mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-05-02 06:16:08 -04:00
joinservice: cache certificates for Azure SEV-SNP attestation (#2336)
* add ASK caching in joinservice Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * use cached ASK in Azure SEV-SNP attestation Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * update test charts Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix linter Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix typ Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * make caching mechanism less provider-specific Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * update buildfiles Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * add `omitempty` flag Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * frontload certificate getter Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * rename frontloaded function Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * pass cached certificates to constructor Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix race condition Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix marshalling of empty certs Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix validator usage Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * [wip] add certcache tests Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * add certcache tests Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * tidy Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix validator test Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * remove unused fields in validator Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix certificate precedence Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * use separate context Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * tidy Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * linter fixes Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * linter fixes Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * Remove unnecessary comment Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * use background context Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * Use error format directive Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * `azure` -> `Azure` Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * improve error messages Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * add x509 -> PEM util function Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * use crypto util functions Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix certificate replacement logic Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * only require ASK from certcache Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * tidy Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix comment typo Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
This commit is contained in:
Moritz Sanft
GitHub
parent
68d8b29335
commit
a5021c52d3
39 changed files with 1197 additions and 50 deletions
|
|
@ -28,8 +28,10 @@ import (
|
|||
"github.com/edgelesssys/constellation/v2/internal/file"
|
||||
"github.com/edgelesssys/constellation/v2/internal/grpc/atlscredentials"
|
||||
"github.com/edgelesssys/constellation/v2/internal/logger"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/certcache"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/kms"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/kubeadm"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/kubernetes"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/kubernetesca"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/server"
|
||||
"github.com/edgelesssys/constellation/v2/joinservice/internal/watcher"
|
||||
|
|
@ -56,11 +58,23 @@ func main() {
|
|||
|
||||
handler := file.NewHandler(afero.NewOsFs())
|
||||
|
||||
variant, err := variant.FromString(*attestationVariant)
|
||||
kubeClient, err := kubernetes.New()
|
||||
if err != nil {
|
||||
log.With(zap.Error(err)).Fatalf("Failed to create Kubernetes client")
|
||||
}
|
||||
|
||||
attVariant, err := variant.FromString(*attestationVariant)
|
||||
if err != nil {
|
||||
log.With(zap.Error(err)).Fatalf("Failed to parse attestation variant")
|
||||
}
|
||||
validator, err := watcher.NewValidator(log.Named("validator"), variant, handler)
|
||||
|
||||
certCacheClient := certcache.NewClient(log.Named("certcache"), kubeClient, attVariant)
|
||||
cachedCerts, err := certCacheClient.CreateCertChainCache(context.Background())
|
||||
if err != nil {
|
||||
log.With(zap.Error(err)).Fatalf("Failed to create certificate chain cache")
|
||||
}
|
||||
|
||||
validator, err := watcher.NewValidator(log.Named("validator"), attVariant, handler, cachedCerts)
|
||||
if err != nil {
|
||||
flag.Usage()
|
||||
log.With(zap.Error(err)).Fatalf("Failed to create validator")
|
||||
|
|
@ -68,9 +82,10 @@ func main() {
|
|||
|
||||
creds := atlscredentials.New(nil, []atls.Validator{validator})
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), vpcIPTimeout)
|
||||
vpcCtx, cancel := context.WithTimeout(context.Background(), vpcIPTimeout)
|
||||
defer cancel()
|
||||
vpcIP, err := getVPCIP(ctx, *provider)
|
||||
|
||||
vpcIP, err := getVPCIP(vpcCtx, *provider)
|
||||
if err != nil {
|
||||
log.With(zap.Error(err)).Fatalf("Failed to get IP in VPC")
|
||||
}
|
||||
|
|
@ -91,6 +106,7 @@ func main() {
|
|||
kubernetesca.New(log.Named("certificateAuthority"), handler),
|
||||
kubeadm,
|
||||
keyServiceClient,
|
||||
kubeClient,
|
||||
log.Named("server"),
|
||||
)
|
||||
if err != nil {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue