mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-02-03 11:00:09 -05:00
docs: clarify permissions on install page (#184)
* docs: clarify permissions on install page * docs: remove default attribute from tabs * docs: publish to 2.0
This commit is contained in:
Thomas Tendyck
GitHub
parent
029e6783a3
commit
811ccc80a3
@ -125,7 +125,7 @@ Enforcing non-reproducible measurements controlled by the cloud provider means t
|
||||
By default, Constellation only enforces measurements that are stable values produced by the infrastructure or by Constellation directly.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
Constellation leverages the [vTPM](https://docs.microsoft.com/en-us/azure/virtual-machines/trusted-launch#vtpm) feature of Azure CVMs for runtime measurements.
|
||||
The vTPM on Azure CVMs adheres to the [TPM 2.0](https://trustedcomputinggroup.org/resource/tpm-library-specification/) specification of the [Trusted Computing Group](https://trustedcomputinggroup.org/resource/trusted-platform-module-tpm-summary/).
|
||||
@ -153,7 +153,7 @@ The latter means that value can be generated offline and compared to the one in
|
||||
| 13–23 | Unused | - | - |
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
Constellation leverages the [vTPM](https://cloud.google.com/compute/confidential-vm/docs/about-cvm) feature of CVMs on GCP for runtime measurements.
|
||||
Note that the vTPM in GCP doesn't run inside the hardware-protected CVM context, but is emulated on the hypervisor level.
|
||||
|
||||
@ -7,7 +7,7 @@ The following steps guide you through the process of creating a cluster and depl
|
||||
1. Create the configuration file for your selected cloud provider.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
```bash
|
||||
constellation config generate azure
|
||||
@ -28,7 +28,7 @@ The following steps guide you through the process of creating a cluster and depl
|
||||
2. Fill in your cloud provider specific information.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure (CLI)" default>
|
||||
<tabItem value="azure" label="Azure (CLI)">
|
||||
|
||||
You need several resources for the cluster. You can use the following `az` script to create them:
|
||||
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
# Installation and Setup
|
||||
# Installation and setup
|
||||
|
||||
Constellation runs entirely in your cloud environment and can be easily controlled via a dedicated Command Line Interface (CLI).
|
||||
Constellation runs entirely in your cloud environment and can be controlled via a dedicated command-line interface (CLI).
|
||||
|
||||
The following guides you through the steps of installing the CLI on your machine, verifying it, and connecting it to your Cloud Service Provider (CSP).
|
||||
The following guides you through the steps of installing the CLI on your machine, verifying it, and connecting it to your cloud service provider (CSP).
|
||||
|
||||
### Prerequisites
|
||||
## Prerequisites
|
||||
|
||||
Make sure the following requirements are met:
|
||||
|
||||
- Your machine is running Linux or macOS
|
||||
- You have admin rights on your machine
|
||||
- [kubectl](https://kubernetes.io/docs/tasks/tools/) is installed
|
||||
- Your cloud provider is Microsoft Azure or Google Cloud Platform (GCP)
|
||||
- Your CSP is Microsoft Azure or Google Cloud Platform (GCP)
|
||||
|
||||
## Install the Constellation CLI
|
||||
|
||||
@ -100,18 +100,47 @@ The CLI supports autocompletion for various shells. To set it up, run `constella
|
||||
|
||||
## Set up cloud credentials
|
||||
|
||||
The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP. Currently, Microsoft Azure and Google Cloud Platform (GCP) are the only supported CSPs.
|
||||
The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP.
|
||||
|
||||
### Step 1: Authenticate
|
||||
### Required permissions
|
||||
|
||||
First, you need to authenticate with your CSP. The following lists the required steps for *testing* and *production* environments.
