diff --git a/cli/internal/cmd/upgradeapply.go b/cli/internal/cmd/upgradeapply.go index c370015b0..415a4e2d9 100644 --- a/cli/internal/cmd/upgradeapply.go +++ b/cli/internal/cmd/upgradeapply.go @@ -341,16 +341,12 @@ type imageFetcher interface { // If so the function will ask the user to confirm (if --yes is not set) and upgrade the measurements only. func (u *upgradeApplyCmd) upgradeAttestConfigIfDiff(cmd *cobra.Command, newConfig config.AttestationCfg, flags upgradeApplyFlags) error { clusterAttestationConfig, _, err := u.upgrader.GetClusterAttestationConfig(cmd.Context(), newConfig.GetVariant()) - // Config migration from v2.7 to v2.8 requires us to skip comparing configs if the cluster is still using the legacy config. - // TODO(daniel-weisse): v2.9 Remove error type check and always run comparison. - if err != nil && !errors.Is(err, kubernetes.ErrLegacyJoinConfig) { - return fmt.Errorf("getting cluster measurements: %w", err) + if err != nil { + return fmt.Errorf("getting cluster attestation config: %w", err) } - if err == nil { - // If the current config is equal, or there is an error when comparing the configs, we skip the upgrade. - if equal, err := newConfig.EqualTo(clusterAttestationConfig); err != nil || equal { - return err - } + // If the current config is equal, or there is an error when comparing the configs, we skip the upgrade. + if equal, err := newConfig.EqualTo(clusterAttestationConfig); err != nil || equal { + return fmt.Errorf("comparing attestation configs: %w", err) } if !flags.yes { diff --git a/cli/internal/helm/client.go b/cli/internal/helm/client.go index e1da410d0..f736ebee4 100644 --- a/cli/internal/helm/client.go +++ b/cli/internal/helm/client.go @@ -8,13 +8,11 @@ package helm import ( "context" - "encoding/json" "errors" "fmt" "strings" "time" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" "github.com/edgelesssys/constellation/v2/internal/compatibility" "github.com/edgelesssys/constellation/v2/internal/config" "github.com/edgelesssys/constellation/v2/internal/constants" @@ -326,50 +324,20 @@ func (c *Client) applyMigrations(ctx context.Context, releaseName string, values return fmt.Errorf("parsing current version: %w", err) } - if currentV.Major == 2 && currentV.Minor == 7 { - return migrateFrom2_7(ctx, values, conf, c.kubectl) + if currentV.Major == 2 && currentV.Minor == 8 { + // Rename/change the following function to implement any necessary migrations. + return migrateFrom2_8(ctx, values, conf, c.kubectl) } return nil } -// migrateFrom2_7 applies the necessary migrations for upgrading from v2.7.x to v2.8.x. -// migrateFrom2_7 should be applied for v2.7.x --> v2.8.x. -// migrateFrom2_7 should NOT be applied for v2.8.0 --> v2.8.x. -// Remove after release of v2.8.0. -func migrateFrom2_7(ctx context.Context, values map[string]any, conf *config.Config, kubeclient crdClient) error { - if conf.GetProvider() == cloudprovider.GCP { - if err := updateGCPStorageClass(ctx, kubeclient); err != nil { - return fmt.Errorf("applying migration for GCP storage class: %w", err) - } - } - - return updateJoinConfig(values, conf) -} - -func updateGCPStorageClass(ctx context.Context, kubeclient crdClient) error { - // v2.8 updates the disk type of GCP default storage class - // This value is not updatable in Kubernetes, but we can use a workaround to update it: - // First, we delete the storage class, then we upgrade the chart, - // which will recreate the storage class with the new disk type. - if err := kubeclient.DeleteStorageClass(ctx, "encrypted-rwo"); err != nil { - return fmt.Errorf("deleting storage class for update: %w", err) - } - return nil -} - -func updateJoinConfig(values map[string]any, conf *config.Config) error { - joinServiceVals, ok := values["join-service"].