mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-08-01 11:36:10 -04:00
docs: generate docs for v2.5.0 (#1059)
Co-authored-by: release[bot] <release[bot]@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
GitHub
parent
5142497a3d
commit
35d9efd351
57 changed files with 7117 additions and 0 deletions
589
docs/versioned_docs/version-2.5/reference/cli.md
Normal file
589
docs/versioned_docs/version-2.5/reference/cli.md
Normal file
|
|
@ -0,0 +1,589 @@
|
|||
# CLI reference
|
||||
|
||||
<!-- This file is generated by constellation/hack/clidocgen via update-cli-reference.yml workflow. Don't edit manually. -->
|
||||
|
||||
Use the Constellation CLI to create and manage your clusters.
|
||||
|
||||
Usage:
|
||||
|
||||
```
|
||||
constellation [command]
|
||||
```
|
||||
Commands:
|
||||
|
||||
* [config](#constellation-config): Work with the Constellation configuration file
|
||||
* [generate](#constellation-config-generate): Generate a default configuration file
|
||||
* [fetch-measurements](#constellation-config-fetch-measurements): Fetch measurements for configured cloud provider and image
|
||||
* [instance-types](#constellation-config-instance-types): Print the supported instance types for all cloud providers
|
||||
* [create](#constellation-create): Create instances on a cloud platform for your Constellation cluster
|
||||
* [init](#constellation-init): Initialize the Constellation cluster
|
||||
* [mini](#constellation-mini): Manage MiniConstellation clusters
|
||||
* [up](#constellation-mini-up): Create and initialize a new MiniConstellation cluster
|
||||
* [down](#constellation-mini-down): Destroy a MiniConstellation cluster
|
||||
* [verify](#constellation-verify): Verify the confidential properties of a Constellation cluster
|
||||
* [upgrade](#constellation-upgrade): Plan and perform an upgrade of a Constellation cluster
|
||||
* [plan](#constellation-upgrade-plan): Plan an upgrade of a Constellation cluster
|
||||
* [execute](#constellation-upgrade-execute): Execute an upgrade of a Constellation cluster
|
||||
* [recover](#constellation-recover): Recover a completely stopped Constellation cluster
|
||||
* [terminate](#constellation-terminate): Terminate a Constellation cluster
|
||||
* [version](#constellation-version): Display version of this CLI
|
||||
* [iam](#constellation-iam): Work with the IAM configuration on your cloud provider
|
||||
* [create](#constellation-iam-create): Create IAM configuration on a cloud platform for your Constellation cluster
|
||||
* [aws](#constellation-iam-create-aws): Create IAM configuration on AWS for your Constellation cluster
|
||||
* [azure](#constellation-iam-create-azure): Create IAM configuration on Microsoft Azure for your Constellation cluster
|
||||
* [gcp](#constellation-iam-create-gcp): Create IAM configuration on GCP for your Constellation cluster
|
||||
|
||||
## constellation config
|
||||
|
||||
Work with the Constellation configuration file
|
||||
|
||||
### Synopsis
|
||||
|
||||
Work with the Constellation configuration file.
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for config
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation config generate
|
||||
|
||||
Generate a default configuration file
|
||||
|
||||
### Synopsis
|
||||
|
||||
Generate a default configuration file for your selected cloud provider.
|
||||
|
||||
```
|
||||
constellation config generate {aws|azure|gcp|qemu} [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-f, --file string path to output file, or '-' for stdout (default "constellation-conf.yaml")
|
||||
-h, --help help for generate
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation config fetch-measurements
|
||||
|
||||
Fetch measurements for configured cloud provider and image
|
||||
|
||||
### Synopsis
|
||||
|
||||
Fetch measurements for configured cloud provider and image.
|
||||
|
||||
A config needs to be generated first.
|
||||
|
||||
```
|
||||
constellation config fetch-measurements [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for fetch-measurements
|
||||
-s, --signature-url string alternative URL to fetch measurements' signature from
|
||||
-u, --url string alternative URL to fetch measurements from
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation config instance-types
|
||||
|
||||
Print the supported instance types for all cloud providers
|
||||
|
||||
### Synopsis
|
||||
|
||||
Print the supported instance types for all cloud providers.