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
You need the following permissions for your user account:
|
||||
|
||||
- `Contributor` (to create cloud resources)
|
||||
- `User Access Administrator` (to create a service account)
|
||||
|
||||
If you don't have these permissions with scope *subscription*, ask your administrator to [create the service account and a resource group for your Constellation cluster](first-steps.md).
|
||||
Your user account needs the `Contributor` permission scoped to this resource group.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
Create a new project for Constellation or use an existing one.
|
||||
Enable the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com) on it.
|
||||
|
||||
You need the following permissions on this project:
|
||||
|
||||
- `compute.*` (or the subset defined by `roles/compute.instanceAdmin.v1`)
|
||||
- `iam.serviceAccountUser`
|
||||
|
||||
Follow Google's guide on [understanding](https://cloud.google.com/iam/docs/understanding-roles) and [assigning roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access).
|
||||
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
### Authentication
|
||||
|
||||
You need to authenticate with your CSP. The following lists the required steps for *testing* and *production* environments.
|
||||
|
||||
:::danger
|
||||
The steps for a *testing* environment are simpler. However, they may expose secrets to the CSP. If in doubt, follow the *production* steps.
|
||||
:::
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
**Testing**
|
||||
|
||||
@ -128,23 +157,15 @@ az login
|
||||
Other options are described in Azure's [authentication guide](https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli).
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
|
||||
Enable the following cloud APIs first:
|
||||
|
||||
- [Compute Engine API](https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com)
|
||||
- [Cloud Resource Manager API](https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com)
|
||||
- [Identity and Access Management (IAM) API](https://console.developers.google.com/apis/api/iam.googleapis.com)
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
**Testing**
|
||||
|
||||
If you are running from within VM on GCP, and the VM is allowed to access the necessary APIs, no further configuration is needed.
|
||||
|
||||
If you are using the [Google Cloud Shell](https://cloud.google.com/shell), make sure your [session is authorized](https://cloud.google.com/shell/docs/auth). For example, execute `gsutil` and accept the authorization prompt.
|
||||
You can use the [Google Cloud Shell](https://cloud.google.com/shell). Make sure your [session is authorized](https://cloud.google.com/shell/docs/auth). For example, execute `gsutil` and accept the authorization prompt.
|
||||
|
||||
**Production**
|
||||
|
||||
For production, use one of the following options on a trusted machine:
|
||||
Use one of the following options on a trusted machine:
|
||||
|
||||
- Use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud)
|
||||
|
||||
@ -162,31 +183,6 @@ For production, use one of the following options on a trusted machine:
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
### Step 2: Set permissions
|
||||
|
||||
Finally, set the required permissions for your user account.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
|
||||
Set the following permissions:
|
||||
|
||||
- `Contributor`
|
||||
- `User Access Administrator`
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
|
||||
Set the following permissions:
|
||||
|
||||
- `compute.*` (or the subset defined by `roles/compute.instanceAdmin.v1`)
|
||||
- `iam.serviceAccountUser`
|
||||
|
||||
Follow Google's guide on [understanding](https://cloud.google.com/iam/docs/understanding-roles) and [assigning roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access).
|
||||
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
### Next Steps
|
||||
## Next steps
|
||||
|
||||
You are now ready to [deploy your first confidential Kubernetes cluster and application](first-steps.md).
|
||||
|
||||
@ -25,14 +25,14 @@ You can find the currently supported machine types for your cloud environment in
|
||||
Constellation can generate a configuration file for your cloud provider:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
```bash
|
||||
constellation config generate azure
|
||||
```
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
```bash
|
||||
constellation config generate gcp
|
||||
|
||||
@ -18,7 +18,7 @@ Constellation provides logging information on the boot process and status via [c
|
||||
In the following, you'll find detailed descriptions for identifying clusters stuck in recovery for each cloud environment.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
In the Azure cloud portal find the cluster's resource group `<cluster-name>-<suffix>`
|
||||
Inside the resource group check that the control plane *Virtual machine scale set* `constellation-scale-set-controlplanes-<suffix>` has enough members in a *Running* state.
|
||||
@ -54,7 +54,7 @@ If that fails, because the control plane is unhealthy, you will see log messages
|
||||
This means that you have to recover the node manually. For this, you need its IP address, which can be obtained from the *Overview* page under *Private IP address*.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
First, check that the control plane *Instance Group* has enough members in a *Ready* state.
|
||||
Go to *Instance Groups* and check the group for the cluster's control plane `<cluster-name>-control-plane-<suffix>`.
