constellation

mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-30 18:06:14 -05:00

Author	SHA1	Message	Date
renovate[bot]	050db3a5d8	deps: update github.com/thomasten/go-tpm digest to f43f8e2 (#2048 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems>	2023-07-07 13:17:58 +02:00
edgelessci	b71d5cdc17	image: update measurements and image version (#2054 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-07-07 08:13:54 +02:00
renovate[bot]	ee8ab6d2e0	deps: update Kubernetes versions (#2023 ) Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-07-06 11:20:38 +02:00
Thomas Tendyck	274fed0990	cli: fix/improve some user-facing strings	2023-07-06 09:05:17 +02:00
edgelessci	37288deacf	image: update measurements and image version (#2019 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-07-05 08:32:25 +02:00
renovate[bot]	ba410186f6	deps: update ghcr.io/edgelesssys/gcp-guest-agent Docker tag to v20230628 (#2002 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-07-04 14:17:05 +02:00
Adrian Stobbe	e72ec60d13	config: iam create aws check zone contains availability zone (#1913 ) * init * make zone flag mandatory again * add info about zone update + refactor * add comment in docs about zone update * Update cli/internal/cmd/iamcreate_test.go Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * thomas feedback * add format check to config validation * remove TODO * Update docs/docs/workflows/config.md Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * thomas nit --------- Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>	2023-07-04 13:55:52 +02:00
Paul Meyer	25a038dfad	versions: update gcp-guest-agent version format Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-07-04 13:23:33 +02:00
Malte Poll	66f1333c31	terraform: use single zone loadbalancer frontend on AWS (#1983 ) This change is required to ensure we have not tls handshake errors when connecting to the kubernetes api. Currently, the certificates used by kube-apiserver pods contain a SAN field with the (single) public ip of the loadbalancer. If we would allow multiple loadbalancer frontend ips, we could encounter cases where the certificate is only valid for one public ip, while we try to connect to a different ip. To prevent this, we consciously disable support for the multi-zone loadbalancer frontend on AWS for now. This will be re-enabled in the future.	2023-06-30 16:56:31 +02:00
Daniel Weiße	d95ddd01d3	helm: fix upgrade command unintentionally skipping all service upgrades (#1992 ) * Fix usage of errors.As in upgrade command implementation * Use struct pointers when working with custom errors --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-06-30 16:46:05 +02:00
Daniel Weiße	5a9f9c0a52	bootstraper: delete helm chart on installation failure before retrying installation (#1977 ) * Delete helm chart on failure before retrying installation * Add chart name to debug output * Remove now unused wait flag from helm Release struct --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-06-30 15:13:29 +02:00
edgelessci	05c43137e4	image: update measurements and image version (#1988 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-06-30 08:48:38 +02:00
Moritz Sanft	7ad284d672	cli: deploy aws csi driver per default (#1981 ) * add aws csi driver helm chart * update chart * add CSI driver to Constellation default deployment * generate config doc * update buildfiles * use upstream chart * update buildfile * set `DeployCSIDriver` in default config * fix helm test * whitespace	2023-06-30 08:46:32 +02:00
Malte Poll	f64e44a438	aws: support LBs in multiple zones when retrieving metadata	2023-06-28 18:13:01 +02:00
Adrian Stobbe	161bb37cba	config: improve usage and meaning of validate (#1975 ) * discuss miniup config.Default() usage + discourage usage for Default() in comment * Update internal/config/config_test.go Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * add enterprise version check for config.Default * split config comment lines * daniel feedback * featureset.CanUseEmbeddedMeasurmentsAndImage --------- Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>	2023-06-28 10:28:48 +02:00
Adrian Stobbe	1edbe962c1	cli: fail fast when CLI and Constellation versions don't match (#1972 ) * fail on version mismatch * rename to validateCLIandConstellationVersionAreEqual * fix test * image version must only be major,minor patch equal (ignore suffix) * add version support doc * fix: do not check patch version equality for image and cli * skip validate on force	2023-06-27 18:24:35 +02:00
Otto Bittner	0a36ce6171	config: validate instance type for aws SNP based on attestation variant (#1963 ) * config: validate instance type for aws SNP * apply suggestions	2023-06-26 17:05:12 +02:00
Thomas Tendyck	46e144d19b	Use term "attestation variant" consistently	2023-06-26 08:54:11 +02:00
Daniel Weiße	e139eff552	fix: small formating/spelling issues (#1965 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-06-26 08:34:37 +02:00
Otto Bittner	3a7bb52560	attestation: docs and config changes for SNP attestation (#1959 ) * docs: describe SEV-SNP support on AWS * config: remove launchMeasurement awsSEVSNP attestation config should not have this value. It doesn't have a function yet.	2023-06-23 15:38:24 +02:00
Otto Bittner	7388240943	Revert "attestation: add SNP-based attestation for aws-sev-snp (#1916 )" (#1957 ) This reverts commit `c7d12055d1`.	2023-06-22 17:08:44 +02:00
Adrian Stobbe	487fa1e397	terraform: azure node groups (#1955 ) * init * migration working * make tf variables with default value optional in go through ptr type * fix CI build * pr feedback * add azure targets tf * skip migration for empty targets * make instance_count optional * change role naming to dashed + add validation * make node_group.zones optional * Update cli/internal/terraform/terraform/azure/main.tf Co-authored-by: Malte Poll <1780588+malt3@users.noreply.github.com> * malte feedback --------- Co-authored-by: Malte Poll <1780588+malt3@users.noreply.github.com>	2023-06-22 16:53:40 +02:00
Otto Bittner	c7d12055d1	attestation: add SNP-based attestation for aws-sev-snp (#1916 ) * config: move AMD root key to global constant * attestation: add SNP based attestation for aws * Always enable SNP, regardless of attestation type. * Make AWSNitroTPM default again There exists a bug in AWS SNP implementation where sometimes a host might not be able to produce valid SNP reports. Since we have to wait for AWS to fix this we are merging SNP attestation as opt-in feature.	2023-06-21 14:19:55 +02:00
renovate[bot]	e5bcd36a23	deps: update K8s constrained Azure versions (#1907 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-06-20 12:55:47 +02:00
Malte Poll	0b262a08bc	cloud: fix discovery of GCP nodes across multiple zones (#1943 )	2023-06-20 12:02:31 +02:00
Adrian Stobbe	be4a636361	cli: improve user warning / information (#1933 ) * print success * warn when debug img but !debugCluster * malte feedback * rename to IsNamedLikeDebugImage	2023-06-19 16:51:39 +02:00
renovate[bot]	4908b5f63c	deps: update golangci/golangci-lint to v1.53.2 (#1924 ) * deps: update golangci/golangci-lint to v1.53.2 * deps: tidy all modules * attestation: silence linter warning --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: edgelessci <edgelessci@users.noreply.github.com> Co-authored-by: Malte Poll <mp@edgeless.systems>	2023-06-16 09:40:08 +02:00
edgelessci	a717cefc26	image: update measurements and image version (#1939 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-06-16 08:27:45 +02:00
Adrian Stobbe	07de6482b2	config: drop support for deprecated Azure's service principal authentication (#1906 ) * invalidate app client id field for azure and provide info * remove TestNewWithDefaultOptions case * fix test * remove appClientID field * remove client secret + rename err * remove from docs * otto feedback * update docs * delete env test in cfg since no envs set anymore * Update dev-docs/workflows/github-actions.md Co-authored-by: Otto Bittner <cobittner@posteo.net> * WARNING to stderr * fix check --------- Co-authored-by: Otto Bittner <cobittner@posteo.net>	2023-06-14 17:50:57 +02:00
Adrian Stobbe	c5f75513b1	fix: Azure SEV-SNP version always gets overwritten by latest API versions (#1930 ) * fix that manual version gets overwritten by latest * put azure in seperate config file * otto feedback	2023-06-14 14:17:52 +02:00
edgelessci	8910e9bac4	image: update measurements and image version (#1927 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-06-14 08:31:30 +02:00
3u13r	a2c98eb1d5	Correctly deploy the AWS CCM (#1853 ) * aws: stop using the imds api for tags * aws: disable tags in imds api * aws: only tag instances with non-lecagy tag * bootstrapper: always let coredns run before cilium * debugd: make debugd less noisy * fixup fix aws imds test * fixup unsued context * move getting instance id to readInstanceTag	2023-06-13 09:58:39 +02:00
Adrian Stobbe	4f63481b7d	config: fix fetcher parse azure sev-snp version (#1911 )	2023-06-12 16:04:54 +02:00
Adrian Stobbe	e738f15f0f	cdbg: make endpoint deployment failure more transparent (#1883 ) * add retry + timeout + intercept grpc logs * LogStateChanges inside grplog pkg * remove retry and tj/assert * rename nit * Update debugd/internal/cdbg/cmd/deploy.go Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> * Update debugd/internal/cdbg/cmd/deploy.go Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> * paul feedback * return waitFn instead of WaitGroup * Revert "return waitFn instead of WaitGroup" This reverts commit 45700f30e341ce3af509b687febbc0125f7ddb38. * log routine inside debugd constructor * test doubles names * Update debugd/internal/cdbg/cmd/deploy.go Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> * fix newDebugClient closeFn --------- Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-06-12 13:45:34 +02:00
