Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-10-01 01:36:09 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,953 Commits 133 Branches 44 Tags 106 MiB
4c5ab7c5e9
Commit Graph

424 Commits

Author SHA1 Message Date
Otto Bittner
07f02a442c
Refactor Helm deployments (#341) 
* Wrap KMS deployment in one main chart that
deploys all other services. Other services will follow.
* Use .tgz via helm-package as serialization format
* Change Release type to carry chart as byte slice
* Remove KMSConfig
* Use json-schema to validate values
* Extend release.md to mention updating helm charts
 2022-10-21 12:01:28 +02:00
Malte Poll
743f5fa627 Remove all traces of CoreOS from the codebase 2022-10-21 11:04:25 +02:00
Malte Poll
3b6ee703f5 Move PCR indices for owner ID and cluster ID 2022-10-21 11:04:25 +02:00
Malte Poll
34367ea3cc Create mkosi image build pipeline 2022-10-21 11:04:25 +02:00
renovate[bot]
8cf6189cf0
Update module github.com/fsnotify/fsnotify to v1.6.0 (#325) 
* Update module github.com/fsnotify/fsnotify to v1.6.0

* [bot] Tidy all modules

* Use event.Has function

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-10-20 10:16:20 +02:00
Otto Bittner
c6ccee1250 AB#2490: deploy KMS via Helm 
* Bundle helm-install related code in speparate package
* Move cilium installation to new helm package
 2022-10-18 13:33:37 +02:00
Daniel Weiße
623cb6cdb5
AB#2479 Implement AWS cloud logging (#232) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-17 09:05:45 +02:00
Malte Poll
c16f5a976d
AB#2365 Upgrade k8s base deployments (add full support for k8s 1.25) (#277) 
* Add container image release for CCM GCP v25.2.0
* Upgrade versions of kubernetes base components
 2022-10-17 08:58:13 +02:00
Daniel Weiße
f068e50dee
Attestation logging (#275) 
* Add section for checking joinservice logs

* Add logging for attestation validation

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-14 16:29:21 +02:00
katexochen
263c700e73 Update operator version 2022-10-13 16:38:35 +02:00
katexochen
4b2dd1317a Normalize URIs for azurerm Terraform provider 2022-10-13 15:29:29 +02:00
katexochen
1556e239ca Remove state file 2022-10-13 15:29:29 +02:00
katexochen
0d1fd8fb2a Remove Azure client from CLI 2022-10-13 15:29:29 +02:00
katexochen
dbe9bf381c Get instance role from tags on Azure 2022-10-13 15:29:29 +02:00
katexochen
75888e986e Add role.FromString and more tolerance 2022-10-13 15:29:29 +02:00
Daniel Weiße
23afccb975
AB#2474 Implement List and Self method for AWS (#229) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-12 13:40:38 +02:00
Fabian Kammel
57b8efd1ec
Improve measurements verification with Rekor (#206) 
Fetched measurements are now verified using Rekor in addition to a signature check.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-11 13:57:52 +02:00
katexochen
6577ca6600 Bump enterprise image version 2022-10-10 13:43:15 +02:00
katexochen
87adf66708 Update qemu image 2022-10-10 13:43:15 +02:00
katexochen
eb340c1e1f Build microservices on release branch 2022-10-10 13:43:15 +02:00
Daniel Weiße
0edae36e43
AB#2426 Mini Constellation (#198) 
* Mini Constellation commands to quickly deploy a local Constellation cluster

* Download libvirt container image if not present locally

* Fix libvirt KVM permission issues by creating kvm group using host GID inside container

