mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-09-20 00:06:21 +00:00
upgrade: don't pass vm image (#2211)
This commit is contained in:
parent
58e9906811
commit
c597ffb1cf
@ -18,16 +18,18 @@ import (
|
|||||||
)
|
)
|
||||||
|
|
||||||
// TerraformUpgradeVars returns variables required to execute the Terraform scripts.
|
// TerraformUpgradeVars returns variables required to execute the Terraform scripts.
|
||||||
func TerraformUpgradeVars(conf *config.Config, imageRef string) (terraform.Variables, error) {
|
func TerraformUpgradeVars(conf *config.Config) (terraform.Variables, error) {
|
||||||
|
// Note that we pass "" as imageRef, as we ignore changes to the image in the terraform.
|
||||||
|
// The image is updates via our operator.
|
||||||
switch conf.GetProvider() {
|
switch conf.GetProvider() {
|
||||||
case cloudprovider.AWS:
|
case cloudprovider.AWS:
|
||||||
vars := awsTerraformVars(conf, imageRef)
|
vars := awsTerraformVars(conf, "")
|
||||||
return vars, nil
|
return vars, nil
|
||||||
case cloudprovider.Azure:
|
case cloudprovider.Azure:
|
||||||
vars := azureTerraformVars(conf, imageRef)
|
vars := azureTerraformVars(conf, "")
|
||||||
return vars, nil
|
return vars, nil
|
||||||
case cloudprovider.GCP:
|
case cloudprovider.GCP:
|
||||||
vars := gcpTerraformVars(conf, imageRef)
|
vars := gcpTerraformVars(conf, "")
|
||||||
return vars, nil
|
return vars, nil
|
||||||
default:
|
default:
|
||||||
return nil, fmt.Errorf("unsupported provider: %s", conf.GetProvider())
|
return nil, fmt.Errorf("unsupported provider: %s", conf.GetProvider())
|
||||||
|
@ -68,7 +68,6 @@ go_library(
|
|||||||
"//internal/grpc/dialer",
|
"//internal/grpc/dialer",
|
||||||
"//internal/grpc/grpclog",
|
"//internal/grpc/grpclog",
|
||||||
"//internal/grpc/retry",
|
"//internal/grpc/retry",
|
||||||
"//internal/imagefetcher",
|
|
||||||
"//internal/kms/uri",
|
"//internal/kms/uri",
|
||||||
"//internal/kubernetes/kubectl",
|
"//internal/kubernetes/kubectl",
|
||||||
"//internal/license",
|
"//internal/license",
|
||||||
|
@ -27,7 +27,6 @@ import (
|
|||||||
"github.com/edgelesssys/constellation/v2/internal/config"
|
"github.com/edgelesssys/constellation/v2/internal/config"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/constants"
|
"github.com/edgelesssys/constellation/v2/internal/constants"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/file"
|
"github.com/edgelesssys/constellation/v2/internal/file"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/imagefetcher"
|
|
||||||
"github.com/edgelesssys/constellation/v2/internal/kms/uri"
|
"github.com/edgelesssys/constellation/v2/internal/kms/uri"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/versions"
|
"github.com/edgelesssys/constellation/v2/internal/versions"
|
||||||
"github.com/rogpeppe/go-internal/diff"
|
"github.com/rogpeppe/go-internal/diff"
|
||||||
@ -76,20 +75,18 @@ func runUpgradeApply(cmd *cobra.Command, _ []string) error {
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
imagefetcher := imagefetcher.New()
|
|
||||||
configFetcher := attestationconfigapi.NewFetcher()
|
configFetcher := attestationconfigapi.NewFetcher()
|
||||||
tfClient, err := terraform.New(cmd.Context(), constants.TerraformWorkingDir)
|
tfClient, err := terraform.New(cmd.Context(), constants.TerraformWorkingDir)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("setting up terraform client: %w", err)
|
return fmt.Errorf("setting up terraform client: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
applyCmd := upgradeApplyCmd{upgrader: upgrader, log: log, imageFetcher: imagefetcher, configFetcher: configFetcher, clusterShower: tfClient, fileHandler: fileHandler}
|
applyCmd := upgradeApplyCmd{upgrader: upgrader, log: log, configFetcher: configFetcher, clusterShower: tfClient, fileHandler: fileHandler}
|
||||||
return applyCmd.upgradeApply(cmd)
|
return applyCmd.upgradeApply(cmd)
|
||||||
}
|
}
|
||||||
|
|
||||||