Otto Bittner	8f21972aec	attestation: add `awsSEVSNP` as new variant (#1900 ) * variant: move into internal/attestation * attesation: move aws attesation into subfolder nitrotpm * config: add aws-sev-snp variant * cli: add tf option to enable AWS SNP For now the implementations in aws/nitrotpm and aws/snp are identical. They both contain the aws/nitrotpm impl. A separate commit will add the actual attestation logic.	2023-06-09 15:41:02 +02:00
Adrian Stobbe	3fde118b33	config: enable azure snp version fetcher again + minimum age for latest version (#1899 ) * fetch latest version when older than 2 weeks * extend hack upload tool to pass an upload date * Revert "config: disable user-facing version Azure SEV SNP fetch for v2.8 (#1882)" This reverts commit `c7b22d314a`. * fix tests * use NewAzureSEVSNPVersionList for type guarantees * Revert "use NewAzureSEVSNPVersionList for type guarantees" This reverts commit 942566453f4b4a2b6dc16f8689248abf1dc47db4. * assure list is sorted * improve root.go style * daniel feedback	2023-06-09 12:48:12 +02:00
Moritz Eckert	9463d6fb27	cli: fix azure config warning message (#1902 )	2023-06-09 11:16:54 +02:00
Adrian Stobbe	4284f892ce	api: rename /api/versions to versionsapi and /api/attestationcfig to attestationconfigapi (#1876 ) * rename to attestationconfigapi + put client and fetcher inside pkg * rename api/version to versionsapi and put fetcher + client inside pkg * rename AttestationConfigAPIFetcher to Fetcher	2023-06-07 16:16:32 +02:00
Adrian Stobbe	c7b22d314a	config: disable user-facing version Azure SEV SNP fetch for v2.8 (#1882 ) * config: disable user-facing version fetch for Azure SEV SNP don't allow "latest" value and disable user-facing version fetcher for Azure SEV SNP Co-authored-by: @derpsteb * fix unittests * attestation: getTrustedKey --------- Co-authored-by: Otto Bittner <cobittner@posteo.net>	2023-06-06 10:44:13 +02:00
Malte Poll	f7f11c32f8	image: choose unique AWS image names based on the attestation variant (#1868 )	2023-06-06 08:35:26 +02:00
Adrian Stobbe	99a88c033c	api: use new signature JSON format (#1872 ) * use new impl for client.UploadAzureSEVSNP * fix: fetcher must parse new signature format * version-file is not persistentflag * fix fetcher tests	2023-06-05 16:10:44 +02:00
Otto Bittner	fa01569cc6	staticupload: don't request empty invalidation (#1870 ) If no files have been touched, do not initiate an invalidation.	2023-06-05 15:47:33 +02:00
Otto Bittner	06cd750345	config: move all config types into file config.go (#1878 ) docgen only includes doc comments from one single file in it's output. Therefore all config types need to be located in config.go	2023-06-05 15:46:55 +02:00
Adrian Stobbe	c446f36b0f	config: Azure SNP tool can delete specific version from attestation API (#1863 ) * client supports delete version * rename to new attestation / fetcher naming * add delete command to upload tool * test client delete * bazel update * use general client in attestation client * Update hack/configapi/cmd/delete.go Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * daniel feedback * unit test azure sev upload * Update hack/configapi/cmd/delete.go Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * add client integration test * new client cmds use apiObject --------- Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>	2023-06-05 12:33:22 +02:00
Otto Bittner	315b6c2f01	api: use correct error types in versions/cli (#1867 ) Imported wrong error types during refactoring.	2023-06-05 10:51:05 +02:00
Otto Bittner	6bda62d397	cli: skip k8s upgrade in case of outdated version (#1864 ) If an unsupported, outdated k8s patch version is used, the user should still be able to run upgrade apply.	2023-06-05 09:13:02 +02:00
edgelessci	b2527d314e	image: update measurements and image version (#1861 ) Co-authored-by: malt3 <malt3@users.noreply.github.com>	2023-06-02 16:06:34 +02:00
Adrian Stobbe	a813760f96	config: automatically upload new Azure SNP versions to API + sign version with release key (#1854 ) * sign version with release key and remove version from fetcher interface * extend azure-reporter GH action to upload updated version values to the Attestation API	2023-06-02 12:10:22 +02:00
Malte Poll	e1d3afe8d4	ci: use aws s3 client that invalidates cloudfront cache for places that modify Constellation api (#1839 )	2023-06-02 11:20:01 +02:00
edgelessci	7ef7f09dda	image: update measurements and image version (#1855 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-06-02 10:13:22 +02:00
Otto Bittner	30f2b332b3	api: restructure api pkg (#1851 ) * api: rename AttestationVersionRepo to Client * api: move client into separate subpkg for clearer import paths. * api: rename configapi -> attestationconfig * api: rename versionsapi -> versions * api: rename sut to client * api: split versionsapi client and make it public * api: split versionapi fetcher and make it public * config: move attestationversion type to config * api: fix attestationconfig client test Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>	2023-06-02 09:19:23 +02:00
Adrian Stobbe	b51cc52945	config: sign Azure versions on upload & verify on fetch (#1836 ) * add SignContent() + integrate into configAPI * use static client for upload versions tool; fix staticupload calleeReference bug * use version to get proper cosign pub key. * mock fetcher in CLI tests * only provide config.New constructor with fetcher Co-authored-by: Otto Bittner <cobittner@posteo.net> Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>	2023-06-01 13:55:46 +02:00
3u13r	e0285c122e	todo responsibilities and cleanup (#1837 ) * chore: add TODO responsibilities * chore: remove not needed TODOs * chore: remove outdated migrations * chore: remove resolved goleak exception * chore: remove not needed cosign env * config: add link to our Azure snp docs	2023-06-01 12:33:06 +02:00
edgelessci	13ffb93ad8	image: update measurements and image version (#1840 ) Co-authored-by: malt3 <malt3@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-06-01 10:45:25 +02:00
Malte Poll	c5e016a8e2	attestation: allow measurement generator to work regardless of build tags	2023-05-31 14:00:00 +02:00
Malte Poll	8a851c8f39	cli: dynamically select signature validation pubkey for release and pre-release artifacts	2023-05-31 14:00:00 +02:00
renovate[bot]	ada66a64a1	deps: update Kubernetes versions (#1807 ) Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-05-30 16:36:07 +02:00
renovate[bot]	b041344331	deps: update registry.k8s.io/autoscaling/cluster-autoscaler Docker tag to v1.27.2 (#1831 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-05-30 15:10:51 +02:00
renovate[bot]	c50c5e69d9	deps: update K8s constrained Azure versions (#1787 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-05-30 14:36:37 +02:00
Malte Poll	29b93065b3	ci: static file uploader with automatic cache invalidation (#1833 )	2023-05-30 13:48:29 +02:00
miampf	8686c5e7e2	bootstrapper: collect journald logs on failure (#1618 )	2023-05-30 11:47:36 +00:00
Moritz Sanft	6d5e7e1f7c	cli: support StackIT provider on config generate (#1803 ) * support stackit provider on config generate * update cli reference * default config values * deploy csi driver Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com> --------- Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>	2023-05-30 09:02:50 +02:00
Moritz Sanft	a0dea7e69b	make imagefetcher visible to all subpackages (#1832 )	2023-05-26 12:05:02 +02:00
3u13r	661f084ffa	cli: use uami for in-cluter authentication (#1820 )	2023-05-26 11:45:03 +02:00
renovate[bot]	9502bc8ff4	deps: update K8s constrained GCP versions (#1829 ) * deps: update K8s constrained GCP versions * deps: bump autoscaler image to 1.27 --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-05-26 11:24:12 +02:00
Adrian Stobbe	0a6e5ec02e	config: dynamic attestation configuration through S3 backed API (#1808 )	2023-05-25 17:43:44 +01:00
Malte Poll	217a744606	image: add go code to upload image info and measurements	2023-05-25 15:01:15 +02:00
Malte Poll	b8751f35f9	image: add intermediate "image" verb to upload tool	2023-05-25 15:01:15 +02:00
Malte Poll	0a7349ca41	attestation: merging of ImageMeasurementsV2	2023-05-25 15:01:15 +02:00
Malte Poll	874c4b76cf	versionsapi: merging of ImageInfo	2023-05-25 15:01:15 +02:00
Malte Poll	d0e53cbb59	cli: image info (v2)	2023-05-25 15:01:15 +02:00
Malte Poll	cd7b116794	cli: image measurements (v2)	2023-05-25 15:01:15 +02:00
Malte Poll	e5b394db87	cli: image measurements (v2)	2023-05-25 15:01:15 +02:00
Malte Poll	9a1ee8697e	osimage: advertise SEV SNP support for gcp images	2023-05-25 15:01:15 +02:00
Leonard Cohnen	c98644df2b	ci: use bazel for unittests	2023-05-23 15:11:10 +02:00
Malte Poll	c1dbbf34c3	cryptsetup: Provide implementation without cgo	2023-05-23 13:44:56 +02:00
renovate[bot]	66ff0b0b78	deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.27.1 (#1754 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-05-23 13:30:38 +02:00
3u13r	6062b10035	cli: split image into oss and enterprise (#1788 )	2023-05-23 10:49:47 +02:00
Adrian Stobbe	cfef384f36	config: support latest as version value for Azure SEVSNP (#1786 ) * support latest as version value	2023-05-23 08:55:49 +01:00