* Remove QEMU specific values from state file

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Nils Hanke <nils.hanke@outlook.com>
 2022-10-07 09:38:43 +02:00
katexochen
4ccd96bf64 Pin container image hashes 2022-10-06 19:16:20 +02:00
katexochen
884c46179a Bump konnectivity version 2022-10-06 19:16:20 +02:00
katexochen
bede530de7 Bump k8s versions 2022-10-06 19:16:20 +02:00
katexochen
9edfc2f6ba Move k8s version window up 2022-10-06 19:16:20 +02:00
Fabian Kammel
369480a50b
Feat/revive (#212) 
* enable revive as linter
* fix var-naming revive issues
* fix blank-imports revive issues
* fix receiver-naming revive issues
* fix exported revive issues
* fix indent-error-flow revive issues
* fix unexported-return revive issues
* fix indent-error-flow revive issues
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-05 15:02:46 +02:00
Daniel Weiße
2ea695896f
AB#2439 Containerized libvirt (#191) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-05 09:11:30 +02:00
Daniel Weiße
acdcb535c0
AB#2444 Verify Azure trusted launch attestation keys (#203) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-04 16:44:44 +02:00
katexochen
a60e76e91f Upgrade operator version 2022-09-30 17:51:49 +02:00
katexochen
ccbc3d9123 Remove exposure of qemu ip_range_start value 2022-09-30 16:50:52 +02:00
katexochen
feffe40987 Remove GCP client from CLI 2022-09-30 16:50:52 +02:00
katexochen
42f273611a Use uid from metadata instead of name 2022-09-30 16:50:52 +02:00
Felix Schuster
eabc433b68 Fix typo 2022-09-29 16:37:52 +02:00
Fabian Kammel
dfa4dd9b85
delete unused config test (#202) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-28 16:31:00 +02:00
Felix Schuster
a6d201b761 Make wording around license less verbose 2022-09-27 11:24:01 +02:00
Daniel Weiße
804c173d52
Use terraform in CLI to create QEMU cluster (#172) 
* Use terraform in CLI to create QEMU cluster

* Dont allow qemu creation on os/arch other than linux/amd64

* Allow usage of --name flag for QEMU resources

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-26 15:52:31 +02:00
Daniel Weiße
30f0554168
AB#2262 Automatic recovery (#158) 
* Update `constellation recover` to be fully automated

* Update recovery docs

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-26 09:57:40 +02:00
katexochen
ba6e41ed5c Upgrade go module to v2 2022-09-22 09:10:19 +02:00
katexochen
6401c345f0 Upgrade node operator 2022-09-20 14:41:54 +02:00
katexochen
88d200232a Remove autoscaling from CLI and bootstrapper 2022-09-20 13:41:23 +02:00
Thomas Tendyck
3d50869ed6 only use test action in license integration test 2022-09-19 12:22:06 +02:00
Daniel Weiße
e367e1a68b
AB#2261 Add loadbalancer for control-plane recovery (#151) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-14 13:25:42 +02:00
Leonard Cohnen
2a6c5df7cc fix waiting on gcp load balancer 2022-09-13 11:06:44 +02:00
Leonard Cohnen
2d8f2af91b prepare release v2.0.0 2022-09-12 19:03:01 +02:00
Nils Hanke
25b769d1e2 Remove obsolete tpmPath passed to OpenTPM 2022-09-12 14:38:10 +02:00
Thomas Tendyck
c41018ed32
license messages (#118) 
* license: tell the user whether file couldn't be found or there was another error

* license: print correct info for community license
 2022-09-12 13:38:50 +02:00
Thomas Tendyck
ab45d5fbfe tidy config 2022-09-12 08:49:51 +02:00
Nils Hanke
c51dec6d00 Use distroless images for JoinService & KMS 2022-09-09 18:11:33 +02:00
Malte Poll
b8b169c93d
Bump node-operator (#114) 2022-09-09 17:33:55 +02:00
Leonard Cohnen
7163c161b6 Deploy Konnectivity 2022-09-09 17:26:02 +02:00
Thomas Tendyck
a85777fd02 enforce pcr4 2022-09-08 17:34:12 +02:00
Nils Hanke
7aded65ea8 Add validation for zero or more than one provider 2022-09-08 13:38:24 +02:00
Moritz Eckert
fb5faa681c
Add provider to license check (#88) 2022-09-08 11:02:04 +02:00
Otto Bittner
611ec25f22 AB#2380: Add unittest for validateAk 
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-07 13:59:09 +02:00
Nils Hanke
fe70231f2a Rename IsImageDebug -> IsDebugImage for consistency 2022-09-07 13:27:15 +02:00
Nils Hanke
1a4b4f564a Remove firewall configuration and make it static with a debug flag 2022-09-07 13:27:15 +02:00
Otto Bittner
23bf4aa665
AB#2379: Validate version in SNP report (#80) 
* AB#2379: Validate version in SNP report

* Check that TCB version in VCEK matches COMMITTED_TCB
* Check that LAUNCH, CURRENT and REPORTED TCB are at least
at the same security level as we are currently.
* Rename variables in snpReport struct
* Use default values in validator_test.go

Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-07 10:39:38 +02:00
Malte Poll
50acded80b
Bump join service (#79) 2022-09-05 17:23:11 +02:00
Malte Poll
c1185241bb temporarily upgrade join-service 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
c38a142d64 Kubernetes 1.25 preview 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
571b4ff36f Switch default Kubernetes version 1.24 -> 1.23 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
57e77ee53f kubernetes version: rename latest -> default 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Otto Bittner
1b810da331 Bump service versions. 
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-05 12:46:40 +02:00
Otto Bittner
405db3286e AB#2386: TrustedLaunch support for azure attestation 
* There are now two attestation packages on azure.
The issuer on the server side is created base on successfully
querying the idkeydigest from the TPM. Fallback on err: Trusted Launch.
* The bootstrapper's issuer choice is validated by the CLI's validator,
which is created based on the local config.
* Add "azureCVM" field to new "internal-config" cm.
This field is populated by the bootstrapper.
* Group attestation OIDs by CSP (#42)
* Bootstrapper now uses IssuerWrapper type to pass
the issuer (and some context info) to the initserver.
* Introduce VMType package akin to cloudprovider. Used by
IssuerWrapper.
* Extend unittests.
* Remove CSP specific attestation integration tests

Co-authored-by: <dw@edgeless.systems>
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-05 12:03:48 +02:00
Thomas Tendyck
bd63aa3c6b add license headers 
sed -i '1i/*\nCopyright (c) Edgeless Systems GmbH\n\nSPDX-License-Identifier: AGPL-3.0-only\n*/\n' `grep -rL --include='*.go' 'DO NOT EDIT'`
gofumpt -w .
 2022-09-05 09:17:25 +02:00
Fabian Kammel
106635a9ee
Restructure config docs (#44) 
* more guided UX when generating and filling in config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-02 17:11:06 +02:00
Nils Hanke
0aefe2c0ba Move instanceType from CLI to config 2022-09-02 07:04:11 -07:00
Otto Bittner
50d3f3ca7f GetIdKeyDigest: Cut HCL header from raw report 2022-09-02 11:21:35 +02:00
Fabian Kammel
6440904865
Ref/update cosign key (#31) 
* use new cosign keypair
* use community images for production image heuristic
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-01 12:58:31 +02:00
Moritz Eckert
db942ee4b5
Update references to docs (#36) 2022-09-01 09:27:25 +02:00
Otto Bittner
4adc19b7f5 AB#2350: Configurably enforce idkeydigest on Azure 
* Add join-config entry for "enforceIdKeyDigest" bool
* Add join-config entry for "idkeydigest"
* Initially filled with TPM value from bootstrapper
* Add config entries for idkeydigest and enforceIdKeyDigest
* Extend azure attestation validator to check idkeydigest,
if configured.
* Update unittests
* Add logger to NewValidator for all CSPs
* Add csp to Updateable type

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 15:26:04 +02:00
Malte Poll
c84e44913b Fork node maintenance operator and deploy it on all supported k8s versions 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-31 14:53:06 +02:00
katexochen
10e5249631 Manual client secrets on azure 2022-08-31 14:10:08 +02:00
katexochen
69abe17c96 Refactor Azure IMDS client and metadata 2022-08-31 14:10:08 +02:00
katexochen
f15605cb45 Manually manage resource group on Azure 2022-08-31 14:10:08 +02:00
Daniel Weiße
ce02878019
AB#2308 / AB#2317 constellation upgrade plan (#3) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 11:59:07 +02:00
Daniel Weiße
b27e205399
Use 4 vCPU instances by default (#24) 
* Use 4 vcpu instances by default

* Remove 2 vcpu instance type option

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 10:33:33 +02:00
Fabian Kammel
66d8c8037b
Release/v0.0.1 (#20) 
* bump images to 0.0.1
* add gh cli commands
* varibale with default value should not be required
* update release docs
* build and upload version manifest as part of release
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 15:54:35 +02:00
Thomas Tendyck
650ab76fe7 Update measurements.go 2022-08-30 15:50:40 +02:00
Fabian Kammel
778952e07c
AB#2287 support community image IDs (#9) 
* support community image IDs
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 15:15:51 +02:00
Fabian Kammel
e0a457b6ff
change default image to new format of public images for next release (#19) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 13:42:22 +02:00
Otto Bittner
2343c91bc7 Update service image versions 2022-08-30 09:42:18 +02:00
Daniel Weiße
7c832273fd
AB#2309 constellation upgrade execute (#2) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:49:44 +02:00
Otto Bittner
7c5556864b AB#2333: Add AMD SNP-based attestation 
Currently only available on Azure CVMs.

