Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-03-28 09:38:37 -04:00
Code Issues Packages Projects Releases Wiki Activity
4,003 Commits 142 Branches 52 Tags
0df26c0e9b
Commit Graph

4003 Commits

Author SHA1 Message Date
Daniel Weiße
65d28f913f Allow starting e2e tests based on attestation variant instead of csp 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2024-01-26 17:06:28 +01:00
Markus Rudy
597a923a7f
cilium: performance fixes and reproducible images () 
* helm: bump cilium version

* helm: patch Cilium chart version
 2024-01-26 17:03:40 +01:00
Daniel Weiße
78b9b0fc96
terraform-provider: enable Azure TDX () 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2024-01-26 15:46:21 +01:00
renovate[bot]
d58d888f54 deps: update dependency Pillow to v10.2.0 [SECURITY] 2024-01-26 15:41:44 +01:00
Moritz Eckert
d6639f7788
add azure region germany west central 2024-01-26 10:04:59 +01:00
edgelessci
49a806a874
image: update measurements and image version () 
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
 2024-01-26 08:15:43 +01:00
Moritz Eckert
26f6fd074f
ci: fix e2e_benchmark comparison 2024-01-25 11:12:32 +01:00
Adrian Stobbe
77276cb4ca
add provider example test to weekly () 2024-01-25 11:09:27 +01:00
Markus Rudy
9fb6c3216e
helm: remove kube-rbac-proxy () 2024-01-25 10:06:40 +01:00
Adrian Stobbe
4431ac3233
ci: fix missing quotes in Opensearch link () 2024-01-24 17:29:19 +01:00
Malte Poll
d3cffa9fee
image: update Linux to 6.1.74 () 2024-01-24 17:10:56 +01:00
Daniel Weiße
e350ca0f57
attestation: add Azure TDX attestation () 
* Implement Azure TDX attestation primitives
* Add default measurements and claims for Azure TDX
* Enable Constellation on Azure TDX

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2024-01-24 15:10:15 +01:00
Moritz Sanft
e07ea4b40f
operator: fix get-handling of Azure marketplace images () 
* operator: support getting MP images

* operator: support getting MP node image

* operator: refactorings
 2024-01-24 10:22:40 +01:00
Moritz Eckert
da26daeb49
docs: update clouds and marketplaces 
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
 2024-01-24 09:57:35 +01:00
Thomas Tendyck
ad5ff6e1bb ci: update vale 2024-01-24 09:07:19 +01:00
edgelessci
6ae59bb986
image: update measurements and image version () 
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
 2024-01-24 08:22:48 +01:00
Malte Poll
c8ffba0366 measurements: update expected PCR[1] on GCP 2024-01-23 21:55:12 +01:00
Malte Poll
a2e2f0387c measurements: correctly override validation options 2024-01-23 21:55:12 +01:00
3u13r
2a7a9dc2aa
helm: re-enable native routing for gcp () 2024-01-23 14:46:24 +01:00
Moritz Sanft
5faa374ede
terraform-provider: validate pod ip cidr only on gcp () 2024-01-23 09:08:23 +01:00
Adrian Stobbe
4db0662b06
ci: remove broken label from OpenSearch query link () 2024-01-23 08:32:02 +01:00
edgelessci
fc1c9b7c1a
image: update locked rpms () 
Co-authored-by: malt3 <malt3@users.noreply.github.com>
 2024-01-22 14:07:26 +01:00
Malte Poll
3a5753045e goleak: ignore rules_go SIGTERM handler 
rules_go added a SIGTERM handler that has a goroutine that survives the scope of the goleak check.
Currently, the best known workaround is to ignore this goroutine.

https://github.com/uber-go/goleak/issues/119
https://github.com/bazelbuild/rules_go/pull/3749
https://github.com/bazelbuild/rules_go/pull/3827#issuecomment-1894002120
 2024-01-22 13:11:58 +01:00
Malte Poll
66faa5493f deps: Go 1.21.6 2024-01-22 13:11:58 +01:00
Malte Poll
f465356ace nix: update flake.lock 2024-01-22 13:11:58 +01:00
Malte Poll
64a4a2230d deps: update gazelle and rules_go 2024-01-22 13:11:58 +01:00
Malte Poll
e40d1e56d8 deps: update hermetic_cc_toolchain 2024-01-22 13:11:58 +01:00
Malte Poll
00eacdf9e8 image: mark image upload as manual bazel target 2024-01-22 13:11:58 +01:00
Moritz Sanft
0030a26eaf
ci: parallelize upgrade e2e test () 
* ci: parallelize upgrade e2e test