|
||||
|
||||
```
|
||||
constellation config instance-types [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for instance-types
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation create
|
||||
|
||||
Create instances on a cloud platform for your Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Create instances on a cloud platform for your Constellation cluster.
|
||||
|
||||
```
|
||||
constellation create [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-c, --control-plane-nodes int number of control-plane nodes (required)
|
||||
-h, --help help for create
|
||||
--name string create the cluster with the specified name (default "constell")
|
||||
-w, --worker-nodes int number of worker nodes (required)
|
||||
-y, --yes create the cluster without further confirmation
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation init
|
||||
|
||||
Initialize the Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Initialize the Constellation cluster.
|
||||
|
||||
Start your confidential Kubernetes.
|
||||
|
||||
```
|
||||
constellation init [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
--conformance enable conformance mode
|
||||
-h, --help help for init
|
||||
--master-secret string path to base64-encoded master secret
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation mini
|
||||
|
||||
Manage MiniConstellation clusters
|
||||
|
||||
### Synopsis
|
||||
|
||||
Manage MiniConstellation clusters.
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for mini
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation mini up
|
||||
|
||||
Create and initialize a new MiniConstellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Create and initialize a new MiniConstellation cluster.
|
||||
|
||||
A mini cluster consists of a single control-plane and worker node, hosted using QEMU/KVM.
|
||||
|
||||
```
|
||||
constellation mini up [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
--config string path to the configuration file to use for the cluster
|
||||
-h, --help help for up
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation mini down
|
||||
|
||||
Destroy a MiniConstellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Destroy a MiniConstellation cluster.
|
||||
|
||||
```
|
||||
constellation mini down [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for down
|
||||
-y, --yes terminate the cluster without further confirmation
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation verify
|
||||
|
||||
Verify the confidential properties of a Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Verify the confidential properties of a Constellation cluster.
|
||||
|
||||
If arguments aren't specified, values are read from `constellation-id.json`.
|
||||
|
||||
```
|
||||
constellation verify [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
--cluster-id string expected cluster identifier
|
||||
-h, --help help for verify
|
||||
-e, --node-endpoint string endpoint of the node to verify, passed as HOST[:PORT]
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation upgrade
|
||||
|
||||
Plan and perform an upgrade of a Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Plan and perform an upgrade of a Constellation cluster.
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for upgrade
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation upgrade plan
|
||||
|
||||
Plan an upgrade of a Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Plan an upgrade of a Constellation cluster by fetching compatible image versions and their measurements.
|
||||
|
||||
```
|
||||
constellation upgrade plan [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-f, --file string path to output file, or '-' for stdout (omit for interactive mode)
|
||||
-h, --help help for plan
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation upgrade execute
|
||||
|
||||
Execute an upgrade of a Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Execute an upgrade of a Constellation cluster by applying the chosen configuration.
|
||||
|
||||
```
|
||||
constellation upgrade execute [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for execute
|
||||
-y, --yes run upgrades without further confirmation
|
||||
WARNING: might delete your resources in case you are using cert-manager in your cluster. Please read the docs.
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation recover
|
||||
|
||||
Recover a completely stopped Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Recover a Constellation cluster by sending a recovery key to an instance in the boot stage.
|
||||
|
||||
This is only required if instances restart without other instances available for bootstrapping.
|
||||
|
||||
```
|
||||
constellation recover [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-e, --endpoint string endpoint of the instance, passed as HOST[:PORT]
|
||||
-h, --help help for recover
|
||||
--master-secret string path to master secret file (default "constellation-mastersecret.json")
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation terminate
|
||||
|
||||
Terminate a Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Terminate a Constellation cluster.
|
||||
|
||||
The cluster can't be started again, and all persistent storage will be lost.
|
||||
|
||||
```
|
||||
constellation terminate [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for terminate
|
||||
-y, --yes terminate the cluster without further confirmation
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation version
|
||||
|
||||
Display version of this CLI
|
||||
|
||||
### Synopsis
|
||||
|
||||
Display version of this CLI.
|
||||
|
||||
```
|
||||
constellation version [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for version
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation iam
|
||||
|
||||
Work with the IAM configuration on your cloud provider
|
||||
|
||||
### Synopsis
|
||||
|
||||
Work with the IAM configuration on your cloud provider.
