Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-25 15:39:37 -05:00
Code Issues Packages Projects Releases Wiki Activity
1,436 Commits 137 Branches 49 Tags 92 MiB
3b6bc3b28f
Commit Graph

187 Commits

Author SHA1 Message Date
Fabian Kammel
668b4d000b
document usage of iamlive (#443) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-11-04 14:01:23 +01:00
renovate[bot]
934d173650
Update AWS SDK (#412) 
* Update AWS SDK

* [bot] Tidy all modules

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-11-04 13:17:27 +01:00
renovate[bot]
8e44eb7ea5
Update module github.com/sigstore/rekor to v1 (#453) 
* Update module github.com/sigstore/rekor to v1
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-11-04 12:45:45 +01:00
renovate[bot]
44b1a92d6b
Update fedora Docker digest to 455fec9 (#447) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Nirusu <Nirusu@users.noreply.github.com>
 2022-11-04 11:49:41 +01:00
Leonard Cohnen
f7a5f299a0 aws: add needed IAM permission for join service 2022-11-03 16:44:54 +01:00
Leonard Cohnen
0430336fdf metadata: implement GetLoadBalancerEndpoint for AWS 2022-11-02 23:29:04 +01:00
Leonard Cohnen
d979aeea2d terraform: add necessary IAM permissions for AWS 2022-11-02 23:29:04 +01:00
Nils Hanke
7ca4a6d0e1 Adjust CI scripts to avoid termination prompt 2022-11-02 18:18:30 +01:00
renovate[bot]
4b257616e4
Update k8s.io/utils digest to 61b03e2 (#427) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-11-02 16:04:19 +01:00
Daniel Weiße
55cfff034a
Remove PublicIP from QEMU metadata (#396) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-02 12:56:16 +01:00
Nils Hanke
6d2ec109d0 Update to Go 1.19.3 2022-11-02 11:53:52 +01:00
renovate[bot]
67a99434e9
Update module github.com/sigstore/sigstore to v1.4.5 (#383) 
* Update module github.com/sigstore/sigstore to v1.4.5
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-11-01 12:14:55 +01:00
Otto Bittner
30bdbd9b85
Add helm unittests (#380) 2022-10-31 19:25:02 +01:00
Daniel Weiße
79f52e67cb
Update go-tpm-tools to fix AWS PCR selection (#390) 
* Update go-tpm-tools to fix AWS PCR selection

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Ignore leaking glog go routine

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-28 17:57:24 +02:00
Paul Meyer
256f0e64b3 Upgrade Go version to 1.19 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-28 16:06:53 +02:00
renovate[bot]
4ef94834ed
Update module github.com/googleapis/gax-go/v2 to v2.6.0 (#330) 
* Update module github.com/googleapis/gax-go/v2 to v2.6.0
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-28 09:33:29 +02:00
leongross
d457620941
AB#2458 AWS NitroTPM attestation (#339) 
* add aws tpm attestation
* fix typos
* Fix return value issue

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-27 11:04:23 +02:00
renovate[bot]
8d82d8c0fa
Update module github.com/stretchr/testify to v1.8.1 (#385) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-27 08:39:45 +02:00
renovate[bot]
8c01a6647f
Update module github.com/spf13/cobra to v1.6.1 (#384) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-27 08:25:21 +02:00
renovate[bot]
9210ae5d04
Update google.golang.org/genproto digest to 527a21c (#320) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-26 15:47:16 +02:00
Malte Poll
2d121d9243
Replace interface{} -> any (#370) 2022-10-25 15:51:23 +02:00
Malte Poll
52f140a968
Pin terraform provider hashes (#361) 2022-10-25 10:10:46 +02:00
renovate[bot]
c452f17ca2
Update module golang.org/x/mod to v0.6.0 (#335) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-24 18:44:03 +02:00
Daniel Weiße
c82d5ccba9
Hide cursor and fix dots (#217) 
* Hide cursor and fix dots spinner

* Allow restarting of spinner

* Don't spin on non TTY output

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-21 14:26:42 +02:00
renovate[bot]
56981a709e
Update module github.com/aws/aws-sdk-go-v2/service/kms to v1.18.13 (#346) 
* Update module github.com/aws/aws-sdk-go-v2/service/kms to v1.18.13