type upgradeApplyCmd struct {
|
type upgradeApplyCmd struct {
|
||||||
upgrader cloudUpgrader
|
upgrader cloudUpgrader
|
||||||
imageFetcher imageFetcher
|
|
||||||
configFetcher attestationconfigapi.Fetcher
|
configFetcher attestationconfigapi.Fetcher
|
||||||
clusterShower clusterShower
|
clusterShower clusterShower
|
||||||
fileHandler file.Handler
|
fileHandler file.Handler
|
||||||
@ -149,7 +146,7 @@ func (u *upgradeApplyCmd) upgradeApply(cmd *cobra.Command) error {
|
|||||||
return fmt.Errorf("upgrading measurements: %w", err)
|
return fmt.Errorf("upgrading measurements: %w", err)
|
||||||
}
|
}
|
||||||
// not moving existing Terraform migrator because of planned apply refactor
|
// not moving existing Terraform migrator because of planned apply refactor
|
||||||
tfOutput, err := u.migrateTerraform(cmd, u.imageFetcher, conf, flags)
|
tfOutput, err := u.migrateTerraform(cmd, conf, flags)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("performing Terraform migrations: %w", err)
|
return fmt.Errorf("performing Terraform migrations: %w", err)
|
||||||
}
|
}
|
||||||
@ -210,18 +207,10 @@ func diffAttestationCfg(currentAttestationCfg config.AttestationCfg, newAttestat
|
|||||||
return diff, nil
|
return diff, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func getImage(ctx context.Context, conf *config.Config, fetcher imageFetcher) (string, error) {
|
|
||||||
// Fetch variables to execute Terraform script with
|
|
||||||
provider := conf.GetProvider()
|
|
||||||
attestationVariant := conf.GetAttestationConfig().GetVariant()
|
|
||||||
region := conf.GetRegion()
|
|
||||||
return fetcher.FetchReference(ctx, provider, attestationVariant, conf.Image, region)
|
|
||||||
}
|
|
||||||
|
|
||||||
// migrateTerraform checks if the Constellation version the cluster is being upgraded to requires a migration
|
// migrateTerraform checks if the Constellation version the cluster is being upgraded to requires a migration
|
||||||
// of cloud resources with Terraform. If so, the migration is performed.
|
// of cloud resources with Terraform. If so, the migration is performed.
|
||||||
func (u *upgradeApplyCmd) migrateTerraform(
|
func (u *upgradeApplyCmd) migrateTerraform(
|
||||||
cmd *cobra.Command, fetcher imageFetcher, conf *config.Config, flags upgradeApplyFlags,
|
cmd *cobra.Command, conf *config.Config, flags upgradeApplyFlags,
|
||||||
) (res terraform.ApplyOutput, err error) {
|
) (res terraform.ApplyOutput, err error) {
|
||||||
u.log.Debugf("Planning Terraform migrations")
|
u.log.Debugf("Planning Terraform migrations")
|
||||||
|
|
||||||
@ -229,12 +218,7 @@ func (u *upgradeApplyCmd) migrateTerraform(
|
|||||||
return res, fmt.Errorf("checking workspace: %w", err)
|
return res, fmt.Errorf("checking workspace: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
imageRef, err := getImage(cmd.Context(), conf, fetcher)
|
vars, err := cloudcmd.TerraformUpgradeVars(conf)
|
||||||
if err != nil {
|
|
||||||
return res, fmt.Errorf("fetching image reference: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
vars, err := cloudcmd.TerraformUpgradeVars(conf, imageRef)
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return res, fmt.Errorf("parsing upgrade variables: %w", err)
|
return res, fmt.Errorf("parsing upgrade variables: %w", err)
|
||||||
}
|
}
|
||||||
@ -340,13 +324,6 @@ func validK8sVersion(cmd *cobra.Command, version string, yes bool) (validVersion
|
|||||||
return validVersion, nil
|
return validVersion, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
type imageFetcher interface {
|
|
||||||
FetchReference(ctx context.Context,
|
|
||||||
provider cloudprovider.Provider, attestationVariant variant.Variant,
|
|
||||||
image, region string,
|
|
||||||
) (string, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// confirmIfUpgradeAttestConfigHasDiff checks if the locally configured measurements are different from the cluster's measurements.
