Commit Graph

482 Commits

Author SHA1 Message Date
Otto Bittner
ff5100f332 AB#2234: Introduce AddNodeSelectorsToDeployment
Add the above function to the different client interfaces.
Remove previously used Command.Exec call.
2022-07-26 16:53:41 +02:00
Otto Bittner
6b6a3ee976 AB#2234: Introduce AddTolerationsToDeployment
Add the above function to the different client interfaces.
Update adjacent functions to provided needed ctx and client
objects.
2022-07-26 16:53:41 +02:00
Moritz Eckert
ad02249b9a Add VerifyService port to GCP LB (#291)
* Add VerifyService port to GCP LB

* cli verify command: Use verify service port by default

Co-authored-by: Malte Poll <mp@edgeless.systems>
2022-07-26 16:35:14 +02:00
Thomas Tendyck
244426305d fix integration test workflow 2022-07-26 15:59:04 +02:00
Thomas Tendyck
aa0a07592b check licenses (#297)
* AB#2222 check licenses of dependencies

* AB#2222 check-licenses: use setup-go
2022-07-26 11:49:13 +02:00
Daniel Weiße
db79784045 AB#2200 Merge Owner and Cluster ID (#282)
* Merge Owner and Cluster ID into single value

* Remove aTLS from KMS, as it is no longer used for cluster external communication

* Update verify command to use cluster-id instead of unique-id flag

* Remove owner ID from init output

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-07-26 10:58:39 +02:00
Thomas Tendyck
48d614c959 AB#2222 replace unlicensed passwd package with own implementation 2022-07-25 15:10:29 +02:00
dependabot[bot]
f57a7e3ed0 Bump docker/setup-buildx-action from 1.7.0 to 2 (#285)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 1.7.0 to 2.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](f211e3e9de...dc7b9719a9)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-25 12:14:17 +02:00
Fabian Kammel
3a52bcabeb First suggestion for issue and pr templates. (#289)
* First suggestion for issue and pr templates.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-25 12:13:02 +02:00
Fabian Kammel
ae13163fb7 kubectl wait is not supported for daemonset (#296)
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-25 11:07:21 +02:00
Malte Poll
aacbf9dc70 Bump coreos images to 1658499095 (#295) 2022-07-25 09:03:51 +02:00
Otto Bittner
566b40699f AB#2255: Bump joinservice version (#294) 2022-07-22 15:44:27 +02:00
Otto Bittner
52ceced223 AB#2255: Fix kubeadm version incompatibility (#293)
* Update image version
* Introduce 'ValidK8sVersion' type. Ensures that consumers
of the k8sVersion receive a valid version, without
having to do their own validation.
* Add testcase to check that kubeadm accepts the currently provided
version.
2022-07-22 15:05:04 +02:00
Malte Poll
ebf76ae7e3 kubernetes binary download: retry downloads for every error during download (after preparing the destination tempfile) (#290)
kubernetes binary download: retry downloads for every error during download (after preparing the destination tempfile)

Signed-off-by: Malte Poll <mp@edgeless.systems>
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2022-07-22 11:10:39 +02:00
Otto Bittner
c743398a23 AB#2181: retry k8s downloads (#286)
Generalize retrier:
* Generalize Do to use a supplied 'retriable' function
* Make clock an optional argument in NewIntervalRetrier
* Move grpc/retrier to interal package
* Update existing unittests to not use retry feature

Add retryDownloadToTempDir:
* Wrap downloadToTempDir with retrier.
* Retry if TCP connection is reset.
* Abort by canceling the context.
* Use a mock server in the unit test that serves responses
depending on the state received through a state channel.

Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
2022-07-21 15:20:12 +02:00
Otto Bittner
741384158a AB#2076: version specific images (#288)
KubernetesVersion sent by the init command now controls
all downloaded binaries, if they depend on the k8s version.