* [bot] Tidy all modules

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-10-21 14:08:36 +02:00
renovate[bot]
02f1f5109a Update module google.golang.org/grpc to v1.50.1 2022-10-21 13:28:03 +02:00
Nils Hanke
04c4cff9f6
AB#2436: Initial support for create/terminate AWS NitroTPM instances 
* Add .DS_Store to .gitignore

* Add AWS to config / supported instance types

* Move AWS terraform skeleton to cli/internal/terraform

* Move currently unused IAM to hack/terraform/aws

* Print supported AWS instance types when AWS dev flag is set

* Block everything aTLS related (e.g. init, verify) until AWS attestation is available

* Create/Terminate AWS dev cluster when dev flag is set

* Restrict Nitro instances to NitroTPM supported specifically

* Pin zone for subnets

This is not great for HA, but for now we need to avoid the two subnets
ending up in different zones, causing the load balancer to not be able
to connect to the targets.

Should be replaced later with a better implementation that just uses
multiple subnets within the same region dynamically
based on # of nodes or similar.

* Add AWS/GCP to Terraform TestLoader unit test

* Add uid tag and create log group

Co-authored-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
 2022-10-21 12:24:18 +02:00
Otto Bittner
07f02a442c
Refactor Helm deployments (#341) 
* Wrap KMS deployment in one main chart that
deploys all other services. Other services will follow.
* Use .tgz via helm-package as serialization format
* Change Release type to carry chart as byte slice
* Remove KMSConfig
* Use json-schema to validate values
* Extend release.md to mention updating helm charts
 2022-10-21 12:01:28 +02:00
Malte Poll
743f5fa627 Remove all traces of CoreOS from the codebase 2022-10-21 11:04:25 +02:00
renovate[bot]
8cf6189cf0
Update module github.com/fsnotify/fsnotify to v1.6.0 (#325) 
* Update module github.com/fsnotify/fsnotify to v1.6.0

* [bot] Tidy all modules

* Use event.Has function

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-10-20 10:16:20 +02:00
renovate[bot]
b0a6f0ea39 [bot] Tidy all modules 2022-10-19 13:37:16 +02:00
renovate[bot]
38ff8b70c7
Update module github.com/spf13/cobra to v1.6.0 (#326) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-19 11:07:00 +02:00
renovate[bot]
37a9dbfad2
Update k8s dependencies (#308) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-19 10:37:40 +02:00
renovate[bot]
f05bccb670
Update module github.com/Azure/azure-sdk-for-go/sdk/storage/azblob to v0.5.1 (#269) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-19 08:57:09 +02:00
renovate[bot]
9a1d795597
Update module github.com/Azure/azure-sdk-for-go/sdk/keyvault (#267) 
* Update module github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys to v0.8.1

* Update module github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets to v0.10.1

* Adjust Azure KMS opts struct

* Update kms readme formatting

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-18 12:08:59 +02:00
renovate[bot]
ecdf5d5165
Update module golang.org/x/text to v0.3.8 (#297) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-17 18:12:19 +02:00
renovate[bot]
71d4aac3f2
Update module github.com/docker/docker to v20.10.19+incompatible (#271) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-17 15:40:59 +02:00
renovate[bot]
a998745e91
Update google.golang.org/genproto digest to 99cd37c (#253) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-17 15:36:21 +02:00
renovate[bot]
51a0c746ca
Update golang.org/x/sys digest to 95e765b (#257) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-17 11:12:04 +02:00
Malte Poll
397e61700d
Use upstream go-attestation (#286) 
The reason for replacing the module was waiting for https://github.com/google/go-attestation/pull/284 to be merged.
 2022-10-17 09:44:05 +02:00
Daniel Weiße
19b67dc622 Update module github.com/aws/aws-sdk-go-v2/feature/s3/manager to v1.11.34 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-14 11:09:44 +02:00
renovate[bot]
def598a154 Update module github.com/Azure/azure-sdk-for-go/sdk/azcore to v1.1.4 2022-10-14 10:03:17 +02:00
katexochen
4c0ef09346 Tidy Go mods 2022-10-13 15:29:29 +02:00
Fabian Kammel
57b8efd1ec
Improve measurements verification with Rekor (#206) 
Fetched measurements are now verified using Rekor in addition to a signature check.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-11 13:57:52 +02:00
Paul Meyer
1c29638421
Use env to find bash in shebang (#225) 2022-10-10 14:21:17 +02:00
katexochen
ef367275e1 Pin container image versions 2022-10-10 13:43:15 +02:00
Daniel Weiße
0edae36e43
AB#2426 Mini Constellation (#198) 
* Mini Constellation commands to quickly deploy a local Constellation cluster