* Get the public attestation key from the TPM.
* Get the snp report from the TPM.
* Get the VCEK and ASK certificate from the metadata api.
* Verify VCEK using hardcoded root key (ARK)
* Verify SNP report using VCEK
* Verify HCLAkPub using SNP report by comparing
AK with runtimeData
* Extend unittest

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:29:33 +02:00
Fabian Kammel
22c912a56d move nodestate and role 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Malte Poll
26e9c67a00 Move cloud metadata packages and kubernetes resources marshaling to internal 
Decouples cloud provider metadata packages from kubernetes related code

Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Thomas Tendyck
6b8a2a0063 remove image pull secret 2022-08-28 15:57:08 +02:00
Malte Poll
716ba52588 create on Azure: Allow toggling between CVMs / Trusted Launch VMs (#401) 2022-08-25 15:24:31 +02:00
Fabian Kammel
45beec15f5 AB#2360 enterprise build tag (#397) 
* enterprise build switch to disable license checking in default (OSS) version
* remove community license quota
* empty image references on OSS build in config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-25 14:06:29 +02:00
katexochen
35a5d34497 Remove legacy build tags 2022-08-24 14:56:30 +02:00
katexochen
e761c9bf97 Manually manage GCP service accounts 2022-08-24 11:44:05 +02:00
katexochen
d770957975 Add debugd ssh key distribution 2022-08-23 18:11:20 +02:00
katexochen
a02a46e454 Use multiple loadbalancers on GCP 2022-08-23 18:11:20 +02:00
katexochen
c2faa20d6e Fix naming in state file 2022-08-23 18:11:20 +02:00
Moritz Eckert
94460654e7 Apply feedback for readme (#389) 
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
 2022-08-23 13:46:06 +02:00
Malte Poll
ec548a6d17 Update image references for v1.5.0 2022-08-19 18:22:55 +02:00
Malte Poll
fdcdd5fb78 Update versions 2022-08-19 18:22:55 +02:00
Paul Meyer
0969ff4ac3 Fix tests and linting (#370) 
* Fix license integration test
* Fix build tags in lint config
* Fix missing error checks
* Fix use of MarkNodeAsInitialized
* Fix attestation tests
* Add license integration test to cmake list
 2022-08-17 13:50:43 +02:00
Fabian Kammel
82eb9f4544 AB#2299 License check in CLI during init (#366) 
* license server interaction
* logic to read from license file
* print license information during init
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>
 2022-08-16 16:06:38 +02:00
Fabian Kammel
170a8bf5e0 AB#2306 Public image sharing in Google (#358) 
* document how to publicly share images in gcloud
* Write disclamer in debugd
* Add disclamer about debug images to contributing file
* Print debug banner on startup
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-16 15:53:54 +02:00
Malte Poll
abb4fb4f0f Build GCP guest agent from github actions in constellation repo 2022-08-16 08:47:58 +02:00
Daniel Weiße
ba4471a228 AB#2316 Configurable enforced PCRs (#361) 
* Add warnings for non enforced, untrusted PCRs

* Fix global state in Config PCR map

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-12 15:59:45 +02:00
3u13r
9478303f80 deploy cilium via helmchart (#321) 2022-08-12 10:20:19 +02:00
Malte Poll
2c7129987a Deploy operator-lifecycle-manager (OLM), node-maintenance-operator (NMO) and constellation-node-operator 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-11 10:48:50 +02:00
Daniel Weiße
ab536ae3c8 AB#2278 Remove hardcoded values from config (#346) 
* Update file handler to avoid incorrect usage of file.Option

* Remove hardcoded values

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-08 11:04:17 +02:00
Otto Bittner
129caae0e4 AB#2258: Fix flacky retry_test.go 
Co-authored-by: <mp@edgeless.systems>
Co-authored-by: <pm@edgeless.systems>
 2022-08-05 18:58:47 +02:00
Malte Poll
bf5816cc00 linter cleanup (#344) 
* go fmt
* static check
 2022-08-05 15:30:23 +02:00
Malte Poll
081dfb5037 Upgrade Azure SDK 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-05 10:35:38 +02:00
Daniel Weiße
4151d365fb AB#2286 Return only primary IPs for instance metadata operations (#335) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-04 11:08:20 +02:00
Malte Poll
d3435b06a2 AB#2283 Build CCM GCP from github actions in constellation repo (#334) 
* Build CCM GCP from github actions in constellation repo
* Deploy correct version of GCP CCM
 2022-08-03 11:46:11 +02:00
Otto Bittner
a13d1d8bd8 Bump coreos-img version 2022-08-03 08:06:05 +02:00
Otto Bittner
ba9555033d Bump service-image versions to v1.4.0 2022-08-03 08:06:05 +02:00
Fabian Kammel
985585f578 fix linter issues (#329) 
* fix linter issues
* replace fmt with logger
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
 2022-08-02 16:25:47 +02:00
Daniel Weiße
aa7fcce8af Add configurable node disk type (#317) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-02 12:24:55 +02:00
Fabian Kammel
050e8fdc4a AB#2159 Feat/cli/fetch measurements (#301) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-01 09:37:05 +02:00
Daniel Weiße
7baf98f014 Add test vectors for key derivation functions (#320) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-01 09:11:13 +02:00
Daniel Weiße
e0ae4e1fe6 Bump kms, joinservice, and verification service image to latest (#319) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-29 10:42:23 +02:00
Daniel Weiße
9a3bd38912 Generate random salt for key derivation on init (#309) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-29 09:52:47 +02:00
Otto Bittner
5d87b48769 Bump image version 2022-07-28 09:57:11 +02:00
Otto Bittner
44b5e042ea AB#2077: Kubernetes 1.22.12 support (#302) 
* Necessary changes to build join-service image
* Reference new join-service image