Moritz Sanft	c69e6777bd	cli: Terraform migrations on upgrade (#1685 ) * add terraform planning * overwrite terraform files in upgrade workspace * Revert "overwrite terraform files in upgrade workspace" This reverts commit 8bdacfb8bef23ef2cdbdb06bad0855b3bbc42df0. * prepare terraform workspace * test upgrade integration * print upgrade abort * rename plan file * write output to file * add show plan test * add upgrade tf workdir * fix workspace preparing * squash to 1 command * test * bazel build * plan test * register flag manually * bazel tidy * fix linter * remove MAA variable * fix workdir * accept tf variables * variable fetching * fix resource indices * accept Terraform targets * refactor upgrade command * Terraform migration apply unit test * pass down image fetcher to test * use new flags in e2e test * move file name to constant * update buildfiles * fix version constant * conditionally create MAA * move interface down * upgrade dir * update buildfiles * fix interface * fix createMAA check * fix imports * update buildfiles * wip: workspace backup * copy utils * backup upgrade workspace * remove debug print * replace old state after upgrade * check if flag exists * prepare test workspace * remove prefix Co-authored-by: Otto Bittner <cobittner@posteo.net> * respect file permissions * refactor tf upgrader * check workspace before upgrades * remove temp upgrade dir after completion * clean up workspace after abortion * fix upgrade apply test * fix linter --------- Co-authored-by: Otto Bittner <cobittner@posteo.net>	2023-05-22 13:31:20 +02:00
edgelessci	87b9d85669	image: update measurements and image version (#1798 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-05-19 18:17:53 +02:00
edgelessci	2754d7817d	image: update measurements and image version (#1795 ) Co-authored-by: 3u13r <3u13r@users.noreply.github.com>	2023-05-17 19:39:32 +02:00
Adrian Stobbe	f99e06b63b	cli: new flag to set the attestation type for `config generate` (#1769 ) * add attestation flag to specify type in config	2023-05-17 16:53:56 +02:00
Moritz Eckert	6252193879	cli: deploy cinder as OpenStack CSI plugin	2023-05-17 15:20:39 +02:00
Daniel Weiße	1d5af5f0f4	Rebase fixes Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-05-17 11:37:26 +02:00
Nils Hanke	e80474ff7f	oid: add missing String() for QEMUTDX	2023-05-17 11:37:26 +02:00
Daniel Weiße	c478df36fa	Add TDX bazel files Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-05-17 11:37:26 +02:00
Nils Hanke	9e987778e0	measurements: Add length field for WithAllBytes	2023-05-17 11:37:26 +02:00
Nils Hanke	fe3622d982	cli/attestation: use const for PCR/TDX lengths	2023-05-17 11:37:26 +02:00
Daniel Weiße	dd2da25ebe	attestation: tdx issuer/validator (#1265 ) * Add TDX validator * Add TDX issuer --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-05-17 11:37:26 +02:00
renovate[bot]	230ea79bcc	deps: update Google SDK (#1748 ) * deps: update Google SDK * deps: fix grpc_testing import * deps: update pseudo version tool hashes --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-05-16 18:13:17 +02:00
Malte Poll	f596a13188	image: include stream in gcp image name (#1768 )	2023-05-16 12:38:38 +02:00
Daniel Weiße	c834911be1	config: fix migration for v2.7 idkeydigest enforcement format (#1770 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-05-16 10:32:01 +02:00
edgelessci	f30e0c9bdd	image: update measurements and image version (#1756 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-05-12 18:51:47 +02:00
renovate[bot]	a1fddd312c	deps: update K8s constrained GCP versions (#1565 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-05-05 14:30:48 +02:00
renovate[bot]	5301534aee	deps: update K8s constrained Azure versions (#1687 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-05-05 13:58:50 +02:00
Paul Meyer	30cd024076	deps: add Kubernetes v1.27, remove Kubernetes v1.24 (#1669 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-05-05 13:22:53 +02:00
Paul Meyer	b48866a756	ci: fix measurement generation on scheduled build (#1741 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-05-05 13:13:51 +02:00
Malte Poll	653bf3621d	image: replicate AWS images to eu-west-1 and eu-west-3	2023-05-05 12:06:44 +02:00
Malte Poll	ad8a3eec4a	versionsapi: increase cloudfront cache invalidation timeout	2023-05-05 12:06:44 +02:00
Malte Poll	ee91d8b1cc	image: implement idempotent upload of os images	2023-05-05 12:06:44 +02:00
Malte Poll	56635c3993	cli: deploy yawol as OpenStack loadbalancer	2023-05-03 21:45:59 +02:00
Daniel Weiße	d7a2ddd939	config: add separate option for handling attestation parameters (#1623 ) * Add attestation options to config * Add join-config migration path for clusters with old measurement format * Always create MAA provider for Azure SNP clusters * Remove confidential VM option from provider in favor of attestation options * cli: add config migrate command to handle config migration (#1678) --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-05-03 11:11:53 +02:00
renovate[bot]	e9103cad0a	deps: update Constellation containers to v2.7.0-pre.0.20230405123345-6bf3c63115a5 (#1563 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-05-02 15:04:31 +02:00
edgelessci	1ea060e873	image: update measurements and image version (#1700 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-04-28 08:02:19 +02:00
renovate[bot]	84c7550f37	deps: update Kubernetes versions (#1688 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-04-27 18:04:01 +02:00
3u13r	1bdf410b52	bazel: allow custom container_prefix (#1693 ) * build: allow custom container registry * build: fix .bazeloverwriterc import	2023-04-27 11:52:02 +02:00
Paul Meyer	bf051174f6	ci: update measurements and image version on scheduled build Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-04-27 10:20:27 +02:00
Malte Poll	c11a3f4460	cli: configurable state disk type on OpenStack (#1686 )	2023-04-27 09:08:43 +02:00
Malte Poll	9dfad32e33	cli: use Bazel container images	2023-04-18 15:35:15 +02:00
Moritz Sanft	1d0ee796e8	cli: add Terraform log support (#1620 ) * add Terraform logging * add TF logging to CLI * fix path * only create file if logging is enabled * update bazel files * register persistent flags manually * clidocgen * move logging code to separate file * reword yes flag parsing error * update bazel buildfile * factor out log level setting	2023-04-14 14:15:07 +02:00
Daniel Weiße	ec01c57661	internal: use config to create attestation validators (#1561 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-04-06 17:00:56 +02:00
Malte Poll	69de06dd1f	image: OpenStack vTPM (#1616 ) * cli: allow vpc traffic between nodes on OpenStack * image: enable vTPM on OpenStack * cli: add create tests for OpenStack	2023-04-05 16:49:03 +02:00
renovate[bot]	a2ae53d229	deps: update dependency kubernetes-sigs/cri-tools to v1.26.1 (#1600 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-04-05 11:37:15 +02:00
Malte Poll	2ca2dbae22	versionsapi: fix list command by allowing empty set of patch versions for a given minor version (#1609 )	2023-04-04 12:10:07 +02:00
Paul Meyer	58b405d04c	license: remove check for Azure.ConfidentialVM (#1602 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-04-03 19:19:54 +02:00
Malte Poll	d15968bed7	bootstrapper: make Azure auth method configurable on cluster init (#1346 ) * bootstrapper: make Azure auth method configurable on cluster init * azure: convert uami resource ID to clientID Co-authored-by: 3u13r <lc@edgeless.systems>	2023-04-03 15:01:25 +02:00
Moritz Sanft	46f5b1734e	cli: show available cli upgrades on upgrade check command (#1394 ) * cli: upgrade check show cli upgrades * only check compatibility for valid upgrades * use semver.Sort * extend unit tests * add unit test for new compatible cli versions * adapt to feedback * fix rebase * rework output * minor -> major Co-authored-by: Otto Bittner <cobittner@posteo.net> * minor -> major Co-authored-by: Otto Bittner <cobittner@posteo.net> * dynamic major version Co-authored-by: Otto Bittner <cobittner@posteo.net> * remove currentK8sVer argument * bazel gen & tidy * bazel update --------- Co-authored-by: Otto Bittner <cobittner@posteo.net>	2023-04-03 14:31:17 +02:00
Otto Bittner	c8c2953d7b	cli: add status cmd The new command allows checking the status of an upgrade and which versions are installed. Also remove the unused restclient. And make GetConstellationVersion a function.	2023-04-03 12:03:41 +02:00
Moritz Sanft	2d41a19fbf	internal: semver support for pseudoversions (#1564 ) * support for prerelease tag / pseudoversion * build version first Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * use strings.Cut Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> --------- Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>	2023-04-03 10:48:28 +02:00
Daniel Weiße	62c165750f	config: remove deprecated upgradeConfig and require name and microserviceVersion fields (#1541 ) * Remove deprecated fields * Remove warning for not setting attestationVariant * Dont write attestationVariant to config --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-31 19:19:10 +02:00
3u13r	efe4681214	add version.txt step to release pipeline (#1493 ) * add version.txt step to release pipeline * refresh git status * make minicon e2e test less flaky	2023-03-31 12:41:32 +02:00
renovate[bot]	8ffd1dcf3f	deps: update bazel_gazelle digest to 4dfcb75 (#1516 ) * deps: update gazelle and rules_go * variant: remove renamed go_library label * deps: tidy all modules --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Malte Poll <mp@edgeless.systems> Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>	2023-03-31 10:43:07 +02:00
renovate[bot]	786d9c86ad	deps: update Constellation containers (#1543 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-30 18:43:28 +02:00
Paul Meyer	d7fafb92b7	bazel: improve script template resilience Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-29 12:51:40 -04:00
Paul Meyer	909bfb9274	bazel: add go generate to //:generate target Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-29 12:51:40 -04:00
Nils Hanke	eaa5949e31	versionsapi: Split GCP image URI to extract the image name	2023-03-29 17:26:03 +02:00