* Download libvirt container image if not present locally

* Fix libvirt KVM permission issues by creating kvm group using host GID inside container

* Remove QEMU specific values from state file

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Nils Hanke <nils.hanke@outlook.com>
 2022-10-07 09:38:43 +02:00
Nils Hanke
803209b12b
Update Go to 1.19.2 (#219) 2022-10-06 19:31:12 +02:00
Daniel Weiße
2ea695896f
AB#2439 Containerized libvirt (#191) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-05 09:11:30 +02:00
Fabian Kammel
88a57fdb36
upgrade k8s 1.24.3 -> 1.24.6 (#201) 
* upgrade k8s 1.24.3 -> 1.24.6
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-30 17:10:16 +02:00
katexochen
d973740b03 Use Terraform for create on GCP 2022-09-30 16:50:52 +02:00
Daniel Weiße
804c173d52
Use terraform in CLI to create QEMU cluster (#172) 
* Use terraform in CLI to create QEMU cluster

* Dont allow qemu creation on os/arch other than linux/amd64

* Allow usage of --name flag for QEMU resources

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-26 15:52:31 +02:00
katexochen
97ef965a80 Tidy go mods 2022-09-22 09:10:19 +02:00
Nils Hanke
81b62ac3e8 Update check-licenses.sh to use constellation/v2 2022-09-22 09:10:19 +02:00
katexochen
ba6e41ed5c Upgrade go module to v2 2022-09-22 09:10:19 +02:00
Malte Poll
cbcb41842f pseudo-version: Fix annotated tag detection and support pre-versions 2022-09-21 14:50:03 +02:00
Otto Bittner
0eb4a7831b AB#2413: Add workflow for snp-report-verify 
* Extend azure-snp-report-verify to also report fw SVNs.
* Add workflow based on azure-cvm to get maa-jwt and
verify it on a second runner.
 2022-09-21 10:58:10 +02:00
Daniel Weiße
d0ba2eb6b7
Remove exporting of PCRs from QEMU metadata API (#169) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-19 14:29:21 +02:00
Malte Poll
ea8019fdd2
Upgrade go-tuf (#166) 2022-09-16 19:55:26 +02:00
Thomas Tendyck
7b7c4b3246 docs: fix CLI reference heading 2022-09-16 15:57:50 +02:00
Thomas Tendyck
72d5aa7558 docs: fix command in trusted launch workflow and add fetch-measurements 2022-09-14 18:26:41 +02:00
katexochen
ddabf974d5 Fix pcr-reader 2022-09-13 15:58:38 +02:00
katexochen
c45c2332bc Use context for http request 2022-09-13 15:58:38 +02:00
Daniel Weiße
90e0f41bde Refactor tool output (#127) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Benedict Schlüter <bs@edgeless.systems>
 2022-09-12 19:10:01 +02:00
Benedict Schlueter
eee2df9723 add image-measurement tool (#106) 
Signed-off-by: Benedict Schlueter <bs@edgeless.systems>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-12 19:10:01 +02:00
Nils Hanke
0949393dbb Update build environment to Fedora 36 & Go 1.19.1 2022-09-09 18:11:33 +02:00
Fabian Kammel
e3ede64ae6
Document trusted launch on Azure (#48) 
* Document trusted launch usage for Azure

