Paul Meyer
02fc3dc635
measurements: refactor validation option ( #1462 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-22 11:47:39 +01:00
renovate[bot]
2d1ffaea4f
deps: update K8s constrained Azure versions ( #1408 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-22 10:23:44 +01:00
renovate[bot]
7a0cbe39f4
deps: update Constellation containers to v2.7.0-pre.0.20230321165012-cab6044f6910 ( #1484 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-21 20:21:42 +01:00
renovate[bot]
248dbb5927
deps: update Constellation containers ( #1464 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-21 17:37:06 +01:00
Daniel Weiße
5a0234b3f2
attestation: add option for MAA fallback to verify azure's snp-sev id key digest ( #1257 )
...
* Convert enforceIDKeyDigest setting to enum
* Use MAA fallback in Azure SNP attestation
* Only create MAA provider if MAA fallback is enabled
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
2023-03-21 12:46:49 +01:00
Malte Poll
67f5625f99
versions: add OpenStack CCM image
2023-03-21 10:51:09 +01:00
Malte Poll
071628c6a0
config: add OpenStack in-cluster authentication settings
2023-03-21 10:51:09 +01:00
Malte Poll
f785ae560b
openstack: implement account key for cluster-internal authentication
2023-03-21 10:51:09 +01:00
Malte Poll
1b2a927b84
openstack: implement api client UID, InitSecretHash and GetLoadBalancerEndpoint
2023-03-21 10:51:09 +01:00
Otto Bittner
1b12147d83
cli: minor restructuring for loading helm charts ( #1441 )
...
Use one loadRelease function instead of one function for each
release.
2023-03-20 17:05:58 +01:00
renovate[bot]
b3b1809251
deps: update K8s version independent containers to v0.1.2 ( #1376 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-20 16:35:26 +01:00
Daniel Weiße
1a0e05c3fb
Set Azure-SEV-SNP as default azure attestation variant ( #1461 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-20 14:40:27 +01:00
Paul Meyer
bad05321a0
go: remove redefinitions of builtins
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-20 08:41:01 -04:00
Paul Meyer
0036b24266
go: remove unused parameters
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-20 08:41:01 -04:00
Moritz Sanft
f2ce9518a3
cli: support custom attestation policies for maa ( #1375 )
...
* create and update maa attestation policy
* use interface to allow unit testing
* fix test csp
* http request for policy patch
* go mod tidy
* remove hyphen
* go mod tidy
* wip: adapt to feedback
* linting fixes
* remove csp from tf call
* fix type assertion
* Add MAA URL to instance tags (#1409 )
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* conditionally create maa provider
* only set instance tag when maa is created
* fix azure unit test
* bazel tidy
* remove AzureCVM const
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
* encode policy at runtime
* remove policy arg
* fix unit test
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
2023-03-20 13:33:04 +01:00
renovate[bot]
540978bc98
deps: update Constellation containers ( #1417 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-03-17 07:48:19 +01:00
Daniel Weiße
6ea5588bdc
config: add attestation variant ( #1413 )
...
* Add attestation type to config (optional for now)
* Get attestation variant from config in CLI
* Set attestation variant for Constellation services in helm deployments
* Remove AzureCVM variable from helm deployments
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-14 11:46:27 +01:00
renovate[bot]
fb83c1dbc4
deps: update Constellation containers to v2.7.0-pre.0.20230313143044-114ac53872c6 ( #1333 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 18:49:59 +01:00
Paul Meyer
bab76e8a9a
deps: update containers to v2.7.0-pre ( #1407 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 13:19:36 +01:00
renovate[bot]
e2ad11320a
deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.26.1 ( #1383 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 11:12:50 +01:00
Paul Meyer
a658368d40
deps: update GCP guest agent image ( #1400 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 10:35:57 +01:00
Paul Meyer
50c4ea9be6
deps: update libvirt container to v2.7.0-pre
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-10 10:46:46 -05:00
Thomas Tendyck
64e1f553d1
cli: remove Edition in version command, which contains duplicate info
2023-03-10 11:36:44 +01:00
Moritz Sanft
01705feb51
ci: upload cli version list ( #1377 )
...
* upload cli version list
* fix flag
* name
* allow cli kind for listing
* [remove] update vapi cli
* allow cli kind
* use latest versionsapi image version
* fix kind parsing
* use workflow calls in on_release action
* [remove] update container tag
* change back to latest tag
2023-03-10 10:21:58 +01:00
Nils Hanke
dc4769d0a0
constants: use "Enterprise" for enterprise build
2023-03-09 17:32:50 +01:00
Malte Poll
bdba9d8ba6
bazel: add build files for go ( #1186 )
...
* build: correct toolchain order
* build: gazelle-update-repos
* build: use pregenerated proto for dependencies
* update bazeldnf
* deps: tpm simulator
* Update Google trillian module
* cli: add stamping as alternative build info source
* bazel: add go_test wrappers, mark special tests and select testing deps
* deps: add libvirt deps
* deps: go-libvirt patches
* deps: cloudflare circl patches
* bazel: add go_test wrappers, mark special tests and select testing deps
* bazel: keep gazelle overrides
* bazel: cleanup bazelrc
* bazel: switch CMakeLists.txt to use bazel
* bazel: fix injection of version information via stamping
* bazel: commit all build files
* dev-docs: document bazel usage
* deps: upgrade zig-cc for go 1.20
* bazel: update Perl for macOS arm64 & Linux arm64 support
* bazel: use static perl toolchain for OpenSSL
* bazel: use static protobuf (protoc) toolchain
* deps: add git and go to nix deps
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-09 15:23:42 +01:00
Daniel Weiße
8c87bba755
Add measurement reader ( #1381 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-09 11:22:58 +01:00
Daniel Weiße
5bad5f768b
attestation: create issuer based on kernel cmd line ( #1355 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-09 09:47:28 +01:00
Paul Meyer
acbd70c741
openstack: implement api client and metadata list
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 09:04:57 -05:00
Paul Meyer
418f08bf40
openstack: implement imds and metadata self
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 09:04:57 -05:00
Paul Meyer
630016d1b3
openstack: use password to authenticate in cluster
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 09:04:57 -05:00
Paul Meyer
64fc43f276
use any instead of interface{} ( #1354 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 10:31:20 +01:00
Malte Poll
62ea224d36
attestation: remove PCR[0] and PCR[10] from enterprise measurements ( #1348 )
...
This will help the measurement generation done as part of internal/attestation/measurements/measurement-generator.
It can currently replace measurements but not reformat the code (in cases where the number of measurements differs).
2023-03-06 17:11:14 +01:00
Thomas Tendyck
c94d1db76d
attestation: remove PCR 0 and 10 on GCP
2023-03-06 13:09:57 +01:00
Thomas Tendyck
0a344e4cf6
attestation: validate GCP machine state
2023-03-06 13:09:57 +01:00
Thomas Tendyck
2535073df8
attestation: add MachineState to ValidateCVM
2023-03-06 13:09:57 +01:00
Malte Poll
aae326d430
deps: manually upgrade libvirt container for upcoming release ( #1339 )
...
The libvirt container is currently not automatically upgraded (it still has version v2.2.0 before this change).
To ensure we update libvirt for this release, we manually upgrade the libvirt container image.
2023-03-03 16:05:29 +01:00
Malte Poll
8aa42e30ad
cli: set OpenStack service account credentials ( #1328 )
2023-03-03 10:10:36 +01:00
Otto Bittner
f0db5d0395
cli: restructure upgrade apply
( #1319 )
...