Tested on GCP and Azure using microservice-demo.
 2022-07-27 13:38:14 +02:00
Otto Bittner
83d2c7b6a3 AB#2077: add v1.24.3 support (#298) 
This is a squashed commit. 
* Necessary changes for 1.24 support. Trigger join-service build.
* Update joinservice version. Image was created 
by manually triggered workflow, based on now squashed commit.

microservice-demo can be deployed successfully.
No errors during cluster setup.
 2022-07-26 17:08:57 +02:00
Daniel Weiße
db79784045 AB#2200 Merge Owner and Cluster ID (#282) 
* Merge Owner and Cluster ID into single value

* Remove aTLS from KMS, as it is no longer used for cluster external communication

* Update verify command to use cluster-id instead of unique-id flag

* Remove owner ID from init output

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-26 10:58:39 +02:00
Thomas Tendyck
48d614c959 AB#2222 replace unlicensed passwd package with own implementation 2022-07-25 15:10:29 +02:00
Malte Poll
aacbf9dc70 Bump coreos images to 1658499095 (#295) 2022-07-25 09:03:51 +02:00
Otto Bittner
566b40699f AB#2255: Bump joinservice version (#294) 2022-07-22 15:44:27 +02:00
Otto Bittner
52ceced223 AB#2255: Fix kubeadm version incompatibility (#293) 
* Update image version
* Introduce 'ValidK8sVersion' type. Ensures that consumers
of the k8sVersion receive a valid version, without
having to do their own validation.
* Add testcase to check that kubeadm accepts the currently provided
version.
 2022-07-22 15:05:04 +02:00
Otto Bittner
c743398a23 AB#2181: retry k8s downloads (#286) 
Generalize retrier:
* Generalize Do to use a supplied 'retriable' function
* Make clock an optional argument in NewIntervalRetrier
* Move grpc/retrier to interal package
* Update existing unittests to not use retry feature

Add retryDownloadToTempDir:
* Wrap downloadToTempDir with retrier.
* Retry if TCP connection is reset.
* Abort by canceling the context.
* Use a mock server in the unit test that serves responses
depending on the state received through a state channel.

Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
 2022-07-21 15:20:12 +02:00
Otto Bittner
741384158a AB#2076: version specific images (#288) 
KubernetesVersion sent by the init command now controls
all downloaded binaries, if they depend on the k8s version.

* Move all download links into /internal/versions.
* Unify files in /internal/versions package
* Move image download links into VersionConfigs
and thus make them dependant on the k8s version,
where the image version is specific to the k8s version.
* Don't specify patch version in k8sVersion
 2022-07-21 14:41:07 +02:00
Fabian Kammel
ba5a3aefe3 fix ci-lint issues (#287) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-07-20 16:44:41 +02:00
Malte Poll
a660af05f1 Use same name for k8s config map key and filename of k8s config map version in joinservice 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-07-19 09:27:23 +02:00
Malte Poll
9f31e0a539 Update join-service image after proto definition change 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-07-18 17:38:07 +02:00
Fabian Kammel
193a91d911 fix reference for statefile field and unwrap errors (#278) 
* fix reference for statefile field
* unwrap errors before checking status
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-07-18 14:00:57 +02:00
Otto Bittner
a68ee817ff AB#2074: Choosable K8S Version (#277) 
AB#2074: Add configurable k8s version

