2022-09-05 03:06:08 -04:00
|
|
|
/*
|
|
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
*/
|
|
|
|
|
2022-04-13 07:01:38 -04:00
|
|
|
package cloudcmd
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
|
2022-09-21 07:47:57 -04:00
|
|
|
azurecl "github.com/edgelesssys/constellation/v2/cli/internal/azure/client"
|
|
|
|
"github.com/edgelesssys/constellation/v2/cli/internal/gcp"
|
|
|
|
gcpcl "github.com/edgelesssys/constellation/v2/cli/internal/gcp/client"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudtypes"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/config"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/constants"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/state"
|
2022-04-13 07:01:38 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
// Creator creates cloud resources.
|
|
|
|
type Creator struct {
|
|
|
|
out io.Writer
|
|
|
|
newGCPClient func(ctx context.Context, project, zone, region, name string) (gcpclient, error)
|
2022-08-25 09:12:08 -04:00
|
|
|
newAzureClient func(subscriptionID, tenantID, name, location, resourceGroup string) (azureclient, error)
|
2022-04-13 07:01:38 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// NewCreator creates a new creator.
|
|
|
|
func NewCreator(out io.Writer) *Creator {
|
|
|
|
return &Creator{
|
|
|
|
out: out,
|
|
|
|
newGCPClient: func(ctx context.Context, project, zone, region, name string) (gcpclient, error) {
|
|
|
|
return gcpcl.NewInitialized(ctx, project, zone, region, name)
|
|
|
|
},
|
2022-08-25 09:12:08 -04:00
|
|
|
newAzureClient: func(subscriptionID, tenantID, name, location, resourceGroup string) (azureclient, error) {
|
|
|
|
return azurecl.NewInitialized(subscriptionID, tenantID, name, location, resourceGroup)
|
2022-04-13 07:01:38 -04:00
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create creates the handed amount of instances and all the needed resources.
|
2022-06-29 09:26:29 -04:00
|
|
|
func (c *Creator) Create(ctx context.Context, provider cloudprovider.Provider, config *config.Config, name, insType string, controlPlaneCount, workerCount int,
|
2022-04-13 07:01:38 -04:00
|
|
|
) (state.ConstellationState, error) {
|
2022-09-05 10:53:37 -04:00
|
|
|
// Use debug ingress firewall rules when debug mode / image is enabled
|
|
|
|
var ingressRules cloudtypes.Firewall
|
|
|
|
if config.IsDebugCluster() {
|
|
|
|
ingressRules = constants.IngressRulesDebug
|
|
|
|
} else {
|
|
|
|
ingressRules = constants.IngressRulesNoDebug
|
|
|
|
}
|
|
|
|
|
2022-04-13 07:01:38 -04:00
|
|
|
switch provider {
|
|
|
|
case cloudprovider.GCP:
|
|
|
|
cl, err := c.newGCPClient(
|
|
|
|
ctx,
|
2022-05-16 12:54:25 -04:00
|
|
|
config.Provider.GCP.Project,
|
|
|
|
config.Provider.GCP.Zone,
|
|
|
|
config.Provider.GCP.Region,
|
2022-04-13 07:01:38 -04:00
|
|
|
name,
|
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
defer cl.Close()
|
2022-09-05 10:53:37 -04:00
|
|
|
return c.createGCP(ctx, cl, config, insType, controlPlaneCount, workerCount, ingressRules)
|
2022-04-13 07:01:38 -04:00
|
|
|
case cloudprovider.Azure:
|
|
|
|
cl, err := c.newAzureClient(
|
2022-05-16 12:54:25 -04:00
|
|
|
config.Provider.Azure.SubscriptionID,
|
|
|
|
config.Provider.Azure.TenantID,
|
2022-04-13 07:01:38 -04:00
|
|
|
name,
|
2022-05-16 12:54:25 -04:00
|
|
|
config.Provider.Azure.Location,
|
2022-08-25 09:12:08 -04:00
|
|
|
config.Provider.Azure.ResourceGroup,
|
2022-04-13 07:01:38 -04:00
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
2022-09-05 10:53:37 -04:00
|
|
|
return c.createAzure(ctx, cl, config, insType, controlPlaneCount, workerCount, ingressRules)
|
2022-04-13 07:01:38 -04:00
|
|
|
default:
|
|
|
|
return state.ConstellationState{}, fmt.Errorf("unsupported cloud provider: %s", provider)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-05 10:53:37 -04:00
|
|
|
func (c *Creator) createGCP(ctx context.Context, cl gcpclient, config *config.Config, insType string, controlPlaneCount, workerCount int, ingressRules cloudtypes.Firewall,
|
2022-04-13 07:01:38 -04:00
|
|
|
) (stat state.ConstellationState, retErr error) {
|
|
|
|
defer rollbackOnError(context.Background(), c.out, &retErr, &rollbackerGCP{client: cl})
|
|
|
|
|
2022-05-16 12:54:25 -04:00
|
|
|
if err := cl.CreateVPCs(ctx); err != nil {
|
2022-04-13 07:01:38 -04:00
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
2022-09-05 10:53:37 -04:00
|
|
|
|
2022-05-16 12:54:25 -04:00
|
|
|