Applies the updated NodeVersion object with one request
instead of two. This makes sure that the first request does
not accidentially put the cluster into a "updgrade in progress"
status. Which would lead users to having to run apply twice.
2023-03-03 09:38:23 +01:00
Daniel Weiße
5eb73706f5
internal: refactor storage credentials ( #1071 )
...
* Move storage clients to separate packages
* Allow setting of client credentials for AWS S3
* Use managed identity client secret or default credentials for Azure Blob Storage
* Use credentials file to authorize GCS client
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-02 15:08:31 +01:00
Malte Poll
ab0b881cbf
oid: add alternative string representations for attestation variants ( #1322 )
2023-03-02 10:48:16 +01:00
Malte Poll
fc33a74c78
constants: make VersionInfo readonly ( #1316 )
...
The variable VersionInfo is supposed to be set by `go build -X ...` during link time but should not be modified at runtime.
This change ensures the underlying var is private and can only be accessed by a public getter.
2023-03-01 11:55:12 +01:00
renovate[bot]
0157537852
deps: update Kubernetes versions ( #1313 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-03-01 11:41:11 +01:00
Paul Meyer
060faae528
config: use toPtr func to get pointers ( #1287 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-28 18:44:21 +01:00
renovate[bot]
2f52091326
deps: update Constellation containers to v2.6.0-pre.0.20230228093604-90ed4701788f ( #1288 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-28 17:32:02 +01:00
Daniel Weiße
b3486fc32b
intenal: add logging to attestation issuer ( #1264 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-28 16:34:18 +01:00
Moritz Sanft
90ed470178
internal: add custom version type ( #1256 )
...
* add custom version type
* extend functionality
* adapt to requested changes
* move to own package
* remove duplicate tests, rename package
* not handle err
2023-02-28 10:36:04 +01:00
Otto Bittner
984f0589d2
cli: upgrade errors for microservice ( #1259 )
...
Handle invalid upgrade errors similarly as for images and k8s.
2023-02-28 10:23:09 +01:00
Malte Poll
b79f7d0c8c
cli: add basic support for constellation create
on OpenStack ( #1283 )
...
* image: support OpenStack image build / upload
* cli: add OpenStack terraform template
* config: add OpenStack as CSP
* versionsapi: add OpenStack as CSP
* cli: add OpenStack as provider for `config generate` and `create`
* disk-mapper: add basic support for boot on OpenStack
* debugd: add placeholder for OpenStack
* image: fix config file sourcing for image upload
2023-02-27 18:19:52 +01:00
Otto Bittner
d98f86686d
versions: let renovate update valid k8s versions
...
Also update lagging v1_24
2023-02-27 16:33:47 +01:00
renovate[bot]
b1d9ede767
deps: update Constellation containers ( #1234 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-24 17:00:50 +01:00
renovate[bot]
7bcd0650a9
deps: update ghcr.io/edgelesssys/cloud-provider-gcp:v26.0.1 Docker digest to db2b15a ( #1267 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-24 15:57:53 +01:00
Moritz Sanft
a274ac8a7c
ci: add cli k8s compatibility table artifact upload to ci ( #1218 )
...
* add cli k8s compatibility api to ci
* extend versionsapi package
* rework cli info upload via ci
* join errors natively
* fix semver
* upload from hack file
* fix ci checks
* add distributionid
* setup go before running hack file
* setup go after repo checkout
* use logger instead of panic, invalidate cache
* use provided ctx
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
---------
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-24 12:00:04 +01:00
Nils Hanke
28bdeb2427
cli: add support for GCP C2D VMs
2023-02-22 15:25:51 +01:00
Nils Hanke
7360e89182
cli: fix n2d-standard-224 support
2023-02-22 15:25:51 +01:00
Otto Bittner
d78d22f95a
cli: add config kubernetes-versions
subcommand ( #1224 )
...
Allows users to learn which k8s versions are supported by the
current CLI.
Extend respective docs section.
2023-02-22 09:52:47 +01:00
leongross
51eef675a2
cli: refer to --force and --config flags ( #1205 )
...
* add reference to --config and --force
2023-02-21 16:46:47 +01:00
Otto Bittner
da7a870f54
cli: add --kubernetes
flag ( #1226 )
...
The flag can be used to specify a Kubernetes version
in format MAJOR.MINOR and let the CLI extend the
value with the patch version.
2023-02-21 14:05:41 +01:00
Paul Meyer
6d6d7d4b6e
kms: replace deprecated rand.Seed
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Paul Meyer
deea806d9c
Improve code sequences with multiple errs
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Paul Meyer
12c866bcb9
deps: replace multierr with native errors.Join
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Otto Bittner
c0a62a52d1
config: allow k8s version MAJOR.MINOR for v2.6 ( #1222 )
...
To adhere to our compatibility goal of not breaking
old configs, the kubernetes patch version is automatically
extended for configs in the transistional version v2.6.
2023-02-20 10:50:55 +01:00
Otto Bittner
87fdb47caa
cli: upgrade apply uses correct measurements key ( #1223 )
...
Apply still used the obsolete upgrade key's measurements.
The new, desired behavior is to use the Provider's measurements
key
2023-02-20 10:32:33 +01:00
renovate[bot]
93f97cb320
deps: update Constellation containers ( #1211 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-02-17 11:41:48 +01:00
Daniel Weiße
f70447bf7d
Allow unset 'name' key but print warning if unset ( #1208 )
...
* Allow unset name key in config but print warning if unset
* Print deprecation warnings for config to os.Stderr
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-17 09:05:42 +01:00
Thomas Tendyck
292f8eef21
attestation: remove VerifyUserData
2023-02-16 16:29:20 +01:00
Thomas Tendyck
dd7d6334ba
attestation: bind user data to PCR state
2023-02-16 16:29:20 +01:00
Fabian Kammel
5e7dc0d7db
Option to disable spinner via environment variable. ( #1207 )
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2023-02-16 15:43:19 +01:00
Otto Bittner
50646b2a10
cli: refactor upgrade apply
cmd to match name
...
* `upgrade apply` will try to make the locally configured and
actual version in the cluster match by appling necessary
upgrades.
* Skip image or kubernetes upgrades if one is already
in progress.
* Skip downgrades/equal-as-running versions
* Move NodeVersionResourceName constant from operators
to internal as its needed in the CLI.
2023-02-15 16:44:47 +01:00
Otto Bittner
3cebd68c24
kubernetes: move k8s-components creation to internal
...
The CLI will have to create similar objects for k8s upgrades.
2023-02-15 16:44:47 +01:00
Otto Bittner
b4ef4ec370
config: conditionally set default microserviceVersion
2023-02-15 13:36:16 +01:00
Otto Bittner
6f9d76dd6e
compatibility: allow newer patch versions for images
...
Validation incorrectly prevented newer patch versions for images.
2023-02-15 13:36:16 +01:00
Otto Bittner
2a0b56f7b8
config: improve error message for outdated CLIs
2023-02-15 13:36:16 +01:00
renovate[bot]
a7b3a9876b
deps: update Constellation containers to v2.6.0-pre.0.20230215104228-2042e6b3382f ( #1185 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-15 13:13:54 +01:00
Otto Bittner
2042e6b338
config: only print upgrade deprecation msg if key is set
2023-02-15 11:42:28 +01:00
Otto Bittner
69a384d978
compatibility: error message wording
...
The new description represents the error condition more accurately.