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for iam
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation iam create
|
||||
|
||||
Create IAM configuration on a cloud platform for your Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Create IAM configuration on a cloud platform for your Constellation cluster.
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
--generate-config automatically generate a configuration file and fill in the required fields
|
||||
-h, --help help for create
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
```
|
||||
|
||||
## constellation iam create aws
|
||||
|
||||
Create IAM configuration on AWS for your Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Create IAM configuration on AWS for your Constellation cluster.
|
||||
|
||||
```
|
||||
constellation iam create aws [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for aws
|
||||
--prefix string name prefix for all resources (required)
|
||||
--yes create the IAM configuration without further confirmation
|
||||
--zone string AWS availability zone the resources will be created in, e.g. us-east-2a (required)
|
||||
Find available zones here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones. Note that we do not support every zone / region. You can find a list of all supported regions in our docs.
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
--generate-config automatically generate a configuration file and fill in the required fields
|
||||
```
|
||||
|
||||
## constellation iam create azure
|
||||
|
||||
Create IAM configuration on Microsoft Azure for your Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Create IAM configuration on Microsoft Azure for your Constellation cluster.
|
||||
|
||||
```
|
||||
constellation iam create azure [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for azure
|
||||
--region string region the resources will be created in, e.g. westus (required)
|
||||
--resourceGroup string name prefix of the two resource groups your cluster / IAM resources will be created in (required)
|
||||
--servicePrincipal string name of the service principal that will be created (required)
|
||||
--yes create the IAM configuration without further confirmation
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
--generate-config automatically generate a configuration file and fill in the required fields
|
||||
```
|
||||
|
||||
## constellation iam create gcp
|
||||
|
||||
Create IAM configuration on GCP for your Constellation cluster
|
||||
|
||||
### Synopsis
|
||||
|
||||
Create IAM configuration on GCP for your Constellation cluster.
|
||||
|
||||
```
|
||||
constellation iam create gcp [flags]
|
||||
```
|
||||
|
||||
### Options
|
||||
|
||||
```
|
||||
-h, --help help for gcp
|
||||
--projectID string ID of the GCP project the configuration will be created in (required)
|
||||
Find it on the welcome screen of your project: https://console.cloud.google.com/welcome.
|
||||
--serviceAccountID string ID for the service account that will be created (required)
|
||||
Must match ^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$.
|
||||
--yes create the IAM configuration without further confirmation
|
||||
--zone string GCP zone the cluster will be deployed in (required)
|
||||
Find a list of available zones here: https://cloud.google.com/compute/docs/regions-zones#available.
|
||||
```
|
||||
|
||||
### Options inherited from parent commands
|
||||
|
||||
```
|
||||
--config string path to the configuration file (default "constellation-conf.yaml")
|
||||
--debug enable debug logging
|
||||
--generate-config automatically generate a configuration file and fill in the required fields
|
||||
```
|
||||
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
# Configuration migrations
|
||||
|
||||
This document describes breaking changes in the configuration file format between Constellation releases.
|
||||
|
||||
## Migrating from CLI versions before 2.3
|
||||
|
||||
- The `sshUsers` field was deprecated in v2.2 and has been removed from the configuration in v2.3.
|
||||
As an alternative for SSH, check the workflow section [Connect to nodes](../workflows/troubleshooting.md#connect-to-nodes).
