Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-09-24 06:54:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

attestation: add option for MAA fallback to verify azure's snp-sev id key digest (#1257)

Browse source 
* Convert enforceIDKeyDigest setting to enum

* Use MAA fallback in Azure SNP attestation

* Only create MAA provider if MAA fallback is enabled

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
This commit is contained in:
Daniel Weiße 2023-03-21 12:46:49 +01:00 • committed by GitHub
parent 9a9688583d
commit 5a0234b3f2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
66 changed files with 1073 additions and 542 deletions
Download patch file Download diff file Expand all files Collapse all files

11
internal/cloud/azure/azure.go
View file

@ -20,7 +20,6 @@ import (
"encoding/json"
"errors"
"fmt"
"net/http"
"path"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
@ -51,12 +50,8 @@ func New(ctx context.Context) (*Cloud, error) {
if err != nil {
return nil, fmt.Errorf("loading credentials: %w", err)
}
// The default http client may use a system-wide proxy and it is recommended to disable the proxy explicitly:
// https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=linux#proxies
// See also: https://github.com/microsoft/azureimds/blob/master/imdssample.go#L10
imdsAPI := imdsClient{
client: &http.Client{Transport: &http.Transport{Proxy: nil}},
}
imdsAPI := NewIMDSClient()
subscriptionID, err := imdsAPI.subscriptionID(ctx)
if err != nil {
return nil, fmt.Errorf("retrieving subscription ID: %w", err)
@ -91,7 +86,7 @@ func New(ctx context.Context) (*Cloud, error) {
}
return &Cloud{
imds: &imdsAPI,
imds: imdsAPI,
netIfacAPI: networkInterfacesAPI,
virtNetAPI: virtualNetworksAPI,
secGroupAPI: securityGroupsAPI,