Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-01-27 07:47:02 -05:00
Code Issues Packages Projects Releases Wiki Activity

Remove GCP non CVMs

Browse Source 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2022-04-29 16:27:03 +02:00 committed by Daniel Weiße
parent 3b49b1453e
commit 10e9faab10
9 changed files with 6 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cli/cloud/cloudcmd/create.go
View File

@ -85,7 +85,6 @@ func (c *Creator) createGCP(ctx context.Context, cl gcpclient, config *config.Co
InstanceType: insType,
StateDiskSizeGB: *config.StateDiskSizeGB,
KubeEnv: gcp.KubeEnv,
DisableCVM: *config.Provider.GCP.DisableCVM,
}
if err := cl.CreateInstances(ctx, createInput); err != nil {
return state.ConstellationState{}, err

1
cli/cloud/cloudcmd/validators.go
View File

@ -93,7 +93,6 @@ func (v *Validators) updateValidators() {
case cloudprovider.GCP:
v.validators = []atls.Validator{
gcp.NewValidator(v.pcrs),
gcp.NewNonCVMValidator(map[uint32][]byte{}), // TODO: Remove once we no longer use non CVMs.
}
case cloudprovider.Azure:
v.validators = []atls.Validator{

1
cli/cloud/cloudcmd/validators_test.go
View File

@ -278,7 +278,6 @@ func TestValidatorsV(t *testing.T) {
pcrs: newTestPCRs(),
wantVs: []atls.Validator{
gcp.NewValidator(newTestPCRs()),
gcp.NewNonCVMValidator(map[uint32][]byte{}), // TODO: remove when not longer needed.
},
},
"azure": {

6
cli/gcp/client/instances.go
View File

@ -37,7 +37,6 @@ func (c *Client) CreateInstances(ctx context.Context, input CreateInstancesInput
Zone: c.zone,
Region: c.region,
UID: c.uid,
DisableCVM: input.DisableCVM,
}
op, err := c.insertInstanceTemplate(ctx, nodeTemplateInput)
if err != nil {
@ -58,7 +57,6 @@ func (c *Client) CreateInstances(ctx context.Context, input CreateInstancesInput
Zone: c.zone,
Region: c.region,
UID: c.uid,
DisableCVM: input.DisableCVM,
}
op, err = c.insertInstanceTemplate(ctx, coordinatorTemplateInput)
if err != nil {
@ -293,7 +291,6 @@ type CreateInstancesInput struct {
InstanceType string
StateDiskSizeGB int
KubeEnv string
DisableCVM bool
}
type insertInstanceTemplateInput struct {
@ -309,7 +306,6 @@ type insertInstanceTemplateInput struct {
Zone string
Region string
UID string
DisableCVM bool
}
func (i insertInstanceTemplateInput) insertInstanceTemplateRequest() *computepb.InsertInstanceTemplateRequest {
@ -319,7 +315,7 @@ func (i insertInstanceTemplateInput) insertInstanceTemplateRequest() *computepb.
Name: proto.String(i.Name),
Properties: &computepb.InstanceProperties{
ConfidentialInstanceConfig: &computepb.ConfidentialInstanceConfig{
EnableConfidentialCompute: proto.Bool(!i.DisableCVM),
EnableConfidentialCompute: proto.Bool(true),
},
Description: proto.String("This instance belongs to a Constellation."),
Disks: []*computepb.AttachedDisk{