2023-02-15 11:41:54 +01:00
renovate[bot]
241d667758
deps: update K8s constrained Azure versions ( #1129 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-14 15:18:55 +01:00
Paul Meyer
84a787b538
cli: add name of build type to version cmd output ( #1179 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-14 14:30:10 +01:00
renovate[bot]
f60f967bd8
deps: update Constellation containers to v2.6.0-pre.0.20230210122722-c29107f5be7b ( #1126 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-10 16:06:46 +01:00
Daniel Weiße
c29107f5be
init: create kubeconfig file with unique user/cluster name ( #1133 )
...
* Generate kubeconfig with unique name
* Move create name flag to config
* Add name validation to config
* Move name flag in e2e tests to config generation
* Remove name flag from create
* Update ascii cinema flow
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-10 13:27:22 +01:00
Otto Bittner
fd860ddb91
config: fix incorrect kubernetes version validation ( #1155 )
...
Fix incorrect string comparison by replacing it with
call to semver.Compare.
Also add handling to check for missing v prefix.
2023-02-09 17:38:02 +01:00
Otto Bittner
c275464634
cli: change upgrade-plan to upgrade-check
...
Upgrade check is used to find updates for the current cluster.
Optionally the found upgrades can be persisted to the config
for consumption by the upgrade-execute cmd.
The old `upgrade execute` in this commit does not work with
the new `upgrade plan`.
The current versions are read from the cluster.
Supported versions are read from the cli and the versionsapi.
Adds a new config field MicroserviceVersion that will be used
by `upgrade execute` to update the service versions.
The field is optional until 2.7
A deprecation warning for the upgrade key is printed during
config validation.
Kubernetes versions now specify the patch version to make it
explicit for users if an upgrade changes the k8s version.
2023-02-08 12:30:01 +01:00
Otto Bittner
f204c24174
cli: add version validation and force flag
...
Version validation checks that the configured versions
are not more than one minor version below the CLI's version.
The validation can be disabled using --force.
This is necessary for now during development as the CLI
does not have a prerelease version, as our images do.
2023-02-08 12:30:01 +01:00
Daniel Weiße
3a7b829107
internal: use go-kms-wrapping for KMS backends ( #1012 )
...
* Replace external KMS backend logic for AWS, Azure, and GCP with go-kms-wrapping
* Move kms client setup config into its own package for easier parsing
* Update kms integration flag naming
* Error if nil storage is passed to external KMS
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-08 12:03:54 +01:00
Daniel Weiße
68ce23b909
Enable cryptsetup read/write workqueue bypass ( #1150 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-08 12:01:14 +01:00
renovate[bot]
535c359ee7
deps: update Constellation containers to v2.6.0-pre.0.20230131161703-e0354826e058 ( #1105 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-31 18:08:40 +01:00
Otto Bittner
6415d80ee4
versions: update constellation operator image
2023-01-31 11:36:49 +01:00
renovate[bot]
11e233e4be
deps: update ghcr.io/edgelesssys/cloud-provider-gcp:v26.0.1 Docker digest to 8708a33 ( #1110 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-30 16:54:11 +01:00
renovate[bot]
dcde73b4c4
deps: update Constellation containers to v2.6.0-pre.0.20230127131021-e174146e0c93 ( #1091 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 16:01:08 +01:00
renovate[bot]
fb1b1f50fd
deps: update K8s version independent containers to v0.1.1 ( #1020 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 15:25:05 +01:00
3u13r
e174146e0c
azure: add new idkeydigest ( #1094 )
2023-01-27 14:10:21 +01:00
Paul Meyer
8364856d55
versions: remove Kubernetes v1.23
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 13:32:20 +01:00
renovate[bot]
c758aef1ff
deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.25.3 ( #1082 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 11:30:43 +01:00
renovate[bot]
dd1140868e
deps: update Constellation containers to v2.6.0-pre ( #1074 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-26 14:58:51 +01:00
Daniel Weiße
aa3ac82408
Add a bit more logging to attestation and join-service on error ( #1076 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-01-26 11:24:29 +01:00
Malte Poll
2d326ea3f0
cli: set placeholder uid for QEMU / MiniConstellation ( #1069 )
2023-01-25 14:42:52 +01:00
3u13r
e6ac8e2a91
config: fix digest naming ( #1064 )
...
* config: fix digest naming
2023-01-24 22:20:10 +01:00
github-actions[bot]
9567cc09ce
release: bring back changes from v2.5.0 ( #1061 )
...
* deps: update version to v2.5.0
* attestation: hardcode measurements for v2.5.0
* bump operator versions
Co-authored-by: release[bot] <release[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-01-24 11:35:26 +01:00
renovate[bot]
5142497a3d
deps: update dependency containernetworking/plugins to v1.2.0 ( #1022 )
...
* Update dependency containernetworking/plugins to v1.2.0
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-23 14:56:28 +01:00
renovate[bot]
f688afff3f
Update K8s constrained Azure versions ( #1009 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-23 14:32:21 +01:00
Paul Meyer
4f9ed08061
versionsapi: fix single version deletion in cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-23 14:15:05 +01:00
Otto Bittner
3b59ebfd53
config: detailed validation errors for k8s version ( #1018 )
...
These extended error messages help users in understanding
what is wrong with the current configuration and how to
remediate the issue.
2023-01-23 11:21:06 +01:00
renovate[bot]
9f05631afd
deps: update Constellation containers ( #1052 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-21 20:17:07 +01:00
Paul Meyer
c4d68d1c28
versions: update key-service name
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-21 19:55:14 +01:00
renovate[bot]
6708aff984
deps: update dependency kubernetes/kubernetes to v1.24.10 ( #1043 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-20 18:54:10 +01:00
Paul Meyer
a8cbfd848f
keyservice: use dash in container name ( #1016 )
...
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-01-20 18:51:06 +01:00
Fabian Kammel
8482d26eef
deps: update cloud provider gcp image for k8s v1.26 ( #1051 )
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2023-01-20 15:54:24 +01:00
renovate[bot]
9b4dc9b478
Update Constellation containers to v2.5.0-pre.0.20230119145750-690b50b29de5 ( #1039 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-20 09:51:29 +01:00
renovate[bot]
99496c3c33
Update Kubernetes versions ( #1019 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-19 17:16:00 +01:00
Daniel Weiße
690b50b29d
dev-docs: Go package docs ( #958 )
...
* Remove unused package
* Add Go package docs to most packages
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Fabian Kammel <fk@edgeless.systems>
2023-01-19 15:57:50 +01:00
Otto Bittner
a0ac957227
versions: update join- & keyservice images
2023-01-19 13:14:55 +01:00
Otto Bittner
9a1f52e94e
Refactor init/recovery to use kms URI
...
So far the masterSecret was sent to the initial bootstrapper
on init/recovery. With this commit this information is encoded
in the kmsURI that is sent during init.
For recover, the communication with the recoveryserver is
changed. Before a streaming gRPC call was used to
exchanges UUID for measurementSecret and state disk key.
Now a standard gRPC is made that includes the same kmsURI &
storageURI that are sent during init.
2023-01-19 13:14:55 +01:00
Otto Bittner
0e71322e2e
keyservice: move kms code to internal/kms
...
Recovery (disk-mapper) and init (bootstrapper)
will have to work with multiple external KMSes
in the future.
