Move debugd config to separate file

Signed-off-by: Malte Poll <mp@edgeless.systems>

README.md

@@ -93,12 +93,61 @@ go install github.com/edgelesssys/constellation/debugd/cdbg
 
 ## debugd & cdbg usage
 
-With `cdbg` installed in your path:
+With `cdbg` and `yq` installed in your path:
 
-0. (optional) Run `constellation config generate` to create a new default configuration
+0. Write the configuration file for cdbg `cdbg-conf.yaml`:
-1. Run `constellation create […]` while specifying a cloud-provider image with the debugd already included. See [Configuration](#debugd-configuration) for a config with a custom image and firewall rules to allow incoming connection on the debugd default port 4000.
+   ```yaml
-2. Run `cdbg deploy`
+   cdbg:
-3.  Run `constellation init […]` as usual
+     authorizedKeys:
+       - user: my-username
+         pubkey: ssh-rsa AAAAB…LJuM=
+     coordinatorPath: "./coordinator"
+     systemdUnits:
+       - name: some-custom.service
+         contents: |-
+           [Unit]
+           Description=…
+   ```
+1. Run `constellation config generate` to create a new default configuration
+2. Locate the latest debugd images for [GCP](#debugd-gcp-image) and [Azure](#debugd-azure-image)
+3. Modify the `constellation-conf.yaml` to use an image with the debugd already included and add required firewall rules:
+   ```shell-session
+   # Set timestamp from cloud provider image name
+   export TIMESTAMP=01234
+
+   yq -i \
+       ".provider.azureConfig.image = \"/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos-debugd/versions/0.0.${TIMESTAMP}\"" \
+       constellation-conf.yaml
+
+   yq -i \
+       ".provider.gcpConfig.image = \"projects/constellation-images/global/images/constellation-coreos-debugd-${TIMESTAMP}\"" \
+       constellation-conf.yaml
+
+   yq -i \
+       ".provider.azureConfig.networkSecurityGroupInput.ingress += {
+           \"name\": \"debugd\",
+           \"description\": \"debugd default port\",
+           \"protocol\": \"tcp\",
+           \"iprange\": \"0.0.0.0/0\",
+           \"fromport\": 4000,
+           \"toport\": 0
+       }" \
+       constellation-conf.yaml
+
+   yq -i \
+       ".provider.gcpConfig.firewallInput.ingress += {
+           \"name\": \"debugd\",
+           \"description\": \"debugd default port\",
+           \"protocol\": \"tcp\",
+           \"iprange\": \"0.0.0.0/0\",
+           \"fromport\": 4000,
+           \"toport\": 0
+       }" \
+       constellation-conf.yaml
+   ```
+4. Run `constellation create […]`
+5. Run `cdbg deploy`
+6.  Run `constellation init […]` as usual
 