Configurable version flow:
* cli config holds/validates k8sVersion
* InitCluster receive a k8sVersion arg
* InitCluster creates CM "k8s-version"
* kubeadm's InitConfiguration receives k8sVersion
* joinservice spec mounts/reads k8s-version CM
* joinservice supplies k8sVersion via JoinTicketResponse
Other changes:
* Remove unused test code (FakeK8SClient)
* move VersionConfig map to /internal/versions
* installk8sComponents is now a function instead of a method
 2022-07-18 12:28:02 +02:00
Fabian Kammel
a931f6692f Fix/bootstrapper regressions (#274) 
* remove wireguard from e2e tests, conformance docs & config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-07-15 11:53:14 +02:00
Malte Poll
49e98286a9 bump coreos 1657814939 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-07-15 09:15:55 +02:00
Malte Poll
260d2571c1 Only upload kubeadm certs if key is rotated 
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: 3u13r <lc@edgeless.systems>
 2022-07-14 17:25:18 +02:00
katexochen
1af18e990d Rename all activation 2022-07-14 17:25:18 +02:00
katexochen
15adba9235 Simplify joinproto 2022-07-14 17:25:18 +02:00
katexochen
dea23604fb Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
916e5d6b55 Rename coordinator to bootstrapper and rename roles 2022-07-14 17:25:18 +02:00
Malte Poll
3280ed200c Test IntervalRetrier 2022-07-14 17:25:18 +02:00
katexochen
f79674cbb8 Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
09e86e6c5d Refactor provider metadata 2022-07-14 17:25:18 +02:00
katexochen
32f1f5fd3e Delete Coordinator core and apis 2022-07-14 17:25:18 +02:00
Malte Poll
7e6ad541c6 Bump coreos images to 1657199013 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-07-08 14:28:04 +02:00
Nils Hanke
259c88fa1a IDsFilename -> ClusterIDsFilename 2022-07-05 14:41:58 +02:00
Daniel Weiße
0a874496b3 Add verbosity flag to all services (#244) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-01 16:17:06 +02:00
cm
3177b2fdb7 AB#2032 Write IDs to disk and read when verifying (#212) 
* AB#2032 Write IDs to disk and read when verifying

* Update CHANGELOG.md

* update changelog

* update changelog

* cli verify: prefer flag values

* Rename fid file

Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
 2022-07-01 10:57:29 +02:00
Otto Bittner
7cada2c9e8 Add goleak to all tests (#227) 
* Run goleak as part of all tests
We are already using goleak in various tests.
This commit adds a TestMain to all remaining tests
and calls goleak.VerifyTestMain in them.
* Add goleak to debugd/deploy package and fix bug.
* Run go mod tidy
* Fix integration tests
* Move goleak invocation for mount integration test
* Ignore leak in state integration tests

Co-authored-by: Fabian Kammel <fk@edgelss.systems>
 2022-06-30 15:24:36 +02:00
Daniel Weiße
f9a581f329 Add aTLS endpoint to KMS (#236) 
* Move file watcher and validator to internal

* Add aTLS endpoint to KMS for Kubernetes external requests

* Update Go version in Dockerfiles

* Move most KMS packages to internal

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-29 16:13:01 +02:00
Daniel Weiße
042f668d20 AB#2190 Verification service (#232) 
* Add verification service

* Update verify command to use new Constellation verification service

* Deploy verification service on cluster init

* Update pcr-reader to use verification service

* Add verification service build workflow

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-28 17:03:28 +02:00
Daniel Weiße
b10b13b173 Replace logging with default logging interface (#233) 
* Add test logger

* Refactor access manager logging

* Refactor activation service logging

* Refactor debugd logging

* Refactor kms server logging

* Refactor disk-mapper logging

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-28 16:51:30 +02:00
Daniel Weiße
1dcb6ed142 Add unified logging interface (#223) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-23 16:42:33 +02:00
Leonard Cohnen
e13f4d84c3 add gcp loadbalancer 2022-06-23 14:00:20 +02:00
Christoph Meyer
9441e46e4b AB#2033 Remove redundant "failed" in error wrapping 
Remove "failed" from wrapped errors
Where appropriate rephrase "unable to/could not" to "failed" in root
errors
Start error log messages with "Failed"
 2022-06-22 12:02:10 +01:00
Daniel Weiße
3b92b52611 Fix endless wait if handshake fails 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-21 15:02:20 +02:00
Daniel Weiße
e6b1156849 AB#2169 Implement control-plane activation in activation service (#217) 
* Implement Control Plane activation flow

* Rename Activation RPCs

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-21 11:10:32 +02:00
katexochen
b926cf9006 Move aTLS fakes into atls package 2022-06-15 16:31:24 +02:00
katexochen
85ba2657e1 Fix grpc dialer 2022-06-15 16:31:24 +02:00
Daniel Weiße
4842d29aff AB#2111 Deploy activation service on cluster init (#205) 
* Deploy activation service on cluster init