Signed-off-by: Fabian Kammel <fk@edgeless.systems>

* there is no valid link because there is no valid release yet

Signed-off-by: Fabian Kammel <fk@edgeless.systems>

* fix link

Signed-off-by: Fabian Kammel <fk@edgeless.systems>

* fix linter issues

Signed-off-by: Fabian Kammel <fk@edgeless.systems>

* improve

* importAzure.sh: print final image ID

Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
 2022-09-07 15:05:24 +02:00
Nils Hanke
2dfa591c41
clidocgen: Support nested commands properly (#58) 2022-09-05 10:34:46 +02:00
Thomas Tendyck
bd63aa3c6b add license headers 
sed -i '1i/*\nCopyright (c) Edgeless Systems GmbH\n\nSPDX-License-Identifier: AGPL-3.0-only\n*/\n' `grep -rL --include='*.go' 'DO NOT EDIT'`
gofumpt -w .
 2022-09-05 09:17:25 +02:00
Thomas Tendyck
95ff987bfc add license 2022-09-05 09:17:25 +02:00
Fabian Kammel
2f871578b2
first implementation of SBOM generation (#50) 
* first implementation of SBOM generation
* updated dependencies as per grype report
* hack: go mod tidy
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-02 16:49:59 +02:00
katexochen
5d63150bed Silence wget output 2022-09-02 15:20:25 +02:00
Daniel Weiße
ce02878019
AB#2308 / AB#2317 constellation upgrade plan (#3) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 11:59:07 +02:00
Thomas Tendyck
2d611e8148 add tooling to obtain Azure ID key digest 2022-08-30 18:10:14 +02:00
Fabian Kammel
778952e07c
AB#2287 support community image IDs (#9) 
* support community image IDs
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 15:15:51 +02:00
Daniel Weiße
7c832273fd
AB#2309 constellation upgrade execute (#2) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:49:44 +02:00
Fabian Kammel
0a3a4e9c7f move util 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Fabian Kammel
22c912a56d move nodestate and role 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Thomas Tendyck
6b6b6df7e1
Update check-licenses.sh 2022-08-28 17:40:49 +02:00
Fabian Kammel
d972f053f9 AB#2287 Public image sharing in Azure (#350) 
Trusted launch VM images in original SIG, additional SIG for community images for CVM
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-26 17:34:46 +02:00
katexochen
d770957975 Add debugd ssh key distribution 2022-08-23 18:11:20 +02:00
katexochen
c2faa20d6e Fix naming in state file 2022-08-23 18:11:20 +02:00
Fabian Kammel
ec79484948 Feat/version manifests (#387) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Otto Bittner <cobittner@posteo.net>
 2022-08-23 13:19:37 +02:00
Malte Poll
2d87db3914 Update pseudo-version script to determine future release version based on branch name 2022-08-19 18:22:55 +02:00
Fabian Kammel
276d25fe11 we are fine to use AGPL-3.0 (#384) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-19 15:57:01 +02:00
Malte Poll
8d642be204 Azure: switch default region to west us and replicate images to multiple regions 2022-08-19 14:39:36 +02:00
Otto Bittner
0892525915 Switch to Azure CVMs 2022-08-19 14:39:36 +02:00
Malte Poll
af99f91fec update qemu metadata image version and use correct CSP name in qemu state (#377) 2022-08-18 15:59:01 +02:00
Fabian Kammel
4176f038df Generate CLI reference also for sub-commands (#374) 
* include all subcommands
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-17 16:58:36 +02:00
Fabian Kammel
059a3eacc0 Use consistent k8s version (#373) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-17 15:25:05 +02:00
Malte Poll
397c9013ea Remove azure-sdk-for-go/armnetwork replace directive (#371) 
https: //github.com/Azure/azure-sdk-for-go/issues/18704 was resolved
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-17 11:19:40 +02:00
3u13r
9478303f80 deploy cilium via helmchart (#321) 2022-08-12 10:20:19 +02:00
Fabian Kammel
c35e85b22b Make E2E cleanup easier (#353) 
* Make E2E cleanup easier
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-10 10:13:18 +02:00
Malte Poll
1df2a20a36 CI: build and upload node operator 2022-08-09 10:29:04 +02:00
Fabian Kammel
503945f8cf Export and import of Azure VM images (#341) 
* Improve performance of file size
* script for importing image to azure
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>
 2022-08-08 16:19:34 +02:00
Malte Poll
f5fe4fe885 Replace armnetworks module until https://github.com/Azure/azure-sdk-for-go/issues/18704 is fixed 2022-08-05 10:35:38 +02:00
Malte Poll
081dfb5037 Upgrade Azure SDK 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-05 10:35:38 +02:00
Daniel Weiße
4151d365fb AB#2286 Return only primary IPs for instance metadata operations (#335) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-04 11:08:20 +02:00
Daniel Weiße
5da92d9d8b AB#2249 Rework image build pipeline (#326) 
* Rework image build pipeline

* Dont cancel workflow runs on main

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-03 16:01:36 +02:00
Malte Poll
6a84bb5b4b go pseudo version hack script: update main 
- use correct default major version
- Warn (but do not fail) if no version tag exists yet.
 2022-08-02 11:02:48 +02:00