cli: support custom attestation policies for maa (#1375)

* create and update maa attestation policy

* use interface to allow unit testing

* fix test csp

* http request for policy patch

* go mod tidy

* remove hyphen

* go mod tidy

* wip: adapt to feedback

* linting fixes

* remove csp from tf call

* fix type assertion

* Add MAA URL to instance tags (#1409)

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* conditionally create maa provider

* only set instance tag when maa is created

* fix azure unit test

* bazel tidy

* remove AzureCVM const

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* encode policy at runtime

* remove policy arg

* fix unit test

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

cli/internal/terraform/terraform/azure/main.tf

@@ -41,6 +41,13 @@ resource "random_password" "initSecret" {
   override_special = "_%@"
 }
 
+resource "azurerm_attestation_provider" "attestation_provider" {
+  count               = var.create_maa ? 1 : 0
+  name                = format("%sap", var.name)
+  resource_group_name = var.resource_group
+  location            = var.location
+}
+
 resource "azurerm_application_insights" "insights" {
   name                = local.name
   location            = var.location
@@ -192,16 +199,21 @@ resource "azurerm_network_security_group" "security_group" {
 module "scale_set_control_plane" {
   source = "./modules/scale_set"
 
-  name                      = "${local.name}-control-plane"
-  instance_count            = var.control_plane_count
-  state_disk_size           = var.state_disk_size
-  state_disk_type           = var.state_disk_type
-  resource_group            = var.resource_group
-  location                  = var.location
-  instance_type             = var.instance_type
-  confidential_vm           = var.confidential_vm
-  secure_boot               = var.secure_boot
-  tags                      = merge(local.tags, { constellation-role = "control-plane" }, { constellation-init-secret-hash = local.initSecretHash })
+  name            = "${local.name}-control-plane"
+  instance_count  = var.control_plane_count
+  state_disk_size = var.state_disk_size
+  state_disk_type = var.state_disk_type
+  resource_group  = var.resource_group
+  location        = var.location
+  instance_type   = var.instance_type
+  confidential_vm = var.confidential_vm
+  secure_boot     = var.secure_boot
+  tags = merge(
+    local.tags,
+    { constellation-role = "control-plane" },
+    { constellation-init-secret-hash = local.initSecretHash },
+    { constellation-maa-url = var.create_maa ? azurerm_attestation_provider.attestation_provider[0].attestation_uri : "" },
+  )
   image_id                  = var.image_id
   user_assigned_identity    = var.user_assigned_identity
   network_security_group_id = azurerm_network_security_group.security_group.id
@@ -215,16 +227,21 @@ module "scale_set_control_plane" {
 module "scale_set_worker" {
   source = "./modules/scale_set"
 
-  name                      = "${local.name}-worker"
-  instance_count            = var.worker_count
-  state_disk_size           = var.state_disk_size
-  state_disk_type           = var.state_disk_type
-  resource_group            = var.resource_group
-  location                  = var.location
-  instance_type             = var.instance_type
-  confidential_vm           = var.confidential_vm
-  secure_boot               = var.secure_boot
-  tags                      = merge(local.tags, { constellation-role = "worker" }, { constellation-init-secret-hash = local.initSecretHash })
+  name            = "${local.name}-worker"
+  instance_count  = var.worker_count
+  state_disk_size = var.state_disk_size
+  state_disk_type = var.state_disk_type
+  resource_group  = var.resource_group
+  location        = var.location
+  instance_type   = var.instance_type
+  confidential_vm = var.confidential_vm
+  secure_boot     = var.secure_boot
+  tags = merge(
+    local.tags,
+    { constellation-role = "worker" },
+    { constellation-init-secret-hash = local.initSecretHash },
+    { constellation-maa-url = var.create_maa ? azurerm_attestation_provider.attestation_provider[0].attestation_uri : "" },
+  )
   image_id                  = var.image_id
   user_assigned_identity    = var.user_assigned_identity
   network_security_group_id = azurerm_network_security_group.security_group.id

cli/internal/terraform/terraform/azure/outputs.tf

@@ -10,3 +10,7 @@ output "initSecret" {
   value     = random_password.initSecret.result
   sensitive = true
 }
+
+output "attestationURL" {
+  value = var.create_maa ? azurerm_attestation_provider.attestation_provider[0].attestation_uri : ""
+}

cli/internal/terraform/terraform/azure/variables.tf

@@ -63,6 +63,12 @@ variable "secure_boot" {
   description = "Whether to deploy the cluster nodes with secure boot."
 }
 
+variable "create_maa" {
+  type        = bool
+  default     = false
+  description = "Whether to create a Microsoft Azure attestation provider."
+}
+
 variable "debug" {
   type        = bool
   default     = false