* vpn: ship our own container image
The container image used in the VPN chart should be reproducible and
stable. We're sticking close to the original nixery.dev version by
building the image with nix ourselves, and then publishing the single
layer from the result with Bazel OCI rules. The resulting image should
be handled similar to s3proxy: it's built as a part of the Constellation
release process and then consumed from a Helm chart in our registry.
Co-authored-by: Malte Poll <1780588+malt3@users.noreply.github.com>
* Make default instance type configurable for provider sample
* Set TDX instance type when running TDX provider e2e test
* Fix missing attestation variant when setting up stub config in provider e2e test
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Fail workflow on error in subshell
* Remove relative paths from workflow
* Set up MMA only for SEV-SNP, not for Azure TDX
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* ci: improve constellation_create error message
When we hit a timeout due to nodes not coming up, the actual error
message is hard to make out because it's buried in a group. With the
right formatting, the error message will be highlighted in the UI.
Another improvement is to output the state of nodes, which helps
debugging the cause of nodes not joining or not becoming ready.
* cleanup: use NodeVersionResourceName constant
... instead of literal strings.
* ci: correctly notify on e2e upgrade error
* atls: report cert extension OIDs on mismatch
If the certificate contains an attestation document for SEV-SNP, but the
given validator is for Nitro, verifyEmbeddedReport should not claim that
there is no attestation document, but that there is no _compatible_ one
and what the incompatible ones were.
* .github: add e2e test to pr checklist
* ci: use sonobuoy quick where possible
* ci: run malicious join test on release
* ci: remove self managed infra test
* ci: remove non-example terraform test from weekly
* ci: run Sonobuoy full on the latest k8s version weekly
* ci: run weekly sonobuoy quick on all k8s versions
* ci: don't run double sonobuoy tests on latest k8s version
Long lists of items in source code or config can be hard to work with as
a human, most problematic being out-of-order entries in an otherwise
ordered list. This is where keep-sorted comes to the rescue: we can
leave two little comments on every listing we care about, and
keep-sorted ensures that the listing stays in order.
This commit also applied keep-sorted to the CODEOWNERS file, hopefully
demonstrating its usefulness to some extent. I'd expect more uses for
keep-sorted to be discovered organically over time.
keep-sorted is super fast, so it should not be a problem to add it to
the //:tidy target, even if we scan all files in the code base. On my
MacBook:
$ time (find . -not -path "./.git/*" -type f | sort | xargs "${keep_sorted}" --mode fix)
real 0m0.249s
user 0m0.124s
sys 0m0.129s
* Add attestation variant to notify hooks
* Quote all inputs in OpenSearch URL
* Add clusterCreation field to OpenSearch URL
* Omit empty fields in OpenSearch URL
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
