Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-09-19 12:34:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

remove deprecated constellation create flags (#2325)

Browse source 
* chore: clean-up TODOs

* cli: make OpenStack error explicit

* cli: remove deprecated flags

* config: require DeployCSIDriver field
This commit is contained in:
3u13r 2023-09-08 21:15:02 +02:00 • committed by GitHub
parent 5960025da7
commit a25c90e9bb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 56 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

2
3rdparty/bazel/org_openssl/BUILD.bazel vendored
View file

@ -18,7 +18,6 @@ cc_test(
], ],
"//conditions:default": [], "//conditions:default": [],
}), }),
# TODO support OpenSSL on Mac
target_compatible_with = [ target_compatible_with = [
"@platforms//os:linux", "@platforms//os:linux",
], ],
@ -27,7 +26,6 @@ cc_test(
build_test( build_test(
name = "build_test", name = "build_test",
# TODO support OpenSSL on Mac
target_compatible_with = [ target_compatible_with = [
"@platforms//os:linux", "@platforms//os:linux",
], ],

3
cli/internal/cloudcmd/create.go
View file

@ -200,9 +200,8 @@ func normalizeAzureURIs(vars *terraform.AzureClusterVariables) *terraform.AzureC
} }
func (c *Creator) createOpenStack(ctx context.Context, cl tfResourceClient, opts CreateOptions) (tfOutput terraform.ApplyOutput, retErr error) { func (c *Creator) createOpenStack(ctx context.Context, cl tfResourceClient, opts CreateOptions) (tfOutput terraform.ApplyOutput, retErr error) {
// TODO(malt3): Remove this once OpenStack is supported.
if os.Getenv("CONSTELLATION_OPENSTACK_DEV") != "1" { if os.Getenv("CONSTELLATION_OPENSTACK_DEV") != "1" {
return terraform.ApplyOutput{}, errors.New("OpenStack isn't supported yet") return terraform.ApplyOutput{}, errors.New("Constellation must be fine-tuned to your OpenStack deployment. Please create an issue or contact Edgeless Systems at https://edgeless.systems/contact/")
} }
if _, hasOSAuthURL := os.LookupEnv("OS_AUTH_URL"); !hasOSAuthURL && opts.Config.Provider.OpenStack.Cloud == "" { if _, hasOSAuthURL := os.LookupEnv("OS_AUTH_URL"); !hasOSAuthURL && opts.Config.Provider.OpenStack.Cloud == "" {
return terraform.ApplyOutput{}, errors.New( return terraform.ApplyOutput{}, errors.New(

1
cli/internal/cloudcmd/create_test.go
View file

@ -21,7 +21,6 @@ import (
) )
func TestCreator(t *testing.T) { func TestCreator(t *testing.T) {
// TODO(malt3): remove once OpenStack is fully supported.
t.Setenv("CONSTELLATION_OPENSTACK_DEV", "1") t.Setenv("CONSTELLATION_OPENSTACK_DEV", "1")
failOnNonAMD64 := (runtime.GOARCH != "amd64") || (runtime.GOOS != "linux") failOnNonAMD64 := (runtime.GOARCH != "amd64") || (runtime.GOOS != "linux")
ip := "192.0.2.1" ip := "192.0.2.1"

5
cli/internal/cmd/create.go
View file

@ -35,11 +35,6 @@ func NewCreateCmd() *cobra.Command {
RunE: runCreate, RunE: runCreate,
} }
cmd.Flags().BoolP("yes", "y", false, "create the cluster without further confirmation") cmd.Flags().BoolP("yes", "y", false, "create the cluster without further confirmation")
// TODO(malt3): remove deprecated flags in v2.11+
cmd.Flags().IntP("control-plane-nodes", "c", 0, "number of control-plane nodes")
cmd.Flags().IntP("worker-nodes", "w", 0, "number of worker nodes")
must(cmd.Flags().MarkDeprecated("control-plane-nodes", "configure the number of control-plane nodes in the configuration file"))
must(cmd.Flags().MarkDeprecated("worker-nodes", "configure the number of worker nodes in the configuration file"))
return cmd return cmd
} }

