Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-01 19:46:07 -04:00
Code Issues Projects Releases Packages Wiki Activity

config: only allow confidential instances on stackit (#3463)

Browse source 
* cli: only allow confidential instances on stackit

* review changes
This commit is contained in:
Mauritz Uphoff 2024-10-29 12:35:01 +01:00 • committed by GitHub
parent 7dc38d9ff0
commit 9124691743
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 75 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
internal/config/validation.go
View file

@ -520,7 +520,7 @@ func (c *Config) translateMoreThanOneProviderError(ut ut.Translator, fe validato
return t
}
func validInstanceTypeForProvider(insType string, attestation variant.Variant) bool {
func validInstanceTypeForProvider(insType string, attestation variant.Variant, provider ProviderConfig) bool {
switch attestation {
case variant.AWSSEVSNP{}, variant.AWSNitroTPM{}:
return isSupportedAWSInstanceType(insType, attestation.Equal(variant.AWSNitroTPM{}))
@ -549,6 +549,17 @@ func validInstanceTypeForProvider(insType string, attestation variant.Variant) b
}
}
case variant.QEMUVTPM{}, variant.QEMUTDX{}:
// only allow confidential instances on stackit cloud using QEMU vTPM
if provider.OpenStack != nil {
if cloud := provider.OpenStack.Cloud; strings.ToLower(cloud) == "stackit" {
for _, instanceType := range instancetypes.STACKITInstanceTypes {
if insType == instanceType {
return true
}
}
return false
}
}
return true
}
return false
@ -789,7 +800,7 @@ func (c *Config) validateNodeGroupZoneField(fl validator.FieldLevel) bool {
}
func (c *Config) validateInstanceType(fl validator.FieldLevel) bool {
return validInstanceTypeForProvider(fl.Field().String(), c.GetAttestationConfig().GetVariant())
return validInstanceTypeForProvider(fl.Field().String(), c.GetAttestationConfig().GetVariant(), c.Provider)
}
func (c *Config) validateStateDiskTypeField(fl validator.FieldLevel) bool {