if err := cl.CreateFirewall(ctx, gcpcl.FirewallInput{
|
2022-09-05 10:53:37 -04:00
|
|
|
Ingress: ingressRules,
|
|
|
|
Egress: constants.EgressRules,
|
2022-05-16 12:54:25 -04:00
|
|
|
}); err != nil {
|
2022-04-13 07:01:38 -04:00
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
|
2022-05-24 04:04:42 -04:00
|
|
|
// additionally create allow-internal rules
|
|
|
|
internalFirewallInput := gcpcl.FirewallInput{
|
|
|
|
Ingress: cloudtypes.Firewall{
|
|
|
|
{
|
|
|
|
Name: "allow-cluster-internal-tcp",
|
|
|
|
Protocol: "tcp",
|
|
|
|
IPRange: gcpcl.SubnetExtCIDR,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "allow-cluster-internal-udp",
|
|
|
|
Protocol: "udp",
|
|
|
|
IPRange: gcpcl.SubnetExtCIDR,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "allow-cluster-internal-icmp",
|
|
|
|
Protocol: "icmp",
|
|
|
|
IPRange: gcpcl.SubnetExtCIDR,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "allow-node-internal-tcp",
|
|
|
|
Protocol: "tcp",
|
|
|
|
IPRange: gcpcl.SubnetCIDR,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "allow-node-internal-udp",
|
|
|
|
Protocol: "udp",
|
|
|
|
IPRange: gcpcl.SubnetCIDR,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Name: "allow-node-internal-icmp",
|
|
|
|
Protocol: "icmp",
|
|
|
|
IPRange: gcpcl.SubnetCIDR,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
if err := cl.CreateFirewall(ctx, internalFirewallInput); err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
|
2022-06-07 08:52:47 -04:00
|
|
|
createInput := gcpcl.CreateInstancesInput{
|
2022-09-19 09:21:33 -04:00
|
|
|
EnableSerialConsole: config.IsDebugCluster(),
|
|
|
|
CountControlPlanes: controlPlaneCount,
|
|
|
|
CountWorkers: workerCount,
|
|
|
|
ImageID: config.Provider.GCP.Image,
|
|
|
|
InstanceType: insType,
|
|
|
|
StateDiskSizeGB: config.StateDiskSizeGB,
|
|
|
|
StateDiskType: config.Provider.GCP.StateDiskType,
|
|
|
|
KubeEnv: gcp.KubeEnv,
|
2022-04-13 07:01:38 -04:00
|
|
|
}
|
|
|
|
if err := cl.CreateInstances(ctx, createInput); err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
|
2022-09-06 04:28:00 -04:00
|
|
|
if err := cl.CreateLoadBalancers(ctx, config.IsDebugCluster()); err != nil {
|
2022-06-09 16:26:36 -04:00
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
|
2022-08-01 06:35:35 -04:00
|
|
|
return cl.GetState(), nil
|
2022-04-13 07:01:38 -04:00
|
|
|
}
|
|
|
|
|
2022-09-05 10:53:37 -04:00
|
|
|
func (c *Creator) createAzure(ctx context.Context, cl azureclient, config *config.Config, insType string, controlPlaneCount, workerCount int, ingressRules cloudtypes.Firewall,
|
2022-04-13 07:01:38 -04:00
|
|
|
) (stat state.ConstellationState, retErr error) {
|
|
|
|
defer rollbackOnError(context.Background(), c.out, &retErr, &rollbackerAzure{client: cl})
|
|
|
|
|
2022-06-15 06:19:41 -04:00
|
|
|
if err := cl.CreateApplicationInsight(ctx); err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
2022-09-05 12:14:58 -04:00
|
|
|
if err := cl.CreateExternalLoadBalancer(ctx, config.IsDebugCluster()); err != nil {
|
2022-05-24 04:04:42 -04:00
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
2022-04-13 07:01:38 -04:00
|
|
|
if err := cl.CreateVirtualNetwork(ctx); err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
2022-05-16 12:54:25 -04:00
|
|
|
|
|
|
|
if err := cl.CreateSecurityGroup(ctx, azurecl.NetworkSecurityGroupInput{
|
2022-09-05 10:53:37 -04:00
|
|
|
Ingress: ingressRules,
|
|
|
|
Egress: constants.EgressRules,
|
2022-05-16 12:54:25 -04:00
|
|
|
}); err != nil {
|
2022-04-13 07:01:38 -04:00
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
createInput := azurecl.CreateInstancesInput{
|
2022-06-29 09:26:29 -04:00
|
|
|
CountControlPlanes: controlPlaneCount,
|
|
|
|
CountWorkers: workerCount,
|
2022-04-13 07:01:38 -04:00
|
|
|
InstanceType: insType,
|
2022-05-16 12:54:25 -04:00
|
|
|
StateDiskSizeGB: config.StateDiskSizeGB,
|
2022-08-02 06:24:55 -04:00
|
|
|
StateDiskType: config.Provider.Azure.StateDiskType,
|
2022-05-16 12:54:25 -04:00
|
|
|
Image: config.Provider.Azure.Image,
|
|
|
|
UserAssingedIdentity: config.Provider.Azure.UserAssignedIdentity,
|
2022-08-25 09:24:31 -04:00
|
|
|
ConfidentialVM: *config.Provider.Azure.ConfidentialVM,
|
2022-04-13 07:01:38 -04:00
|
|
|
}
|
|
|
|
if err := cl.CreateInstances(ctx, createInput); err != nil {
|
|
|
|
return state.ConstellationState{}, err
|
|
|
|
}
|
|
|
|
|
2022-08-01 06:35:35 -04:00
|
|
|
return cl.GetState(), nil
|
2022-04-13 07:01:38 -04:00
|
|
|
}
|