139
cli/internal/cmd/create_test.go
View file

@ -9,7 +9,6 @@ package cmd
import ( import (
"bytes" "bytes"
"errors" "errors"
"strconv"
"testing" "testing"
"github.com/edgelesssys/constellation/v2/cli/internal/clusterid" "github.com/edgelesssys/constellation/v2/cli/internal/clusterid"
@ -46,68 +45,30 @@ func TestCreate(t *testing.T) {
wantAbort bool wantAbort bool
}{ }{
"create": { "create": {
setupFs: fsWithDefaultConfig, setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{id: idFile}, creator: &stubCloudCreator{id: idFile},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), yesFlag: true,
workerCountFlag: intPtr(2),
yesFlag: true,
}, },
"interactive": { "interactive": {
setupFs: fsWithDefaultConfig, setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{id: idFile}, creator: &stubCloudCreator{id: idFile},
provider: cloudprovider.Azure, provider: cloudprovider.Azure,
controllerCountFlag: intPtr(2), stdin: "yes\n",
workerCountFlag: intPtr(1),
stdin: "yes\n",
}, },
"interactive abort": { "interactive abort": {
setupFs: fsWithDefaultConfig, setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{}, creator: &stubCloudCreator{},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), stdin: "no\n",
workerCountFlag: intPtr(1), wantAbort: true,
stdin: "no\n",
wantAbort: true,
}, },
"interactive error": { "interactive error": {
setupFs: fsWithDefaultConfig, setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{}, creator: &stubCloudCreator{},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), stdin: "foo\nfoo\nfoo\n",
workerCountFlag: intPtr(1), wantErr: true,
stdin: "foo\nfoo\nfoo\n",
wantErr: true,
},
"flag control-plane-count invalid": {
setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{},
provider: cloudprovider.GCP,
controllerCountFlag: intPtr(0),
workerCountFlag: intPtr(3),
wantErr: true,
},
"flag worker-count invalid": {
setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{},
provider: cloudprovider.GCP,
controllerCountFlag: intPtr(3),
workerCountFlag: intPtr(0),
wantErr: true,
},
"flag control-plane-count missing": {
setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{},
provider: cloudprovider.GCP,
workerCountFlag: intPtr(3),
wantErr: true,
},
"flag worker-count missing": {
setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{},
provider: cloudprovider.GCP,
controllerCountFlag: intPtr(3),
wantErr: true,
}, },
"old adminConf in directory": { "old adminConf in directory": {
setupFs: func(require *require.Assertions, csp cloudprovider.Provider) afero.Fs { setupFs: func(require *require.Assertions, csp cloudprovider.Provider) afero.Fs {
@ -117,12 +78,10 @@ func TestCreate(t *testing.T) {
require.NoError(fileHandler.WriteYAML(constants.ConfigFilename, defaultConfigWithExpectedMeasurements(t, config.Default(), csp))) require.NoError(fileHandler.WriteYAML(constants.ConfigFilename, defaultConfigWithExpectedMeasurements(t, config.Default(), csp)))
return fs return fs
}, },
creator: &stubCloudCreator{}, creator: &stubCloudCreator{},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), yesFlag: true,
workerCountFlag: intPtr(1), wantErr: true,
yesFlag: true,
wantErr: true,
}, },