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* ci: revert name change

* ci: upgrade checkout action

* ci: add target version before building target cli

* ci: rename input

* ci: upload service account key

* ci: download sa key on GCP

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
 2024-01-19 16:34:47 +01:00
edgelessci
3b02edcc48
image: update measurements and image version () 
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
 2024-01-19 09:12:24 +01:00
edgelessci
2acbd10ef7
image: update measurements and image version () 
Co-authored-by: malt3 <malt3@users.noreply.github.com>
 2024-01-17 18:55:10 +01:00
Malte Poll
b8933560be
image upload: use unique blob name for AWS images uploaded to S3 () 
When uploading images to AWS, they need to be uploaded to S3 first.
Since blob names are not unique between attestation variants, there
was a possibility for one S3 upload to be used for the wrong AMI.
 2024-01-17 17:09:07 +01:00
edgelessci
6259815869
image: update measurements and image version () 
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
 2024-01-17 08:11:53 +01:00
Malte Poll
9d6321faa3 uplosi: use separate galleries for Azure TDX and TDX 2024-01-16 17:34:44 +01:00
Malte Poll
52dec77508 nix: update uplosi to support Azure TDX 2024-01-16 17:34:44 +01:00
Malte Poll
336ba6bc34 attestation: add Azure TDX variant 
Only a stub for now.
 2024-01-16 17:34:44 +01:00
Malte Poll
5063b815f1 config: allow Azure TDX instance types 2024-01-16 17:34:44 +01:00
Malte Poll
403acf75aa image: add mainline kernel and azure tdx image target 2024-01-16 17:34:44 +01:00
Markus Rudy
e29ea77d23
helm: bump Cilium chart version () 
* helm: bump Cilium chart version

* helm: generate Cilium chart
 2024-01-16 14:49:24 +01:00
Markus Rudy
16c63d57cd
dev-docs: Helm chart for full L3 VPN connectivity () 
* dev-docs: add 'things to try' section to VPN howto

* dev-docs: full L3 connectivity in VPN chart
 2024-01-16 13:59:33 +01:00
Malte Poll
9181705299
ci: use sonobuoy 0.57.1 () 2024-01-16 13:19:46 +01:00
Markus Rudy
2d3996d5b3
ci: don't check Wireguard weblinks () 2024-01-15 15:45:45 +01:00
Moritz Sanft
bf02680477
ci: mirror GCP images to MPI project on release () 2024-01-15 13:58:30 +01:00
Malte Poll
9a27e7bf77 image: only archive release images + QEMU / OpenStack image 2024-01-15 13:53:15 +01:00
Malte Poll
8a74893461 ci: build and upload OS image in single job 2024-01-15 13:53:15 +01:00
Malte Poll
5ec03c5b9d image: add upload rules for images 2024-01-15 13:53:15 +01:00
Malte Poll
f237ae8ae2 bazel: add upload_os_images rule 
This rule combines uplosi, the upload command, measurement code and cosign
to upload OS images, extract measurements, sign them and upload the measurements.
 2024-01-15 13:53:15 +01:00
Malte Poll
b7bab7c3c8 image: replace "upload {aws|azure|gcp}" with uplosi 2024-01-15 13:53:15 +01:00
Malte Poll
fb392c2d50 image: add image uploader that uses uplosi in the background 
This implementation will replace the custom Go code in
internal/osimage/{aws|azure|gcp} and still conforms to the same interface.
 2024-01-15 13:53:15 +01:00
Malte Poll
181b8f64d2 image: add static (per-CSP) measurements during "measurement envelope" 
This logic was previously performed in a GitHub Actions workflow
using yq.
Since every step should now be performed in Bazel, this now needs to happen here.
 2024-01-15 13:53:15 +01:00