4030 Commits

Author SHA1 Message Date
miampf
6df013e8aa
only get workflow runs that failed 2024-04-26 10:52:38 +02:00
miampf
05b4bed034
use terraform plugin cache 2024-04-26 10:52:38 +02:00
miampf
4430f448be
delete directory after everything to save space 2024-04-26 10:52:38 +02:00
miampf
94d93b6886
update to use correct roles 2024-04-26 10:52:38 +02:00
miampf
989db042c1
cleaner shell script 2024-04-26 10:52:38 +02:00
miampf
c944533982
set id-token write permission for OIDC 2024-04-26 10:52:38 +02:00
miampf
69bad3430d
authenticate with cloud providers 2024-04-26 10:52:38 +02:00
miampf
7f1e13f7b2
pass secret by environment variable 2024-04-26 10:52:37 +02:00
miampf
5f8c94437b
remove pull_request trigger 2024-04-26 10:52:37 +02:00
miampf
fbcae19ec2
use correct artifact name 2024-04-26 10:52:37 +02:00
miampf
d190fea16e
checkout branch 2024-04-26 10:52:37 +02:00
miampf
04a97a8e0a
added pull request trigger for testing 2024-04-26 10:52:37 +02:00
miampf
759d6366b3
added workflow dispatch trigger 2024-04-26 10:52:37 +02:00
miampf
a8b6866861
fetch all workflow IDs from that day (increase limit 20->1000) 2024-04-26 10:52:37 +02:00
miampf
3de77d93e4
tidy 2024-04-26 10:52:37 +02:00
miampf
14c1af3cf2
require actions read permission 2024-04-26 10:52:37 +02:00
miampf
a9a96054ee
fixed issues with download format and allow stderr output 2024-04-26 10:52:37 +02:00
miampf
7b95a54b92
install plugins before deleting resources 2024-04-26 10:52:37 +02:00
miampf
85c485f723
added explaining comments 2024-04-26 10:52:37 +02:00
miampf
ebe3f0a7b6
use a string for potentially weird characters 2024-04-26 10:52:37 +02:00
miampf
30a688a159
dont silent terraform output 2024-04-26 10:52:37 +02:00
miampf
abef777c9f
use correct name for artifact content 2024-04-26 10:52:37 +02:00
miampf
9b2b18607c
added comment that explains cron 2024-04-26 10:52:36 +02:00
miampf
a07e40382b
wrote workflow that uses action 2024-04-26 10:52:36 +02:00
miampf
5418d7bce0
only go back a week 2024-04-26 10:52:36 +02:00
miampf
4b024c1ecc
wrote bash script + started writing action 2024-04-26 10:52:16 +02:00
Daniel Weiße
680d3318af
ci: ensure --tags flag is only set if the CLI supports it (#3044)
* Use github.run_id to correctly tag resources with the run id
* Ensure `--tags` flag is only set if CLI supports it

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-26 09:34:21 +02:00
edgelessci
0df26c0e9b
image: update measurements and image version (#3043)
Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
2024-04-26 08:05:44 +02:00
renovate[bot]
3ea0e3a487
deps: update K8s constrained AWS versions (#2938)
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2024-04-25 15:49:50 +02:00
renovate[bot]
0f6491f3c7
deps: update K8s constrained Azure versions (#2941)
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2024-04-25 15:48:46 +02:00
renovate[bot]
f00890ab1e
deps: update module k8s.io/kubernetes to v1.29.4 [SECURITY] (#3039)
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2024-04-25 14:03:24 +02:00
miampf
3f7a4e4313
ci: tag resources created by e2e tests with the run name (#3035) 2024-04-25 12:02:23 +00:00
edgelessci
591aba99fd
image: update measurements and image version (#3040)
Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
2024-04-24 08:16:45 +02:00
Daniel Weiße
056f991f58
ci: add missing permission for e2e-windows test in weekly run (#3037)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-22 15:21:56 +02:00
Daniel Weiße
4635a6c8b1
attestation: dont set a default for TDX MRSEAM (#3038)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-22 14:07:24 +02:00
edgelessci
a7451fbe1c
image: update locked rpms (#3036)
Co-authored-by: malt3 <1780588+malt3@users.noreply.github.com>
2024-04-22 09:39:09 +02:00
miampf
b187966581
cli: allow tagging cloud resources with custom tags (#3033) 2024-04-19 09:07:57 +00:00
edgelessci
f60c133724
image: update measurements and image version (#3034)
Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
2024-04-19 08:30:06 +02:00
Markus Rudy
9b52ec403b
deps: auto-assign reviewer for deps PRs (#3032)
* deps: auto-assign reviewer for deps PRs