2023-01-19 13:14:55 +01:00
renovate[bot]
90ea35ae35
Update Constellation containers to v2.5.0-pre.0.20230118154955-632090c21b93 ( #1014 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-18 17:28:04 +01:00
3u13r
632090c21b
azure: allow a set of idkeydigest values ( #991 )
2023-01-18 16:49:55 +01:00
renovate[bot]
41eb533d63
Update Constellation containers ( #1003 )
...
https://github.com/edgelesssys/constellation/actions/runs/3943576556/jobs/6748558235
2023-01-18 09:44:36 +01:00
Thomas Tendyck
f0f109a1ea
verify: use fixed user data
2023-01-17 16:14:00 +01:00
renovate[bot]
bbda3d1ecd
Update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.25.2 ( #979 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-17 16:10:26 +01:00
renovate[bot]
a3035167b6
Update Constellation containers ( #965 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-16 16:59:49 +01:00
Otto Bittner
89f075d490
versions: rename KmsImage to KeyServiceImage
2023-01-16 15:14:23 +01:00
Paul Meyer
42135dfdd6
versions: update container images to v2.5.0-pre
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-16 14:54:41 +01:00
Paul Meyer
467c3f501c
versionsapi: add implementation of json flag
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-16 13:52:11 +01:00
Otto Bittner
90b88e1cf9
kms: rename kms to keyservice
...
In the light of extending our eKMS support it will be helpful
to have a tighter use of the word "KMS".
KMS should refer to the actual component that manages keys.
The keyservice, also called KMS in the constellation code,
does not manage keys itself. It talks to a KMS backend,
which in turn does the actual key management.
2023-01-16 11:56:34 +01:00
Malte Poll
bcd8aa9acc
Use upstream node-maintenance-operator ( #115 )
2023-01-12 16:01:03 +01:00
Malte Poll
75fb61e001
attestation: codegen for hardcoded measurements in go
2023-01-12 13:24:07 +01:00
Fabian Kammel
82a0fcbb9d
upgrade: fix broken reference from constellation-os to constellation-version ( #939 )
...
* update constellation-os to constellation-version references
* update nodeimage to nodeversion in CRD type name
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-01-11 16:07:07 +01:00
Paul Meyer
4bc191e434
versions: move hash generator into own package
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-11 14:29:32 +01:00
Paul Meyer
c081664d03
versions: repair hash generation
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-11 14:29:32 +01:00
Malte Poll
fe8518a4e3
release: update measurements
2023-01-11 11:10:44 +01:00
release[bot]
e8fad4b7f9
Update version to v2.4.0
2023-01-11 11:10:44 +01:00
Paul Meyer
ef086bf02d
versionsapi: log aws region
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-10 17:02:01 +01:00
renovate[bot]
d24fac00f0
Update Constellation containers ( #884 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-09 13:15:28 +01:00
Leonard Cohnen
2700d5182b
operator: reconcile kubernetesClusterVersion
2023-01-09 12:16:54 +01:00
Leonard Cohnen
8c5e41b865
constants: rename components annotation key
2023-01-09 12:16:54 +01:00
Leonard Cohnen
3637909a46
internal: move components into their own package
2023-01-09 12:16:54 +01:00
Paul Meyer
49534d463d
deps: update cluster autoscaler ( #835 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 16:47:31 +01:00
Paul Meyer
f4df4067bd
deps: upgrade Azure sdk ( #887 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 16:26:30 +01:00
renovate[bot]
8b11a18239
Update K8s constrained Azure versions ( #886 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 14:15:16 +01:00
renovate[bot]
f99a3189d8
Update K8s constrained versions ( #799 )
...
* Update K8s constrained versions
* Update azure images to v1.26
* Revert upgrade for k8s v1.23
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 10:40:37 +01:00
Paul Meyer
66f2c446a4
versionsapi: replace shortname pkg
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 10:15:27 +01:00
Paul Meyer
f17b40b44a
versionsapi: fix shortPath implementation
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 10:15:27 +01:00
Otto Bittner
e7c7e35f51
cli: create backups for CRDs and their resources
...
These backups could be used in case an upgrade
misbehaves after helm declared it as successful.
The manual backups are required as helm-rollback
won't touch custom resources and changes to CRDs
delete resources of the old version.
2023-01-05 16:52:06 +01:00
Paul Meyer
afbd4a3dc1
deps: upgrade AWS cloud controller manager ( #863 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-05 16:35:19 +01:00
renovate[bot]
7eae68d4f9
Update Constellation containers
2023-01-05 15:43:11 +01:00
Leonard Cohnen
25c3a8a1f3
init: add cluster version to kubernetes components
2023-01-05 14:52:09 +01:00
renovate[bot]
9c71145862
Update K8s version independent containers to v0.0.35 ( #872 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-05 13:26:55 +01:00
renovate[bot]
cf3169cf44
Update Constellation containers ( #854 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-05 08:14:57 +01:00
Paul Meyer
f9458950cb
versionsapi: change image path ( #856 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 17:07:16 +01:00
Paul Meyer
053f4552d9
versionsapi: fix semver dependency
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 16:00:14 +01:00
Paul Meyer
3c24e3fa01
cli: move image package into cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
f19a90527b
cli: use versionsapi fetcher to fetch image ref
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
3561a16819
ci: replace add-version through versionsapi cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
d2d3a8e068
versionsapi: use read-only client
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
0011d960f7
versionsapi: implement rm cmd in cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
53cc63362f
versionsapi: implement list cmd in cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
777c9406fd
versionsapi: implement latest cmd in cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
5679c9d3de
versionsapi: create cli, implement add cmd
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
b3f251909c
versionsapi: implement Go client
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
9dbe6033f2
versionsapi: new fetcher implementation
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
3f00f89d55
versionsapi: new implementation
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
f43b653231
versionsapi: backup old API
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
renovate[bot]
324ef42c42
Update Constellation containers ( #852 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-03 12:30:07 +01:00
Paul Meyer
de6ee412ac
deps: update AWS cloud controller manager
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-03 12:14:16 +01:00
3u13r
f14af0c3eb
upgrade: support Kubernetes components ( #839 )
...
* upgrade: add Kubernetes components to NodeVersion
* update rfc
2023-01-03 12:09:53 +01:00
Leonard Cohnen
4b43311fbd
bump microservice versions
2023-01-03 11:51:29 +01:00
renovate[bot]
806f6b70dd
Update module github.com/talos-systems/talos/pkg/machinery to v1.3.1 ( #844 )
...
* Update module github.com/talos-systems/talos/pkg/machinery to v1.3.1
* Rename talos-systems/talos to siderolabs/talos
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-02 13:33:56 +01:00
3u13r
47fb9f7cc8
gcp: unofficial support for internal LBs ( #826 )
2022-12-28 13:30:39 +01:00
Moritz Sanft
9859b30c4d
AB#2544 add upgrade agent for automatic version updates ( #745 )
2022-12-25 18:49:45 +01:00
Paul Meyer
8b39d3d368
versionsapi: fix cache invalidation
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-23 10:15:42 +01:00
Otto Bittner
efcd0337b4
Microservice upgrades ( #729 )
...
Run with: constellation upgrade execute --helm.
This will only upgrade the helm charts. No config is needed.
Upgrades are implemented via helm's upgrade action, i.e. they
automatically roll back if something goes wrong. Releases could
still be managed via helm, even after an upgrade with constellation
has been done.
Currently not user facing as CRD/CR backups are still in progress.
These backups should be automatically created and saved to the
user's disk as updates may delete CRs. This happens implicitly
through CRD upgrades, which are part of microservice upgrades.