"old masterSecret in directory": { "old masterSecret in directory": {
setupFs: func(require *require.Assertions, csp cloudprovider.Provider) afero.Fs { setupFs: func(require *require.Assertions, csp cloudprovider.Provider) afero.Fs {
@ -132,30 +91,24 @@ func TestCreate(t *testing.T) {
require.NoError(fileHandler.WriteYAML(constants.ConfigFilename, defaultConfigWithExpectedMeasurements(t, config.Default(), csp))) require.NoError(fileHandler.WriteYAML(constants.ConfigFilename, defaultConfigWithExpectedMeasurements(t, config.Default(), csp)))
return fs return fs
}, },
creator: &stubCloudCreator{}, creator: &stubCloudCreator{},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), yesFlag: true,
workerCountFlag: intPtr(1), wantErr: true,
yesFlag: true,
wantErr: true,
}, },
"config does not exist": { "config does not exist": {
setupFs: func(a *require.Assertions, p cloudprovider.Provider) afero.Fs { return afero.NewMemMapFs() }, setupFs: func(a *require.Assertions, p cloudprovider.Provider) afero.Fs { return afero.NewMemMapFs() },
creator: &stubCloudCreator{}, creator: &stubCloudCreator{},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), yesFlag: true,
workerCountFlag: intPtr(1), wantErr: true,
yesFlag: true,
wantErr: true,
}, },
"create error": { "create error": {
setupFs: fsWithDefaultConfig, setupFs: fsWithDefaultConfig,
creator: &stubCloudCreator{createErr: someErr}, creator: &stubCloudCreator{createErr: someErr},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), yesFlag: true,
workerCountFlag: intPtr(1), wantErr: true,
yesFlag: true,
wantErr: true,
}, },
"write id file error": { "write id file error": {
setupFs: func(require *require.Assertions, csp cloudprovider.Provider) afero.Fs { setupFs: func(require *require.Assertions, csp cloudprovider.Provider) afero.Fs {
@ -164,12 +117,10 @@ func TestCreate(t *testing.T) {
require.NoError(fileHandler.WriteYAML(constants.ConfigFilename, defaultConfigWithExpectedMeasurements(t, config.Default(), csp))) require.NoError(fileHandler.WriteYAML(constants.ConfigFilename, defaultConfigWithExpectedMeasurements(t, config.Default(), csp)))
return afero.NewReadOnlyFs(fs) return afero.NewReadOnlyFs(fs)
}, },
creator: &stubCloudCreator{}, creator: &stubCloudCreator{},
provider: cloudprovider.GCP, provider: cloudprovider.GCP,
controllerCountFlag: intPtr(1), yesFlag: true,
workerCountFlag: intPtr(1), wantErr: true,
yesFlag: true,
wantErr: true,
}, },
} }
@ -189,12 +140,6 @@ func TestCreate(t *testing.T) {
if tc.yesFlag { if tc.yesFlag {
require.NoError(cmd.Flags().Set("yes", "true")) require.NoError(cmd.Flags().Set("yes", "true"))
} }
if tc.controllerCountFlag != nil {
require.NoError(cmd.Flags().Set("control-plane-nodes", strconv.Itoa(*tc.controllerCountFlag)))
}
if tc.workerCountFlag != nil {
require.NoError(cmd.Flags().Set("worker-nodes", strconv.Itoa(*tc.workerCountFlag)))
}
fileHandler := file.NewHandler(tc.setupFs(require, tc.provider)) fileHandler := file.NewHandler(tc.setupFs(require, tc.provider))
c := &createCmd{log: logger.NewTest(t)} c := &createCmd{log: logger.NewTest(t)}
@ -332,7 +277,3 @@ func TestValidateCLIandConstellationVersionCompatibility(t *testing.T) {
}) })
} }
} }
func intPtr(i int) *int {
return &i
}