* Use base image with CA certificates for activation service

* Improve KMS server 

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-15 16:00:48 +02:00
Paul Meyer
86d29a4567 Add concurrency tests for atls connections (#211) 2022-06-15 13:04:56 +02:00
Thomas Tendyck
e9916a7d3a atls: make client cfg reusable 2022-06-15 13:04:56 +02:00
Thomas Tendyck
989c128fa6 atls: rename nonce to clientNonce/serverNonce for clarification 2022-06-15 13:04:56 +02:00
Nils Hanke
f0b8412ef8 constellation-access-manager: Persistent SSH as ConfigMap (#184) 2022-06-13 16:23:19 +02:00
Daniel Weiße
1e19e64fbc Dynamic grpc client credentials (#204) 
* Add an aTLS wrapper for grpc credentials

* Move grpc dialers to internal and use aTLS grpc credentials

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-13 11:40:27 +02:00
Fabian Kammel
84552ca8f7 AB#2104 Feat/azure logging (#198) 
implementation for azure early boot logging
 2022-06-10 13:18:30 +02:00
Daniel Weiße
691ab84326 Update version variable 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-08 17:17:06 +02:00
Daniel Weiße
3467df6b69 Move attestation, atls and oid packages to internal directory 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-08 17:17:06 +02:00
Daniel Weiße
b461c40c3a Implement activation service 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-08 17:17:06 +02:00
katexochen
b3a51cca64 Move cli/status to internal/statuswaiter 2022-06-08 11:59:23 +02:00
katexochen
b308db03fe Move cli/cloud/cloudtypes into /internal 2022-06-08 11:59:23 +02:00
katexochen
6a9419e89c Remove cli/ec2 2022-06-08 11:59:23 +02:00
katexochen
180d7872dd Separate shared azure code 2022-06-08 11:59:23 +02:00
katexochen
48b4f10207 Separate shared gcp code 2022-06-08 11:53:55 +02:00
katexochen
21127a4cdc Remove azure instances 2022-06-08 11:53:55 +02:00
katexochen
3562345da4 Remove gcp instances 2022-06-08 11:53:55 +02:00
katexochen
4b30dd21c8 Remove cli/qemu, use cloudtypes instead 2022-06-08 11:53:55 +02:00
katexochen
67b25d2771 Move cli/cloudprovider into internal/cloud 2022-06-08 11:53:55 +02:00
Leonard Cohnen
791d5564ba replace flannel with cilium 2022-06-02 13:08:25 +02:00
3u13r
c4f15cd30b bump images (#191) 2022-06-02 10:30:43 +02:00
Christoph Meyer
db5468a886 Deploy KMS server image in Constellation 
Add image pull secret for ghcr.io
 2022-05-31 11:13:26 +02:00
Thomas Tendyck
42fc497477 cli: fix and tweak config file wording 2022-05-27 16:53:04 +02:00
Thomas Tendyck
2ba3c153de AB#2117 cli: validate config (#170) 
* AB#2117 cli: validate config

* update hack/go.mod
 2022-05-23 15:01:39 +02:00
Malte Poll
c16f5391db bump images 1653299706 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-23 14:26:10 +02:00
Fabian Kammel
135c787001 AB#2098 versioned & strict yaml reading (#157) 2022-05-18 18:10:57 +02:00
Fabian Kammel
7c2d1c3490 AB#2094 cloud provider specific configs (#151) 
add argument to generate cloud specific configuration file
 2022-05-18 11:39:14 +02:00
Fabian Kammel
08f4f4e0aa updated images to newest version (#150) 2022-05-17 14:24:44 +02:00
Moritz Eckert
772aa66fb4 Set hardcoded file permissions to 0o600 (#153) 2022-05-17 13:10:39 +02:00
Fabian Kammel
cfad36720b Cloned UserKey struct to config so it can be documented. Added examples. (#149) 2022-05-17 10:52:37 +02:00
Fabian Kammel
b905c28515 AB#2061 Self Documenting Config File (#143) 
Move firewall up into root config, remove VPC config & autogenerate comments in config file.
 2022-05-16 18:54:25 +02:00
Nils Hanke
68092f27dd AB#2046 : Add option to create SSH users for the first coordinator upon initialization (#133) 
* Move `file`, `ssh` and `user` packages to internal
* Rename `SSHKey` to `(ssh.)UserKey`
* Rename KeyValue / Publickey to PublicKey
* Rename SSH key file from "debugd" to "ssh-keys"
* Add CreateSSHUsers function to Core
* Call CreateSSHUsers users on first control-plane node, when defined in config