 
 ### debugd GCP image
@@ -117,98 +166,6 @@ az sig image-version list --resource-group constellation-images --gallery-name C
 ```
 Choose the newest debugd image and copy the full URI.
 
-## debugd Configuration
-
-You should first locate the newest debugd image for your cloud provider ([GCP](#debugd-gcp-image), [Azure](#debugd-azure-image)).
-
-This tool uses the config file from `constellation` and extends it with more fields.
-See this example on what the possible settings are and how to setup the constellation cli to use a cloud-provider image and firewall rules with support for debugd:
-```yaml
-cdbg:
-  authorizedKeys:
-    - user: my-username
-      pubkey: ssh-rsa AAAAB…LJuM=
-  coordinatorPath: "/path/to/coordinator"
-  systemdUnits:
-    - name: some-custom.service
-      contents: |-
-        [Unit]
-        Description=…
-provider:
-  # Add Azure image
-  azureConfig:
-    image: /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.TIMESTAMP
-    networkSecurityGroupInput:
-      ingress:
-        - name: coordinator
-          description: Coordinator default port
-          protocol: tcp
-          iprange: 0.0.0.0/0
-          fromport: 9000
-          toport: 0
-        - name: wireguard
-          description: WireGuard default port
-          protocol: udp
-          iprange: 0.0.0.0/0
-          fromport: 51820
-          toport: 0
-        - name: ssh
-          description: SSH
-          protocol: tcp
-          iprange: 0.0.0.0/0
-          fromport: 22
-          toport: 0
-        - name: nodeport
-          description: NodePort
-          protocol: tcp
-          iprange: 0.0.0.0/0
-          fromport: 30000
-          toport: 32767
-        # Add debug port
-        - name: debugd
-          description: debugd default port
-          protocol: tcp
-          iprange: 0.0.0.0/0
-          fromport: 4000
-          toport: 0
-  gcpConfig:
-    # Add GCP image
-    image: projects/constellation-images/global/images/constellation-coreos-debugd-TIMESTAMP
-    firewallInput:
-      ingress:
-        - name: coordinator
-          description: Coordinator default port
-          protocol: tcp
-          iprange: ""
-          fromport: 9000
-          toport: 0
-        - name: wireguard
-          description: WireGuard default port
-          protocol: udp
-          iprange: ""
-          fromport: 51820
-          toport: 0
-        - name: ssh
-          description: SSH
-          protocol: tcp
-          iprange: ""
-          fromport: 22
-          toport: 0
-        - name: nodeport
-          description: NodePort
-          protocol: tcp
-          iprange: ""
-          fromport: 30000
-          toport: 32767
-        # Add debugd port
-        - name: debugd
-          description: debugd default port
-          protocol: tcp
-          iprange: ""
-          fromport: 4000
-          toport: 0
-```
-
 # Local image testing with QEMU
 
 To build our images we use the [CoreOS-Assembler (COSA)](https://github.com/edgelesssys/constellation-coreos-assembler).

debugd/cdbg/cmd/deploy.go

@@ -16,6 +16,7 @@ import (
 	depl "github.com/edgelesssys/constellation/debugd/debugd/deploy"
 	pb "github.com/edgelesssys/constellation/debugd/service"
 	"github.com/edgelesssys/constellation/debugd/ssh"
+	configc "github.com/edgelesssys/constellation/internal/config"
 	"github.com/edgelesssys/constellation/internal/constants"
 	statec "github.com/edgelesssys/constellation/internal/state"
 	"github.com/spf13/afero"
@@ -32,7 +33,7 @@ Uses config provided by --config and reads constellation config from its default
 If required, you can override the IP addresses that are used for a deployment by specifying "--ips" and a list of IP addresses.
 Specifying --coordinator will upload the coordinator from the specified path.`,
 	RunE:    runDeploy,
-	Example: "cdbg deploy --config /path/to/config\ncdbg deploy --coordinator /path/to/coordinator --ips 192.0.2.1,192.0.2.2,192.0.2.3 --config /path/to/config",
+	Example: "cdbg deploy\ncdbg deploy --config /path/to/config\ncdbg deploy --coordinator /path/to/coordinator --ips 192.0.2.1,192.0.2.2,192.0.2.3 --config /path/to/config",
 }
 
 func runDeploy(cmd *cobra.Command, args []string) error {
@@ -41,21 +42,25 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		return err
 	}
 	fileHandler := file.NewHandler(afero.NewOsFs())
-	config, err := config.FromFile(fileHandler, configName)
+	debugConfig, err := config.FromFile(fileHandler, configName)
+	if err != nil {
+		return err
+	}
+	constellationConfig, err := configc.FromFile(fileHandler, constants.ConfigFilename)
 	if err != nil {
 		return err
 	}
 
-	return deploy(cmd, fileHandler, config, coordinator.NewFileStreamer(afero.NewOsFs()))