2022-12-19 16:52:15 +01:00
renovate[bot]
8ddc8cdb65
Update dependency kubernetes-sigs/cri-tools to v1.26.0
2022-12-16 10:43:33 +01:00
renovate[bot]
7ffbad12be
Update Constellation containers to v2.3.0-pre.0.20221212170906-a77f38efbb31 ( #779 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-14 10:46:15 +01:00
Paul Meyer
c741ccfb4b
kubernetes: use new registry
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-13 16:08:19 +01:00
Paul Meyer
6862c2587f
kubernetes: add v1.26, default to v1.25
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-13 16:08:19 +01:00
Malte Poll
cf0b04291a
Embed measurements for v2.3.0
2022-12-12 17:45:35 +01:00
Malte Poll
d6b2e9ea9a
Expand PCR selection on AWS
2022-12-12 17:45:35 +01:00
Malte Poll
c3b657de01
Bump version to v2.3.0
2022-12-12 17:45:35 +01:00
renovate[bot]
5eae12778a
Update Constellation containers ( #777 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-12-09 18:45:09 +01:00
renovate[bot]
012f739c67
Update Constellation containers ( #759 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-09 16:32:58 +01:00
Malte Poll
4a8ebfd921
OS images: use "ref", "stream" and "version"
...
Switch azure default region to west us
Update find-image script to work with new API spec
Add version for every os image build
generate measurements: Use new API paths
CLI: config fetch measurements: Use image short versions to fetch measurements
CLI: allows shortnames to specify image in config
Image build pipeline: Change paths to contain "ref" and "stream"
2022-12-09 13:37:43 +01:00
Paul Meyer
4795fe9695
hack: create latest endpoint in add-version script
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-09 13:37:43 +01:00
Paul Meyer
f23a2fe073
hack: implement new api for add-version script
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-09 13:37:43 +01:00
renovate[bot]
72ba97efcc
Update K8s constrained versions ( #762 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-09 13:17:55 +01:00
Paul Meyer
9b1551e76a
dependencies: migrate go-genproto to google-cloud-go
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-08 13:27:15 +01:00
renovate[bot]
3435ac216f
Update Constellation containers ( #748 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-12-08 11:38:05 +01:00
Leonard Cohnen
a1161ae05d
k8supdates: label nodes with k8s component hash
2022-12-08 11:19:22 +01:00
renovate[bot]
bb9122f115
Update Constellation containers to v2.3.0-pre.0.20221207104854-286803fb97a0 ( #747 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-12-07 15:12:04 +01:00
Moritz Sanft
286803fb97
AB#2579 Add constellation iam create command ( #624 )
2022-12-07 11:48:54 +01:00
renovate[bot]
be01cf7129
Update Constellation containers to v2.3.0-pre.0.20221206170532-a9ed8c0191ac ( #733 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-07 10:44:45 +01:00
Paul Meyer
cb734a2e66
debugd: pin logcollector container digest
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-06 18:05:32 +01:00
renovate[bot]
1766f0e4b3
Update Constellation containers to v2.3.0-pre.0.20221205155634-0981ab6fa45b ( #725 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-06 13:29:54 +01:00
renovate[bot]
0981ab6fa4
Update Constellation containers to v2.3.0-pre.0.20221205121645-176dae317f6c ( #719 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-05 16:56:34 +01:00
Paul Meyer
176dae317f
debugd: fix logcollector container image naming
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-05 13:16:45 +01:00
Paul Meyer
226a6b6626
debugd: let renovate manage logcollector images
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-02 18:54:24 +01:00
Paul Meyer
8c5fc7a890
versionsapi: allow debug stream
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-02 18:49:17 +01:00
Paul Meyer
9c9c8e3d46
versionsapi: rename package
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-02 18:49:17 +01:00
renovate[bot]
3c62b841ed
Update Constellation containers ( #705 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-02 18:48:03 +01:00
Leonard Cohnen
0c71cc77f6
joinservice: use configmap for k8s components
2022-12-02 14:34:38 +01:00
renovate[bot]
de77f1d9be
Update ghcr.io/edgelesssys/constellation/qemu-metadata-api Docker tag to v2.3.0-pre.0.20221201105133-8004edcc144d ( #700 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-01 18:49:02 +01:00
Paul Meyer
8004edcc14
image: add version and debug field to lookup table ( #682 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-01 11:51:33 +01:00
Malte Poll
e67f65709f
Prepare release checklist for v2.3 ( #690 )
2022-12-01 10:46:04 +01:00
renovate[bot]
da114519ca
Update Constellation containers ( #693 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-12-01 08:07:09 +01:00
Leonard Cohnen
7e57944cc0
versions: bump qemu metadata image
2022-11-30 18:58:22 +01:00
renovate[bot]
016f7a67c2
Update Constellation containers to v2.3.0-pre.0.20221130104839-9537fb73c015 ( #684 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-11-30 16:53:58 +01:00
Malte Poll
85d723ccbd
Change path for version API:
...
- Rename "updates" -> "versions"
- Add explicit "stream" in path to make API self-describing
2022-11-30 16:36:12 +01:00
Paul Meyer
b93b24e058
debugd: add logcollector
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-11-30 16:26:25 +01:00
Malte Poll
9537fb73c0
use constants for default CDN paths
2022-11-30 12:35:12 +01:00
Malte Poll
3aa51df74d
Add release trigger to make image versions available via CDN
2022-11-30 12:35:12 +01:00
Malte Poll
9bccf26ccf
move update api
2022-11-30 12:35:12 +01:00
Malte Poll
ebf852b3ba
Add image update API and use for "upgrade plan"
2022-11-30 12:35:12 +01:00
Thomas Tendyck
21529d0e9e
don't promote Trusted Launch for now
2022-11-30 12:24:37 +01:00
renovate[bot]
8fbc4b9b19
Update ghcr.io/edgelesssys/constellation/node-operator Docker tag to v2.3.0-pre.0.20221129130129-a32f9ae75290 ( #671 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-11-30 11:34:57 +01:00
renovate[bot]
e2673cac29
Update Constellation containers ( #663 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-11-29 13:46:13 +01:00
Leonard Cohnen
3b6bc3b28f
initserver: add client verification
2022-11-28 19:34:02 +01:00
Thomas Tendyck
64f03cf675
config: sort measurements numerically ( #654 )
...
* config: sort measurements numerically
* add comment to swap
2022-11-28 11:09:39 +01:00
Daniel Weiße
d52f3db2a3
AB#2644 Fetch measurements from CDN ( #653 )
...
* Fetch measurements from CDN
* Perform metadata validation on fetched measurements
* Remove deprecated public bucket
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-28 10:27:33 +01:00
Leonard Cohnen
c978329839
helm: fix expected helm charts
2022-11-27 16:43:50 +01:00
Nils Hanke
878d66dcda
Remove SSHUsers and UserKey from config v2 ( #650 )
...
* Remove SSHUsers and UserKey as part of configVersion v2
* Add migration nodes to docs
* Update CHANGELOG.md
2022-11-25 15:27:34 +01:00
renovate[bot]
a3661d6c07
Update Constellation containers to v2.3.0-pre.0.20221125110824-89b25f8ebbd7 ( #652 )
...
* Update Constellation containers to v2.3.0-pre.0.20221125110824-89b25f8ebbd7
* Update node operator and add hashes back for every container image
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2022-11-25 15:17:58 +01:00
Nils Hanke
89b25f8ebb
Add new generate measurements matrix CI/CD action (now with AWS support) ( #641 )
2022-11-25 12:08:24 +01:00
Daniel Weiße
c2ea937fb5
Fix potential data race when accessing a validators OID ( #640 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-24 15:50:59 +01:00
renovate[bot]
0b85709dd2
Update Constellation containers to v2.3.0-pre.0.20221124095758-f8001efbc0d0
2022-11-24 13:52:44 +01:00
Daniel Weiße
f8001efbc0
Refactor enforced/expected PCRs ( #553 )
...