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2024-04-17 20:38:32 +02:00
Moritz Sanft
35e19a45bb
ci: disable SEV-SNP tests that need stable images (#3031) 2024-04-17 09:12:52 +02:00
edgelessci
ea17af3dcc
image: update measurements and image version (#3030)
Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
2024-04-17 08:18:39 +02:00
Moritz Sanft
913b09aeb8
Support SEV-SNP on GCP (#3011)
* terraform: enable creation of SEV-SNP VMs on GCP

* variant: add SEV-SNP attestation variant

* config: add SEV-SNP config options for GCP

* measurements: add GCP SEV-SNP measurements

* gcp: separate package for SEV-ES

* attestation: add GCP SEV-SNP attestation logic

* gcp: factor out common logic

* choose: add GCP SEV-SNP

* cli: add TF variable passthrough for GCP SEV-SNP variables

* cli: support GCP SEV-SNP for `constellation verify`

* Adjust usage of GCP SEV-SNP throughout codebase

* ci: add GCP SEV-SNP

* terraform-provider: support GCP SEV-SNP

* docs: add GCP SEV-SNP reference

* linter fixes

* gcp: only run test with TPM simulator

* gcp: remove nonsense test

* Update cli/internal/cmd/verify.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update docs/docs/overview/clouds.md

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update terraform-provider-constellation/internal/provider/attestation_data_source_test.go

Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>

* linter fixes

* terraform_provider: correctly pass down CC technology

* config: mark attestationconfigapi as unimplemented

* gcp: fix comments and typos

* snp: use nonce and PK hash in SNP report

* snp: ensure we never use ARK supplied by Issuer (#3025)

* Make sure SNP ARK is always loaded from config, or fetched from AMD KDS
* GCP: Set validator `reportData` correctly

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* attestationconfigapi: add GCP to uploading

* snp: use correct cert

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform-provider: enable fetching of attestation config values for GCP SEV-SNP

* linter fixes

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
2024-04-16 18:13:47 +02:00
Daniel Weiße
485ebb151e
kubecmd: retry any k8s errors in CLI and Terraform (#3028)
* Retry any k8s errors in CLI and Terraform
* Use structured logging in `kubecmd` package

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-16 15:12:42 +02:00
Markus Rudy
f189aa186f
dev-docs: document security advisory process (#3024)
* dev-docs: document security advisory process
2024-04-15 11:49:23 +02:00
edgelessci
456279c896
image: update locked rpms (#3026)
Co-authored-by: malt3 <1780588+malt3@users.noreply.github.com>
2024-04-15 07:44:24 +02:00
edgelessci
41e4f144ed
image: update measurements and image version (#3023)
Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
2024-04-12 08:24:28 +02:00
davidweisse
e89d8e4d72
ci: add error handling to e2e windows liveness probe (#3018)
* workflows: add error handling to e2e windows liveness probe

* update retry condition in last iteration

* Update liveness probe to check for correct number of nodes

* ci: fix Windows e2e test not pushing required container images (#3021)

* More output when waiting for nodes to get ready
* Create unique resource group name for Windows e2e test
* Push container images on windows CLI build to fix e2e test

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Fix resource group naming

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2024-04-11 11:27:12 +02:00
Markus Rudy
f6dfea2a79
helm: unbreak helm test after Cilium version bump (#3022) 2024-04-11 09:38:15 +02:00
Markus Rudy
550798279a
Merge pull request from GHSA-g8fc-vrcg-8vjg
* helm: firewall pods

* helm: bump cilium chart version

---------

Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2024-04-10 13:48:32 +02:00
Daniel Weiße
6e31223ff9
ci: suppress license check on windows e2e (#3020)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-04-10 10:51:09 +02:00