|
||||
|
||||
@ -49,7 +49,7 @@ kubectl -n kube-system get nodes
|
||||
Alternatively, you can choose to manually scale your cluster up or down:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. Find your Constellation resource group.
|
||||
2. Select the `scale-set-workers`.
|
||||
@ -57,7 +57,7 @@ Alternatively, you can choose to manually scale your cluster up or down:
|
||||
4. Set the new **instance count** and **save**.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. In Compute Engine go to [Instance Groups](https://console.cloud.google.com/compute/instanceGroups/).
|
||||
2. **Edit** the **worker** instance group.
|
||||
@ -74,7 +74,7 @@ To increase the number of control-plane nodes, follow these steps:
|
||||
|
||||
<tabs groupId="csp">
|
||||
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. Find your Constellation resource group.
|
||||
2. Select the `scale-set-controlplanes`.
|
||||
@ -82,7 +82,7 @@ To increase the number of control-plane nodes, follow these steps:
|
||||
4. Set the new (increased) **instance count** and **save**.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. In Compute Engine go to [Instance Groups](https://console.cloud.google.com/compute/instanceGroups/).
|
||||
2. **Edit** the **control-plane** instance group.
|
||||
|
||||
@ -22,14 +22,14 @@ For more details see [encrypted persistent storage](../architecture/encrypted-st
|
||||
Constellation supports the following drivers, which offer node-level encryption and optional integrity protection.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. [Azure Disk Storage](https://github.com/edgelesssys/constellation-azuredisk-csi-driver)
|
||||
|
||||
Mount Azure [Disk Storage](https://azure.microsoft.com/en-us/services/storage/disks/#overview) into your Constellation cluster. See the example below on how to install the modified Azure Disk CSI driver or check out the [repository](https://github.com/edgelesssys/constellation-azuredisk-csi-driver) for installation and more information about the Constellation-managed version of the driver. Since Azure Disks are mounted as ReadWriteOnce, they're only available to a single pod.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. [Persistent Disk](https://github.com/edgelesssys/constellation-gcp-compute-persistent-disk-csi-driver):
|
||||
|
||||
@ -48,7 +48,7 @@ Note that in case the options above aren't a suitable solution for you, Constell
|
||||
The following installation guide gives an overview of how to securely use CSI-based cloud storage for persistent volumes in Constellation.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. Install the CSI driver:
|
||||
|
||||
@ -82,7 +82,7 @@ The following installation guide gives an overview of how to securely use CSI-ba
|
||||
```
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. Install the CSI driver:
|
||||
|
||||
@ -111,7 +111,7 @@ The following installation guide gives an overview of how to securely use CSI-ba
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
EOF
|
||||
```
|
||||
|
||||
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
@ -176,7 +176,7 @@ By default, integrity protection is disabled for performance reasons. If you wan
|
||||
The examples above are defined to be automatically set as the default storage class. The default storage class is responsible for all persistent volume claims that don't explicitly request `storageClassName`. In case you need to change the default, follow the steps below:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. List the storage classes in your cluster:
|
||||
|
||||
@ -223,7 +223,7 @@ The examples above are defined to be automatically set as the default storage cl
|
||||
```
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. List the storage classes in your cluster:
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ To provide information during early stages of the node's boot process, Constella
|
||||
You can view these information in the follow places:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. In your Azure subscription find the Constellation resource group.
|
||||
2. Inside the resource group find the Application Insights resource called `constellation-insights-*`.
|
||||
@ -20,7 +20,7 @@ You can view these information in the follow places:
|
||||
To **find the disk UUIDs** use the following query: `traces | where message contains "Disk UUID"`
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. Select the project that hosts Constellation.
|
||||
2. Go to the `Compute Engine` service.
|
||||
|
||||
@ -71,7 +71,7 @@ const sidebars = {
|
||||
items: [
|
||||
{
|
||||
type: 'doc',
|
||||
label: 'Install the CLI',
|
||||
label: 'Installation',
|
||||
id: 'getting-started/install',
|
||||
},
|
||||
{
|
||||
|
||||
@ -125,7 +125,7 @@ Enforcing non-reproducible measurements controlled by the cloud provider means t
|
||||
By default, Constellation only enforces measurements that are stable values produced by the infrastructure or by Constellation directly.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
Constellation leverages the [vTPM](https://docs.microsoft.com/en-us/azure/virtual-machines/trusted-launch#vtpm) feature of Azure CVMs for runtime measurements.