Daniel Weiße	fc0efb6309	config: deprecate confidentialVM option for Azure clusters in favor of using attestationVariant option (#1539 ) * Remove confidentialVM option from azure provider config * Fix cloudcmd creator test --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-29 14:04:37 +02:00
Nils Hanke	1b832ac959	atls: fix link in README.md (#1545 ) Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>	2023-03-29 13:33:19 +02:00
Thomas Tendyck	091fe3e2d7	measurements: compare to constants for clarity	2023-03-29 12:03:29 +02:00
renovate[bot]	83e6b4d64d	deps: update Constellation containers (#1504 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-29 11:31:26 +02:00
Daniel Weiße	b57413cfa7	cli: set cluster's initial measurements from user's config using Helm (#1540 ) * Remove using measurements from the initial control-plane node for the cluster's initial measurements * Add using measurements from the user's config for the cluster's initial measurements to align behavior with upgrade command --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-29 11:16:56 +02:00
Daniel Weiße	99b12e4035	internal: refactor oid package to variant package (#1538 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-29 09:30:13 +02:00
Daniel Weiße	db5660e3d6	attestation: add context to Issue and Validate methods (#1532 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-29 09:06:10 +02:00
3u13r	c21b32d440	fix measurement generator (#1510 )	2023-03-23 17:44:30 +01:00
Otto Bittner	cac43a1dd0	ci: add e2e-upgrade test The test is implemented as a go test. It can be executed as a bazel target. The general workflow is to setup a cluster, point the test to the workspace in which to find the kubeconfig and the constellation config and specify a target image, k8s and service version. The test will succeed if it detects all target versions in the cluster within the configured timeout. The CI automates the above steps. A separate workflow is introduced as there are multiple input fields to the test. Adding all of these to the manual e2e test seemed confusing. Co-authored-by: Fabian Kammel <fk@edgeless.systems>	2023-03-23 14:57:38 +01:00
Leonard Cohnen	b2df6ba07a	bump enterprise miniconstellation image	2023-03-23 14:55:29 +01:00
renovate[bot]	090d071993	deps: update Constellation containers to v2.7.0-pre.0.20230322165747-0a190c2bf672 (#1491 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-03-22 18:30:59 +01:00
renovate[bot]	57f1c8f139	deps: update Kubernetes versions (#1473 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-22 14:27:07 +01:00
Paul Meyer	02fc3dc635	measurements: refactor validation option (#1462 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-22 11:47:39 +01:00
renovate[bot]	2d1ffaea4f	deps: update K8s constrained Azure versions (#1408 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-22 10:23:44 +01:00
renovate[bot]	7a0cbe39f4	deps: update Constellation containers to v2.7.0-pre.0.20230321165012-cab6044f6910 (#1484 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-21 20:21:42 +01:00
renovate[bot]	248dbb5927	deps: update Constellation containers (#1464 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-21 17:37:06 +01:00
Daniel Weiße	5a0234b3f2	attestation: add option for MAA fallback to verify azure's snp-sev id key digest (#1257 ) * Convert enforceIDKeyDigest setting to enum * Use MAA fallback in Azure SNP attestation * Only create MAA provider if MAA fallback is enabled --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Thomas Tendyck <tt@edgeless.systems>	2023-03-21 12:46:49 +01:00
Malte Poll	67f5625f99	versions: add OpenStack CCM image	2023-03-21 10:51:09 +01:00
Malte Poll	071628c6a0	config: add OpenStack in-cluster authentication settings	2023-03-21 10:51:09 +01:00
Malte Poll	f785ae560b	openstack: implement account key for cluster-internal authentication	2023-03-21 10:51:09 +01:00
Malte Poll	1b2a927b84	openstack: implement api client UID, InitSecretHash and GetLoadBalancerEndpoint	2023-03-21 10:51:09 +01:00
Otto Bittner	1b12147d83	cli: minor restructuring for loading helm charts (#1441 ) Use one loadRelease function instead of one function for each release.	2023-03-20 17:05:58 +01:00
renovate[bot]	b3b1809251	deps: update K8s version independent containers to v0.1.2 (#1376 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-20 16:35:26 +01:00
Daniel Weiße	1a0e05c3fb	Set Azure-SEV-SNP as default azure attestation variant (#1461 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-20 14:40:27 +01:00
Paul Meyer	bad05321a0	go: remove redefinitions of builtins Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-20 08:41:01 -04:00
Paul Meyer	0036b24266	go: remove unused parameters Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-20 08:41:01 -04:00
Moritz Sanft	f2ce9518a3	cli: support custom attestation policies for maa (#1375 ) * create and update maa attestation policy * use interface to allow unit testing * fix test csp * http request for policy patch * go mod tidy * remove hyphen * go mod tidy * wip: adapt to feedback * linting fixes * remove csp from tf call * fix type assertion * Add MAA URL to instance tags (#1409) Signed-off-by: Daniel Weiße <dw@edgeless.systems> * conditionally create maa provider * only set instance tag when maa is created * fix azure unit test * bazel tidy * remove AzureCVM const Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * encode policy at runtime * remove policy arg * fix unit test --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>	2023-03-20 13:33:04 +01:00
renovate[bot]	540978bc98	deps: update Constellation containers (#1417 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-03-17 07:48:19 +01:00
Daniel Weiße	6ea5588bdc	config: add attestation variant (#1413 ) * Add attestation type to config (optional for now) * Get attestation variant from config in CLI * Set attestation variant for Constellation services in helm deployments * Remove AzureCVM variable from helm deployments --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-14 11:46:27 +01:00
renovate[bot]	fb83c1dbc4	deps: update Constellation containers to v2.7.0-pre.0.20230313143044-114ac53872c6 (#1333 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-13 18:49:59 +01:00
Paul Meyer	bab76e8a9a	deps: update containers to v2.7.0-pre (#1407 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-13 13:19:36 +01:00
renovate[bot]	e2ad11320a	deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.26.1 (#1383 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-13 11:12:50 +01:00
Paul Meyer	a658368d40	deps: update GCP guest agent image (#1400 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-13 10:35:57 +01:00
Paul Meyer	50c4ea9be6	deps: update libvirt container to v2.7.0-pre Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-10 10:46:46 -05:00
Thomas Tendyck	64e1f553d1	cli: remove Edition in version command, which contains duplicate info	2023-03-10 11:36:44 +01:00
Moritz Sanft	01705feb51	ci: upload cli version list (#1377 ) * upload cli version list * fix flag * name * allow cli kind for listing * [remove] update vapi cli * allow cli kind * use latest versionsapi image version * fix kind parsing * use workflow calls in on_release action * [remove] update container tag * change back to latest tag	2023-03-10 10:21:58 +01:00
Nils Hanke	dc4769d0a0	constants: use "Enterprise" for enterprise build	2023-03-09 17:32:50 +01:00
Malte Poll	bdba9d8ba6	bazel: add build files for go (#1186 ) * build: correct toolchain order * build: gazelle-update-repos * build: use pregenerated proto for dependencies * update bazeldnf * deps: tpm simulator * Update Google trillian module * cli: add stamping as alternative build info source * bazel: add go_test wrappers, mark special tests and select testing deps * deps: add libvirt deps * deps: go-libvirt patches * deps: cloudflare circl patches * bazel: add go_test wrappers, mark special tests and select testing deps * bazel: keep gazelle overrides * bazel: cleanup bazelrc * bazel: switch CMakeLists.txt to use bazel * bazel: fix injection of version information via stamping * bazel: commit all build files * dev-docs: document bazel usage * deps: upgrade zig-cc for go 1.20 * bazel: update Perl for macOS arm64 & Linux arm64 support * bazel: use static perl toolchain for OpenSSL * bazel: use static protobuf (protoc) toolchain * deps: add git and go to nix deps Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-09 15:23:42 +01:00
Daniel Weiße	8c87bba755	Add measurement reader (#1381 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-09 11:22:58 +01:00
Daniel Weiße	5bad5f768b	attestation: create issuer based on kernel cmd line (#1355 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-09 09:47:28 +01:00
Paul Meyer	acbd70c741	openstack: implement api client and metadata list Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-08 09:04:57 -05:00
Paul Meyer	418f08bf40	openstack: implement imds and metadata self Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-08 09:04:57 -05:00
Paul Meyer	630016d1b3	openstack: use password to authenticate in cluster Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-08 09:04:57 -05:00
Paul Meyer	64fc43f276	use any instead of interface{} (#1354 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-03-08 10:31:20 +01:00
Malte Poll	62ea224d36	attestation: remove PCR[0] and PCR[10] from enterprise measurements (#1348 ) This will help the measurement generation done as part of internal/attestation/measurements/measurement-generator. It can currently replace measurements but not reformat the code (in cases where the number of measurements differs).	2023-03-06 17:11:14 +01:00
Thomas Tendyck	c94d1db76d	attestation: remove PCR 0 and 10 on GCP	2023-03-06 13:09:57 +01:00
Thomas Tendyck	0a344e4cf6	attestation: validate GCP machine state	2023-03-06 13:09:57 +01:00
Thomas Tendyck	2535073df8	attestation: add MachineState to ValidateCVM	2023-03-06 13:09:57 +01:00
