Daniel Weiße
78b9b0fc96
terraform-provider: enable Azure TDX ( #2854 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-01-26 15:46:21 +01:00
renovate[bot]
d58d888f54
deps: update dependency Pillow to v10.2.0 [SECURITY]
2024-01-26 15:41:44 +01:00
Moritz Eckert
d6639f7788
add azure region germany west central
2024-01-26 10:04:59 +01:00
edgelessci
49a806a874
image: update measurements and image version ( #2859 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2024-01-26 08:15:43 +01:00
Moritz Eckert
26f6fd074f
ci: fix e2e_benchmark comparison
2024-01-25 11:12:32 +01:00
Adrian Stobbe
77276cb4ca
add provider example test to weekly ( #2840 )
2024-01-25 11:09:27 +01:00
Markus Rudy
9fb6c3216e
helm: remove kube-rbac-proxy ( #2849 )
2024-01-25 10:06:40 +01:00
Adrian Stobbe
4431ac3233
ci: fix missing quotes in Opensearch link ( #2852 )
2024-01-24 17:29:19 +01:00
Malte Poll
d3cffa9fee
image: update Linux to 6.1.74 ( #2851 )
2024-01-24 17:10:56 +01:00
Daniel Weiße
e350ca0f57
attestation: add Azure TDX attestation ( #2827 )
...
* Implement Azure TDX attestation primitives
* Add default measurements and claims for Azure TDX
* Enable Constellation on Azure TDX
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-01-24 15:10:15 +01:00
Moritz Sanft
e07ea4b40f
operator: fix get-handling of Azure marketplace images ( #2846 )
...
* operator: support getting MP images
* operator: support getting MP node image
* operator: refactorings
2024-01-24 10:22:40 +01:00
Moritz Eckert
da26daeb49
docs: update clouds and marketplaces
...
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
2024-01-24 09:57:35 +01:00
Thomas Tendyck
ad5ff6e1bb
ci: update vale
2024-01-24 09:07:19 +01:00
edgelessci
6ae59bb986
image: update measurements and image version ( #2848 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2024-01-24 08:22:48 +01:00
Malte Poll
c8ffba0366
measurements: update expected PCR[1] on GCP
2024-01-23 21:55:12 +01:00
Malte Poll
a2e2f0387c
measurements: correctly override validation options
2024-01-23 21:55:12 +01:00
3u13r
2a7a9dc2aa
helm: re-enable native routing for gcp ( #2842 )
2024-01-23 14:46:24 +01:00
Moritz Sanft
5faa374ede
terraform-provider: validate pod ip cidr only on gcp ( #2838 )
2024-01-23 09:08:23 +01:00
Adrian Stobbe
4db0662b06
ci: remove broken label from OpenSearch query link ( #2839 )
2024-01-23 08:32:02 +01:00
edgelessci
fc1c9b7c1a
image: update locked rpms ( #2835 )
...
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2024-01-22 14:07:26 +01:00
Malte Poll
3a5753045e
goleak: ignore rules_go SIGTERM handler
...
rules_go added a SIGTERM handler that has a goroutine that survives the scope of the goleak check.
Currently, the best known workaround is to ignore this goroutine.
https://github.com/uber-go/goleak/issues/119
https://github.com/bazelbuild/rules_go/pull/3749
https://github.com/bazelbuild/rules_go/pull/3827#issuecomment-1894002120
2024-01-22 13:11:58 +01:00
Malte Poll
66faa5493f
deps: Go 1.21.6
2024-01-22 13:11:58 +01:00
Malte Poll
f465356ace
nix: update flake.lock
2024-01-22 13:11:58 +01:00
Malte Poll
64a4a2230d
deps: update gazelle and rules_go
2024-01-22 13:11:58 +01:00
Malte Poll
e40d1e56d8
deps: update hermetic_cc_toolchain
2024-01-22 13:11:58 +01:00
Malte Poll
00eacdf9e8
image: mark image upload as manual bazel target
2024-01-22 13:11:58 +01:00
Moritz Sanft
0030a26eaf
ci: parallelize upgrade e2e test ( #2724 )
...