(map[string]interface{}) - if !ok { - return errors.New("invalid join-service config") - } - - attestationConfigJSON, err := json.Marshal(conf.GetAttestationConfig()) - if err != nil { - return fmt.Errorf("marshalling attestation config: %w", err) - } - joinServiceVals["attestationConfig"] = string(attestationConfigJSON) - +// migrateFrom2_8 is currently a no-op that is kept for documentation purposes. +// If you have to implement the function please make sure to update the below comment to your situation. +// migrateFrom2_8 applies the necessary migrations for upgrading from v2.8.x to v2.9.x. +// migrateFrom2_8 should be applied for v2.8.x --> v2.9.x. +// migrateFrom2_8 should NOT be applied for v2.8.0 --> v2.9.x. +func migrateFrom2_8(_ context.Context, _ map[string]any, _ *config.Config, _ crdClient) error { return nil } @@ -431,7 +399,6 @@ type crdClient interface { ApplyCRD(ctx context.Context, rawCRD []byte) error GetCRDs(ctx context.Context) ([]apiextensionsv1.CustomResourceDefinition, error) GetCRs(ctx context.Context, gvr schema.GroupVersionResource) ([]unstructured.Unstructured, error) - DeleteStorageClass(ctx context.Context, name string) error // TODO(daniel-weisse): remove with v2.9 } type actionWrapper interface { diff --git a/cli/internal/kubernetes/BUILD.bazel b/cli/internal/kubernetes/BUILD.bazel index d7b1d4d44..3d7eef35b 100644 --- a/cli/internal/kubernetes/BUILD.bazel +++ b/cli/internal/kubernetes/BUILD.bazel @@ -15,7 +15,6 @@ go_library( "//cli/internal/terraform", "//cli/internal/upgrade", "//internal/api/versionsapi", - "//internal/attestation/measurements", "//internal/attestation/variant", "//internal/cloud/cloudprovider", "//internal/compatibility", diff --git a/cli/internal/kubernetes/upgrade.go b/cli/internal/kubernetes/upgrade.go index e8515e84d..e3f339692 100644 --- a/cli/internal/kubernetes/upgrade.go +++ b/cli/internal/kubernetes/upgrade.go @@ -20,7 +20,6 @@ import ( "github.com/edgelesssys/constellation/v2/cli/internal/terraform" "github.com/edgelesssys/constellation/v2/cli/internal/upgrade" "github.com/edgelesssys/constellation/v2/internal/api/versionsapi" - "github.com/edgelesssys/constellation/v2/internal/attestation/measurements" "github.com/edgelesssys/constellation/v2/internal/attestation/variant" "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" "github.com/edgelesssys/constellation/v2/internal/compatibility" @@ -58,10 +57,6 @@ const ( // ErrInProgress signals that an upgrade is in progress inside the cluster. var ErrInProgress = errors.New("upgrade in progress") -// ErrLegacyJoinConfig signals that a legacy join-config was found. -// TODO(daniel-weisse): v2.9 remove. -var ErrLegacyJoinConfig = errors.New("legacy join-config with missing attestationConfig found") - // GetConstellationVersion queries the constellation-version object for a given field. func GetConstellationVersion(ctx context.Context, client DynamicInterface) (updatev1alpha1.NodeVersion, error) { raw, err := client.GetCurrent(ctx, "constellation-version") @@ -301,13 +296,7 @@ func (u *Upgrader) CurrentKubernetesVersion(ctx context.Context) (string, error) func (u *Upgrader) UpdateAttestationConfig(ctx context.Context, newAttestConfig config.AttestationCfg) error { currentAttestConfig, joinConfig, err := u.GetClusterAttestationConfig(ctx, newAttestConfig.GetVariant()) if