Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-03 20:44:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

docs: update Tab tags

Browse source
This commit is contained in:
Thomas Tendyck 2024-08-23 13:04:15 +02:00 • committed by Thomas Tendyck
parent e90b0e5109
commit e2ee775483
197 changed files with 3640 additions and 3581 deletions
Download patch file Download diff file Expand all files Collapse all files

64
docs/versioned_docs/version-2.14/workflows/config.md
View file

@ -14,49 +14,49 @@ Before you can create your cluster, you need to configure the identity and acces
You can generate a configuration file for your CSP by using the following CLI command:
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
```bash
constellation config generate azure
```
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
```bash
constellation config generate gcp
```
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
```bash
constellation config generate aws
```
</tabItem>
</tabs>
</TabItem>
</Tabs>
This creates the file `constellation-conf.yaml` in the current directory.
## Choosing a VM type
Constellation supports the following VM types:
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
By default, Constellation uses `Standard_DC4as_v5` CVMs (4 vCPUs, 16 GB RAM) to create your cluster. Optionally, you can switch to a different VM type by modifying **instanceType** in the configuration file. For CVMs, any VM type with a minimum of 4 vCPUs from the [DCasv5 & DCadsv5](https://docs.microsoft.com/en-us/azure/virtual-machines/dcasv5-dcadsv5-series) or [ECasv5 & ECadsv5](https://docs.microsoft.com/en-us/azure/virtual-machines/ecasv5-ecadsv5-series) families is supported.
You can also run `constellation config instance-types` to get the list of all supported options.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
By default, Constellation uses `n2d-standard-4` VMs (4 vCPUs, 16 GB RAM) to create your cluster. Optionally, you can switch to a different VM type by modifying **instanceType** in the configuration file. Supported are all machines with a minimum of 4 vCPUs from the [C2D](https://cloud.google.com/compute/docs/compute-optimized-machines#c2d_machine_types) or [N2D](https://cloud.google.com/compute/docs/general-purpose-machines#n2d_machines) family. You can run `constellation config instance-types` to get the list of all supported options.
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
By default, Constellation uses `m6a.xlarge` VMs (4 vCPUs, 16 GB RAM) to create your cluster.
Optionally, you can switch to a different VM type by modifying **instanceType** in the configuration file.
@ -67,8 +67,8 @@ If you are using the attestation variant `awsNitroTPM`, you can choose any of th
The Constellation CLI can also print the supported instance types with: `constellation config instance-types`.
</tabItem>
</tabs>
</TabItem>
</Tabs>
Fill the desired VM type into the **instanceType** fields in the `constellation-conf.yml` file.
@ -125,8 +125,8 @@ See also Constellation's [Kubernetes support policy](../architecture/versions.md
You can create an IAM configuration for your cluster automatically using the `constellation iam create` command.
If you already have a Constellation configuration file, you can add the `--update-config` flag to the command. This writes the needed IAM fields into your configuration. Furthermore, the flag updates the zone/region of the configuration if it hasn't been set yet.
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
You must be authenticated with the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) in the shell session with a user that has the [required permissions for IAM creation](../getting-started/install.md#set-up-cloud-credentials).
@ -146,8 +146,8 @@ Note that CVMs are currently only supported in a few regions, check [Azure's pro
Paste the output into the corresponding fields of the `constellation-conf.yaml` file.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
You must be authenticated with the [GCP CLI](https://cloud.google.com/sdk/gcloud) in the shell session with a user that has the [required permissions for IAM creation](../getting-started/install.md#set-up-cloud-credentials).
@ -161,8 +161,8 @@ Note that only regions offering CVMs of the `C2D` or `N2D` series are supported.
Paste the output into the corresponding fields of the `constellation-conf.yaml` file.
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
You must be authenticated with the [AWS CLI](https://aws.amazon.com/en/cli/) in the shell session with a user that has the [required permissions for IAM creation](../getting-started/install.md#set-up-cloud-credentials).
@ -186,16 +186,16 @@ You can find a list of all [regions in AWS's documentation](https://docs.aws.ama
Paste the output into the corresponding fields of the `constellation-conf.yaml` file.
</tabItem>
</tabs>
</TabItem>
</Tabs>
<details>
<summary>Alternatively, you can manually create the IAM configuration on your CSP.</summary>
The following describes the configuration fields and how you obtain the required information or create the required resources.
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
* **subscription**: The UUID of your Azure subscription, e.g., `8b8bd01f-efd9-4113-9bd1-c82137c32da7`.
@ -224,9 +224,9 @@ The following describes the configuration fields and how you obtain the required
The user-assigned identity is used by instances of the cluster to access other cloud resources.
For more information about managed identities refer to [Azure's documentation](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities).
</tabItem>
</TabItem>
<tabItem value="gcp" label="GCP">
<TabItem value="gcp" label="GCP">
* **project**: The ID of your GCP project, e.g., `constellation-129857`.
@ -250,9 +250,9 @@ The following describes the configuration fields and how you obtain the required
Afterward, create and download a new JSON key for this service account. Place the downloaded file in your Constellation workspace, and set the config parameter to the filename, e.g., `constellation-129857-15343dba46cb.json`.
</tabItem>
</TabItem>
<tabItem value="aws" label="AWS">
<TabItem value="aws" label="AWS">
* **region**: The name of your chosen AWS data center region, e.g., `us-east-2`.
@ -283,9 +283,9 @@ The following describes the configuration fields and how you obtain the required
Alternatively, you can create the AWS profile with a tool of your choice. Use the JSON policy in [main.tf](https://github.com/edgelesssys/constellation/tree/release/v2.2/hack/terraform/aws/iam/main.tf) in the resource `aws_iam_policy.worker_node_policy`.
</tabItem>
</TabItem>
</tabs>
</Tabs>
</details>
Now that you've configured your CSP, you can [create your cluster](./create.md).