* Merge enforced and expected measurements
* Update measurement generation to new format
* Write expected measurements hex encoded by default
* Allow hex or base64 encoded expected measurements
* Allow hex or base64 encoded clusterID
* Allow security upgrades to warnOnly flag
* Upload signed measurements in JSON format
* Fetch measurements either from JSON or YAML
* Use yaml.v3 instead of yaml.v2
* Error on invalid enforced selection
* Add placeholder measurements to config
* Update e2e test to new measurement format
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-24 10:57:58 +01:00
renovate[bot]
8ce954e012
Update Constellation containers to v2.3.0-pre.0.20221123084142-3dc9c6086469 ( #636 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-11-24 09:22:49 +01:00
Malte Poll
1331c171c3
Upgrade config to v2
2022-11-23 15:47:46 +01:00
Malte Poll
575b6e93f6
CLI: use global image version field
...
- Restructure config by removing CSP-specific image references
- Add global image field
- Download image lookup table on create
- Download QEMU image on QEMU create
2022-11-23 15:47:46 +01:00
Leonard Cohnen
1e98b686b6
kubernetes: verify Kubernetes components
2022-11-23 10:48:03 +01:00
Otto Bittner
6b2d9d16f8
Remove obsolote revive comments
2022-11-23 08:35:12 +01:00
renovate[bot]
bc346805aa
Update Constellation containers to v2.3.0-pre.0.20221121163101-1362e40f53ad ( #615 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-11-22 12:39:50 +01:00
Otto Bittner
1362e40f53
Surpress argument-limit errors and add TODO. ( #603 )
2022-11-21 17:31:01 +01:00
renovate[bot]
a5aa820d8c
Update Constellation containers ( #602 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-11-21 11:23:06 +01:00
Otto Bittner
bdd9dd922b
AB#2589: Deploy operators via Helm ( #575 )
...
* Only deploy operators on GCP/Azure.
* cert-manager is now deployed by default (GCP/Azure)
* remove OLM
2022-11-21 10:35:40 +01:00
Malte Poll
74aabe86fa
Move PCR[8] -> PCR[12]
2022-11-18 10:37:45 +01:00
Fabian Kammel
56dccb77b4
Merge back changes from v2.2.2 release ( #580 )
...
* prepare v2.2.2 release and update release.md
* Updated QEMU measurements
* Terraform GCP: Always use the local account for resource creation (#571 )
* CoreOS is no longer used, change docs to OS.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2022-11-18 10:24:45 +01:00
Daniel Weiße
b966f57a2f
AB#2554 GCP CSI driver deployment ( #532 )
...
* Allow enabling/disabling of CSI driver through config
* Fix inconsistent namespace parsing
* Deploy GCP CSI driver on init
* Update invalid pod tolerations
* Add generate script for CSI charts
* Update generateCilium script
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-18 10:05:02 +01:00
Nils Hanke
4a2cba988c
Create separate Terraform workspace directory
2022-11-17 13:49:34 +01:00
Fabian Kammel
ca4764c466
Merge v2.2.1 changes back to main ( #563 )
...
* Bump version to v2.2.0
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Fix release detection in pipeline
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Update CHANGELOG for 2.2.1
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
* bump constellation versions to 2.2.1
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2022-11-16 11:13:10 +01:00
Fabian Kammel
bb76a4e4c8
AB#2512 Config secrets via env var & config refactoring ( #544 )
...
* refactor measurements to use consistent types and less byte pushing
* refactor: only rely on a single multierr dependency
* extend config creation with envar support
* document changes
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-11-15 15:40:49 +01:00
Leonard Cohnen
c51694a51a
kubernetes: add hashes to components
2022-11-15 11:07:46 +01:00
Daniel Weiße
5efe05d933
AB#2525 clean up unused code ( #504 )
...
* Rename Metadata->Cloud
* Remove unused methods, functions, and variables
* More privacy for testing stubs
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-15 10:31:55 +01:00
Daniel Weiße
f41c54e837
AB#2524 Refactor Azure metadata/cloud API ( #477 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-15 09:08:18 +01:00
renovate[bot]
df0c6159db
Update K8s constrained versions
2022-11-14 09:33:42 +01:00
Daniel Weiße
a07cab4b97
Update go-tpm dependency ( #533 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-14 09:02:56 +01:00
Fabian Kammel
b92b3772ca
Remove access manager ( #470 )
...
* remove access manager from code base
* document new node ssh workflow
* keep config backwards compatible
* slow down link checking to prevent http 429
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-11-11 08:44:36 +01:00
renovate[bot]
c6f4b2e1a0
Update Constellation containers to v2.3.0-pre.0.20221109145754-0d12e37c9699 ( #497 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-11-09 18:17:31 +01:00
Fabian Kammel
0d12e37c96
Document exported funcs,types,interfaces and enable check. ( #475 )
...
* Include EXC0014 and fix issues.
* Include EXC0012 and fix issues.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2022-11-09 15:57:54 +01:00
Daniel Weiße
c9873f2bfb
AB#2523 Refactor GCP metadata/cloud API ( #387 )
...
* Refactor GCP metadata/cloud API
* Remove cloud controller manager from metadata package
* Remove PublicIP
* Move shared cloud packages
* Remove dead code
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-09 14:43:48 +01:00
Leonard Cohnen
3c6d59ce7e
aws: don't flag release as debug images
2022-11-09 11:20:58 +01:00
Leonard Cohnen
97acdfa297
config: align pre-filled AWS measurements
2022-11-09 11:20:58 +01:00
Daniel Weiße
011f9c597d
Bring in changes from release branch ( #479 )
...
* Bump version to v2.2.0
* Update changelog
* Fix release detection in pipeline
* Fix PKI selection in pipeline
* Set enforced measurements for AWS
* Update default images
* Fix release docs
* Update mini-con defaults
* Fix measurements action
* Fix syft env variable naming
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-08 18:32:59 +01:00
renovate[bot]
9ecc92e35f
Update dependency kubernetes-sigs/cri-tools to v1.25.0 ( #458 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-11-04 17:38:52 +01:00
3u13r
4f4cd4cc67
bump verify image 20221104 ( #459 )
2022-11-04 13:56:19 +01:00
Leonard Cohnen
6fce8f77d3
join-service: bump image for AWS support
2022-11-03 16:44:54 +01:00
Otto Bittner
f164af29cf
AB#2583: deploy autoscaler via helm ( #438 )
2022-11-03 16:42:19 +01:00
Otto Bittner
0887bc540f
Fix invalid slice access in validateAk ( #437 )
2022-11-03 09:57:59 +01:00
Leonard Cohnen
1f9a788c21
aws: name instances for CCM
2022-11-02 23:29:04 +01:00
Leonard Cohnen
3aa0177333
join-service: add AWS attestation
2022-11-02 23:29:04 +01:00
Leonard Cohnen
b69d19c3d6
metadata: clarify networking variables
2022-11-02 23:29:04 +01:00
Leonard Cohnen
0430336fdf
metadata: implement GetLoadBalancerEndpoint for AWS
2022-11-02 23:29:04 +01:00
Leonard Cohnen
dd007f4772
metadata: move subnetCIDR to InstanceMetadata
2022-11-02 23:29:04 +01:00
Leonard Cohnen
d59dc82e56
qemu attestation: fix typos
2022-11-02 23:29:04 +01:00
Leonard Cohnen
f199b08068
attestation: make AWS TPM check use the correct region
2022-11-02 23:29:04 +01:00
renovate[bot]
302303f2ea
Update K8s constrained versions ( #428 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-11-02 13:28:41 +01:00
Daniel Weiße
55cfff034a
Remove PublicIP from QEMU metadata ( #396 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-11-02 12:56:16 +01:00
Leonard Cohnen
8f8236a491
bump verification service
2022-10-31 17:00:14 +01:00
renovate[bot]
116736a7b9
Update Constellation containers ( #402 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-10-31 11:00:36 +01:00
renovate[bot]
fd74ef754e
Update K8s version constrained containers (missing v1 prefix) ( #399 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-10-31 10:34:12 +01:00
Daniel Weiße
79f52e67cb
Update go-tpm-tools to fix AWS PCR selection ( #390 )
...