91
coordinator/attestation/gcp/noncvm.go
View File

@ -1,91 +0,0 @@
package gcp
import (
"context"
"fmt"
"time"
compute "cloud.google.com/go/compute/apiv1"
"cloud.google.com/go/compute/metadata"
"github.com/edgelesssys/constellation/coordinator/attestation/vtpm"
"github.com/edgelesssys/constellation/coordinator/oid"
tpmclient "github.com/google/go-tpm-tools/client"
computepb "google.golang.org/genproto/googleapis/cloud/compute/v1"
)
// NonCVMValidator is a validator for regular GCP VMs with vTPM.
// TODO: Remove once we no longer use non cvms.
type NonCVMValidator struct {
oid.GCPNonCVM
*vtpm.Validator
}
// NewNonCVMValidator initializes a new non CVM GCP validator with the provided PCR values.
// TODO: Remove once we no longer use non cvms.
func NewNonCVMValidator(pcrs map[uint32][]byte) *NonCVMValidator {
return &NonCVMValidator{
Validator: vtpm.NewValidator(
pcrs,
trustedKeyFromGCEAPI(newInstanceClient),
func(attestation vtpm.AttestationDocument) error { return nil },
vtpm.VerifyPKCS1v15,
),
}
}
// NonCVNMIssuer for GCP confindetial VM attestation.
// TODO: Remove once we no longer use non cvms.
type NonCVMIssuer struct {
oid.GCPNonCVM
*vtpm.Issuer
}
// NewNonCVNMIssuer initializes a new GCP Issuer.
// TODO: Remove once we no longer use non cvms.
func NewNonCVMIssuer() *NonCVMIssuer {
return &NonCVMIssuer{
Issuer: vtpm.NewIssuer(
vtpm.OpenVTPM,
tpmclient.GceAttestationKeyRSA,
getGCEInstanceInfo(metadataClient{}),
),
}
}
// IsCVM returns true if the VM has confidential computing capabilities enabled.
func IsCVM() (bool, error) {
project, err := metadata.ProjectID()
if err != nil {
return false, err
}
zone, err := metadata.Zone()
if err != nil {
return false, err
}
instance, err := metadata.InstanceName()
if err != nil {
return false, err
}
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
defer cancel()
client, err := compute.NewInstancesRESTClient(ctx)
if err != nil {
return false, err
}
defer client.Close()
infos, err := client.Get(ctx, &computepb.GetInstanceRequest{
Instance: instance,
Project: project,
Zone: zone,
})
if err != nil {
return false, err
}
if infos.ConfidentialInstanceConfig == nil {
return false, fmt.Errorf("received empty confidential instance config")
}
return *infos.ConfidentialInstanceConfig.EnableConfidentialCompute, nil
}

15
coordinator/cmd/coordinator/main.go
View File

@ -84,18 +84,9 @@ func main() {
log.Fatal(err)
}
// TODO: Remove once we no longer use non cvms
isCVM, err := gcp.IsCVM()
if err != nil {
log.Fatal(err)
}
if isCVM {
issuer = gcp.NewIssuer()
validator = gcp.NewValidator(pcrs)
} else {
issuer = gcp.NewNonCVMIssuer()
validator = gcp.NewNonCVMValidator(pcrs)
}
issuer = gcp.NewIssuer()
validator = gcp.NewValidator(pcrs)
kube = kubernetes.New(&k8sapi.KubernetesUtil{}, &k8sapi.CoreOSConfiguration{}, kubectl.New())
gcpClient, err := gcpcloud.NewClient(context.Background())
if err != nil {

9
coordinator/oid/oid.go
View File

@ -51,12 +51,3 @@ type QEMU struct{}
func (QEMU) OID() asn1.ObjectIdentifier {
return asn1.ObjectIdentifier{1, 3, 9900, 5}
}
// GCPNonCVM returns the GCP OID for non CVMs.
// TODO: Remove once we no longer use non cvms.
type GCPNonCVM struct{}
// OID returns the struct's object identifier.
func (GCPNonCVM) OID() asn1.ObjectIdentifier {
return asn1.ObjectIdentifier{1, 3, 9900, 99}
}

4
internal/config/config.go
View File

@ -191,8 +191,7 @@ func Default() *Config {
"roles/storage.admin",
"roles/iam.serviceAccountUser",
},
DisableCVM: proto.Bool(false),
PCRs: pcrPtr(gcpPCRs),
PCRs: pcrPtr(gcpPCRs),
},
},
}
@ -247,7 +246,6 @@ type GCPConfig struct {
VPCsInput *gcpClient.VPCsInput `json:"vpcsinput,omitempty"`
ServiceAccountRoles *[]string `json:"serviceaccountroles,omitempty"`
PCRs *map[uint32][]byte `json:"pcrs,omitempty"`
DisableCVM *bool `json:"disableCVM"`
}
func pcrPtr(pcrs map[uint32][]byte) *map[uint32][]byte {

3
util/pcr-reader/main.go
View File

@ -48,7 +48,6 @@ func main() {
if err := waiter.InitializeValidators([]atls.Validator{
azure.NewValidator(map[uint32][]byte{}),
gcp.NewValidator(map[uint32][]byte{}),
gcp.NewNonCVMValidator(map[uint32][]byte{}),
}); err != nil {
log.Fatal(err)
}
@ -110,7 +109,7 @@ func getVerifyPeerCertificateFunc(attDoc *[]byte) func(rawCerts [][]byte, verifi
}
for _, ex := range cert.Extensions {
if ex.Id.Equal(oid.Azure{}.OID()) || ex.Id.Equal(oid.GCP{}.OID()) || ex.Id.Equal(oid.GCPNonCVM{}.OID()) {
if ex.Id.Equal(oid.Azure{}.OID()) || ex.Id.Equal(oid.GCP{}.OID()) {
if err := json.Unmarshal(ex.Value, attDoc); err != nil {
*attDoc = ex.Value
}