Malte Poll	aae326d430	deps: manually upgrade libvirt container for upcoming release (#1339 ) The libvirt container is currently not automatically upgraded (it still has version v2.2.0 before this change). To ensure we update libvirt for this release, we manually upgrade the libvirt container image.	2023-03-03 16:05:29 +01:00
Malte Poll	8aa42e30ad	cli: set OpenStack service account credentials (#1328 )	2023-03-03 10:10:36 +01:00
Otto Bittner	f0db5d0395	cli: restructure `upgrade apply` (#1319 ) Applies the updated NodeVersion object with one request instead of two. This makes sure that the first request does not accidentially put the cluster into a "updgrade in progress" status. Which would lead users to having to run apply twice.	2023-03-03 09:38:23 +01:00
Daniel Weiße	5eb73706f5	internal: refactor storage credentials (#1071 ) * Move storage clients to separate packages * Allow setting of client credentials for AWS S3 * Use managed identity client secret or default credentials for Azure Blob Storage * Use credentials file to authorize GCS client --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-03-02 15:08:31 +01:00
Malte Poll	ab0b881cbf	oid: add alternative string representations for attestation variants (#1322 )	2023-03-02 10:48:16 +01:00
Malte Poll	fc33a74c78	constants: make VersionInfo readonly (#1316 ) The variable VersionInfo is supposed to be set by `go build -X ...` during link time but should not be modified at runtime. This change ensures the underlying var is private and can only be accessed by a public getter.	2023-03-01 11:55:12 +01:00
renovate[bot]	0157537852	deps: update Kubernetes versions (#1313 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-03-01 11:41:11 +01:00
Paul Meyer	060faae528	config: use toPtr func to get pointers (#1287 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-28 18:44:21 +01:00
renovate[bot]	2f52091326	deps: update Constellation containers to v2.6.0-pre.0.20230228093604-90ed4701788f (#1288 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-02-28 17:32:02 +01:00
Daniel Weiße	b3486fc32b	intenal: add logging to attestation issuer (#1264 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-02-28 16:34:18 +01:00
Moritz Sanft	90ed470178	internal: add custom version type (#1256 ) * add custom version type * extend functionality * adapt to requested changes * move to own package * remove duplicate tests, rename package * not handle err	2023-02-28 10:36:04 +01:00
Otto Bittner	984f0589d2	cli: upgrade errors for microservice (#1259 ) Handle invalid upgrade errors similarly as for images and k8s.	2023-02-28 10:23:09 +01:00
Malte Poll	b79f7d0c8c	cli: add basic support for `constellation create` on OpenStack (#1283 ) * image: support OpenStack image build / upload * cli: add OpenStack terraform template * config: add OpenStack as CSP * versionsapi: add OpenStack as CSP * cli: add OpenStack as provider for `config generate` and `create` * disk-mapper: add basic support for boot on OpenStack * debugd: add placeholder for OpenStack * image: fix config file sourcing for image upload	2023-02-27 18:19:52 +01:00
Otto Bittner	d98f86686d	versions: let renovate update valid k8s versions Also update lagging v1_24	2023-02-27 16:33:47 +01:00
renovate[bot]	b1d9ede767	deps: update Constellation containers (#1234 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-02-24 17:00:50 +01:00
renovate[bot]	7bcd0650a9	deps: update ghcr.io/edgelesssys/cloud-provider-gcp:v26.0.1 Docker digest to db2b15a (#1267 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-02-24 15:57:53 +01:00
Moritz Sanft	a274ac8a7c	ci: add cli k8s compatibility table artifact upload to ci (#1218 ) * add cli k8s compatibility api to ci * extend versionsapi package * rework cli info upload via ci * join errors natively * fix semver * upload from hack file * fix ci checks * add distributionid * setup go before running hack file * setup go after repo checkout * use logger instead of panic, invalidate cache * use provided ctx Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> --------- Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-24 12:00:04 +01:00
Nils Hanke	28bdeb2427	cli: add support for GCP C2D VMs	2023-02-22 15:25:51 +01:00
Nils Hanke	7360e89182	cli: fix n2d-standard-224 support	2023-02-22 15:25:51 +01:00
Otto Bittner	d78d22f95a	cli: add `config kubernetes-versions` subcommand (#1224 ) Allows users to learn which k8s versions are supported by the current CLI. Extend respective docs section.	2023-02-22 09:52:47 +01:00
leongross	51eef675a2	cli: refer to --force and --config flags (#1205 ) * add reference to --config and --force	2023-02-21 16:46:47 +01:00
Otto Bittner	da7a870f54	cli: add `--kubernetes` flag (#1226 ) The flag can be used to specify a Kubernetes version in format MAJOR.MINOR and let the CLI extend the value with the patch version.	2023-02-21 14:05:41 +01:00
Paul Meyer	6d6d7d4b6e	kms: replace deprecated rand.Seed Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-20 12:08:24 -05:00
Paul Meyer	deea806d9c	Improve code sequences with multiple errs Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-20 12:08:24 -05:00
Paul Meyer	12c866bcb9	deps: replace multierr with native errors.Join Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-20 12:08:24 -05:00
Otto Bittner	c0a62a52d1	config: allow k8s version MAJOR.MINOR for v2.6 (#1222 ) To adhere to our compatibility goal of not breaking old configs, the kubernetes patch version is automatically extended for configs in the transistional version v2.6.	2023-02-20 10:50:55 +01:00
Otto Bittner	87fdb47caa	cli: upgrade apply uses correct measurements key (#1223 ) Apply still used the obsolete upgrade key's measurements. The new, desired behavior is to use the Provider's measurements key	2023-02-20 10:32:33 +01:00
renovate[bot]	93f97cb320	deps: update Constellation containers (#1211 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-02-17 11:41:48 +01:00
Daniel Weiße	f70447bf7d	Allow unset 'name' key but print warning if unset (#1208 ) * Allow unset name key in config but print warning if unset * Print deprecation warnings for config to os.Stderr --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-02-17 09:05:42 +01:00
Thomas Tendyck	292f8eef21	attestation: remove VerifyUserData	2023-02-16 16:29:20 +01:00
Thomas Tendyck	dd7d6334ba	attestation: bind user data to PCR state	2023-02-16 16:29:20 +01:00
Fabian Kammel	5e7dc0d7db	Option to disable spinner via environment variable. (#1207 ) Signed-off-by: Fabian Kammel <fk@edgeless.systems>	2023-02-16 15:43:19 +01:00
Otto Bittner	50646b2a10	cli: refactor `upgrade apply` cmd to match name * `upgrade apply` will try to make the locally configured and actual version in the cluster match by appling necessary upgrades. * Skip image or kubernetes upgrades if one is already in progress. * Skip downgrades/equal-as-running versions * Move NodeVersionResourceName constant from operators to internal as its needed in the CLI.	2023-02-15 16:44:47 +01:00
Otto Bittner	3cebd68c24	kubernetes: move k8s-components creation to internal The CLI will have to create similar objects for k8s upgrades.	2023-02-15 16:44:47 +01:00
Otto Bittner	b4ef4ec370	config: conditionally set default microserviceVersion	2023-02-15 13:36:16 +01:00
Otto Bittner	6f9d76dd6e	compatibility: allow newer patch versions for images Validation incorrectly prevented newer patch versions for images.	2023-02-15 13:36:16 +01:00
Otto Bittner	2a0b56f7b8	config: improve error message for outdated CLIs	2023-02-15 13:36:16 +01:00
renovate[bot]	a7b3a9876b	deps: update Constellation containers to v2.6.0-pre.0.20230215104228-2042e6b3382f (#1185 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-02-15 13:13:54 +01:00
Otto Bittner	2042e6b338	config: only print upgrade deprecation msg if key is set	2023-02-15 11:42:28 +01:00
Otto Bittner	69a384d978	compatibility: error message wording The new description represents the error condition more accurately.	2023-02-15 11:41:54 +01:00
renovate[bot]	241d667758	deps: update K8s constrained Azure versions (#1129 ) Co-authored-by: katexochen <katexochen@users.noreply.github.com>	2023-02-14 15:18:55 +01:00
Paul Meyer	84a787b538	cli: add name of build type to version cmd output (#1179 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-14 14:30:10 +01:00
renovate[bot]	f60f967bd8	deps: update Constellation containers to v2.6.0-pre.0.20230210122722-c29107f5be7b (#1126 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-02-10 16:06:46 +01:00
Daniel Weiße	c29107f5be	init: create kubeconfig file with unique user/cluster name (#1133 ) * Generate kubeconfig with unique name * Move create name flag to config * Add name validation to config * Move name flag in e2e tests to config generation * Remove name flag from create * Update ascii cinema flow --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-02-10 13:27:22 +01:00
Otto Bittner	fd860ddb91	config: fix incorrect kubernetes version validation (#1155 ) Fix incorrect string comparison by replacing it with call to semver.Compare. Also add handling to check for missing v prefix.	2023-02-09 17:38:02 +01:00
Otto Bittner	c275464634	cli: change upgrade-plan to upgrade-check Upgrade check is used to find updates for the current cluster. Optionally the found upgrades can be persisted to the config for consumption by the upgrade-execute cmd. The old `upgrade execute` in this commit does not work with the new `upgrade plan`. The current versions are read from the cluster. Supported versions are read from the cli and the versionsapi. Adds a new config field MicroserviceVersion that will be used by `upgrade execute` to update the service versions. The field is optional until 2.7 A deprecation warning for the upgrade key is printed during config validation. Kubernetes versions now specify the patch version to make it explicit for users if an upgrade changes the k8s version.	2023-02-08 12:30:01 +01:00