* Update go-tpm-tools to fix AWS PCR selection
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Ignore leaking glog go routine
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-28 17:57:24 +02:00
Malte Poll
caadd50056
Use renovate to update versions.go ( #388 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-10-28 15:01:58 +02:00
Nils Hanke
34f729ccd2
Case insensitive replace for every user input that could break azurerm
2022-10-27 11:35:14 +02:00
leongross
d457620941
AB#2458 AWS NitroTPM attestation ( #339 )
...
* add aws tpm attestation
* fix typos
* Fix return value issue
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2022-10-27 11:04:23 +02:00
Malte Poll
447f0bbf39
Add AWS CCM versions
2022-10-26 15:07:34 +02:00
Paul Meyer
c05b22f1dc
Remove dead code ( #373 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-10-26 10:29:28 +02:00
Malte Poll
c1e3231848
Preinstall kubelet systemd unit in OS images ( #365 )
2022-10-25 16:36:03 +02:00
Malte Poll
2d121d9243
Replace interface{} -> any ( #370 )
2022-10-25 15:51:23 +02:00
Daniel Weiße
6fe750f21b
Update operator image
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-25 08:41:42 +02:00
Daniel Weiße
b35b74b772
Use tags for UID and role parsing ( #242 )
...
* Apply tags to all applicable GCP resources
* Move GCP UID and role from VM metadata to labels
* Adjust Azure tags to be in line with GCP and AWS
* Dont rely on resource name to find resources
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-24 16:58:21 +02:00
Malte Poll
8ef1400810
Upgrade libvirt container image ( #348 )
2022-10-24 10:32:37 +02:00
Daniel Weiße
3ccde25584
Implement minimal feature support for bootstrapper on AWS ( #333 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-24 09:12:01 +02:00
Daniel Weiße
252a7226a9
Fix ordering of QEMU config values
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-21 16:19:00 +02:00
Nils Hanke
04c4cff9f6
AB#2436: Initial support for create/terminate AWS NitroTPM instances
...
* Add .DS_Store to .gitignore
* Add AWS to config / supported instance types
* Move AWS terraform skeleton to cli/internal/terraform
* Move currently unused IAM to hack/terraform/aws
* Print supported AWS instance types when AWS dev flag is set
* Block everything aTLS related (e.g. init, verify) until AWS attestation is available
* Create/Terminate AWS dev cluster when dev flag is set
* Restrict Nitro instances to NitroTPM supported specifically
* Pin zone for subnets
This is not great for HA, but for now we need to avoid the two subnets
ending up in different zones, causing the load balancer to not be able
to connect to the targets.
Should be replaced later with a better implementation that just uses
multiple subnets within the same region dynamically
based on # of nodes or similar.
* Add AWS/GCP to Terraform TestLoader unit test
* Add uid tag and create log group
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2022-10-21 12:24:18 +02:00
Otto Bittner
07f02a442c
Refactor Helm deployments ( #341 )
...
* Wrap KMS deployment in one main chart that
deploys all other services. Other services will follow.
* Use .tgz via helm-package as serialization format
* Change Release type to carry chart as byte slice
* Remove KMSConfig
* Use json-schema to validate values
* Extend release.md to mention updating helm charts
2022-10-21 12:01:28 +02:00
Malte Poll
743f5fa627
Remove all traces of CoreOS from the codebase
2022-10-21 11:04:25 +02:00
Malte Poll
3b6ee703f5
Move PCR indices for owner ID and cluster ID
2022-10-21 11:04:25 +02:00
Malte Poll
34367ea3cc
Create mkosi image build pipeline
2022-10-21 11:04:25 +02:00
renovate[bot]
8cf6189cf0
Update module github.com/fsnotify/fsnotify to v1.6.0 ( #325 )
...
* Update module github.com/fsnotify/fsnotify to v1.6.0
* [bot] Tidy all modules
* Use event.Has function
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
2022-10-20 10:16:20 +02:00
Otto Bittner
c6ccee1250
AB#2490: deploy KMS via Helm
...
* Bundle helm-install related code in speparate package
* Move cilium installation to new helm package
2022-10-18 13:33:37 +02:00
Daniel Weiße
623cb6cdb5
AB#2479 Implement AWS cloud logging ( #232 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-17 09:05:45 +02:00
Malte Poll
c16f5a976d
AB#2365 Upgrade k8s base deployments (add full support for k8s 1.25) ( #277 )
...
* Add container image release for CCM GCP v25.2.0
* Upgrade versions of kubernetes base components
2022-10-17 08:58:13 +02:00
Daniel Weiße
f068e50dee
Attestation logging ( #275 )
...
* Add section for checking joinservice logs
* Add logging for attestation validation
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-14 16:29:21 +02:00
katexochen
263c700e73
Update operator version
2022-10-13 16:38:35 +02:00
katexochen
4b2dd1317a
Normalize URIs for azurerm Terraform provider
2022-10-13 15:29:29 +02:00
katexochen
1556e239ca
Remove state file
2022-10-13 15:29:29 +02:00
katexochen
0d1fd8fb2a
Remove Azure client from CLI
2022-10-13 15:29:29 +02:00
katexochen
dbe9bf381c
Get instance role from tags on Azure
2022-10-13 15:29:29 +02:00
katexochen
75888e986e
Add role.FromString and more tolerance
2022-10-13 15:29:29 +02:00
Daniel Weiße
23afccb975
AB#2474 Implement List and Self method for AWS ( #229 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-12 13:40:38 +02:00
Fabian Kammel
57b8efd1ec
Improve measurements verification with Rekor ( #206 )
...
Fetched measurements are now verified using Rekor in addition to a signature check.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-10-11 13:57:52 +02:00
katexochen
6577ca6600
Bump enterprise image version
2022-10-10 13:43:15 +02:00
katexochen
87adf66708
Update qemu image
2022-10-10 13:43:15 +02:00
katexochen
eb340c1e1f
Build microservices on release branch
2022-10-10 13:43:15 +02:00
Daniel Weiße
0edae36e43
AB#2426 Mini Constellation ( #198 )
...
* Mini Constellation commands to quickly deploy a local Constellation cluster
* Download libvirt container image if not present locally
* Fix libvirt KVM permission issues by creating kvm group using host GID inside container
* Remove QEMU specific values from state file
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Nils Hanke <nils.hanke@outlook.com>
2022-10-07 09:38:43 +02:00
katexochen
4ccd96bf64
Pin container image hashes
2022-10-06 19:16:20 +02:00
katexochen
884c46179a
Bump konnectivity version
2022-10-06 19:16:20 +02:00
katexochen
bede530de7
Bump k8s versions
2022-10-06 19:16:20 +02:00
katexochen
9edfc2f6ba
Move k8s version window up
2022-10-06 19:16:20 +02:00
Fabian Kammel
369480a50b
Feat/revive ( #212 )
...
