Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-10-01 01:36:09 -04:00
Code Issues Packages Projects Releases Wiki Activity
838 Commits 133 Branches 44 Tags 106 MiB
711532158f
Commit Graph

213 Commits

Author SHA1 Message Date
katexochen
e761c9bf97 Manually manage GCP service accounts 2022-08-24 11:44:05 +02:00
Malte Poll
f9c70d5c5a constellation create azure: use custom poller to check for scale set creation (#394) 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-24 11:31:43 +02:00
Daniel Weiße
d1495e9285 Fix helm csp selection (#362) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-24 09:45:02 +02:00
katexochen
df9db94079 Add method for building resource names 2022-08-23 18:11:20 +02:00
katexochen
14ef07aca9 Add method for building resource URIs 2022-08-23 18:11:20 +02:00
katexochen
a02a46e454 Use multiple loadbalancers on GCP 2022-08-23 18:11:20 +02:00
katexochen
c954ec089f Check for 404 errors in GCP termination 2022-08-23 18:11:20 +02:00
katexochen
9f599c3993 Remove checks for GetState/SetState 2022-08-23 18:11:20 +02:00
katexochen
f28e00659c Use uber/multierr for error composition 2022-08-23 18:11:20 +02:00
katexochen
a859accf1f Use id file for init ip 2022-08-23 18:11:20 +02:00
katexochen
7bbcc564bb Refactor id file interaction 
* Use IP instead of endpoint in clusterIDsFile
* Move and rename validateEnpoint to addPortIfMissing
* Refactor clusterIDsFile handling in verify cmd
 2022-08-23 18:11:20 +02:00
katexochen
c2faa20d6e Fix naming in state file 2022-08-23 18:11:20 +02:00
Malte Poll
e841d9201b Use Azure CVMs in e2e tests 2022-08-19 18:22:55 +02:00
Malte Poll
5883278d4a Enable secure boot on Azure CVMs 2022-08-19 14:39:36 +02:00
Otto Bittner
0892525915 Switch to Azure CVMs 2022-08-19 14:39:36 +02:00
Malte Poll
402fc7761b Disable l7 proxy on QEMU (#378) 2022-08-19 08:44:36 +02:00
Fabian Kammel
82eb9f4544 AB#2299 License check in CLI during init (#366) 
* license server interaction
* logic to read from license file
* print license information during init
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>
 2022-08-16 16:06:38 +02:00
Fabian Kammel
170a8bf5e0 AB#2306 Public image sharing in Google (#358) 
* document how to publicly share images in gcloud
* Write disclamer in debugd
* Add disclamer about debug images to contributing file
* Print debug banner on startup
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-16 15:53:54 +02:00
Daniel Weiße
ba4471a228 AB#2316 Configurable enforced PCRs (#361) 
* Add warnings for non enforced, untrusted PCRs

* Fix global state in Config PCR map

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-12 15:59:45 +02:00
3u13r
9478303f80 deploy cilium via helmchart (#321) 2022-08-12 10:20:19 +02:00
Daniel Weiße
8f5f84deb5 AB#2305 Fix missing atls verifier in init call (#352) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-09 14:04:40 +02:00
Daniel Weiße
60d5578475 AB#2215 Perform sanity check on GCP projectID (#349) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-09 10:26:29 +02:00
Daniel Weiße
ab536ae3c8 AB#2278 Remove hardcoded values from config (#346) 
* Update file handler to avoid incorrect usage of file.Option

* Remove hardcoded values

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-08 11:04:17 +02:00
Malte Poll
bf5816cc00 linter cleanup (#344) 
* go fmt
* static check
 2022-08-05 15:30:23 +02:00
Daniel Weiße
8895693ae2 AB#2251 Parallel Azure scale set creation (#318) 
* Parallel Azure scale set creation

