AB#2386: TrustedLaunch support for azure attestation

* There are now two attestation packages on azure.
The issuer on the server side is created base on successfully
querying the idkeydigest from the TPM. Fallback on err: Trusted Launch.
* The bootstrapper's issuer choice is validated by the CLI's validator,
which is created based on the local config.
* Add "azureCVM" field to new "internal-config" cm.
This field is populated by the bootstrapper.
* Group attestation OIDs by CSP (#42)
* Bootstrapper now uses IssuerWrapper type to pass
the issuer (and some context info) to the initserver.
* Introduce VMType package akin to cloudprovider. Used by
IssuerWrapper.
* Extend unittests.
* Remove CSP specific attestation integration tests

Co-authored-by: <dw@edgeless.systems>
Signed-off-by: Otto Bittner <cobittner@posteo.net>

bootstrapper/internal/initserver/initserver.go

@@ -18,6 +18,7 @@ import (
 	"github.com/edgelesssys/constellation/bootstrapper/internal/kubernetes/k8sapi/resources"
 	"github.com/edgelesssys/constellation/internal/atls"
 	"github.com/edgelesssys/constellation/internal/attestation"
+	"github.com/edgelesssys/constellation/internal/cloud/vmtype"
 	"github.com/edgelesssys/constellation/internal/crypto"
 	"github.com/edgelesssys/constellation/internal/file"
 	"github.com/edgelesssys/constellation/internal/grpc/atlscredentials"
@@ -36,12 +37,13 @@ import (
 // The server handles initialization calls from the CLI and initializes the
 // Kubernetes cluster.
 type Server struct {
-	nodeLock    locker
-	initializer ClusterInitializer
-	disk        encryptedDisk
-	fileHandler file.Handler
-	grpcServer  serveStopper
-	cleaner     cleaner
+	nodeLock      locker
+	initializer   ClusterInitializer
+	disk          encryptedDisk
+	fileHandler   file.Handler
+	grpcServer    serveStopper
+	cleaner       cleaner
+	issuerWrapper IssuerWrapper
 
 	log *logger.Logger
 
@@ -49,18 +51,20 @@ type Server struct {
 }
 
 // New creates a new initialization server.
-func New(lock locker, kube ClusterInitializer, issuer atls.Issuer, fh file.Handler, log *logger.Logger) *Server {
+func New(lock locker, kube ClusterInitializer, issuerWrapper IssuerWrapper, fh file.Handler, log *logger.Logger) *Server {
 	log = log.Named("initServer")
+
 	server := &Server{
-		nodeLock:    lock,
-		disk:        diskencryption.New(),
-		initializer: kube,
-		fileHandler: fh,
-		log:         log,
+		nodeLock:      lock,
+		disk:          diskencryption.New(),
+		initializer:   kube,
+		fileHandler:   fh,
+		issuerWrapper: issuerWrapper,
+		log:           log,
 	}
 
 	grpcServer := grpc.NewServer(
-		grpc.Creds(atlscredentials.New(issuer, nil)),
+		grpc.Creds(atlscredentials.New(issuerWrapper, nil)),
 		grpc.KeepaliveParams(keepalive.ServerParameters{Time: 15 * time.Second}),
 		log.Named("gRPC").GetServerUnaryInterceptor(),
 	)
@@ -127,6 +131,8 @@ func (s *Server) Init(ctx context.Context, req *initproto.InitRequest) (*initpro
 		measurementSalt,
 		req.EnforcedPcrs,
 		req.EnforceIdkeydigest,
+		s.issuerWrapper.IdKeyDigest(),
+		s.issuerWrapper.VMType() == vmtype.AzureCVM,
 		resources.KMSConfig{
 			MasterSecret:       req.MasterSecret,
 			Salt:               req.Salt,
@@ -175,6 +181,28 @@ func (s *Server) setupDisk(masterSecret, salt []byte) error {
 	return s.disk.UpdatePassphrase(string(diskKey))
 }
 
+type IssuerWrapper struct {
+	atls.Issuer
+	vmType      vmtype.VMType
+	idkeydigest []byte
+}
+
+func NewIssuerWrapper(issuer atls.Issuer, vmType vmtype.VMType, idkeydigest []byte) IssuerWrapper {
+	return IssuerWrapper{
+		Issuer:      issuer,
+		vmType:      vmType,
+		idkeydigest: idkeydigest,
+	}
+}
+
+func (i *IssuerWrapper) VMType() vmtype.VMType {
+	return i.vmType
+}
+
+func (i *IssuerWrapper) IdKeyDigest() []byte {
+	return i.idkeydigest
+}
+
 func sshProtoKeysToMap(keys []*initproto.SSHUserKey) map[string]string {
 	keyMap := make(map[string]string)
 	for _, key := range keys {
@@ -211,6 +239,8 @@ type ClusterInitializer interface {
 		measurementSalt []byte,
 		enforcedPcrs []uint32,
 		enforceIdKeyDigest bool,
+		idKeyDigest []byte,
+		azureCVM bool,
 		kmsConfig resources.KMSConfig,
 		sshUserKeys map[string]string,
 		helmDeployments []byte,

bootstrapper/internal/initserver/initserver_test.go

@@ -34,7 +34,7 @@ func TestNew(t *testing.T) {
 	assert := assert.New(t)
 
 	fh := file.NewHandler(afero.NewMemMapFs())
-	server := New(newFakeLock(), &stubClusterInitializer{}, nil, fh, logger.NewTest(t))
+	server := New(newFakeLock(), &stubClusterInitializer{}, IssuerWrapper{}, fh, logger.NewTest(t))
 	assert.NotNil(server)
 	assert.NotNil(server.log)
 	assert.NotNil(server.nodeLock)
@@ -289,7 +289,7 @@ type stubClusterInitializer struct {
 }
 
 func (i *stubClusterInitializer) InitCluster(
-	context.Context, []string, string, string, []byte, []uint32, bool,
+	context.Context, []string, string, string, []byte, []uint32, bool, []byte, bool,
 	resources.KMSConfig, map[string]string, []byte, *logger.Logger,
 ) ([]byte, error) {
 	return i.initClusterKubeconfig, i.initClusterErr