* Move all download links into /internal/versions.
* Unify files in /internal/versions package
* Move image download links into VersionConfigs
and thus make them dependant on the k8s version,
where the image version is specific to the k8s version.
* Don't specify patch version in k8sVersion
2022-07-21 14:41:07 +02:00
dependabot[bot]
b57e9cf92a Bump docker/login-action from 1.14.1 to 2 (#284)
Bumps [docker/login-action](https://github.com/docker/login-action) from 1.14.1 to 2.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](dd4fa0671b...49ed152c8e)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-21 09:45:54 +02:00
Fabian Kammel
ba5a3aefe3 fix ci-lint issues (#287)
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-20 16:44:41 +02:00
Fabian Kammel
085f548333 GitHub action pin-by-hash & dependabot (#283)
* remove Sunday and Monday morning runs, little value
* run test lint on main, as we do for all linters
* fixup outdated instructions
* use version hash instead of tags
* use dependabot for github actions
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-20 10:48:01 +02:00
Fabian Kammel
3842e50c49 use common boostrapperhost field and wait before reading pcr values (#281)
* use common boostrapperhost field and wait before reading pcr values
* use wait to be more explicit about goal
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2022-07-20 10:47:22 +02:00
Daniel Weiße
877fc7a0d2 [RFC] HKDF key derivation and the use of salts (#275)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-07-20 09:16:13 +02:00
Malte Poll
a660af05f1 Use same name for k8s config map key and filename of k8s config map version in joinservice
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-07-19 09:27:23 +02:00
Malte Poll
9f31e0a539 Update join-service image after proto definition change
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-07-18 17:38:07 +02:00
Fabian Kammel
193a91d911 fix reference for statefile field and unwrap errors (#278)
* fix reference for statefile field
* unwrap errors before checking status
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-18 14:00:57 +02:00
Otto Bittner
a68ee817ff AB#2074: Choosable K8S Version (#277)
AB#2074: Add configurable k8s version

Configurable version flow:
* cli config holds/validates k8sVersion
* InitCluster receive a k8sVersion arg
* InitCluster creates CM "k8s-version"
* kubeadm's InitConfiguration receives k8sVersion
* joinservice spec mounts/reads k8s-version CM
* joinservice supplies k8sVersion via JoinTicketResponse
Other changes:
* Remove unused test code (FakeK8SClient)
* move VersionConfig map to /internal/versions
* installk8sComponents is now a function instead of a method
2022-07-18 12:28:02 +02:00
Malte Poll
d3466da393 Add azure jump host hack script
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-07-18 10:20:36 +02:00
Fabian Kammel
a931f6692f Fix/bootstrapper regressions (#274)
* remove wireguard from e2e tests, conformance docs & config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-15 11:53:14 +02:00
Fabian Kammel
e315a3b5d8 AB#2070 automatic cli ref update (#272)
* automatically update cli reference branch in docs repository
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-07-15 10:23:52 +02:00
Daniel Weiße
c6ff34f4d2 Use Certificate Requests to issue Kubelet Certificates and set CA (#261)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-07-15 09:33:11 +02:00
Malte Poll
49e98286a9 bump coreos 1657814939
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-07-15 09:15:55 +02:00
Daniel Weiße
edf424d415 Refactor bootstrapper logging
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-07-15 09:09:56 +02:00
Malte Poll
50188d1d93 pseudo-version: always use tag name instead of message
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-07-15 09:04:37 +02:00
Malte Poll
ea9450dcfd Update CHANGELOG 2022-07-14 18:03:49 +02:00
Malte Poll
f63c99a1bd Use go pseudo versions for container images
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-07-14 17:34:33 +02:00
Malte Poll
d1d24ca587 pseudo-version: allow tags that are only references 2022-07-14 17:25:18 +02:00
Malte Poll
cce2611e2a Simplify node lock and various small changes
Co-authored-by: Fabian Kammel <fabian@kammel.dev>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2022-07-14 17:25:18 +02:00
Daniel Weiße
2bcf001d52 Distribute k8s CA certificates and key over join-service
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-07-14 17:25:18 +02:00
Malte Poll
260d2571c1 Only upload kubeadm certs if key is rotated
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: 3u13r <lc@edgeless.systems>
2022-07-14 17:25:18 +02:00
daniel-weisse
586b65f089 Cache kubeadm certificate keys to avoid race conditions
Signed-off-by: daniel-weisse <daniel.weisse@gmx.net>
2022-07-14 17:25:18 +02:00
Malte Poll
5d54ce689b Print kubeadm init/join output on success 2022-07-14 17:25:18 +02:00
katexochen
66b573ea5d Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
1af18e990d Rename all activation 2022-07-14 17:25:18 +02:00
katexochen
2083d37b11 Create internal package for joinservice 2022-07-14 17:25:18 +02:00
katexochen
43eb94b6dc Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
15adba9235 Simplify joinproto 2022-07-14 17:25:18 +02:00
katexochen
dc9e8e75df Rename activation to joinservice 2022-07-14 17:25:18 +02:00
katexochen
dea23604fb Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
916e5d6b55 Rename coordinator to bootstrapper and rename roles 2022-07-14 17:25:18 +02:00
Malte Poll
3280ed200c Test IntervalRetrier 2022-07-14 17:25:18 +02:00
katexochen
f79674cbb8 Bootstrapper 2022-07-14 17:25:18 +02:00