12
docs/versioned_docs/version-2.14/workflows/create.md
View file

@ -27,8 +27,8 @@ If you don't have a cloud subscription, you can also set up a [local Constellati
Before you create the cluster, make sure to have a [valid configuration file](./config.md).
<tabs groupId="usage">
<tabItem value="cli" label="CLI">
<Tabs groupId="usage">
<TabItem value="cli" label="CLI">
```bash
constellation apply
@ -36,8 +36,8 @@ constellation apply
`apply` stores the state of your cluster's cloud resources in a [`constellation-terraform`](../architecture/orchestration.md#cluster-creation-process) directory in your workspace.
</tabItem>
<tabItem value="self-managed" label="Self-managed">
</TabItem>
<TabItem value="self-managed" label="Self-managed">
Self-managed infrastructure allows for more flexibility in the setup, by separating the infrastructure setup from the Constellation cluster management.
This provides flexibility in DevOps and can meet potential regulatory requirements.
@ -77,8 +77,8 @@ With the required cloud resources set up, continue with initializing your cluste
constellation apply --skip-phases=infrastructure
```
</tabItem>
</tabs>
</TabItem>
</Tabs>
Finally, configure `kubectl` for your cluster:

16
docs/versioned_docs/version-2.14/workflows/recovery.md
View file

@ -16,8 +16,8 @@ You can check the health status of the nodes via the cloud service provider (CSP
Constellation provides logging information on the boot process and status via [cloud logging](troubleshooting.md#cloud-logging).
In the following, you'll find detailed descriptions for identifying clusters stuck in recovery for each CSP.
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
In the Azure portal, find the cluster's resource group.
Inside the resource group, open the control plane *Virtual machine scale set* `constellation-scale-set-controlplanes-<suffix>`.
@ -51,8 +51,8 @@ If this fails due to an unhealthy control plane, you will see log messages simil
This means that you have to recover the node manually.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
First, check that the control plane *Instance Group* has enough members in a *Ready* state.
In the GCP Console, go to **Instance Groups** and check the group for the cluster's control plane `<cluster-name>-control-plane-<suffix>`.
@ -87,8 +87,8 @@ If this fails due to an unhealthy control plane, you will see log messages simil
This means that you have to recover the node manually.
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
First, open the AWS console to view all Auto Scaling Groups (ASGs) in the region of your cluster. Select the ASG of the control plane `<cluster-name>-<UID>-control-plane` and check that enough members are in a *Running* state.
@ -118,8 +118,8 @@ If this fails due to an unhealthy control plane, you will see log messages simil
This means that you have to recover the node manually.
</tabItem>
</tabs>
</TabItem>
</Tabs>
## Recover a cluster