|
||||
- The `image` field for each cloud service provider has been replaced with a global `image` field. Use the following mapping to migrate your configuration:
|
||||
<details>
|
||||
<summary>Show all</summary>
|
||||
|
||||
| CSP | old image | new image |
|
||||
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
|
||||
| AWS | `ami-06b8cbf4837a0a57c` | `v2.2.2` |
|
||||
| AWS | `ami-02e96dc04a9e438cd` | `v2.2.2` |
|
||||
| AWS | `ami-028ead928a9034b2f` | `v2.2.2` |
|
||||
| AWS | `ami-032ac10dd8d8266e3` | `v2.2.1` |
|
||||
| AWS | `ami-032e0d57cc4395088` | `v2.2.1` |
|
||||
| AWS | `ami-053c3e49e19b96bdd` | `v2.2.1` |
|
||||
| AWS | `ami-0e27ebcefc38f648b` | `v2.2.0` |
|
||||
| AWS | `ami-098cd37f66523b7c3` | `v2.2.0` |
|
||||
| AWS | `ami-04a87d302e2509aad` | `v2.2.0` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.2.2` | `v2.2.2` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.2.2` | `v2.2.2` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.2.1` | `v2.2.1` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.2.1` | `v2.2.1` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.2.0` | `v2.2.0` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.2.0` | `v2.2.0` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.1.0` | `v2.1.0` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.1.0` | `v2.1.0` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation/images/constellation/versions/2.0.0` | `v2.0.0` |
|
||||
| Azure | `/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/constellation-images/providers/Microsoft.Compute/galleries/Constellation_CVM/images/constellation/versions/2.0.0` | `v2.0.0` |
|
||||
| GCP | `projects/constellation-images/global/images/constellation-v2-2-2` | `v2.2.2` |
|
||||
| GCP | `projects/constellation-images/global/images/constellation-v2-2-1` | `v2.2.1` |
|
||||
| GCP | `projects/constellation-images/global/images/constellation-v2-2-0` | `v2.2.0` |
|
||||
| GCP | `projects/constellation-images/global/images/constellation-v2-1-0` | `v2.1.0` |
|
||||
| GCP | `projects/constellation-images/global/images/constellation-v2-0-0` | `v2.0.0` |
|
||||
</details>
|
||||
- The `enforcedMeasurements` field has been removed and merged with the `measurements` field.
|
||||
- To migrate your config containing a new image (`v2.3` or greater), remove the old `measurements` and `enforcedMeasurements` entries from your config and run `constellation fetch-measurements`
|
||||
- To migrate your config containing an image older than `v2.3`, remove the `enforcedMeasurements` entry and replace the entries in `measurements` as shown in the example below:
|
||||
|
||||
```diff
|
||||
measurements:
|
||||
- 0: DzXCFGCNk8em5ornNZtKi+Wg6Z7qkQfs5CfE3qTkOc8=
|
||||
+ 0:
|
||||
+ expected: DzXCFGCNk8em5ornNZtKi+Wg6Z7qkQfs5CfE3qTkOc8=
|
||||
+ warnOnly: true
|
||||
- 8: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
|
||||
+ 8:
|
||||
+ expected: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
|
||||
+ warnOnly: false
|
||||
-enforcedMeasurements:
|
||||
- - 8
|
||||
```
|
||||
73
docs/versioned_docs/version-2.5/reference/slsa.md
Normal file
73
docs/versioned_docs/version-2.5/reference/slsa.md
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# Supply chain levels for software artifacts (SLSA) adoption
|
||||
|
||||
[Supply chain Levels for Software Artifacts, or SLSA (salsa)](https://slsa.dev/) is a framework for improving and grading a project's build system and engineering processes. SLSA focuses on security improvements for source code storage as well as build system definition, execution, and observation. SLSA is structured in [four levels](https://slsa.dev/spec/v0.1/levels). This page describes the adoption of SLSA for Constellation.
|
||||
|
||||
:::info
|
||||
SLSA is still in alpha status. The presented levels and their requirements might change in the future. We will adopt any changes into our engineering processes, as they get defined.
|
||||
:::
|
||||
|
||||
## Level 1 - Adopted
|
||||
|
||||
**[Build - Scripted](https://slsa.dev/spec/v0.1/requirements#scripted-build)**
|
||||
|
||||
All build steps are automated via [CMake](https://github.com/edgelesssys/constellation/blob/main/CMakeLists.txt) and [GitHub Actions](https://github.com/edgelesssys/constellation/tree/main/.github).
