Commit Graph

792 Commits

Author SHA1 Message Date
Thomas Tendyck
399376d3e3
Make SEV-SNP the default attestation variant on GCP (#3267)
* Make SNP the default on GCP

* fixup! Make SNP

* fixup! Make SNP
2024-07-22 13:29:27 +02:00
renovate[bot]
78ce220cf9
deps: update GitHub action dependencies (#3259)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-07-18 08:49:57 +02:00
Daniel Weiße
391deeae37
ci: reduce max parallel attestationconfig e2e tests back to 1 for stability (#3208)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-07-10 08:24:32 +02:00
Moritz Sanft
74e0f44230
chore: v2.17.0 post-release (#3229)
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2024-07-04 11:17:55 +02:00
Daniel Weiße
e9a4ccd009
ci: run versionsapi through Bazel instead of building a container (#3231)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-07-04 10:02:59 +02:00
Daniel Weiße
9c3cb08f92
deps: bump Go version to v1.22.5 (#3225)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-07-03 09:49:37 +02:00
Moritz Sanft
c48995f249
ci: only commit measurements if changes are present (#3223)
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2024-07-02 09:12:46 +02:00
Moritz Sanft
c7027d9ddf
ci: add missing permissions in release workflow (#3220)
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2024-07-01 16:23:53 +02:00
Daniel Weiße
d67d0ac9df Enable upload of TDX reports to Constellation CDN
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-27 09:09:13 +02:00
renovate[bot]
af3f2bcd42
deps: update GitHub action dependencies (#3198)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-06-24 15:19:00 +02:00
Markus Rudy
c911eb4e3a
versions: default to k8s v1.29, support k8s v1.30, EOL v1.27 (#3173)
* versions: remove k8s 1.27 and patch-upgrade the others

* versions: add support for k8s 1.30.2

* versions: upgrade cloud provider images
2024-06-19 17:34:34 +02:00
renovate[bot]
9cd1184244
deps: update GitHub action dependencies (#3176)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-06-19 15:19:41 +02:00
Markus Rudy
9a295b2c3a
ci: better fence around tidy-check-generate summary (#3174) 2024-06-19 12:19:41 +02:00
Moritz Sanft
3efd50a518
ci: bump origin versions of upgrade tests (#3158) 2024-06-10 14:04:00 +02:00
Daniel Weiße
d64aba7636
ci: author scheduled PRs using edgelessci account (#3145)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-05 10:41:19 +02:00
Daniel Weiße
39b01f8dac
deps: bump Go version to v1.22.4 (#3146)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-05 10:27:39 +02:00
Daniel Weiße
1514351571
ci: update conditions on when to auto assign reviewer (#3141)
* Use the correct value for `github.event.pull_request.requested_reviewers`
* Run the workflow on more events than just labeling a PR
* Skip workflow if there are already reviewers assigned

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-05 08:42:47 +02:00
renovate[bot]
72555e9ba1
deps: update GitHub action dependencies (#3140)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-06-04 14:50:20 +02:00
Daniel Weiße
66aa8a8d52
ci: adjust performance benchmark to run on different attestation variants (#3129)
* Create perf bench artifacts based on attestation variant, not CSP
* Enable perf bench on gcp-sev-snp, azure-tdx and AWS

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-04 13:23:07 +02:00
miampf
fbdc8f6e85
ci: clean up failed miniconstellation e2e tests (#3109) 2024-05-31 13:51:55 +02:00
Daniel Weiße
3834373fd2
ci: disable perf-bench test for gcp-sev-snp (#3127)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-28 16:25:37 +02:00
renovate[bot]
80917921e3
deps: update GitHub action dependencies (#3123)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-24 11:04:23 +02:00
Malte Poll
b86faadfcc tidy: document MODULE.bazel.lock maintencance 2024-05-23 09:48:04 +02:00
renovate[bot]
36a827056f
deps: update softprops/action-gh-release action to v2 (#3103)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-15 10:54:37 +02:00
renovate[bot]
ed54277f78
deps: update actions/download-artifact action to v4 (#3096)
* deps: update actions/download-artifact action to v4

* Update slsa generator action to v2

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2024-05-15 09:26:10 +02:00
renovate[bot]
73d86c25df
deps: update azure/login action to v2 (#3097)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-15 09:05:50 +02:00
renovate[bot]
d5d5ea857d
deps: update github/codeql-action action to v3 (#3099)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-15 09:05:38 +02:00
renovate[bot]
62baa9bed2
deps: update cachix/install-nix-action action to v26 (#3098)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-15 08:59:07 +02:00
renovate[bot]
c866e3d670
deps: update actions/checkout action to v4 (#3095)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-15 08:58:56 +02:00
Markus Rudy
8e3cf5a270
s3proxy: commit image version on release, too (#3093) 2024-05-14 15:45:06 +02:00
Malte Poll
93fcb51e67 ci: explicitly set bazel test timeout to four hours for e2e tests
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2024-05-14 13:34:50 +02:00
Markus Rudy
43e6b85026
ci: only assign reviewer to bot PRs (#3091) 2024-05-14 10:02:00 +02:00
renovate[bot]
d76c9ac82d
deps: update GitHub action dependencies (#3086)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-13 10:42:07 +02:00
Malte Poll
03475b60b3
ci: disable BuildBuddy (#3077) 2024-05-10 11:14:45 +02:00
Malte Poll
1c0c7d6227
ci: disable e2e-attestationconfigapi on PRs (#2937)
This workflow touches shared state by deleting all objects of a bucket and then
uploading a signed blob of data to that S3 bucket under a fixed name.
It also does so multiple times in a row, while invalidating the cloudfront
cache and checking if the uploaded object exists.
All runs of this workflow share the same bucket.
Since this pipeline runs on any modification of go.mod, it is very prone
to race condition between PRs (or PRs and main).
2024-05-08 14:59:03 +02:00
renovate[bot]
adf03ad76c
deps: update GitHub action dependencies (#3070)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-05-08 14:33:35 +02:00
Daniel Weiße
86c45d1d5f
deps: update to Go 1.22.3 (#3069)
* Update renovate syntax
* Update to Go 1.22.3