32
docs/versioned_docs/version-2.14/workflows/scale.md
View file

@ -51,30 +51,30 @@ kubectl -n kube-system get nodes
Alternatively, you can manually scale your cluster up or down:
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
1. Find your Constellation resource group.
2. Select the `scale-set-workers`.
3. Go to **settings** and **scaling**.
4. Set the new **instance count** and **save**.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
1. In Compute Engine go to [Instance Groups](https://console.cloud.google.com/compute/instanceGroups/).
2. **Edit** the **worker** instance group.
3. Set the new **number of instances** and **save**.
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
1. Go to Auto Scaling Groups and select the worker ASG to scale up.
2. Click **Edit**
3. Set the new (increased) **Desired capacity** and **Update**.
</tabItem>
</tabs>
</TabItem>
</Tabs>
## Control-plane node scaling
@ -82,30 +82,30 @@ Control-plane nodes can **only be scaled manually and only scaled up**!
To increase the number of control-plane nodes, follow these steps:
<tabs groupId="csp">
<Tabs groupId="csp">
<tabItem value="azure" label="Azure">
<TabItem value="azure" label="Azure">
1. Find your Constellation resource group.
2. Select the `scale-set-controlplanes`.
3. Go to **settings** and **scaling**.
4. Set the new (increased) **instance count** and **save**.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
1. In Compute Engine go to [Instance Groups](https://console.cloud.google.com/compute/instanceGroups/).
2. **Edit** the **control-plane** instance group.
3. Set the new (increased) **number of instances** and **save**.
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
1. Go to Auto Scaling Groups and select the control-plane ASG to scale up.
2. Click **Edit**
3. Set the new (increased) **Desired capacity** and **Update**.
</tabItem>
</tabs>
</TabItem>
</Tabs>
If you scale down the number of control-planes nodes, the removed nodes won't be able to exit the `etcd` cluster correctly. This will endanger the quorum that's required to run a stable Kubernetes control plane.

32
docs/versioned_docs/version-2.14/workflows/storage.md
View file

@ -21,30 +21,30 @@ For more details see [encrypted persistent storage](../architecture/encrypted-st
Constellation supports the following drivers, which offer node-level encryption and optional integrity protection.
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
**Constellation CSI driver for Azure Disk**:
Mount Azure [Disk Storage](https://azure.microsoft.com/en-us/services/storage/disks/#overview) into your Constellation cluster.
See the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-azuredisk-csi-driver) for more information.
Since Azure Disks are mounted as `ReadWriteOnce`, they're only available to a single pod.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
**Constellation CSI driver for GCP Persistent Disk**:
Mount [Persistent Disk](https://cloud.google.com/persistent-disk) block storage into your Constellation cluster.
Follow the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-gcp-compute-persistent-disk-csi-driver) for more information.
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
**Constellation CSI driver for AWS Elastic Block Store**
Mount [Elastic Block Store](https://aws.amazon.com/ebs/) storage volumes into your Constellation cluster.
Follow the instructions on how to [install the Constellation CSI driver](#installation) or check out the [repository](https://github.com/edgelesssys/constellation-aws-ebs-csi-driver) for more information.
</tabItem>
</tabs>
</TabItem>
</Tabs>
Note that in case the options above aren't a suitable solution for you, Constellation is compatible with all other CSI-based storage options. For example, you can use [AWS EFS](https://docs.aws.amazon.com/en_en/eks/latest/userguide/efs-csi.html), [Azure Files](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction), or [GCP Filestore](https://cloud.google.com/filestore) with Constellation out of the box. Constellation is just not providing transparent encryption on the node level for these storage types yet.
@ -53,8 +53,8 @@ Note that in case the options above aren't a suitable solution for you, Constell
The Constellation CLI automatically installs Constellation's CSI driver for the selected CSP in your cluster.
If you don't need a CSI driver or wish to deploy your own, you can disable the automatic installation by setting `deployCSIDriver` to `false` in your Constellation config file.
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
Azure comes with two storage classes by default.
@ -82,8 +82,8 @@ Note that volume expansion isn't supported for integrity-protected disks.
:::
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
GCP comes with two storage classes by default.
@ -111,8 +111,8 @@ Note that volume expansion isn't supported for integrity-protected disks.
:::
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
AWS comes with two storage classes by default.
@ -140,8 +140,8 @@ Note that volume expansion isn't supported for integrity-protected disks.
:::
</tabItem>
</tabs>
</TabItem>
</Tabs>
1. Create a [persistent volume](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)