|
||||
The vTPM on Azure CVMs adheres to the [TPM 2.0](https://trustedcomputinggroup.org/resource/tpm-library-specification/) specification of the [Trusted Computing Group](https://trustedcomputinggroup.org/resource/trusted-platform-module-tpm-summary/).
|
||||
@ -153,7 +153,7 @@ The latter means that value can be generated offline and compared to the one in
|
||||
| 13–23 | Unused | - | - |
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
Constellation leverages the [vTPM](https://cloud.google.com/compute/confidential-vm/docs/about-cvm) feature of CVMs on GCP for runtime measurements.
|
||||
Note that the vTPM in GCP doesn't run inside the hardware-protected CVM context, but is emulated on the hypervisor level.
|
||||
|
||||
@ -7,7 +7,7 @@ The following steps guide you through the process of creating a cluster and depl
|
||||
1. Create the configuration file for your selected cloud provider.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
```bash
|
||||
constellation config generate azure
|
||||
@ -28,7 +28,7 @@ The following steps guide you through the process of creating a cluster and depl
|
||||
2. Fill in your cloud provider specific information.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure (CLI)" default>
|
||||
<tabItem value="azure" label="Azure (CLI)">
|
||||
|
||||
You need several resources for the cluster. You can use the following `az` script to create them:
|
||||
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
# Installation and Setup
|
||||
# Installation and setup
|
||||
|
||||
Constellation runs entirely in your cloud environment and can be easily controlled via a dedicated Command Line Interface (CLI).
|
||||
Constellation runs entirely in your cloud environment and can be controlled via a dedicated command-line interface (CLI).
|
||||
|
||||
The following guides you through the steps of installing the CLI on your machine, verifying it, and connecting it to your Cloud Service Provider (CSP).
|
||||
The following guides you through the steps of installing the CLI on your machine, verifying it, and connecting it to your cloud service provider (CSP).
|
||||
|
||||
### Prerequisites
|
||||
## Prerequisites
|
||||
|
||||
Make sure the following requirements are met:
|
||||
|
||||
- Your machine is running Linux or macOS
|
||||
- You have admin rights on your machine
|
||||
- [kubectl](https://kubernetes.io/docs/tasks/tools/) is installed
|
||||
- Your cloud provider is Microsoft Azure or Google Cloud Platform (GCP)
|
||||
- Your CSP is Microsoft Azure or Google Cloud Platform (GCP)
|
||||
|
||||
## Install the Constellation CLI
|
||||
|
||||
@ -100,18 +100,47 @@ The CLI supports autocompletion for various shells. To set it up, run `constella
|
||||
|
||||
## Set up cloud credentials
|
||||
|
||||
The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP. Currently, Microsoft Azure and Google Cloud Platform (GCP) are the only supported CSPs.
|
||||
The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP.
|
||||
|
||||
### Step 1: Authenticate
|
||||
### Required permissions
|
||||
|
||||
First, you need to authenticate with your CSP. The following lists the required steps for *testing* and *production* environments.
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
You need the following permissions for your user account:
|
||||
|
||||
- `Contributor` (to create cloud resources)
|
||||
- `User Access Administrator` (to create a service account)
|
||||
|
||||
If you don't have these permissions with scope *subscription*, ask your administrator to [create the service account and a resource group for your Constellation cluster](first-steps.md).
|
||||
Your user account needs the `Contributor` permission scoped to this resource group.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
Create a new project for Constellation or use an existing one.
|
||||
Enable the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com) on it.
|
||||
|
||||
You need the following permissions on this project:
|
||||
|
||||
- `compute.*` (or the subset defined by `roles/compute.instanceAdmin.v1`)
|
||||
- `iam.serviceAccountUser`
|
||||
|
||||
Follow Google's guide on [understanding](https://cloud.google.com/iam/docs/understanding-roles) and [assigning roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access).
|
||||
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
### Authentication
|
||||
|
||||
You need to authenticate with your CSP. The following lists the required steps for *testing* and *production* environments.
|
||||
|
||||
:::danger
|
||||
The steps for a *testing* environment are simpler. However, they may expose secrets to the CSP. If in doubt, follow the *production* steps.
|
||||
:::
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
**Testing**
|
||||
|
||||
@ -128,23 +157,15 @@ az login
|
||||
Other options are described in Azure's [authentication guide](https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli).