|
||||
|
||||
**[Provenance - Available](https://slsa.dev/spec/v0.1/requirements#available)**
|
||||
|
||||
Provenance for the CLI is generated using the [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator).
|
||||
|
||||
## Level 2 - Adopted
|
||||
|
||||
**[Source - Version Controlled](https://slsa.dev/spec/v0.1/requirements#version-controlled)**
|
||||
|
||||
Constellation is hosted on GitHub using git.
|
||||
|
||||
**[Build - Build Service](https://slsa.dev/spec/v0.1/requirements#build-service)**
|
||||
|
||||
All builds are carried out by [GitHub Actions](https://github.com/edgelesssys/constellation/tree/main/.github).
|
||||
|
||||
**[Provenance - Authenticated](https://slsa.dev/spec/v0.1/requirements#authenticated)**
|
||||
|
||||
Provenance for the CLI is signed using the [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator). Learn [how to verify the CLI](../workflows/verify-cli.md) using the signed provenance, before using it for the first time.
|
||||
|
||||
**[Provenance - Service Generated](https://slsa.dev/spec/v0.1/requirements#service-generated)**
|
||||
|
||||
Provenance for the CLI is generated using the [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) in GitHub Actions.
|
||||
|
||||
## Level 3 - Adopted
|
||||
|
||||
**[Source - Verified History](https://slsa.dev/spec/v0.1/requirements#verified-history)**
|
||||
|
||||
The [Edgeless Systems](https://github.com/edgelesssys) GitHub organization [requires two-factor authentication](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization) for all members.
|
||||
|
||||
**[Source - Retained Indefinitely](https://slsa.dev/spec/v0.1/requirements#retained-indefinitely)**
|
||||
|
||||
Since we use GitHub to host the repository, an external person can't modify or delete the history. Before a pull request can be merged, an explicit approval from an [Edgeless Systems](https://github.com/edgelesssys) team member is required.
|
||||
|
||||
The same holds true for changes proposed by team members. Each change to `main` needs to be proposed via a pull request and requires at least one approval.
|
||||
|
||||
The [Edgeless Systems](https://github.com/edgelesssys) GitHub organization admins control these settings and are able to make changes to the repository's history should legal requirements necessitate it. These changes require two-party approval following the obliterate policy.
|
||||
|
||||
**[Build - Build as Code](https://slsa.dev/spec/v0.1/requirements#build-as-code)**
|
||||
|
||||
All build files for Constellation are stored in [the same repository](https://github.com/edgelesssys/constellation/tree/main/.github).
|
||||
|
||||
**[Build - Ephemeral Environment](https://slsa.dev/spec/v0.1/requirements#ephemeral-environment)**
|
||||
|
||||
All GitHub Action workflows are executed on [GitHub-hosted runners](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners). These runners are only available during workflow.
|
||||
|
||||
We currently don't use [self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners).
|
||||
|
||||
**[Build - Isolated](https://slsa.dev/spec/v0.1/requirements#isolated)**
|
||||
|
||||
As outlined in the previous section, we use GitHub-hosted runners, which provide a new, isolated and ephemeral environment for each build.
|
||||
|
||||
Additionally, the [SLSA GitHub generator](https://github.com/slsa-framework/slsa-github-generator#generation-of-provenance) itself is run in an isolated workflow with the artifact hash as defined inputs.
|
||||
|
||||
**[Provenance - Non-falsifiable](https://slsa.dev/spec/v0.1/requirements#non-falsifiable)**
|
||||
|
||||
As outlined by [SLSA GitHub generator](https://github.com/slsa-framework/slsa-github-generator) it already fulfills the non-falsifiable requirements for SLSA Level 3. The generated provenance is signed using [sigstore](https://sigstore.dev/) with an OIDC based proof of identity.
|
||||
|
||||
## Level 4 - In Progress
|
||||
|
||||
We strive to adopt certain aspect of SLSA Level 4 that support our engineering process. At the same time, SLSA is still in alpha status and the biggest changes to SLSA are expected to be around Level 4.
|
||||
Loading…
Add table
Add a link
Reference in a new issue