2
cli/internal/cmd/upgradeapply_test.go
View file

@ -209,7 +209,7 @@ func (u *stubKubernetesUpgrader) ExtendClusterConfigCertSANs(_ context.Context,
return nil return nil
} }
// TODO(v2.11): Remove this function. // TODO(v2.11): Remove this function after v2.11 is released.
func (u *stubKubernetesUpgrader) RemoveAttestationConfigHelmManagement(_ context.Context) error { func (u *stubKubernetesUpgrader) RemoveAttestationConfigHelmManagement(_ context.Context) error {
return nil return nil
} }

2
cli/internal/kubecmd/backup.go
View file

@ -66,7 +66,7 @@ func (k *KubeCmd) BackupCRs(ctx context.Context, crds []apiextensionsv1.CustomRe
k.log.Debugf("Creating backup for resource type: %s", crd.Name) k.log.Debugf("Creating backup for resource type: %s", crd.Name)
// Iterate over all versions of the CRD // Iterate over all versions of the CRD
// TODO: Consider iterating over crd.Status.StoredVersions instead // TODO(daniel-weisse): Consider iterating over crd.Status.StoredVersions instead
// Currently, we have to ignore not-found errors, because a CRD might define // Currently, we have to ignore not-found errors, because a CRD might define
// a version that is not installed in the cluster. // a version that is not installed in the cluster.
// With the StoredVersions field, we could only iterate over the installed versions. // With the StoredVersions field, we could only iterate over the installed versions.

2
cli/internal/terraform/terraform/aws/modules/instance_group/main.tf
View file

@ -54,7 +54,7 @@ resource "aws_launch_template" "launch_template" {
# Disable SMT. We are already disabling it inside the image. # Disable SMT. We are already disabling it inside the image.
# Disabling SMT only in the image, not in the Hypervisor creates problems. # Disabling SMT only in the image, not in the Hypervisor creates problems.
# Thus, also disable it in the Hypervisor. # Thus, also disable it in the Hypervisor.
# TODO (derpsteb): reenable once AWS confirms it's safe to do so. # TODO(derpsteb): reenable once AWS confirms it's safe to do so.
# threads_per_core = 1 # threads_per_core = 1
# When setting threads_per_core we also have to set core_count. # When setting threads_per_core we also have to set core_count.
# For the currently supported SNP instance families (C6a, M6a, R6a) default_cores # For the currently supported SNP instance families (C6a, M6a, R6a) default_cores

12
cli/internal/terraform/variables.go
View file

@ -23,7 +23,7 @@ type Variables interface {
// ClusterVariables should be used in places where a cluster is created. // ClusterVariables should be used in places where a cluster is created.
type ClusterVariables interface { type ClusterVariables interface {
Variables Variables
// TODO (derpsteb): Rename this function once we have introduced an interface for config.Config. // TODO(derpsteb): Rename this function once we have introduced an interface for config.Config.
// GetCreateMAA does not follow Go's naming convention because we need to keep the CreateMAA property public for now. // GetCreateMAA does not follow Go's naming convention because we need to keep the CreateMAA property public for now.
// There are functions creating Variables objects outside of this package. // There are functions creating Variables objects outside of this package.
// These functions can only be moved into this package once we have introduced an interface for config.Config, // These functions can only be moved into this package once we have introduced an interface for config.Config,
@ -69,7 +69,7 @@ type AWSClusterVariables struct {
} }
// GetCreateMAA gets the CreateMAA variable. // GetCreateMAA gets the CreateMAA variable.
// TODO (derpsteb): Rename this function once we have introduced an interface for config.Config. // TODO(derpsteb): Rename this function once we have introduced an interface for config.Config.
func (a *AWSClusterVariables) GetCreateMAA() bool { func (a *AWSClusterVariables) GetCreateMAA() bool {
return false return false
} }
@ -134,7 +134,7 @@ type GCPClusterVariables struct {
} }
// GetCreateMAA gets the CreateMAA variable. // GetCreateMAA gets the CreateMAA variable.
// TODO (derpsteb): Rename this function once we have introduced an interface for config.Config. // TODO(derpsteb): Rename this function once we have introduced an interface for config.Config.
func (g *GCPClusterVariables) GetCreateMAA() bool { func (g *GCPClusterVariables) GetCreateMAA() bool {
return false return false
} }
@ -206,7 +206,7 @@ type AzureClusterVariables struct {
} }
// GetCreateMAA gets the CreateMAA variable. // GetCreateMAA gets the CreateMAA variable.
// TODO (derpsteb): Rename this function once we have introduced an interface for config.Config. // TODO(derpsteb): Rename this function once we have introduced an interface for config.Config.
func (a *AzureClusterVariables) GetCreateMAA() bool { func (a *AzureClusterVariables) GetCreateMAA() bool {
if a.CreateMAA == nil { if a.CreateMAA == nil {
return false return false
@ -278,7 +278,7 @@ type OpenStackClusterVariables struct {
} }
// GetCreateMAA gets the CreateMAA variable. // GetCreateMAA gets the CreateMAA variable.
// TODO (derpsteb): Rename this function once we have introduced an interface for config.Config. // TODO(derpsteb): Rename this function once we have introduced an interface for config.Config.
func (o *OpenStackClusterVariables) GetCreateMAA() bool { func (o *OpenStackClusterVariables) GetCreateMAA() bool {
return false return false
} }
@ -349,7 +349,7 @@ type QEMUVariables struct {
} }
// GetCreateMAA gets the CreateMAA variable. // GetCreateMAA gets the CreateMAA variable.
// TODO (derpsteb): Rename this function once we have introduced an interface for config.Config. // TODO(derpsteb): Rename this function once we have introduced an interface for config.Config.
func (q *QEMUVariables) GetCreateMAA() bool { func (q *QEMUVariables) GetCreateMAA() bool {
return false return false
} }