Tests:
* Make StubUserCreator add entries to /etc/passwd
* Add NewLinuxUserManagerFake for unit tests
* Add unit tests & adjust existing ones to changes
 2022-05-16 17:32:00 +02:00
Malte Poll
baa7dbc1ef Move debugd config to separate file 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-16 15:20:23 +02:00
Nils Hanke
25b0ca2a06 Use filename from input instead of hardcoded name 2022-05-16 15:15:05 +02:00
Malte Poll
3b30291360 QEMU CSP Config: PCRs -> Measurements 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-13 13:36:03 +02:00
Malte Poll
c679526bae Remove ConstellationPort from config file 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-13 13:36:03 +02:00
Fabian Kammel
83857b142c AB#2064 Feat/config/dev config to config (#139) 
Renamed dev-config to config, additionally changed cdbg config to yaml.
 2022-05-13 11:56:43 +02:00
Fabian Kammel
094a8b7659 Feat/config/generate (#136) 
Implement config command & generate verb to write default configuration to file or stdout.
 2022-05-12 15:14:52 +02:00
Fabian Kammel
14103e4f89 Fix/config/measurements in yaml (#135) 
Custom type & marshal implementation for measurements to write base64 instead of single bytes
 2022-05-12 10:15:00 +02:00
Fabian Kammel
b8d1cc2b75 converted config file from JSON to YAML. (#132) 
converted config file from JSON to YAML
 2022-05-11 13:53:02 +02:00
Malte Poll
748eb0f96b Create GCP images in "constellation-images" project 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-10 13:58:10 +02:00
cm
c63d7126e7 AB#1943 Extract KMS package (#56) 
* Extract kmsapi from coordinator

* Add kmsapi cmd server
 2022-05-10 12:35:17 +02:00
Daniel Weiße
a953df60b6 Rename in config: PCRs->Measurements 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-05-09 08:24:21 +02:00
Malte Poll
c9226de9ab Create kubernetes join token on demand 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-06 12:12:44 +02:00
Malte Poll
ddcb4dc95f Pin kubernetes version deployed by kubeadm init 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-05 09:15:41 +02:00
katexochen
1189078c5a Replace mutiple args with flags 
AB#1955
 2022-05-04 17:14:03 +02:00
Daniel Weiße
8444d5c515 Add qemu cloudprovider for activation calls 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-05-04 08:57:43 +02:00
Malte Poll
e13ec3f914 "constellation recover" CLI command 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-04 08:41:32 +02:00
Daniel Weiße
10e9faab10 Remove GCP non CVMs 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-05-02 16:03:36 +02:00
Malte Poll
3621c7af9a Bump images 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-04-28 21:48:38 +02:00
Daniel Weiße
7619e1dee7 Remove kernel panic function 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-04-28 15:10:55 +02:00
datosh
2a766a3ab5 Feat/conformity test (#79) 
* Added files required to request conformance with kubernetes
* Extended firewall implementation to allow port ranges
* Added default nodeport range to vpc network config
 2022-04-26 17:09:03 +02:00
Benedict Schlueter
6265b307af bump images 
Signed-off-by: Benedict Schlueter <bs@edgeless.systems>
 2022-04-26 15:22:51 +02:00
Leonard Cohnen
daba25c3d4 bump images 2022-04-25 10:30:28 +02:00
katexochen
1a9b33d738 Restructure config and constants 2022-04-21 09:06:35 +02:00
Benedict
d869e10a85 Bump coordinator images to 1649852687 2022-04-13 20:30:57 +02:00
Malte Poll
e10a47f255 file handler: Add "mkdirAll" flag 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-04-13 13:07:10 +02:00
Daniel Weiße
0e2025b67c Add state disk volume mounter 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-04-11 15:41:51 +02:00
Daniel Weiße
4b156be15e Add kernel panic util function 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-04-11 15:41:51 +02:00
Malte Poll
daf2280e3f create state disk on constellation create 2022-04-05 15:08:55 +02:00
Malte Poll
2cd8d580d8 Bump coreos images to 1649063903 2022-04-04 12:51:00 +02:00
Leonard Cohnen
f74d7e22eb update aws image 2022-04-01 17:18:07 +02:00
katexochen
66fe34ee32 Write WireGuard config file on init 2022-03-31 15:43:25 +02:00
Malte Poll
8d7253ca75 Bump coreos images to 1648560610 2022-03-30 17:14:34 +02:00
Leonard Cohnen
2d8fcd9bf4 monorepo 
Co-authored-by: Malte Poll <mp@edgeless.systems>
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
Co-authored-by: Benedict Schlueter <bs@edgeless.systems>
Co-authored-by: leongross <leon.gross@rub.de>
Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>
 2022-03-22 16:09:39 +01:00