Otto Bittner	f204c24174	cli: add version validation and force flag Version validation checks that the configured versions are not more than one minor version below the CLI's version. The validation can be disabled using --force. This is necessary for now during development as the CLI does not have a prerelease version, as our images do.	2023-02-08 12:30:01 +01:00
Daniel Weiße	3a7b829107	internal: use go-kms-wrapping for KMS backends (#1012 ) * Replace external KMS backend logic for AWS, Azure, and GCP with go-kms-wrapping * Move kms client setup config into its own package for easier parsing * Update kms integration flag naming * Error if nil storage is passed to external KMS --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-02-08 12:03:54 +01:00
Daniel Weiße	68ce23b909	Enable cryptsetup read/write workqueue bypass (#1150 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-02-08 12:01:14 +01:00
renovate[bot]	535c359ee7	deps: update Constellation containers to v2.6.0-pre.0.20230131161703-e0354826e058 (#1105 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-31 18:08:40 +01:00
Otto Bittner	6415d80ee4	versions: update constellation operator image	2023-01-31 11:36:49 +01:00
renovate[bot]	11e233e4be	deps: update ghcr.io/edgelesssys/cloud-provider-gcp:v26.0.1 Docker digest to 8708a33 (#1110 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-30 16:54:11 +01:00
renovate[bot]	dcde73b4c4	deps: update Constellation containers to v2.6.0-pre.0.20230127131021-e174146e0c93 (#1091 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-27 16:01:08 +01:00
renovate[bot]	fb1b1f50fd	deps: update K8s version independent containers to v0.1.1 (#1020 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-27 15:25:05 +01:00
3u13r	e174146e0c	azure: add new idkeydigest (#1094 )	2023-01-27 14:10:21 +01:00
Paul Meyer	8364856d55	versions: remove Kubernetes v1.23 Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-27 13:32:20 +01:00
renovate[bot]	c758aef1ff	deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.25.3 (#1082 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-27 11:30:43 +01:00
renovate[bot]	dd1140868e	deps: update Constellation containers to v2.6.0-pre (#1074 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-26 14:58:51 +01:00
Daniel Weiße	aa3ac82408	Add a bit more logging to attestation and join-service on error (#1076 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2023-01-26 11:24:29 +01:00
Malte Poll	2d326ea3f0	cli: set placeholder uid for QEMU / MiniConstellation (#1069 )	2023-01-25 14:42:52 +01:00
3u13r	e6ac8e2a91	config: fix digest naming (#1064 ) * config: fix digest naming	2023-01-24 22:20:10 +01:00
github-actions[bot]	9567cc09ce	release: bring back changes from v2.5.0 (#1061 ) * deps: update version to v2.5.0 * attestation: hardcode measurements for v2.5.0 * bump operator versions Co-authored-by: release[bot] <release[bot]@users.noreply.github.com> Co-authored-by: Leonard Cohnen <lc@edgeless.systems>	2023-01-24 11:35:26 +01:00
renovate[bot]	5142497a3d	deps: update dependency containernetworking/plugins to v1.2.0 (#1022 ) * Update dependency containernetworking/plugins to v1.2.0 Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-01-23 14:56:28 +01:00
renovate[bot]	f688afff3f	Update K8s constrained Azure versions (#1009 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-01-23 14:32:21 +01:00
Paul Meyer	4f9ed08061	versionsapi: fix single version deletion in cli Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-23 14:15:05 +01:00
Otto Bittner	3b59ebfd53	config: detailed validation errors for k8s version (#1018 ) These extended error messages help users in understanding what is wrong with the current configuration and how to remediate the issue.	2023-01-23 11:21:06 +01:00
renovate[bot]	9f05631afd	deps: update Constellation containers (#1052 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-21 20:17:07 +01:00
Paul Meyer	c4d68d1c28	versions: update key-service name Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-21 19:55:14 +01:00
renovate[bot]	6708aff984	deps: update dependency kubernetes/kubernetes to v1.24.10 (#1043 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-20 18:54:10 +01:00
Paul Meyer	a8cbfd848f	keyservice: use dash in container name (#1016 ) Co-authored-by: Otto Bittner <cobittner@posteo.net>	2023-01-20 18:51:06 +01:00
Fabian Kammel	8482d26eef	deps: update cloud provider gcp image for k8s v1.26 (#1051 ) Signed-off-by: Fabian Kammel <fk@edgeless.systems>	2023-01-20 15:54:24 +01:00
renovate[bot]	9b4dc9b478	Update Constellation containers to v2.5.0-pre.0.20230119145750-690b50b29de5 (#1039 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-20 09:51:29 +01:00
renovate[bot]	99496c3c33	Update Kubernetes versions (#1019 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-19 17:16:00 +01:00
Daniel Weiße	690b50b29d	dev-docs: Go package docs (#958 ) * Remove unused package * Add Go package docs to most packages Signed-off-by: Daniel Weiße <dw@edgeless.systems> Signed-off-by: Fabian Kammel <fk@edgeless.systems> Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com> Co-authored-by: Fabian Kammel <fk@edgeless.systems>	2023-01-19 15:57:50 +01:00
Otto Bittner	a0ac957227	versions: update join- & keyservice images	2023-01-19 13:14:55 +01:00
Otto Bittner	9a1f52e94e	Refactor init/recovery to use kms URI So far the masterSecret was sent to the initial bootstrapper on init/recovery. With this commit this information is encoded in the kmsURI that is sent during init. For recover, the communication with the recoveryserver is changed. Before a streaming gRPC call was used to exchanges UUID for measurementSecret and state disk key. Now a standard gRPC is made that includes the same kmsURI & storageURI that are sent during init.	2023-01-19 13:14:55 +01:00
Otto Bittner	0e71322e2e	keyservice: move kms code to internal/kms Recovery (disk-mapper) and init (bootstrapper) will have to work with multiple external KMSes in the future.	2023-01-19 13:14:55 +01:00
renovate[bot]	90ea35ae35	Update Constellation containers to v2.5.0-pre.0.20230118154955-632090c21b93 (#1014 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-01-18 17:28:04 +01:00
3u13r	632090c21b	azure: allow a set of idkeydigest values (#991 )	2023-01-18 16:49:55 +01:00
renovate[bot]	41eb533d63	Update Constellation containers (#1003 ) https://github.com/edgelesssys/constellation/actions/runs/3943576556/jobs/6748558235	2023-01-18 09:44:36 +01:00
Thomas Tendyck	f0f109a1ea	verify: use fixed user data	2023-01-17 16:14:00 +01:00
renovate[bot]	bbda3d1ecd	Update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.25.2 (#979 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-17 16:10:26 +01:00
renovate[bot]	a3035167b6	Update Constellation containers (#965 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-16 16:59:49 +01:00
Otto Bittner	89f075d490	versions: rename KmsImage to KeyServiceImage	2023-01-16 15:14:23 +01:00
Paul Meyer	42135dfdd6	versions: update container images to v2.5.0-pre Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-16 14:54:41 +01:00
Paul Meyer	467c3f501c	versionsapi: add implementation of json flag Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-16 13:52:11 +01:00
Otto Bittner	90b88e1cf9	kms: rename kms to keyservice In the light of extending our eKMS support it will be helpful to have a tighter use of the word "KMS". KMS should refer to the actual component that manages keys. The keyservice, also called KMS in the constellation code, does not manage keys itself. It talks to a KMS backend, which in turn does the actual key management.	2023-01-16 11:56:34 +01:00
Malte Poll	bcd8aa9acc	Use upstream node-maintenance-operator (#115 )	2023-01-12 16:01:03 +01:00
Malte Poll	75fb61e001	attestation: codegen for hardcoded measurements in go	2023-01-12 13:24:07 +01:00
Fabian Kammel	82a0fcbb9d	upgrade: fix broken reference from constellation-os to constellation-version (#939 ) * update constellation-os to constellation-version references * update nodeimage to nodeversion in CRD type name Signed-off-by: Fabian Kammel <fk@edgeless.systems> Co-authored-by: Malte Poll <mp@edgeless.systems>	2023-01-11 16:07:07 +01:00
Paul Meyer	4bc191e434	versions: move hash generator into own package Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-11 14:29:32 +01:00
Paul Meyer	c081664d03	versions: repair hash generation Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-11 14:29:32 +01:00
Malte Poll	fe8518a4e3	release: update measurements	2023-01-11 11:10:44 +01:00
release[bot]	e8fad4b7f9	Update version to v2.4.0	2023-01-11 11:10:44 +01:00
Paul Meyer	ef086bf02d	versionsapi: log aws region Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-10 17:02:01 +01:00
renovate[bot]	d24fac00f0	Update Constellation containers (#884 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-01-09 13:15:28 +01:00
Leonard Cohnen	2700d5182b	operator: reconcile kubernetesClusterVersion	2023-01-09 12:16:54 +01:00
Leonard Cohnen	8c5e41b865	constants: rename components annotation key	2023-01-09 12:16:54 +01:00
Leonard Cohnen	3637909a46	internal: move components into their own package	2023-01-09 12:16:54 +01:00
Paul Meyer	49534d463d	deps: update cluster autoscaler (#835 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-06 16:47:31 +01:00
Paul Meyer	f4df4067bd	deps: upgrade Azure sdk (#887 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-06 16:26:30 +01:00
renovate[bot]	8b11a18239	Update K8s constrained Azure versions (#886 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-06 14:15:16 +01:00