2
dev-docs/miniconstellation/setup-miniconstellation.sh
View file

@ -5,7 +5,7 @@ curl -LO https://github.com/edgelesssys/constellation/releases/latest/download/c
sudo install constellation-linux-amd64 /usr/local/bin/constellation sudo install constellation-linux-amd64 /usr/local/bin/constellation
# Start docker service and auto start on boot # Start docker service and auto start on boot
# TODO should be done in cloud-init but was not done in my test case # TODO(elchead) should be done in cloud-init but was not done in my test case
sudo systemctl start docker.service && sudo systemctl enable docker.service sudo systemctl start docker.service && sudo systemctl enable docker.service
echo "Waiting for docker service to be active..." echo "Waiting for docker service to be active..."
# Wait at most 20min # Wait at most 20min

2
internal/api/attestationconfigapi/fetcher.go
View file

@ -56,7 +56,7 @@ func newFetcherWithClientAndVerifier(client apifetcher.HTTPClient, cosignVerifie
// FetchAzureSEVSNPVersionList fetches the version list information from the config API. // FetchAzureSEVSNPVersionList fetches the version list information from the config API.
func (f *fetcher) FetchAzureSEVSNPVersionList(ctx context.Context, attestation AzureSEVSNPVersionList) (AzureSEVSNPVersionList, error) { func (f *fetcher) FetchAzureSEVSNPVersionList(ctx context.Context, attestation AzureSEVSNPVersionList) (AzureSEVSNPVersionList, error) {
// TODO (derpsteb): Replace with FetchAndVerify once we move to v2 of the config API. // TODO(derpsteb): Replace with FetchAndVerify once we move to v2 of the config API.
return apifetcher.Fetch(ctx, f.HTTPClient, attestation) return apifetcher.Fetch(ctx, f.HTTPClient, attestation)
} }