|
// confirmIfUpgradeAttestConfigHasDiff checks if the locally configured measurements are different from the cluster's measurements.
|
||||||
// If so the function will ask the user to confirm (if --yes is not set).
|
// If so the function will ask the user to confirm (if --yes is not set).
|
||||||
func (u *upgradeApplyCmd) confirmIfUpgradeAttestConfigHasDiff(cmd *cobra.Command, newConfig config.AttestationCfg, flags upgradeApplyFlags) error {
|
func (u *upgradeApplyCmd) confirmIfUpgradeAttestConfigHasDiff(cmd *cobra.Command, newConfig config.AttestationCfg, flags upgradeApplyFlags) error {
|
||||||
|
@ -35,7 +35,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
someErr := errors.New("some error")
|
someErr := errors.New("some error")
|
||||||
testCases := map[string]struct {
|
testCases := map[string]struct {
|
||||||
upgrader *stubUpgrader
|
upgrader *stubUpgrader
|
||||||
fetcher stubImageFetcher
|
|
||||||
wantErr bool
|
wantErr bool
|
||||||
yesFlag bool
|
yesFlag bool
|
||||||
dontWantJoinConfigBackup bool
|
dontWantJoinConfigBackup bool
|
||||||
@ -66,7 +65,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
helmErr: someErr,
|
helmErr: someErr,
|
||||||
},
|
},
|
||||||
wantErr: true,
|
wantErr: true,
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
yesFlag: true,
|
yesFlag: true,
|
||||||
},
|
},
|
||||||
"check terraform error": {
|
"check terraform error": {
|
||||||
@ -74,7 +72,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
currentConfig: config.DefaultForAzureSEVSNP(),
|
currentConfig: config.DefaultForAzureSEVSNP(),
|
||||||
checkTerraformErr: someErr,
|
checkTerraformErr: someErr,
|
||||||
},
|
},
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
wantErr: true,
|
wantErr: true,
|
||||||
yesFlag: true,
|
yesFlag: true,
|
||||||
},
|
},
|
||||||
@ -83,7 +80,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
currentConfig: config.DefaultForAzureSEVSNP(),
|
currentConfig: config.DefaultForAzureSEVSNP(),
|
||||||
terraformDiff: true,
|
terraformDiff: true,
|
||||||
},
|
},
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
wantErr: true,
|
wantErr: true,
|
||||||
stdin: "no\n",
|
stdin: "no\n",
|
||||||
},
|
},
|
||||||
@ -93,7 +89,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
cleanTerraformErr: someErr,
|
cleanTerraformErr: someErr,
|
||||||
terraformDiff: true,
|
terraformDiff: true,
|
||||||
},
|
},
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
wantErr: true,
|
wantErr: true,
|
||||||
stdin: "no\n",
|
stdin: "no\n",
|
||||||
},
|
},
|
||||||
@ -102,7 +97,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
currentConfig: config.DefaultForAzureSEVSNP(),
|
currentConfig: config.DefaultForAzureSEVSNP(),
|
||||||
planTerraformErr: someErr,
|
planTerraformErr: someErr,
|
||||||
},
|
},
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
wantErr: true,
|
wantErr: true,
|
||||||
yesFlag: true,
|
yesFlag: true,
|
||||||
},
|
},
|
||||||
@ -112,15 +106,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
applyTerraformErr: someErr,
|
applyTerraformErr: someErr,
|
||||||
terraformDiff: true,
|
terraformDiff: true,
|
||||||
},
|
},
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
wantErr: true,
|
|
||||||
yesFlag: true,
|
|
||||||
},
|
|
||||||
"fetch reference error": {
|
|
||||||
upgrader: &stubUpgrader{
|
|
||||||
currentConfig: config.DefaultForAzureSEVSNP(),
|
|
||||||
},
|
|
||||||
fetcher: stubImageFetcher{fetchReferenceErr: someErr},
|
|
||||||
wantErr: true,
|
wantErr: true,
|
||||||
yesFlag: true,