+	return deploy(cmd, fileHandler, constellationConfig, debugConfig, coordinator.NewFileStreamer(afero.NewOsFs()))
 }
 
-func deploy(cmd *cobra.Command, fileHandler file.Handler, config *config.CDBGConfig, reader fileToStreamReader) error {
+func deploy(cmd *cobra.Command, fileHandler file.Handler, constellationConfig *configc.Config, debugConfig *config.CDBGConfig, reader fileToStreamReader) error {
 	overrideCoordinatorPath, err := cmd.Flags().GetString("coordinator")
 	if err != nil {
 		return err
 	}
 	if len(overrideCoordinatorPath) > 0 {
-		config.ConstellationDebugConfig.CoordinatorPath = overrideCoordinatorPath
+		debugConfig.ConstellationDebugConfig.CoordinatorPath = overrideCoordinatorPath
 	}
 
 	overrideIPs, err := cmd.Flags().GetStringSlice("ips")
@@ -74,7 +79,7 @@ func deploy(cmd *cobra.Command, fileHandler file.Handler, config *config.CDBGCon
 		} else if err != nil {
 			return fmt.Errorf("loading statefile failed: %w", err)
 		}
-		ips, err = getIPsFromConfig(stat, *config)
+		ips, err = getIPsFromConfig(stat, *constellationConfig)
 		if err != nil {
 			return err
 		}
@@ -83,10 +88,10 @@ func deploy(cmd *cobra.Command, fileHandler file.Handler, config *config.CDBGCon
 	for _, ip := range ips {
 		input := deployOnEndpointInput{
 			debugdEndpoint:  net.JoinHostPort(ip, debugd.DebugdPort),
-			coordinatorPath: config.ConstellationDebugConfig.CoordinatorPath,
+			coordinatorPath: debugConfig.ConstellationDebugConfig.CoordinatorPath,
 			reader:          reader,
-			authorizedKeys:  config.ConstellationDebugConfig.AuthorizedKeys,
+			authorizedKeys:  debugConfig.ConstellationDebugConfig.AuthorizedKeys,
-			systemdUnits:    config.ConstellationDebugConfig.SystemdUnits,
+			systemdUnits:    debugConfig.ConstellationDebugConfig.SystemdUnits,
 		}
 		if err := deployOnEndpoint(cmd.Context(), input); err != nil {
 			return err
@@ -166,8 +171,8 @@ func deployOnEndpoint(ctx context.Context, in deployOnEndpointInput) error {
 	return nil
 }
 
-func getIPsFromConfig(stat statec.ConstellationState, config config.CDBGConfig) ([]string, error) {
+func getIPsFromConfig(stat statec.ConstellationState, config configc.Config) ([]string, error) {
-	coordinators, nodes, err := state.GetScalingGroupsFromConfig(stat, &config.Config)
+	coordinators, nodes, err := state.GetScalingGroupsFromConfig(stat, &config)
 	if err != nil {
 		return nil, err
 	}

debugd/cdbg/cmd/root.go

@@ -22,5 +22,5 @@ func Execute() {
 }
 
 func init() {
-	rootCmd.PersistentFlags().String("config", constants.ConfigFilename, "debugd config file")
+	rootCmd.PersistentFlags().String("config", constants.DebugdConfigFilename, "debugd config file")
 }

debugd/cdbg/config/config.go

@@ -1,18 +1,18 @@
 package config
 
 import (
+	"errors"
 	"fmt"
+	"io/fs"
 
 	"github.com/edgelesssys/constellation/cli/file"
 	"github.com/edgelesssys/constellation/debugd/debugd/deploy"
 	"github.com/edgelesssys/constellation/debugd/ssh"
-	configc "github.com/edgelesssys/constellation/internal/config"
 )
 
-// CDBGConfig describes the constellation-cli config file and extends it with a new field "cdbg".
+// CDBGConfig describes the constellation-cli config file.
 type CDBGConfig struct {
 	ConstellationDebugConfig ConstellationDebugdConfig `yaml:"cdbg"`
-	configc.Config
 }
 
 // ConstellationDebugdConfig is the cdbg specific configuration.
@@ -22,27 +22,13 @@ type ConstellationDebugdConfig struct {
 	SystemdUnits    []deploy.SystemdUnit `yaml:"systemdUnits,omitempty"`
 }
 
-// Default returns a struct with the default config.
+// FromFile reads a debug configuration.
-func Default() *CDBGConfig {
-	return &CDBGConfig{
-		ConstellationDebugConfig: ConstellationDebugdConfig{
-			AuthorizedKeys:  []ssh.SSHKey{},
-			CoordinatorPath: "coordinator",
-			SystemdUnits:    []deploy.SystemdUnit{},
-		},
-		Config: *configc.Default(),
-	}
-}
-
-// FromFile returns a default config that has been merged with a config file.
-// If name is empty, the defaults are returned.
 func FromFile(fileHandler file.Handler, name string) (*CDBGConfig, error) {
-	conf := Default()
+	conf := &CDBGConfig{}
-	if name == "" {
-		return conf, nil
-	}
-
 	if err := fileHandler.ReadYAML(name, conf); err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, fmt.Errorf("unable to find %s - consult the README on how to setup cdbg", name)
+		}
 		return nil, fmt.Errorf("could not load config from file %s: %w", name, err)
 	}
 	return conf, nil

internal/constants/constants.go

@@ -27,6 +27,7 @@ const (
 
 	StateFilename         = "constellation-state.json"
 	ConfigFilename        = "constellation-conf.yaml"
+	DebugdConfigFilename  = "cdbg-conf.yaml"
 	AdminConfFilename     = "constellation-admin.conf"
 	MasterSecretFilename  = "constellation-mastersecret.base64"
 	WGQuickConfigFilename = "wg0.conf"