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-05 10:35:38 +02:00
Malte Poll
081dfb5037 Upgrade Azure SDK 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-05 10:35:38 +02:00
Daniel Weiße
19871ee422 Enable integrity protection on boot (#300) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-02 12:35:23 +02:00
Daniel Weiße
aa7fcce8af Add configurable node disk type (#317) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-02 12:24:55 +02:00
Fabian Kammel
050e8fdc4a AB#2159 Feat/cli/fetch measurements (#301) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-01 09:37:05 +02:00
Daniel Weiße
7baf98f014 Add test vectors for key derivation functions (#320) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-01 09:11:13 +02:00
Daniel Weiße
9a3bd38912 Generate random salt for key derivation on init (#309) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-29 09:52:47 +02:00
Daniel Weiße
a3a85b31cf Remove mentions of unique ID (#311) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-27 16:10:50 +02:00
Moritz Eckert
ad02249b9a Add VerifyService port to GCP LB (#291) 
* Add VerifyService port to GCP LB

* cli verify command: Use verify service port by default

Co-authored-by: Malte Poll <mp@edgeless.systems>
 2022-07-26 16:35:14 +02:00
Daniel Weiße
db79784045 AB#2200 Merge Owner and Cluster ID (#282) 
* Merge Owner and Cluster ID into single value

* Remove aTLS from KMS, as it is no longer used for cluster external communication

* Update verify command to use cluster-id instead of unique-id flag

* Remove owner ID from init output

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-26 10:58:39 +02:00
Otto Bittner
c743398a23 AB#2181: retry k8s downloads (#286) 
Generalize retrier:
* Generalize Do to use a supplied 'retriable' function
* Make clock an optional argument in NewIntervalRetrier
* Move grpc/retrier to interal package
* Update existing unittests to not use retry feature

Add retryDownloadToTempDir:
* Wrap downloadToTempDir with retrier.
* Retry if TCP connection is reset.
* Abort by canceling the context.
* Use a mock server in the unit test that serves responses
depending on the state received through a state channel.

Co-authored-by: katexochen <49727155+katexochen@users.noreply.github.com>
 2022-07-21 15:20:12 +02:00
Fabian Kammel
ba5a3aefe3 fix ci-lint issues (#287) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-07-20 16:44:41 +02:00
Otto Bittner
a68ee817ff AB#2074: Choosable K8S Version (#277) 
AB#2074: Add configurable k8s version

Configurable version flow:
* cli config holds/validates k8sVersion
* InitCluster receive a k8sVersion arg
* InitCluster creates CM "k8s-version"
* kubeadm's InitConfiguration receives k8sVersion
* joinservice spec mounts/reads k8s-version CM
* joinservice supplies k8sVersion via JoinTicketResponse
Other changes:
* Remove unused test code (FakeK8SClient)
* move VersionConfig map to /internal/versions
* installk8sComponents is now a function instead of a method
 2022-07-18 12:28:02 +02:00
Fabian Kammel
a931f6692f Fix/bootstrapper regressions (#274) 
* remove wireguard from e2e tests, conformance docs & config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-07-15 11:53:14 +02:00
Malte Poll
260d2571c1 Only upload kubeadm certs if key is rotated 
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: 3u13r <lc@edgeless.systems>
 2022-07-14 17:25:18 +02:00
Malte Poll
5d54ce689b Print kubeadm init/join output on success 2022-07-14 17:25:18 +02:00
katexochen
66b573ea5d Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
dea23604fb Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
916e5d6b55 Rename coordinator to bootstrapper and rename roles 2022-07-14 17:25:18 +02:00
Malte Poll
3280ed200c Test IntervalRetrier 2022-07-14 17:25:18 +02:00
katexochen
f79674cbb8 Bootstrapper 2022-07-14 17:25:18 +02:00
katexochen
32f1f5fd3e Delete Coordinator core and apis 2022-07-14 17:25:18 +02:00
Nils Hanke
14a15e131a Modify accepted list of Azure VM types (#250) 
* Add more instances types for Azure (with commented out entries)

* Remove commented out entries

* Only AMD VMs

* Comment out CVMs (not supported yet)

* Adjust comments
 2022-07-10 13:27:05 +02:00
Fabian Kammel
b4fd4fbacd Fix/add verify grpc port to lb (#262) 
* Add verify port to lb
* Use correct health probe
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-07-08 18:18:23 +02:00
Nils Hanke
bc5471e9b3 Delete cluster IDs file on terminate 2022-07-05 14:41:58 +02:00
Nils Hanke
259c88fa1a IDsFilename -> ClusterIDsFilename 2022-07-05 14:41:58 +02:00
Thomas Tendyck
70efb92adc cli: fix vale lint errors in verify description 2022-07-04 12:19:38 +02:00
cm
3177b2fdb7 AB#2032 Write IDs to disk and read when verifying (#212) 
* AB#2032 Write IDs to disk and read when verifying