|
yesFlag: true,
|
||||||
},
|
},
|
||||||
@ -128,7 +113,6 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
upgrader: &stubUpgrader{
|
upgrader: &stubUpgrader{
|
||||||
currentConfig: fakeAzureAttestationConfigFromCluster(context.Background(), t, cloudprovider.Azure),
|
currentConfig: fakeAzureAttestationConfigFromCluster(context.Background(), t, cloudprovider.Azure),
|
||||||
},
|
},
|
||||||
fetcher: stubImageFetcher{},
|
|
||||||
yesFlag: true,
|
yesFlag: true,
|
||||||
dontWantJoinConfigBackup: true,
|
dontWantJoinConfigBackup: true,
|
||||||
},
|
},
|
||||||
@ -157,7 +141,7 @@ func TestUpgradeApply(t *testing.T) {
|
|||||||
require.NoError(handler.WriteJSON(constants.ClusterIDsFilename, clusterid.File{}))
|
require.NoError(handler.WriteJSON(constants.ClusterIDsFilename, clusterid.File{}))
|
||||||
require.NoError(handler.WriteJSON(constants.MasterSecretFilename, uri.MasterSecret{}))
|
require.NoError(handler.WriteJSON(constants.MasterSecretFilename, uri.MasterSecret{}))
|
||||||
|
|
||||||
upgrader := upgradeApplyCmd{upgrader: tc.upgrader, log: logger.NewTest(t), imageFetcher: tc.fetcher, configFetcher: stubAttestationFetcher{}, clusterShower: &stubShowCluster{}, fileHandler: handler}
|
upgrader := upgradeApplyCmd{upgrader: tc.upgrader, log: logger.NewTest(t), configFetcher: stubAttestationFetcher{}, clusterShower: &stubShowCluster{}, fileHandler: handler}
|
||||||
|
|
||||||
err := upgrader.upgradeApply(cmd)
|
err := upgrader.upgradeApply(cmd)
|
||||||
if tc.wantErr {
|
if tc.wantErr {
|
||||||
@ -231,17 +215,6 @@ func (u stubUpgrader) ExtendClusterConfigCertSANs(_ context.Context, _ []string)
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
type stubImageFetcher struct {
|
|
||||||
fetchReferenceErr error
|
|
||||||
}
|
|
||||||
|
|
||||||
func (f stubImageFetcher) FetchReference(_ context.Context,
|
|
||||||
_ cloudprovider.Provider, _ variant.Variant,
|
|
||||||
_, _ string,
|
|
||||||
) (string, error) {
|
|
||||||
return "", f.fetchReferenceErr
|
|
||||||
}
|
|
||||||
|
|
||||||
func fakeAzureAttestationConfigFromCluster(ctx context.Context, t *testing.T, provider cloudprovider.Provider) config.AttestationCfg {
|
func fakeAzureAttestationConfigFromCluster(ctx context.Context, t *testing.T, provider cloudprovider.Provider) config.AttestationCfg {
|
||||||
cpCfg := defaultConfigWithExpectedMeasurements(t, config.Default(), provider)
|
cpCfg := defaultConfigWithExpectedMeasurements(t, config.Default(), provider)
|
||||||
// the cluster attestation config needs to have real version numbers that are translated from "latest" as defined in config.Default()
|
// the cluster attestation config needs to have real version numbers that are translated from "latest" as defined in config.Default()
|
||||||
|
@ -31,7 +31,6 @@ import (
|
|||||||
"github.com/edgelesssys/constellation/v2/internal/config"
|
"github.com/edgelesssys/constellation/v2/internal/config"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/constants"
|
"github.com/edgelesssys/constellation/v2/internal/constants"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/file"
|
"github.com/edgelesssys/constellation/v2/internal/file"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/imagefetcher"
|
|
||||||
"github.com/edgelesssys/constellation/v2/internal/kubernetes/kubectl"
|
"github.com/edgelesssys/constellation/v2/internal/kubernetes/kubectl"
|
||||||
consemver "github.com/edgelesssys/constellation/v2/internal/semver"
|
consemver "github.com/edgelesssys/constellation/v2/internal/semver"