14
internal/config/config.go
View file

@ -130,7 +130,7 @@ type AWSConfig struct {
IAMProfileWorkerNodes string `yaml:"iamProfileWorkerNodes" validate:"required"` IAMProfileWorkerNodes string `yaml:"iamProfileWorkerNodes" validate:"required"`
// description: | // description: |
// Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage // Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage
DeployCSIDriver *bool `yaml:"deployCSIDriver"` // TODO (msanft): after v2.9 release re-enable "required" validation DeployCSIDriver *bool `yaml:"deployCSIDriver" validate:"required"`
} }
// AzureConfig are Azure specific configuration values used by the CLI. // AzureConfig are Azure specific configuration values used by the CLI.
@ -472,16 +472,6 @@ func New(fileHandler file.Handler, name string, fetcher attestationconfigapi.Fet
c.Provider.OpenStack.Password = openstackPassword c.Provider.OpenStack.Password = openstackPassword
} }
// Backwards compatibility: configs without the field `deployCSIDriver` are valid in version 2.8.
// TODO (msanft): v2.9. Remove after v2.9 release.
if c.Provider.AWS != nil && c.Provider.AWS.DeployCSIDriver == nil {
fmt.Fprintln(
os.Stderr,
"WARNING: 'provider.aws.deployCSIDriver' not set. The key will be required in v2.10. Defaulting to 'false'.",
)
c.Provider.AWS.DeployCSIDriver = toPtr(false)
}
return c, c.Validate(force) return c, c.Validate(force)
} }
@ -949,7 +939,7 @@ func (c AWSSEVSNP) EqualTo(other AttestationCfg) (bool, error) {
if !ok { if !ok {
return false, fmt.Errorf("cannot compare %T with %T", c, other) return false, fmt.Errorf("cannot compare %T with %T", c, other)
} }
// TODO (derpsteb): reenable launchMeasurement once SNP is fixed on AWS. // TODO(derpsteb): reenable launchMeasurement once SNP is fixed on AWS.
// if !bytes.Equal(c.LaunchMeasurement.Expected, otherCfg.LaunchMeasurement.Expected) { // if !bytes.Equal(c.LaunchMeasurement.Expected, otherCfg.LaunchMeasurement.Expected) {
// return false, nil // return false, nil
// } // }

2
internal/config/config_doc.go
View file

@ -155,7 +155,7 @@ func init() {
AWSConfigDoc.Fields[3].Comments[encoder.LineComment] = "Name of the IAM profile to use for the worker nodes." AWSConfigDoc.Fields[3].Comments[encoder.LineComment] = "Name of the IAM profile to use for the worker nodes."
AWSConfigDoc.Fields[4].Name = "deployCSIDriver" AWSConfigDoc.Fields[4].Name = "deployCSIDriver"
AWSConfigDoc.Fields[4].Type = "bool" AWSConfigDoc.Fields[4].Type = "bool"
AWSConfigDoc.Fields[4].Note = "TODO (msanft): after v2.9 release re-enable \"required\" validation\n" AWSConfigDoc.Fields[4].Note = ""
AWSConfigDoc.Fields[4].Description = "Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage" AWSConfigDoc.Fields[4].Description = "Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage"
AWSConfigDoc.Fields[4].Comments[encoder.LineComment] = "Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage" AWSConfigDoc.Fields[4].Comments[encoder.LineComment] = "Deploy Persistent Disk CSI driver with on-node encryption. For details see: https://docs.edgeless.systems/constellation/architecture/encrypted-storage"

2
internal/config/migration/migration.go
View file

@ -139,7 +139,7 @@ type AWSSEVSNP struct {
// description: | // description: |
// Expected TPM measurements. // Expected TPM measurements.
Measurements measurements.M `json:"measurements" yaml:"measurements" validate:"required,no_placeholders"` Measurements measurements.M `json:"measurements" yaml:"measurements" validate:"required,no_placeholders"`
// TODO (derpsteb): reenable launchMeasurement once SNP is fixed on AWS. // TODO(derpsteb): reenable launchMeasurement once SNP is fixed on AWS.
// description: | // description: |
// Expected launch measurement in SNP report. // Expected launch measurement in SNP report.
// LaunchMeasurement measurements.Measurement `json:"launchMeasurement" yaml:"launchMeasurement" validate:"required"` // LaunchMeasurement measurements.Measurement `json:"launchMeasurement" yaml:"launchMeasurement" validate:"required"`