* enable revive as linter
* fix var-naming revive issues
* fix blank-imports revive issues
* fix receiver-naming revive issues
* fix exported revive issues
* fix indent-error-flow revive issues
* fix unexported-return revive issues
* fix indent-error-flow revive issues
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-10-05 15:02:46 +02:00
Daniel Weiße
2ea695896f
AB#2439 Containerized libvirt ( #191 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-05 09:11:30 +02:00
Daniel Weiße
acdcb535c0
AB#2444 Verify Azure trusted launch attestation keys ( #203 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-10-04 16:44:44 +02:00
katexochen
a60e76e91f
Upgrade operator version
2022-09-30 17:51:49 +02:00
katexochen
ccbc3d9123
Remove exposure of qemu ip_range_start value
2022-09-30 16:50:52 +02:00
katexochen
feffe40987
Remove GCP client from CLI
2022-09-30 16:50:52 +02:00
katexochen
42f273611a
Use uid from metadata instead of name
2022-09-30 16:50:52 +02:00
Felix Schuster
eabc433b68
Fix typo
2022-09-29 16:37:52 +02:00
Fabian Kammel
dfa4dd9b85
delete unused config test ( #202 )
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-09-28 16:31:00 +02:00
Felix Schuster
a6d201b761
Make wording around license less verbose
2022-09-27 11:24:01 +02:00
Daniel Weiße
804c173d52
Use terraform in CLI to create QEMU cluster ( #172 )
...
* Use terraform in CLI to create QEMU cluster
* Dont allow qemu creation on os/arch other than linux/amd64
* Allow usage of --name flag for QEMU resources
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-09-26 15:52:31 +02:00
Daniel Weiße
30f0554168
AB#2262 Automatic recovery ( #158 )
...
* Update `constellation recover` to be fully automated
* Update recovery docs
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-09-26 09:57:40 +02:00
katexochen
ba6e41ed5c
Upgrade go module to v2
2022-09-22 09:10:19 +02:00
katexochen
6401c345f0
Upgrade node operator
2022-09-20 14:41:54 +02:00
katexochen
88d200232a
Remove autoscaling from CLI and bootstrapper
2022-09-20 13:41:23 +02:00
Thomas Tendyck
3d50869ed6
only use test action in license integration test
2022-09-19 12:22:06 +02:00
Daniel Weiße
e367e1a68b
AB#2261 Add loadbalancer for control-plane recovery ( #151 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-09-14 13:25:42 +02:00
Leonard Cohnen
2a6c5df7cc
fix waiting on gcp load balancer
2022-09-13 11:06:44 +02:00
Leonard Cohnen
2d8f2af91b
prepare release v2.0.0
2022-09-12 19:03:01 +02:00
Nils Hanke
25b769d1e2
Remove obsolete tpmPath passed to OpenTPM
2022-09-12 14:38:10 +02:00
Thomas Tendyck
c41018ed32
license messages ( #118 )
...
* license: tell the user whether file couldn't be found or there was another error
* license: print correct info for community license
2022-09-12 13:38:50 +02:00
Thomas Tendyck
ab45d5fbfe
tidy config
2022-09-12 08:49:51 +02:00
Nils Hanke
c51dec6d00
Use distroless images for JoinService & KMS
2022-09-09 18:11:33 +02:00
Malte Poll
b8b169c93d
Bump node-operator ( #114 )
2022-09-09 17:33:55 +02:00
Leonard Cohnen
7163c161b6
Deploy Konnectivity
2022-09-09 17:26:02 +02:00
Thomas Tendyck
a85777fd02
enforce pcr4
2022-09-08 17:34:12 +02:00
Nils Hanke
7aded65ea8
Add validation for zero or more than one provider
2022-09-08 13:38:24 +02:00
Moritz Eckert
fb5faa681c
Add provider to license check ( #88 )
2022-09-08 11:02:04 +02:00
Otto Bittner
611ec25f22
AB#2380: Add unittest for validateAk
...
Signed-off-by: Otto Bittner <cobittner@posteo.net>
2022-09-07 13:59:09 +02:00
Nils Hanke
fe70231f2a
Rename IsImageDebug -> IsDebugImage for consistency
2022-09-07 13:27:15 +02:00
Nils Hanke
1a4b4f564a
Remove firewall configuration and make it static with a debug flag
2022-09-07 13:27:15 +02:00
Otto Bittner
23bf4aa665
AB#2379: Validate version in SNP report ( #80 )
...
* AB#2379: Validate version in SNP report
* Check that TCB version in VCEK matches COMMITTED_TCB
* Check that LAUNCH, CURRENT and REPORTED TCB are at least
at the same security level as we are currently.
* Rename variables in snpReport struct
* Use default values in validator_test.go
Signed-off-by: Otto Bittner <cobittner@posteo.net>
2022-09-07 10:39:38 +02:00
Malte Poll
50acded80b
Bump join service ( #79 )
2022-09-05 17:23:11 +02:00
Malte Poll
c1185241bb
temporarily upgrade join-service
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-09-05 16:57:28 +02:00
Malte Poll
c38a142d64
Kubernetes 1.25 preview
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-09-05 16:57:28 +02:00
Malte Poll
571b4ff36f
Switch default Kubernetes version 1.24 -> 1.23
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-09-05 16:57:28 +02:00
Malte Poll
57e77ee53f
kubernetes version: rename latest -> default
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-09-05 16:57:28 +02:00
Otto Bittner
1b810da331
Bump service versions.
...
Signed-off-by: Otto Bittner <cobittner@posteo.net>
2022-09-05 12:46:40 +02:00
Otto Bittner
405db3286e
AB#2386: TrustedLaunch support for azure attestation
...
* There are now two attestation packages on azure.
The issuer on the server side is created base on successfully
querying the idkeydigest from the TPM. Fallback on err: Trusted Launch.
* The bootstrapper's issuer choice is validated by the CLI's validator,
which is created based on the local config.
* Add "azureCVM" field to new "internal-config" cm.
This field is populated by the bootstrapper.
* Group attestation OIDs by CSP (#42 )
* Bootstrapper now uses IssuerWrapper type to pass
the issuer (and some context info) to the initserver.
* Introduce VMType package akin to cloudprovider. Used by
IssuerWrapper.
* Extend unittests.
* Remove CSP specific attestation integration tests
Co-authored-by: <dw@edgeless.systems>
Signed-off-by: Otto Bittner <cobittner@posteo.net>
2022-09-05 12:03:48 +02:00
Thomas Tendyck
bd63aa3c6b
add license headers
...
sed -i '1i/*\nCopyright (c) Edgeless Systems GmbH\n\nSPDX-License-Identifier: AGPL-3.0-only\n*/\n' `grep -rL --include='*.go' 'DO NOT EDIT'`
gofumpt -w .
2022-09-05 09:17:25 +02:00
Fabian Kammel
106635a9ee
Restructure config docs ( #44 )
...
* more guided UX when generating and filling in config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-09-02 17:11:06 +02:00
Nils Hanke
0aefe2c0ba
Move instanceType from CLI to config
2022-09-02 07:04:11 -07:00
Otto Bittner
50d3f3ca7f
GetIdKeyDigest: Cut HCL header from raw report
2022-09-02 11:21:35 +02:00
Fabian Kammel
6440904865
Ref/update cosign key ( #31 )
...
* use new cosign keypair
* use community images for production image heuristic
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-09-01 12:58:31 +02:00