renovate[bot]	f99a3189d8	Update K8s constrained versions (#799 ) * Update K8s constrained versions * Update azure images to v1.26 * Revert upgrade for k8s v1.23 Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-06 10:40:37 +01:00
Paul Meyer	66f2c446a4	versionsapi: replace shortname pkg Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-06 10:15:27 +01:00
Paul Meyer	f17b40b44a	versionsapi: fix shortPath implementation Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-06 10:15:27 +01:00
Otto Bittner	e7c7e35f51	cli: create backups for CRDs and their resources These backups could be used in case an upgrade misbehaves after helm declared it as successful. The manual backups are required as helm-rollback won't touch custom resources and changes to CRDs delete resources of the old version.	2023-01-05 16:52:06 +01:00
Paul Meyer	afbd4a3dc1	deps: upgrade AWS cloud controller manager (#863 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-05 16:35:19 +01:00
renovate[bot]	7eae68d4f9	Update Constellation containers	2023-01-05 15:43:11 +01:00
Leonard Cohnen	25c3a8a1f3	init: add cluster version to kubernetes components	2023-01-05 14:52:09 +01:00
renovate[bot]	9c71145862	Update K8s version independent containers to v0.0.35 (#872 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-05 13:26:55 +01:00
renovate[bot]	cf3169cf44	Update Constellation containers (#854 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-05 08:14:57 +01:00
Paul Meyer	f9458950cb	versionsapi: change image path (#856 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 17:07:16 +01:00
Paul Meyer	053f4552d9	versionsapi: fix semver dependency Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 16:00:14 +01:00
Paul Meyer	3c24e3fa01	cli: move image package into cli Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	f19a90527b	cli: use versionsapi fetcher to fetch image ref Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	3561a16819	ci: replace add-version through versionsapi cli Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	d2d3a8e068	versionsapi: use read-only client Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	0011d960f7	versionsapi: implement rm cmd in cli Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	53cc63362f	versionsapi: implement list cmd in cli Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	777c9406fd	versionsapi: implement latest cmd in cli Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	5679c9d3de	versionsapi: create cli, implement add cmd Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	b3f251909c	versionsapi: implement Go client Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	9dbe6033f2	versionsapi: new fetcher implementation Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	3f00f89d55	versionsapi: new implementation Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
Paul Meyer	f43b653231	versionsapi: backup old API Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-04 11:39:19 +01:00
renovate[bot]	324ef42c42	Update Constellation containers (#852 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2023-01-03 12:30:07 +01:00
Paul Meyer	de6ee412ac	deps: update AWS cloud controller manager Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-03 12:14:16 +01:00
3u13r	f14af0c3eb	upgrade: support Kubernetes components (#839 ) * upgrade: add Kubernetes components to NodeVersion * update rfc	2023-01-03 12:09:53 +01:00
Leonard Cohnen	4b43311fbd	bump microservice versions	2023-01-03 11:51:29 +01:00
renovate[bot]	806f6b70dd	Update module github.com/talos-systems/talos/pkg/machinery to v1.3.1 (#844 ) * Update module github.com/talos-systems/talos/pkg/machinery to v1.3.1 * Rename talos-systems/talos to siderolabs/talos Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2023-01-02 13:33:56 +01:00
3u13r	47fb9f7cc8	gcp: unofficial support for internal LBs (#826 )	2022-12-28 13:30:39 +01:00
Moritz Sanft	9859b30c4d	AB#2544 add upgrade agent for automatic version updates (#745 )	2022-12-25 18:49:45 +01:00
Paul Meyer	8b39d3d368	versionsapi: fix cache invalidation Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-23 10:15:42 +01:00
Otto Bittner	efcd0337b4	Microservice upgrades (#729 ) Run with: constellation upgrade execute --helm. This will only upgrade the helm charts. No config is needed. Upgrades are implemented via helm's upgrade action, i.e. they automatically roll back if something goes wrong. Releases could still be managed via helm, even after an upgrade with constellation has been done. Currently not user facing as CRD/CR backups are still in progress. These backups should be automatically created and saved to the user's disk as updates may delete CRs. This happens implicitly through CRD upgrades, which are part of microservice upgrades.	2022-12-19 16:52:15 +01:00
renovate[bot]	8ddc8cdb65	Update dependency kubernetes-sigs/cri-tools to v1.26.0	2022-12-16 10:43:33 +01:00
renovate[bot]	7ffbad12be	Update Constellation containers to v2.3.0-pre.0.20221212170906-a77f38efbb31 (#779 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-14 10:46:15 +01:00
Paul Meyer	c741ccfb4b	kubernetes: use new registry Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-13 16:08:19 +01:00
Paul Meyer	6862c2587f	kubernetes: add v1.26, default to v1.25 Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-13 16:08:19 +01:00
Malte Poll	cf0b04291a	Embed measurements for v2.3.0	2022-12-12 17:45:35 +01:00
Malte Poll	d6b2e9ea9a	Expand PCR selection on AWS	2022-12-12 17:45:35 +01:00
Malte Poll	c3b657de01	Bump version to v2.3.0	2022-12-12 17:45:35 +01:00
renovate[bot]	5eae12778a	Update Constellation containers (#777 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-12-09 18:45:09 +01:00
renovate[bot]	012f739c67	Update Constellation containers (#759 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-09 16:32:58 +01:00
Malte Poll	4a8ebfd921	OS images: use "ref", "stream" and "version" Switch azure default region to west us Update find-image script to work with new API spec Add version for every os image build generate measurements: Use new API paths CLI: config fetch measurements: Use image short versions to fetch measurements CLI: allows shortnames to specify image in config Image build pipeline: Change paths to contain "ref" and "stream"	2022-12-09 13:37:43 +01:00
Paul Meyer	4795fe9695	hack: create latest endpoint in add-version script Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-09 13:37:43 +01:00
Paul Meyer	f23a2fe073	hack: implement new api for add-version script Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-09 13:37:43 +01:00
renovate[bot]	72ba97efcc	Update K8s constrained versions (#762 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-09 13:17:55 +01:00
Paul Meyer	9b1551e76a	dependencies: migrate go-genproto to google-cloud-go Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-08 13:27:15 +01:00
renovate[bot]	3435ac216f	Update Constellation containers (#748 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-12-08 11:38:05 +01:00
Leonard Cohnen	a1161ae05d	k8supdates: label nodes with k8s component hash	2022-12-08 11:19:22 +01:00
renovate[bot]	bb9122f115	Update Constellation containers to v2.3.0-pre.0.20221207104854-286803fb97a0 (#747 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-12-07 15:12:04 +01:00
Moritz Sanft	286803fb97	AB#2579 Add constellation iam create command (#624 )	2022-12-07 11:48:54 +01:00
renovate[bot]	be01cf7129	Update Constellation containers to v2.3.0-pre.0.20221206170532-a9ed8c0191ac (#733 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-07 10:44:45 +01:00
Paul Meyer	cb734a2e66	debugd: pin logcollector container digest Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-06 18:05:32 +01:00
renovate[bot]	1766f0e4b3	Update Constellation containers to v2.3.0-pre.0.20221205155634-0981ab6fa45b (#725 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-06 13:29:54 +01:00
renovate[bot]	0981ab6fa4	Update Constellation containers to v2.3.0-pre.0.20221205121645-176dae317f6c (#719 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-05 16:56:34 +01:00
Paul Meyer	176dae317f	debugd: fix logcollector container image naming Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-05 13:16:45 +01:00
Paul Meyer	226a6b6626	debugd: let renovate manage logcollector images Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-02 18:54:24 +01:00
Paul Meyer	8c5fc7a890	versionsapi: allow debug stream Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-02 18:49:17 +01:00
Paul Meyer	9c9c8e3d46	versionsapi: rename package Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-02 18:49:17 +01:00
renovate[bot]	3c62b841ed	Update Constellation containers (#705 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-02 18:48:03 +01:00
Leonard Cohnen	0c71cc77f6	joinservice: use configmap for k8s components	2022-12-02 14:34:38 +01:00
renovate[bot]	de77f1d9be	Update ghcr.io/edgelesssys/constellation/qemu-metadata-api Docker tag to v2.3.0-pre.0.20221201105133-8004edcc144d (#700 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-01 18:49:02 +01:00
Paul Meyer	8004edcc14	image: add version and debug field to lookup table (#682 ) Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-01 11:51:33 +01:00
Malte Poll	e67f65709f	Prepare release checklist for v2.3 (#690 )	2022-12-01 10:46:04 +01:00
renovate[bot]	da114519ca	Update Constellation containers (#693 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-12-01 08:07:09 +01:00
Leonard Cohnen	7e57944cc0	versions: bump qemu metadata image	2022-11-30 18:58:22 +01:00
renovate[bot]	016f7a67c2	Update Constellation containers to v2.3.0-pre.0.20221130104839-9537fb73c015 (#684 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-11-30 16:53:58 +01:00
Malte Poll	85d723ccbd	Change path for version API: - Rename "updates" -> "versions" - Add explicit "stream" in path to make API self-describing	2022-11-30 16:36:12 +01:00
