmip(c)
-			assert.NoError(t, m.RegisterKmsCluster(
-				ctx,
-				providerID,
-				types.KmipClusterInfoKmsManagementTypeUnknown))
-			assert.NoError(t, m.SetDefaultKmsClusterId(ctx, providerID, nil))
-
-			finder := find.NewFinder(c, false)
-
-			dc, err := finder.DefaultDatacenter(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, dc)
-			finder.SetDatacenter(dc)
-
-			ds, err := finder.DefaultDatastore(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, ds)
-
-			folders, err := dc.Folders(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, folders)
-			assert.NotNil(t, folders.VmFolder)
-
-			hosts, err := finder.HostSystemList(ctx, "*/*")
-			assert.NoError(t, err)
-			assert.NotEmpty(t, hosts)
-
-			host := hosts[rand.Intn(len(hosts))]
-			pool, err := host.ResourcePool(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, pool)
-
-			tsk, err := folders.VmFolder.CreateVM(
-				ctx,
-				types.VirtualMachineConfigSpec{
-					Name: "test",
-					Files: &types.VirtualMachineFileInfo{
-						VmPathName: fmt.Sprintf("[%s] test/test.vmx", ds.Name()),
-					},
-					GuestId: string(types.VirtualMachineGuestOsIdentifierOtherGuest),
-					Crypto:  &types.CryptoSpecEncrypt{},
-				},
-				pool,
-				host)
-			assert.NoError(t, err)
-			assert.NotNil(t, tsk)
-
-			tskInfo, err := tsk.WaitForResult(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, tskInfo)
-			assert.Nil(t, tskInfo.Error)
-			assert.NotNil(t, tskInfo.Result)
-
-			vmRef, ok := tskInfo.Result.(types.ManagedObjectReference)
-			assert.True(t, ok)
-
-			vm := object.NewVirtualMachine(c, vmRef)
-
-			var moVM mo.VirtualMachine
-			assert.NoError(t, vm.Properties(ctx, vmRef, []string{"config.keyId"}, &moVM))
-
-			assert.NotNil(t, moVM.Config)
-			assert.NotNil(t, moVM.Config.KeyId)
-			assert.NotNil(t, moVM.Config.KeyId.ProviderId)
-			assert.Equal(t, providerID, moVM.Config.KeyId.ProviderId.Id)
-			assert.NotEmpty(t, moVM.Config.KeyId.KeyId)
-		})
-	})
-
-	t.Run("when default key provider does not exist", func(t *testing.T) {
-		Test(func(ctx context.Context, c *vim25.Client) {
-			providerID := uuid.NewString()
-			m := crypto.NewManagerKmip(c)
-			assert.NoError(t, m.RegisterKmsCluster(
-				ctx,
-				providerID,
-				types.KmipClusterInfoKmsManagementTypeUnknown))
-
-			finder := find.NewFinder(c, false)
-
-			dc, err := finder.DefaultDatacenter(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, dc)
-			finder.SetDatacenter(dc)
-
-			ds, err := finder.DefaultDatastore(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, ds)
-
-			folders, err := dc.Folders(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, folders)
-			assert.NotNil(t, folders.VmFolder)
-
-			hosts, err := finder.HostSystemList(ctx, "*/*")
-			assert.NoError(t, err)
-			assert.NotEmpty(t, hosts)
-
-			host := hosts[rand.Intn(len(hosts))]
-			pool, err := host.ResourcePool(ctx)
-			assert.NoError(t, err)
-			assert.NotNil(t, pool)
-
-			tsk, err := folders.VmFolder.CreateVM(
-				ctx,
-				types.VirtualMachineConfigSpec{
-					Name: "test",
-					Files: &types.VirtualMachineFileInfo{
-						VmPathName: fmt.Sprintf("[%s] test/test.vmx", ds.Name()),
-					},
-					GuestId: string(types.VirtualMachineGuestOsIdentifierOtherGuest),
-					Crypto:  &types.CryptoSpecEncrypt{},
-				},
-				pool,
-				host)
-			assert.NoError(t, err)
-			assert.NotNil(t, tsk)
-
-			_, err = tsk.WaitForResult(ctx)
-			assert.Error(t, err)
-
-			var flt *types.InvalidVmConfig
-			_, ok := fault.As(err, &flt)
-			assert.True(t, ok)
-			assert.NotNil(t, flt)
-			assert.Equal(t, "configSpec.crypto", flt.Property)
-		})
-	})
-}
-
-func TestCreateVmWithGeneratedKey(t *testing.T) {
-
-	Test(func(ctx context.Context, c *vim25.Client) {
-		providerID := uuid.NewString()
-		m := crypto.NewManagerKmip(c)
-		assert.NoError(t, m.RegisterKmsCluster(
-			ctx,
-			providerID,
-			types.KmipClusterInfoKmsManagementTypeUnknown))
-		finder := find.NewFinder(c, false)
-
-		dc, err := finder.DefaultDatacenter(ctx)
-		assert.NoError(t, err)
-		assert.NotNil(t, dc)
-		finder.SetDatacenter(dc)
-
-		ds, err := finder.DefaultDatastore(ctx)
-		assert.NoError(t, err)
-		assert.NotNil(t, ds)
-
-		folders, err := dc.Folders(ctx)
-		assert.NoError(t, err)
-		assert.NotNil(t, folders)
-		assert.NotNil(t, folders.VmFolder)
-
-		hosts, err := finder.HostSystemList(ctx, "*/*")
-		assert.NoError(t, err)
-		assert.NotEmpty(t, hosts)
-
-		host := hosts[rand.Intn(len(hosts))]
-		pool, err := host.ResourcePool(ctx)
-		assert.NoError(t, err)
-		assert.NotNil(t, pool)
-
-		tsk, err := folders.VmFolder.CreateVM(
-			ctx,
-			types.VirtualMachineConfigSpec{
-				Name: "test",
-				Files: &types.VirtualMachineFileInfo{
-					VmPathName: fmt.Sprintf("[%s] test/test.vmx", ds.Name()),
-				},
-				GuestId: string(types.VirtualMachineGuestOsIdentifierOtherGuest),
-				Crypto: &types.CryptoSpecEncrypt{
-					CryptoKeyId: types.CryptoKeyId{
-						ProviderId: &types.KeyProviderId{
-							Id: providerID,
-						},
-					},
-				},
-			},
-			pool,
-			host)
-		assert.NoError(t, err)
-		assert.NotNil(t, tsk)
-
-		tskInfo, err := tsk.WaitForResult(ctx)
-		assert.NoError(t, err)
-		assert.NotNil(t, tskInfo)
-		assert.Nil(t, tskInfo.Error)
-		assert.NotNil(t, tskInfo.Result)
-
-		vmRef, ok := tskInfo.Result.(types.ManagedObjectReference)
-		assert.True(t, ok)
-
-		vm := object.NewVirtualMachine(c, vmRef)
-
-		var moVM mo.VirtualMachine
-		assert.NoError(t, vm.Properties(ctx, vmRef, []string{"config.keyId"}, &moVM))
-
-		assert.NotNil(t, moVM.Config)
-		assert.NotNil(t, moVM.Config.KeyId)
-		assert.NotNil(t, moVM.Config.KeyId.ProviderId)
-		assert.Equal(t, providerID, moVM.Config.KeyId.ProviderId.Id)
-		assert.NotEmpty(t, moVM.Config.KeyId.KeyId)
-	})
-}