Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-11-27 07:06:56 -05:00
Code Issues Projects Releases Packages Wiki Activity

Rewrite install.md and create verify-cli.md (#124)

Browse source 
* Rewrite install.md and create verify-cli

* Small beautification

* Address review comment

* Shorten examples.md

* Quick brush over examples

* Fix broken links in v2.0

* Fix broken links in v2.0

* fix lint errors

Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
This commit is contained in:
Felix Schuster 2022-09-12 18:35:12 +02:00 • committed by GitHub
parent 55af5695ed
commit ebb8d7ca96
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
19 changed files with 165 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/docs/architecture/attestation.md
View file

@ -112,7 +112,7 @@ Those correspond to measurements of closed-source firmware components and other
While not being directly verifiable, they can be compared against previously observed values.
As part of the [signed image measurements](#chain-of-trust), Constellation provides measurements that are known, previously observed values.
Thereby, Constellation enables users to identify changes and deviations and allows them to act accordingly.
See how to [fetch](../workflows/verify.md#fetch-measurements) the latest measurements and verify a cluster.
See how to [fetch](../workflows/verify-cluster.md#fetch-measurements) the latest measurements and verify a cluster.
Second, are the measurements produced by the Constellation bootloader and boot chain itself.
The Constellation Bootloader is the first part of the Constellation stack that takes over from the CVM firmware and measures the rest of the boot chain.
@ -205,7 +205,7 @@ When an initialized node tries to join another cluster, its measurements inevita
### User-facing attestation
The [*VerificationService*](components.md#verificationservice) provides an endpoint for obtaining its hardware-based remote attestation statement, which includes the runtime measurements.
A user can [verify](../workflows/verify.md) this statement and compare the measurements against the configured ground truth and, thus, verify the identity and integrity of all Constellation components and the cluster configuration. Subsequently, the user knows that the entire cluster is in the expected state and is trustworthy.
A user can [verify](../workflows/verify-cluster.md) this statement and compare the measurements against the configured ground truth and, thus, verify the identity and integrity of all Constellation components and the cluster configuration. Subsequently, the user knows that the entire cluster is in the expected state and is trustworthy.
## Chain of trust

2
docs/docs/architecture/components.md
View file

@ -67,7 +67,7 @@ sequenceDiagram
The *VerificationService* runs as DaemonSet on each node.
It provides user-facing functionality for remote attestation during the cluster's lifetime via an endpoint for [verifying the cluster](attestation.md#cluster-attestation).
Read more about the hardware-based [attestation feature](attestation.md) of Constellation and how to [verify](../workflows/verify.md) a cluster on the client side.
Read more about the hardware-based [attestation feature](attestation.md) of Constellation and how to [verify](../workflows/verify-cluster.md) a cluster on the client side.
## KMS

2
docs/docs/architecture/orchestration.md
View file

@ -70,7 +70,7 @@ You can read more about these values and their meaning in the guide on [cluster
The *master secret* must be kept secret and can be used to [recover your cluster](../workflows/recovery.md).
Instead of managing this secret manually, you can [use your key management solution of choice](keys.md#user-managed-key-management) with Constellation.
The *clusterID* uniquely identifies a cluster and can be used to [verify your cluster](../workflows/verify.md).
The *clusterID* uniquely identifies a cluster and can be used to [verify your cluster](../workflows/verify-cluster.md).
## Upgrades