* ci: parallelize upgrade e2e test
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* ci: revert name change
* ci: upgrade checkout action
* ci: add target version before building target cli
* ci: rename input
* ci: upload service account key
* ci: download sa key on GCP
---------
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2024-01-19 16:34:47 +01:00
edgelessci
3b02edcc48
image: update measurements and image version ( #2833 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2024-01-19 09:12:24 +01:00
edgelessci
2acbd10ef7
image: update measurements and image version ( #2831 )
...
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2024-01-17 18:55:10 +01:00
Malte Poll
b8933560be
image upload: use unique blob name for AWS images uploaded to S3 ( #2830 )
...
When uploading images to AWS, they need to be uploaded to S3 first.
Since blob names are not unique between attestation variants, there
was a possibility for one S3 upload to be used for the wrong AMI.
2024-01-17 17:09:07 +01:00
edgelessci
6259815869
image: update measurements and image version ( #2828 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2024-01-17 08:11:53 +01:00
Malte Poll
9d6321faa3
uplosi: use separate galleries for Azure TDX and TDX
2024-01-16 17:34:44 +01:00
Malte Poll
52dec77508
nix: update uplosi to support Azure TDX
2024-01-16 17:34:44 +01:00
Malte Poll
336ba6bc34
attestation: add Azure TDX variant
...
Only a stub for now.
2024-01-16 17:34:44 +01:00
Malte Poll
5063b815f1
config: allow Azure TDX instance types
2024-01-16 17:34:44 +01:00
Malte Poll
403acf75aa
image: add mainline kernel and azure tdx image target
2024-01-16 17:34:44 +01:00
Markus Rudy
e29ea77d23
helm: bump Cilium chart version ( #2822 )
...
* helm: bump Cilium chart version
* helm: generate Cilium chart
2024-01-16 14:49:24 +01:00
Markus Rudy
16c63d57cd
dev-docs: Helm chart for full L3 VPN connectivity ( #2620 )
...
* dev-docs: add 'things to try' section to VPN howto
* dev-docs: full L3 connectivity in VPN chart
2024-01-16 13:59:33 +01:00
Malte Poll
9181705299
ci: use sonobuoy 0.57.1 ( #2821 )
2024-01-16 13:19:46 +01:00
Markus Rudy
2d3996d5b3
ci: don't check Wireguard weblinks ( #2823 )
2024-01-15 15:45:45 +01:00
Moritz Sanft
bf02680477
ci: mirror GCP images to MPI project on release ( #2820 )
2024-01-15 13:58:30 +01:00
Malte Poll
9a27e7bf77
image: only archive release images + QEMU / OpenStack image
2024-01-15 13:53:15 +01:00
Malte Poll
8a74893461
ci: build and upload OS image in single job
2024-01-15 13:53:15 +01:00
Malte Poll
5ec03c5b9d
image: add upload rules for images
2024-01-15 13:53:15 +01:00
Malte Poll
f237ae8ae2
bazel: add upload_os_images rule
...
This rule combines uplosi, the upload command, measurement code and cosign
to upload OS images, extract measurements, sign them and upload the measurements.
2024-01-15 13:53:15 +01:00
Malte Poll
b7bab7c3c8
image: replace "upload {aws|azure|gcp}" with uplosi
2024-01-15 13:53:15 +01:00
Malte Poll
fb392c2d50
image: add image uploader that uses uplosi in the background
...
This implementation will replace the custom Go code in
internal/osimage/{aws|azure|gcp} and still conforms to the same interface.
2024-01-15 13:53:15 +01:00
Malte Poll
181b8f64d2
image: add static (per-CSP) measurements during "measurement envelope"
...
This logic was previously performed in a GitHub Actions workflow
using yq.
Since every step should now be performed in Bazel, this now needs to happen here.
2024-01-15 13:53:15 +01:00
Malte Poll
f7b22f3705
bazel: add tool dependencies for image upload
2024-01-15 13:53:15 +01:00
Markus Rudy
711dff37a4
ci: fetch OpenSearch password from e2e test project ( #2818 )
2024-01-15 13:25:15 +01:00