Paul Meyer	b93b24e058	debugd: add logcollector Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-11-30 16:26:25 +01:00
Malte Poll	9537fb73c0	use constants for default CDN paths	2022-11-30 12:35:12 +01:00
Malte Poll	3aa51df74d	Add release trigger to make image versions available via CDN	2022-11-30 12:35:12 +01:00
Malte Poll	9bccf26ccf	move update api	2022-11-30 12:35:12 +01:00
Malte Poll	ebf852b3ba	Add image update API and use for "upgrade plan"	2022-11-30 12:35:12 +01:00
Thomas Tendyck	21529d0e9e	don't promote Trusted Launch for now	2022-11-30 12:24:37 +01:00
renovate[bot]	8fbc4b9b19	Update ghcr.io/edgelesssys/constellation/node-operator Docker tag to v2.3.0-pre.0.20221129130129-a32f9ae75290 (#671 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-11-30 11:34:57 +01:00
renovate[bot]	e2673cac29	Update Constellation containers (#663 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-11-29 13:46:13 +01:00
Leonard Cohnen	3b6bc3b28f	initserver: add client verification	2022-11-28 19:34:02 +01:00
Thomas Tendyck	64f03cf675	config: sort measurements numerically (#654 ) * config: sort measurements numerically * add comment to swap	2022-11-28 11:09:39 +01:00
Daniel Weiße	d52f3db2a3	AB#2644 Fetch measurements from CDN (#653 ) * Fetch measurements from CDN * Perform metadata validation on fetched measurements * Remove deprecated public bucket Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-28 10:27:33 +01:00
Leonard Cohnen	c978329839	helm: fix expected helm charts	2022-11-27 16:43:50 +01:00
Nils Hanke	878d66dcda	Remove SSHUsers and UserKey from config v2 (#650 ) * Remove SSHUsers and UserKey as part of configVersion v2 * Add migration nodes to docs * Update CHANGELOG.md	2022-11-25 15:27:34 +01:00
renovate[bot]	a3661d6c07	Update Constellation containers to v2.3.0-pre.0.20221125110824-89b25f8ebbd7 (#652 ) * Update Constellation containers to v2.3.0-pre.0.20221125110824-89b25f8ebbd7 * Update node operator and add hashes back for every container image Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Malte Poll <mp@edgeless.systems>	2022-11-25 15:17:58 +01:00
Nils Hanke	89b25f8ebb	Add new generate measurements matrix CI/CD action (now with AWS support) (#641 )	2022-11-25 12:08:24 +01:00
Daniel Weiße	c2ea937fb5	Fix potential data race when accessing a validators OID (#640 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-24 15:50:59 +01:00
renovate[bot]	0b85709dd2	Update Constellation containers to v2.3.0-pre.0.20221124095758-f8001efbc0d0	2022-11-24 13:52:44 +01:00
Daniel Weiße	f8001efbc0	Refactor enforced/expected PCRs (#553 ) * Merge enforced and expected measurements * Update measurement generation to new format * Write expected measurements hex encoded by default * Allow hex or base64 encoded expected measurements * Allow hex or base64 encoded clusterID * Allow security upgrades to warnOnly flag * Upload signed measurements in JSON format * Fetch measurements either from JSON or YAML * Use yaml.v3 instead of yaml.v2 * Error on invalid enforced selection * Add placeholder measurements to config * Update e2e test to new measurement format Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-24 10:57:58 +01:00
renovate[bot]	8ce954e012	Update Constellation containers to v2.3.0-pre.0.20221123084142-3dc9c6086469 (#636 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-11-24 09:22:49 +01:00
Malte Poll	1331c171c3	Upgrade config to v2	2022-11-23 15:47:46 +01:00
Malte Poll	575b6e93f6	CLI: use global image version field - Restructure config by removing CSP-specific image references - Add global image field - Download image lookup table on create - Download QEMU image on QEMU create	2022-11-23 15:47:46 +01:00
Leonard Cohnen	1e98b686b6	kubernetes: verify Kubernetes components	2022-11-23 10:48:03 +01:00
Otto Bittner	6b2d9d16f8	Remove obsolote revive comments	2022-11-23 08:35:12 +01:00
renovate[bot]	bc346805aa	Update Constellation containers to v2.3.0-pre.0.20221121163101-1362e40f53ad (#615 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-11-22 12:39:50 +01:00
Otto Bittner	1362e40f53	Surpress argument-limit errors and add TODO. (#603 )	2022-11-21 17:31:01 +01:00
renovate[bot]	a5aa820d8c	Update Constellation containers (#602 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-11-21 11:23:06 +01:00
Otto Bittner	bdd9dd922b	AB#2589: Deploy operators via Helm (#575 ) * Only deploy operators on GCP/Azure. * cert-manager is now deployed by default (GCP/Azure) * remove OLM	2022-11-21 10:35:40 +01:00
Malte Poll	74aabe86fa	Move PCR[8] -> PCR[12]	2022-11-18 10:37:45 +01:00
Fabian Kammel	56dccb77b4	Merge back changes from v2.2.2 release (#580 ) * prepare v2.2.2 release and update release.md * Updated QEMU measurements * Terraform GCP: Always use the local account for resource creation (#571) * CoreOS is no longer used, change docs to OS. Signed-off-by: Fabian Kammel <fk@edgeless.systems> Co-authored-by: Malte Poll <mp@edgeless.systems>	2022-11-18 10:24:45 +01:00
Daniel Weiße	b966f57a2f	AB#2554 GCP CSI driver deployment (#532 ) * Allow enabling/disabling of CSI driver through config * Fix inconsistent namespace parsing * Deploy GCP CSI driver on init * Update invalid pod tolerations * Add generate script for CSI charts * Update generateCilium script Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-18 10:05:02 +01:00
Nils Hanke	4a2cba988c	Create separate Terraform workspace directory	2022-11-17 13:49:34 +01:00
Fabian Kammel	ca4764c466	Merge v2.2.1 changes back to main (#563 ) * Bump version to v2.2.0 Signed-off-by: Daniel Weiße <dw@edgeless.systems> * Fix release detection in pipeline Signed-off-by: Daniel Weiße <dw@edgeless.systems> * Update CHANGELOG for 2.2.1 Signed-off-by: Fabian Kammel <fk@edgeless.systems> * bump constellation versions to 2.2.1 Signed-off-by: Fabian Kammel <fk@edgeless.systems> Signed-off-by: Daniel Weiße <dw@edgeless.systems> Signed-off-by: Fabian Kammel <fk@edgeless.systems> Co-authored-by: Daniel Weiße <dw@edgeless.systems>	2022-11-16 11:13:10 +01:00
Fabian Kammel	bb76a4e4c8	AB#2512 Config secrets via env var & config refactoring (#544 ) * refactor measurements to use consistent types and less byte pushing * refactor: only rely on a single multierr dependency * extend config creation with envar support * document changes Signed-off-by: Fabian Kammel <fk@edgeless.systems>	2022-11-15 15:40:49 +01:00
Leonard Cohnen	c51694a51a	kubernetes: add hashes to components	2022-11-15 11:07:46 +01:00
Daniel Weiße	5efe05d933	AB#2525 clean up unused code (#504 ) * Rename Metadata->Cloud * Remove unused methods, functions, and variables * More privacy for testing stubs Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-15 10:31:55 +01:00
Daniel Weiße	f41c54e837	AB#2524 Refactor Azure metadata/cloud API (#477 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-15 09:08:18 +01:00
renovate[bot]	df0c6159db	Update K8s constrained versions	2022-11-14 09:33:42 +01:00
Daniel Weiße	a07cab4b97	Update go-tpm dependency (#533 ) Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-14 09:02:56 +01:00
Fabian Kammel	b92b3772ca	Remove access manager (#470 ) * remove access manager from code base * document new node ssh workflow * keep config backwards compatible * slow down link checking to prevent http 429 Signed-off-by: Fabian Kammel <fk@edgeless.systems>	2022-11-11 08:44:36 +01:00
renovate[bot]	c6f4b2e1a0	Update Constellation containers to v2.3.0-pre.0.20221109145754-0d12e37c9699 (#497 ) Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>	2022-11-09 18:17:31 +01:00
Fabian Kammel	0d12e37c96	Document exported funcs,types,interfaces and enable check. (#475 ) * Include EXC0014 and fix issues. * Include EXC0012 and fix issues. Signed-off-by: Fabian Kammel <fk@edgeless.systems> Co-authored-by: Otto Bittner <cobittner@posteo.net>	2022-11-09 15:57:54 +01:00
Daniel Weiße	c9873f2bfb	AB#2523 Refactor GCP metadata/cloud API (#387 ) * Refactor GCP metadata/cloud API * Remove cloud controller manager from metadata package * Remove PublicIP * Move shared cloud packages * Remove dead code Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-09 14:43:48 +01:00
Leonard Cohnen	3c6d59ce7e	aws: don't flag release as debug images	2022-11-09 11:20:58 +01:00
Leonard Cohnen	97acdfa297	config: align pre-filled AWS measurements	2022-11-09 11:20:58 +01:00
Daniel Weiße	011f9c597d	Bring in changes from release branch (#479 ) * Bump version to v2.2.0 * Update changelog * Fix release detection in pipeline * Fix PKI selection in pipeline * Set enforced measurements for AWS * Update default images * Fix release docs * Update mini-con defaults * Fix measurements action * Fix syft env variable naming Signed-off-by: Daniel Weiße <dw@edgeless.systems>	2022-11-08 18:32:59 +01:00
renovate[bot]	9ecc92e35f	Update dependency kubernetes-sigs/cri-tools to v1.25.0 (#458 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2022-11-04 17:38:52 +01:00
3u13r	4f4cd4cc67	bump verify image 20221104 (#459 )	2022-11-04 13:56:19 +01:00
Leonard Cohnen	6fce8f77d3	join-service: bump image for AWS support	2022-11-03 16:44:54 +01:00
Otto Bittner	f164af29cf	AB#2583: deploy autoscaler via helm (#438 )	2022-11-03 16:42:19 +01:00
Otto Bittner	0887bc540f	Fix invalid slice access in validateAk (#437 )	2022-11-03 09:57:59 +01:00
Leonard Cohnen	1f9a788c21	aws: name instances for CCM	2022-11-02 23:29:04 +01:00
Leonard Cohnen	3aa0177333	join-service: add AWS attestation	2022-11-02 23:29:04 +01:00
Leonard Cohnen	b69d19c3d6	metadata: clarify networking variables	2022-11-02 23:29:04 +01:00
Leonard Cohnen	0430336fdf	metadata: implement GetLoadBalancerEndpoint for AWS	2022-11-02 23:29:04 +01:00
Leonard Cohnen	dd007f4772	metadata: move subnetCIDR to InstanceMetadata	2022-11-02 23:29:04 +01:00
Leonard Cohnen	d59dc82e56	qemu attestation: fix typos	2022-11-02 23:29:04 +01:00

... 6 7 8 9 10 ...

994 Commits