err != nil { - if !errors.Is(err, ErrLegacyJoinConfig) { - return fmt.Errorf("getting cluster attestation config: %w", err) - } - currentAttestConfig, joinConfig, err = joinConfigMigration(joinConfig, newAttestConfig.GetVariant()) - if err != nil { - return fmt.Errorf("migrating join config: %w", err) - } + return fmt.Errorf("getting attestation config: %w", err) } equal, err := newAttestConfig.EqualTo(currentAttestConfig) if err != nil { @@ -343,11 +332,6 @@ func (u *Upgrader) GetClusterAttestationConfig(ctx context.Context, variant vari return nil, nil, fmt.Errorf("retrieving current attestation config: %w", err) } if _, ok := existingConf.Data[constants.AttestationConfigFilename]; !ok { - // TODO(daniel-weisse): v2.9 remove legacy config detection since it is only required for upgrades from v2.7 - if _, ok := existingConf.Data["measurements"]; ok { - u.log.Debugf("Legacy join config detected, migrating to new config") - return nil, existingConf, ErrLegacyJoinConfig - } return nil, nil, errors.New("attestation config missing from join-config") } @@ -527,45 +511,6 @@ func (u *stableClient) KubernetesVersion() (string, error) { return serverVersion.GitVersion, nil } -// joinConfigMigration prepares a join-config ConfigMap for migration from v2.7 to v2.8. -// TODO(daniel-weisse): v2.9: remove this function. -func joinConfigMigration(existingConf *corev1.ConfigMap, attestVariant variant.Variant) (config.AttestationCfg, *corev1.ConfigMap, error) { - m, ok := existingConf.Data["measurements"] - if !ok { - return nil, nil, errors.New("no measurements found in configmap") - } - - var measurements measurements.M - if err := json.Unmarshal([]byte(m), &measurements); err != nil { - return nil, nil, fmt.Errorf("unmarshalling measurements: %w", err) - } - - var oldConf config.AttestationCfg - switch attestVariant { - case variant.AWSNitroTPM{}: - oldConf = &config.AWSNitroTPM{} - case variant.AzureSEVSNP{}: - oldConf = &config.AzureSEVSNP{} - case variant.AzureTrustedLaunch{}: - oldConf = &config.AzureTrustedLaunch{} - case variant.GCPSEVES{}: - oldConf = &config.GCPSEVES{} - case variant.QEMUVTPM{}: - oldConf = &config.QEMUVTPM{} - default: - return nil, nil, fmt.Errorf("unknown variant: %s", attestVariant) - } - - oldConf.SetMeasurements(measurements) - oldConfJSON, err := json.Marshal(oldConf) - if err != nil { - return nil, nil, fmt.Errorf("marshalling previous config: %w", err) - } - existingConf.Data[constants.AttestationConfigFilename] = string(oldConfJSON) - - return oldConf, existingConf, nil -} - type helmInterface interface { Upgrade(ctx context.Context, config *config.Config, timeout time.Duration, allowDestructive, force bool, upgradeID string) error } diff --git a/internal/kubernetes/kubectl/kubectl.go b/internal/kubernetes/kubectl/kubectl.go index c469b2b6e..3181654ad 100644 --- a/internal/kubernetes/kubectl/kubectl.go +++ b/internal/kubernetes/kubectl/kubectl.go @@ -241,12 +241,6 @@ func (k *Kubectl) AddNodeSelectorsToDeployment(ctx context.Context, selectors ma return nil } -// DeleteStorageClass deletes the storage class with the given name. -// TODO(daniel-weisse): Remove with v2.9. -func (k *Kubectl) DeleteStorageClass(ctx context.Context, name string) error { - return k.StorageV1().StorageClasses().Delete(ctx, name, metav1.DeleteOptions{}) -} - // parseCRD takes a byte slice of data and tries to create a CustomResourceDefinition object from it. func parseCRD(crdString []byte) (*v1.CustomResourceDefinition, error) { sch := runtime.NewScheme()