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
|
||||
Enable the following cloud APIs first:
|
||||
|
||||
- [Compute Engine API](https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com)
|
||||
- [Cloud Resource Manager API](https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com)
|
||||
- [Identity and Access Management (IAM) API](https://console.developers.google.com/apis/api/iam.googleapis.com)
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
**Testing**
|
||||
|
||||
If you are running from within VM on GCP, and the VM is allowed to access the necessary APIs, no further configuration is needed.
|
||||
|
||||
If you are using the [Google Cloud Shell](https://cloud.google.com/shell), make sure your [session is authorized](https://cloud.google.com/shell/docs/auth). For example, execute `gsutil` and accept the authorization prompt.
|
||||
You can use the [Google Cloud Shell](https://cloud.google.com/shell). Make sure your [session is authorized](https://cloud.google.com/shell/docs/auth). For example, execute `gsutil` and accept the authorization prompt.
|
||||
|
||||
**Production**
|
||||
|
||||
For production, use one of the following options on a trusted machine:
|
||||
Use one of the following options on a trusted machine:
|
||||
|
||||
- Use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud)
|
||||
|
||||
@ -162,31 +183,6 @@ For production, use one of the following options on a trusted machine:
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
### Step 2: Set permissions
|
||||
|
||||
Finally, set the required permissions for your user account.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
|
||||
Set the following permissions:
|
||||
|
||||
- `Contributor`
|
||||
- `User Access Administrator`
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
|
||||
Set the following permissions:
|
||||
|
||||
- `compute.*` (or the subset defined by `roles/compute.instanceAdmin.v1`)
|
||||
- `iam.serviceAccountUser`
|
||||
|
||||
Follow Google's guide on [understanding](https://cloud.google.com/iam/docs/understanding-roles) and [assigning roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access).
|
||||
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
### Next Steps
|
||||
## Next steps
|
||||
|
||||
You are now ready to [deploy your first confidential Kubernetes cluster and application](first-steps.md).
|
||||
|
||||
@ -26,14 +26,14 @@ You can find the currently supported machine types for your cloud environment in
|
||||
Constellation can generate a configuration file for your cloud provider:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
```bash
|
||||
constellation config generate azure
|
||||
```
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
```bash
|
||||
constellation config generate gcp
|
||||
|
||||
@ -18,7 +18,7 @@ Constellation provides logging information on the boot process and status via [c
|
||||
In the following, you'll find detailed descriptions for identifying clusters stuck in recovery for each cloud environment.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
In the Azure cloud portal find the cluster's resource group `<cluster-name>-<suffix>`
|
||||
Inside the resource group check that the control plane *Virtual machine scale set* `constellation-scale-set-controlplanes-<suffix>` has enough members in a *Running* state.
|
||||
@ -54,7 +54,7 @@ If that fails, because the control plane is unhealthy, you will see log messages
|
||||
This means that you have to recover the node manually. For this, you need its IP address, which can be obtained from the *Overview* page under *Private IP address*.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
First, check that the control plane *Instance Group* has enough members in a *Ready* state.
|
||||
Go to *Instance Groups* and check the group for the cluster's control plane `<cluster-name>-control-plane-<suffix>`.
|
||||
|
||||
@ -7,7 +7,7 @@ Constellation provides all features of a Kubernetes cluster including scaling an
|
||||
[During cluster initialization](create.md#init) you can choose to deploy the [cluster autoscaler](https://github.com/kubernetes/autoscaler). It automatically provisions additional worker nodes so that all pods have a place to run. Alternatively, you can choose to manually scale your cluster up or down:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. Find your Constellation resource group.
