From 0332a3645f0c49b53259b793a6ccf7debc6db486 Mon Sep 17 00:00:00 2001
From: Adrian Stobbe <stobbe.adrian@gmail.com>
Date: Tue, 15 Aug 2023 13:58:04 +0200
Subject: [PATCH] cli: update join-config manually during upgrade (#2229)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
---
 cli/internal/cmd/upgradeapply.go   |  4 ++++
 cli/internal/kubernetes/upgrade.go | 24 ++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/cli/internal/cmd/upgradeapply.go b/cli/internal/cmd/upgradeapply.go
index b145826c4..2775a058d 100644
--- a/cli/internal/cmd/upgradeapply.go
+++ b/cli/internal/cmd/upgradeapply.go
@@ -360,6 +360,9 @@ func (u *upgradeApplyCmd) confirmIfUpgradeAttestConfigHasDiff(cmd *cobra.Command
 	if err := u.upgrader.BackupConfigMap(cmd.Context(), constants.JoinConfigMap); err != nil {
 		return fmt.Errorf("backing up join-config: %w", err)
 	}
+	if err := u.upgrader.UpdateAttestationConfig(cmd.Context(), newConfig); err != nil {
+		return fmt.Errorf("updating attestation config: %w", err)
+	}
 	return nil
 }
 
@@ -472,6 +475,7 @@ type cloudUpgrader interface {
 	UpgradeHelmServices(ctx context.Context, config *config.Config, idFile clusterid.File, timeout time.Duration, allowDestructive bool, force bool, conformance bool, helmWaitMode helm.WaitMode, masterSecret uri.MasterSecret, serviceAccURI string, validK8sVersion versions.ValidK8sVersion, tfOutput terraform.ApplyOutput) error
 	ExtendClusterConfigCertSANs(ctx context.Context, alternativeNames []string) error
 	GetClusterAttestationConfig(ctx context.Context, variant variant.Variant) (config.AttestationCfg, error)
+	UpdateAttestationConfig(ctx context.Context, newAttestConfig config.AttestationCfg) error
 	GetMeasurementSalt(ctx context.Context) ([]byte, error)
 	PlanTerraformMigrations(ctx context.Context, opts upgrade.TerraformUpgradeOptions) (bool, error)
 	ApplyTerraformMigrations(ctx context.Context, opts upgrade.TerraformUpgradeOptions) (terraform.ApplyOutput, error)
diff --git a/cli/internal/kubernetes/upgrade.go b/cli/internal/kubernetes/upgrade.go
index 38eedbdd6..a04b79e0f 100644
--- a/cli/internal/kubernetes/upgrade.go
+++ b/cli/internal/kubernetes/upgrade.go
@@ -8,6 +8,7 @@ package kubernetes
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -347,6 +348,29 @@ func (u *Upgrader) BackupConfigMap(ctx context.Context, name string) error {
 	return nil
 }
 
+// UpdateAttestationConfig fetches the cluster's attestation config, compares them to a new config,
+// and updates the cluster's config if it is different from the new one.
+func (u *Upgrader) UpdateAttestationConfig(ctx context.Context, newAttestConfig config.AttestationCfg) error {
+	// backup of previous measurements
+	joinConfig, err := u.stableInterface.GetConfigMap(ctx, constants.JoinConfigMap)
+	if err != nil {
+		return fmt.Errorf("getting join-config configmap: %w", err)
+	}
+
+	newConfigJSON, err := json.Marshal(newAttestConfig)
+	if err != nil {
+		return fmt.Errorf("marshaling attestation config: %w", err)
+	}
+	joinConfig.Data[constants.AttestationConfigFilename] = string(newConfigJSON)
+	u.log.Debugf("Triggering attestation config update now")
+	if _, err = u.stableInterface.UpdateConfigMap(ctx, joinConfig); err != nil {
+		return fmt.Errorf("setting new attestation config: %w", err)
+	}
+
+	fmt.Fprintln(u.outWriter, "Successfully updated the cluster's attestation config")
+	return nil
+}
+
 // ExtendClusterConfigCertSANs extends the ClusterConfig stored under "kube-system/kubeadm-config" with the given SANs.
 // Existing SANs are preserved.
 func (u *Upgrader) ExtendClusterConfigCertSANs(ctx context.Context, alternativeNames []string) error {