|
||||||
"github.com/edgelesssys/constellation/v2/internal/sigstore"
|
"github.com/edgelesssys/constellation/v2/internal/sigstore"
|
||||||
@ -100,9 +99,8 @@ func runUpgradeCheck(cmd *cobra.Command, _ []string) error {
|
|||||||
log: log,
|
log: log,
|
||||||
versionsapi: versionfetcher,
|
versionsapi: versionfetcher,
|
||||||
},
|
},
|
||||||
checker: checker,
|
checker: checker,
|
||||||
imagefetcher: imagefetcher.New(),
|
log: log,
|
||||||
log: log,
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return up.upgradeCheck(cmd, fileHandler, attestationconfigapi.NewFetcher(), flags)
|
return up.upgradeCheck(cmd, fileHandler, attestationconfigapi.NewFetcher(), flags)
|
||||||
@ -148,7 +146,6 @@ type upgradeCheckCmd struct {
|
|||||||
canUpgradeCheck bool
|
canUpgradeCheck bool
|
||||||
collect collector
|
collect collector
|
||||||
checker upgradeChecker
|
checker upgradeChecker
|
||||||
imagefetcher imageFetcher
|
|
||||||
log debugLog
|
log debugLog
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -219,12 +216,7 @@ func (u *upgradeCheckCmd) upgradeCheck(cmd *cobra.Command, fileHandler file.Hand
|
|||||||
return fmt.Errorf("checking workspace: %w", err)
|
return fmt.Errorf("checking workspace: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
imageRef, err := getImage(cmd.Context(), conf, u.imagefetcher)
|
vars, err := cloudcmd.TerraformUpgradeVars(conf)
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("fetching image reference: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
vars, err := cloudcmd.TerraformUpgradeVars(conf, imageRef)
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("parsing upgrade variables: %w", err)
|
return fmt.Errorf("parsing upgrade variables: %w", err)
|
||||||
}
|
}
|
||||||
|
@ -213,29 +213,26 @@ func TestUpgradeCheck(t *testing.T) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
testCases := map[string]struct {
|
testCases := map[string]struct {
|
||||||
collector stubVersionCollector
|
collector stubVersionCollector
|
||||||
csp cloudprovider.Provider
|
csp cloudprovider.Provider
|
||||||
checker stubUpgradeChecker
|
checker stubUpgradeChecker
|
||||||
imagefetcher stubImageFetcher
|
cliVersion string
|
||||||
cliVersion string
|
wantError bool
|
||||||
wantError bool
|
|
||||||
}{
|
}{
|
||||||
"upgrades gcp": {
|
"upgrades gcp": {
|
||||||
collector: collector,
|
collector: collector,
|
||||||
checker: stubUpgradeChecker{},
|
checker: stubUpgradeChecker{},
|
||||||
imagefetcher: stubImageFetcher{},
|
csp: cloudprovider.GCP,
|
||||||
csp: cloudprovider.GCP,
|
cliVersion: "v1.0.0",
|
||||||
cliVersion: "v1.0.0",
|
|
||||||
},
|
},
|
||||||
"terraform err": {
|
"terraform err": {
|
||||||
collector: collector,
|
collector: collector,
|
||||||
checker: stubUpgradeChecker{
|
checker: stubUpgradeChecker{
|
||||||
err: assert.AnError,
|
err: assert.AnError,
|
||||||
},
|
},
|
||||||
imagefetcher: stubImageFetcher{},
|
csp: cloudprovider.GCP,
|
||||||
csp: cloudprovider.GCP,
|
cliVersion: "v1.0.0",
|
||||||
cliVersion: "v1.0.0",
|
wantError: true,
|
||||||
wantError: true,
|
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -251,7 +248,6 @@ func TestUpgradeCheck(t *testing.T) {
|
|||||||
canUpgradeCheck: true,
|
canUpgradeCheck: true,
|
||||||
collect: &tc.collector,
|
collect: &tc.collector,
|
||||||
checker: tc.checker,
|
checker: tc.checker,
|
||||||
imagefetcher: tc.imagefetcher,
|
|
||||||
log: logger.NewTest(t),
|
log: logger.NewTest(t),
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user