12
docs/versioned_docs/version-2.14/workflows/terminate.md
View file

@ -16,8 +16,8 @@ All ephemeral storage and state of your cluster will be lost. Make sure any data
:::
<tabs groupId="provider">
<tabItem value="cli" label="CLI">
<Tabs groupId="provider">
<TabItem value="cli" label="CLI">
Terminate the cluster by running:
```bash
@ -40,8 +40,8 @@ resources manually. Just run the `terminate` command again afterward to continue
:::
</tabItem>
<tabItem value="terraform" label="Terraform">
</TabItem>
<TabItem value="terraform" label="Terraform">
Terminate the cluster by running:
```bash
@ -56,5 +56,5 @@ rm constellation-state.yaml constellation-admin.conf
Only the `constellation-mastersecret.json` and the configuration file remain.
</tabItem>
</tabs>
</TabItem>
</Tabs>

16
docs/versioned_docs/version-2.14/workflows/terraform-provider.md
View file

@ -21,9 +21,9 @@ This example shows how to set up a Constellation cluster with the reference IAM
2. Use one of the [example configurations for using the Constellation Terraform provider](https://github.com/edgelesssys/constellation/tree/main/terraform-provider-constellation/examples/full) or create a `main.tf` file and fill it with the resources you want to create. The [Constellation Terraform provider documentation](https://registry.terraform.io/providers/edgelesssys/constellation/latest) offers thorough documentation on the resources and their attributes.
3. Initialize and apply the Terraform configuration.
<tabs groupId="csp">
<Tabs groupId="csp">
<tabItem value="azure" label="Azure">
<TabItem value="azure" label="Azure">
When creating a cluster on Azure, you need to manually patch the policy of the MAA provider before creating the Constellation cluster, as this feature isn't available in Azure's Terraform provider yet. The Constellation CLI provides a utility for patching, but you
can also do it manually.
@ -57,8 +57,8 @@ This example shows how to set up a Constellation cluster with the reference IAM
};
```
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
Initialize the providers and apply the configuration.
```bash
@ -67,8 +67,8 @@ This example shows how to set up a Constellation cluster with the reference IAM
```
Optionally, you can prefix the `terraform apply` command with `TF_LOG=INFO` to collect [Terraform logs](https://developer.hashicorp.com/terraform/internals/debugging) while applying the configuration. This may provide helpful output in debugging scenarios.
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
Initialize the providers and apply the configuration.
```bash
@ -77,8 +77,8 @@ This example shows how to set up a Constellation cluster with the reference IAM
```
Optionally, you can prefix the `terraform apply` command with `TF_LOG=INFO` to collect [Terraform logs](https://developer.hashicorp.com/terraform/internals/debugging) while applying the configuration. This may provide helpful output in debugging scenarios.
</tabItem>
</tabs>
</TabItem>
</Tabs>
4. Connect to the cluster.
```bash

16
docs/versioned_docs/version-2.14/workflows/troubleshooting.md
View file

@ -101,8 +101,8 @@ To provide information during early stages of a node's boot process, Constellati
You can view this information in the following places:
<tabs groupId="csp">
<tabItem value="azure" label="Azure">
<Tabs groupId="csp">
<TabItem value="azure" label="Azure">
1. In your Azure subscription find the Constellation resource group.
2. Inside the resource group find the Application Insights resource called `constellation-insights-*`.
@ -112,8 +112,8 @@ You can view this information in the following places:
To **find the disk UUIDs** use the following query: `traces | where message contains "Disk UUID"`
</tabItem>
<tabItem value="gcp" label="GCP">
</TabItem>
<TabItem value="gcp" label="GCP">
1. Select the project that hosts Constellation.
2. Go to the `Compute Engine` service.
@ -128,16 +128,16 @@ Constellation uses the default bucket to store logs. Its [default retention peri
:::
</tabItem>
<tabItem value="aws" label="AWS">
</TabItem>
<TabItem value="aws" label="AWS">
1. Open [AWS CloudWatch](https://console.aws.amazon.com/cloudwatch/home)
2. Select [Log Groups](https://console.aws.amazon.com/cloudwatch/home#logsV2:log-groups)
3. Select the log group that matches the name of your cluster.
4. Select the log stream for control or worker type nodes.
</tabItem>
</tabs>
</TabItem>
</Tabs>
### Node shell access