cli: declare mastersecret as immutable and print attestationCfg diff in warning (#2167)

cli/internal/cmd/upgradeapply.go

@@ -28,8 +28,10 @@ import (
 	"github.com/edgelesssys/constellation/v2/internal/file"
 	"github.com/edgelesssys/constellation/v2/internal/imagefetcher"
 	"github.com/edgelesssys/constellation/v2/internal/versions"
+	"github.com/rogpeppe/go-internal/diff"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v3"
 	corev1 "k8s.io/api/core/v1"
 )
 
@@ -73,9 +75,19 @@ func runUpgradeApply(cmd *cobra.Command, _ []string) error {
 
 	imagefetcher := imagefetcher.New()
 	configFetcher := attestationconfigapi.NewFetcher()
-
 	applyCmd := upgradeApplyCmd{upgrader: upgrader, log: log, imageFetcher: imagefetcher, configFetcher: configFetcher}
-	return applyCmd.upgradeApply(cmd, fileHandler)
+	return applyCmd.upgradeApply(cmd, fileHandler, stableClientFactoryImpl)
+}
+
+type stableClientFactory func(kubeconfigPath string) (getConfigMapper, error)
+
+// needed because StableClient returns the bigger kubernetes.StableInterface.
+func stableClientFactoryImpl(kubeconfigPath string) (getConfigMapper, error) {
+	return kubernetes.NewStableClient(kubeconfigPath)
+}
+
+type getConfigMapper interface {
+	GetCurrentConfigMap(ctx context.Context, name string) (*corev1.ConfigMap, error)
 }
 
 type upgradeApplyCmd struct {
@@ -85,7 +97,7 @@ type upgradeApplyCmd struct {
 	log           debugLog
 }
 
-func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command, fileHandler file.Handler) error {
+func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command, fileHandler file.Handler, stableClientFactory stableClientFactory) error {
 	flags, err := parseUpgradeApplyFlags(cmd)
 	if err != nil {
 		return fmt.Errorf("parsing flags: %w", err)
@@ -112,7 +124,6 @@ func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command, fileHandler file.Hand
 			}
 		}
 	}
-
 	if err := handleInvalidK8sPatchVersion(cmd, conf.KubernetesVersion, flags.yes); err != nil {
 		return err
 	}
@@ -124,7 +135,11 @@ func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command, fileHandler file.Hand
 	conf.UpdateMAAURL(idFile.AttestationURL)
 
 	// If an image upgrade was just executed there won't be a diff. The function will return nil in that case.
-	if err := u.upgradeAttestConfigIfDiff(cmd, conf.GetAttestationConfig(), flags); err != nil {
+	stableClient, err := stableClientFactory(constants.AdminConfFilename)
+	if err != nil {
+		return fmt.Errorf("creating stable client: %w", err)
+	}
+	if err := u.upgradeAttestConfigIfDiff(cmd, stableClient, conf.GetAttestationConfig(), flags); err != nil {
 		return fmt.Errorf("upgrading measurements: %w", err)
 	}
 	// not moving existing Terraform migrator because of planned apply refactor
@@ -172,6 +187,20 @@ func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command, fileHandler file.Hand
 	return nil
 }
 
+func diffAttestationCfg(currentAttestationCfg config.AttestationCfg, newAttestationCfg config.AttestationCfg) (string, error) {
+	// cannot compare structs directly with go-cmp because of unexported fields in the attestation config
+	currentYml, err := yaml.Marshal(currentAttestationCfg)
+	if err != nil {
+		return "", fmt.Errorf("marshalling remote attestation config: %w", err)
+	}
+	newYml, err := yaml.Marshal(newAttestationCfg)
+	if err != nil {
+		return "", fmt.Errorf("marshalling local attestation config: %w", err)
+	}
+	diff := string(diff.Diff("current", currentYml, "new", newYml))
+	return diff, nil
+}
+
 func getImage(ctx context.Context, conf *config.Config, fetcher imageFetcher) (string, error) {
 	// Fetch variables to execute Terraform script with
 	provider := conf.GetProvider()
@@ -290,8 +319,8 @@ type imageFetcher interface {
 
 // upgradeAttestConfigIfDiff checks if the locally configured measurements are different from the cluster's measurements.
 // If so the function will ask the user to confirm (if --yes is not set) and upgrade the measurements only.
-func (u *upgradeApplyCmd) upgradeAttestConfigIfDiff(cmd *cobra.Command, newConfig config.AttestationCfg, flags upgradeApplyFlags) error {
-	clusterAttestationConfig, _, err := u.upgrader.GetClusterAttestationConfig(cmd.Context(), newConfig.GetVariant())
+func (u *upgradeApplyCmd) upgradeAttestConfigIfDiff(cmd *cobra.Command, stableClient getConfigMapper, newConfig config.AttestationCfg, flags upgradeApplyFlags) error {
+	clusterAttestationConfig, err := getAttestationConfig(cmd.Context(), stableClient, newConfig.GetVariant())
 	if err != nil {
 		return fmt.Errorf("getting cluster attestation config: %w", err)
 	}
@@ -305,7 +334,14 @@ func (u *upgradeApplyCmd) upgradeAttestConfigIfDiff(cmd *cobra.Command, newConfi
 	}
 
 	if !flags.yes {
-		ok, err := askToConfirm(cmd, "You are about to change your cluster's attestation config. Are you sure you want to continue?")
+		cmd.Println("The configured attestation config is different from the attestation config in the cluster.")
+		diffStr, err := diffAttestationCfg(clusterAttestationConfig, newConfig)
+		if err != nil {
+			return fmt.Errorf("diffing attestation configs: %w", err)
+		}
+		cmd.Println("The following changes will be applied to the attestation config:")
+		cmd.Println(diffStr)
+		ok, err := askToConfirm(cmd, "Are you sure you want to change your cluster's attestation config?")
 		if err != nil {
 			return fmt.Errorf("asking for confirmation: %w", err)
 		}