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-08 11:34:31 +02:00
Daniel Weiße
edc0c7068e
ci: fix delete artifact conditional (#3067)
* Fix state exists check
* Dont fail if folder to remove does not exist

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-07 08:48:38 +02:00
miampf
bd26cb592d
ci: correctly clean up failed windows e2e tests (#3059) 2024-05-03 10:54:08 +00:00
Daniel Weiße
f6999084c9
terraform: set empty default value for additional_tags (#3052)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-03 10:27:46 +02:00
Daniel Weiße
35bd805bec
ci: enable gcp-sev-snp for daily tests (#3058)
* Run gcp-sev-snp debug e2e test in daily
* Fix verify e2e test not creating json file for gcp-sev-snp

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-03 08:18:21 +02:00
Daniel Weiße
259e85d9c1
ci: reduce noise from warnings (#3055)
* Fix whitespace errors
* Remove usage of external action to URI encode component
* Upgrade Azure login action to v2.1
* Remove GitHub actions warning when running e2e test with NOP payload
* Only try to upload updated tf state if it exists
* Upgrade out of date aws credential actions

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-03 08:17:40 +02:00
miampf
0c0d87aa4c
ci: Delete e2e terraform state (#2874) 2024-04-26 10:06:01 +00:00
Daniel Weiße
680d3318af
ci: ensure --tags flag is only set if the CLI supports it (#3044)
* Use github.run_id to correctly tag resources with the run id
* Ensure `--tags` flag is only set if CLI supports it

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-26 09:34:21 +02:00
miampf
3f7a4e4313
ci: tag resources created by e2e tests with the run name (#3035) 2024-04-25 12:02:23 +00:00
Daniel Weiße
056f991f58
ci: add missing permission for e2e-windows test in weekly run (#3037)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-22 15:21:56 +02:00
Markus Rudy
9b52ec403b
deps: auto-assign reviewer for deps PRs (#3032)
* deps: auto-assign reviewer for deps PRs

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2024-04-17 20:38:32 +02:00
Moritz Sanft
35e19a45bb
ci: disable SEV-SNP tests that need stable images (#3031) 2024-04-17 09:12:52 +02:00
Moritz Sanft
913b09aeb8
Support SEV-SNP on GCP (#3011)
* terraform: enable creation of SEV-SNP VMs on GCP

* variant: add SEV-SNP attestation variant

* config: add SEV-SNP config options for GCP

* measurements: add GCP SEV-SNP measurements

* gcp: separate package for SEV-ES

* attestation: add GCP SEV-SNP attestation logic

* gcp: factor out common logic

* choose: add GCP SEV-SNP

* cli: add TF variable passthrough for GCP SEV-SNP variables

* cli: support GCP SEV-SNP for `constellation verify`

* Adjust usage of GCP SEV-SNP throughout codebase

* ci: add GCP SEV-SNP

* terraform-provider: support GCP SEV-SNP

* docs: add GCP SEV-SNP reference

* linter fixes

* gcp: only run test with TPM simulator

* gcp: remove nonsense test

* Update cli/internal/cmd/verify.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update docs/docs/overview/clouds.md

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update terraform-provider-constellation/internal/provider/attestation_data_source_test.go

Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>

* linter fixes

* terraform_provider: correctly pass down CC technology

* config: mark attestationconfigapi as unimplemented

* gcp: fix comments and typos

* snp: use nonce and PK hash in SNP report

* snp: ensure we never use ARK supplied by Issuer (#3025)

* Make sure SNP ARK is always loaded from config, or fetched from AMD KDS
* GCP: Set validator `reportData` correctly

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* attestationconfigapi: add GCP to uploading

* snp: use correct cert

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform-provider: enable fetching of attestation config values for GCP SEV-SNP

* linter fixes

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
2024-04-16 18:13:47 +02:00
davidweisse
e89d8e4d72
ci: add error handling to e2e windows liveness probe (#3018)
* workflows: add error handling to e2e windows liveness probe

* update retry condition in last iteration

* Update liveness probe to check for correct number of nodes

* ci: fix Windows e2e test not pushing required container images (#3021)

* More output when waiting for nodes to get ready
* Create unique resource group name for Windows e2e test
* Push container images on windows CLI build to fix e2e test

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Fix resource group naming

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2024-04-11 11:27:12 +02:00