|
||||
2. Select the `scale-set-workers`.
|
||||
@ -15,7 +15,7 @@ Constellation provides all features of a Kubernetes cluster including scaling an
|
||||
4. Set the new **instance count** and **save**.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. In Compute Engine go to [Instance Groups](https://console.cloud.google.com/compute/instanceGroups/).
|
||||
2. **Edit** the **worker** instance group.
|
||||
@ -32,7 +32,7 @@ To increase the number of control-plane nodes, follow these steps:
|
||||
|
||||
<tabs groupId="csp">
|
||||
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. Find your Constellation resource group.
|
||||
2. Select the `scale-set-controlplanes`.
|
||||
@ -40,7 +40,7 @@ To increase the number of control-plane nodes, follow these steps:
|
||||
4. Set the new (increased) **instance count** and **save**.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. In Compute Engine go to [Instance Groups](https://console.cloud.google.com/compute/instanceGroups/).
|
||||
2. **Edit** the **control-plane** instance group.
|
||||
|
||||
@ -22,14 +22,14 @@ For more details see [encrypted persistent storage](../architecture/encrypted-st
|
||||
Constellation supports the following drivers, which offer node-level encryption and optional integrity protection.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. [Azure Disk Storage](https://github.com/edgelesssys/constellation-azuredisk-csi-driver)
|
||||
|
||||
Mount Azure [Disk Storage](https://azure.microsoft.com/en-us/services/storage/disks/#overview) into your Constellation cluster. See the example below on how to install the modified Azure Disk CSI driver or check out the [repository](https://github.com/edgelesssys/constellation-azuredisk-csi-driver) for installation and more information about the Constellation-managed version of the driver. Since Azure Disks are mounted as ReadWriteOnce, they're only available to a single pod.
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. [Persistent Disk](https://github.com/edgelesssys/constellation-gcp-compute-persistent-disk-csi-driver):
|
||||
|
||||
@ -48,7 +48,7 @@ Note that in case the options above aren't a suitable solution for you, Constell
|
||||
The following installation guide gives an overview of how to securely use CSI-based cloud storage for persistent volumes in Constellation.
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. Install the CSI driver:
|
||||
|
||||
@ -82,7 +82,7 @@ The following installation guide gives an overview of how to securely use CSI-ba
|
||||
```
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. Install the CSI driver:
|
||||
|
||||
@ -111,7 +111,7 @@ The following installation guide gives an overview of how to securely use CSI-ba
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
EOF
|
||||
```
|
||||
|
||||
|
||||
</tabItem>
|
||||
</tabs>
|
||||
|
||||
@ -176,7 +176,7 @@ By default, integrity protection is disabled for performance reasons. If you wan
|
||||
The examples above are defined to be automatically set as the default storage class. The default storage class is responsible for all persistent volume claims that don't explicitly request `storageClassName`. In case you need to change the default, follow the steps below:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. List the storage classes in your cluster:
|
||||
|
||||
@ -223,7 +223,7 @@ The examples above are defined to be automatically set as the default storage cl
|
||||
```
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. List the storage classes in your cluster:
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ To provide information during early stages of the node's boot process, Constella
|
||||
You can view these information in the follow places:
|
||||
|
||||
<tabs groupId="csp">
|
||||
<tabItem value="azure" label="Azure" default>
|
||||
<tabItem value="azure" label="Azure">
|
||||
|
||||
1. In your Azure subscription find the Constellation resource group.
|
||||
2. Inside the resource group find the Application Insights resource called `constellation-insights-*`.
|
||||
@ -20,7 +20,7 @@ You can view these information in the follow places:
|
||||
To **find the disk UUIDs** use the following query: `traces | where message contains "Disk UUID"`
|
||||
|
||||
</tabItem>
|
||||
<tabItem value="gcp" label="GCP" default>
|
||||
<tabItem value="gcp" label="GCP">
|
||||
|
||||
1. Select the project that hosts Constellation.
|
||||
2. Go to the `Compute Engine` service.
|
||||
|
||||
@ -53,7 +53,7 @@
|
||||
"items": [
|
||||
{
|
||||
"type": "doc",
|
||||
"label": "Install the CLI",
|
||||
"label": "Installation",
|
||||
"id": "getting-started/install"
|
||||
},
|
||||
{
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user