* Update CHANGELOG.md

* update changelog

* update changelog

* cli verify: prefer flag values

* Rename fid file

Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
 2022-07-01 10:57:29 +02:00
Otto Bittner
7cada2c9e8 Add goleak to all tests (#227) 
* Run goleak as part of all tests
We are already using goleak in various tests.
This commit adds a TestMain to all remaining tests
and calls goleak.VerifyTestMain in them.
* Add goleak to debugd/deploy package and fix bug.
* Run go mod tidy
* Fix integration tests
* Move goleak invocation for mount integration test
* Ignore leak in state integration tests

Co-authored-by: Fabian Kammel <fk@edgelss.systems>
 2022-06-30 15:24:36 +02:00
Daniel Weiße
f9a581f329 Add aTLS endpoint to KMS (#236) 
* Move file watcher and validator to internal

* Add aTLS endpoint to KMS for Kubernetes external requests

* Update Go version in Dockerfiles

* Move most KMS packages to internal

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-29 16:13:01 +02:00
Daniel Weiße
042f668d20 AB#2190 Verification service (#232) 
* Add verification service

* Update verify command to use new Constellation verification service

* Deploy verification service on cluster init

* Update pcr-reader to use verification service

* Add verification service build workflow

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-28 17:03:28 +02:00
Nils Hanke
e3f78a5bff Remove passing context seperately to initialize 2022-06-28 13:55:50 +02:00
Leonard Cohnen
e13f4d84c3 add gcp loadbalancer 2022-06-23 14:00:20 +02:00
Christoph Meyer
1e11188dac AB#2033 User-friendly wrap and reword errors 
fix: readOrGenerated function signature
 2022-06-22 12:02:10 +01:00
Christoph Meyer
9441e46e4b AB#2033 Remove redundant "failed" in error wrapping 
Remove "failed" from wrapped errors
Where appropriate rephrase "unable to/could not" to "failed" in root
errors
Start error log messages with "Failed"
 2022-06-22 12:02:10 +01:00
Fabian Kammel
0c9ca50be8 Feat/more version info (#224) 2022-06-21 15:12:27 +02:00
Fabian Kammel
392ad7fe45 Create Application Insights early so they are ready when VM needs them. (#213) 2022-06-15 12:19:41 +02:00
Daniel Weiße
1e19e64fbc Dynamic grpc client credentials (#204) 
* Add an aTLS wrapper for grpc credentials

* Move grpc dialers to internal and use aTLS grpc credentials

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-13 11:40:27 +02:00
Fabian Kammel
84552ca8f7 AB#2104 Feat/azure logging (#198) 
implementation for azure early boot logging
 2022-06-10 13:18:30 +02:00
Daniel Weiße
691ab84326 Update version variable 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-08 17:17:06 +02:00
Daniel Weiße
3467df6b69 Move attestation, atls and oid packages to internal directory 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-06-08 17:17:06 +02:00
katexochen
b3a51cca64 Move cli/status to internal/statuswaiter 2022-06-08 11:59:23 +02:00
katexochen
0627b14445 Move cli/cloud/cloudcmd into cli/internal 2022-06-08 11:59:23 +02:00
katexochen
b308db03fe Move cli/cloud/cloudtypes into /internal 2022-06-08 11:59:23 +02:00
katexochen
c3ebd3d3cd Move cli/cmd into cli/internal 2022-06-08 11:59:23 +02:00
katexochen
d71e97a940 Move ScalingGroup to cloudtypes 2022-06-08 11:59:23 +02:00
katexochen
6a9419e89c Remove cli/ec2 2022-06-08 11:59:23 +02:00
katexochen
064151a956 Move cli/azure to cli/internal/azure 2022-06-08 11:59:23 +02:00
katexochen
180d7872dd Separate shared azure code 2022-06-08 11:59:23 +02:00
katexochen
6cd93e4179 Move cli/gcp to cli/internal/gcp 2022-06-08 11:53:55 +02:00
katexochen
48b4f10207 Separate shared gcp code 2022-06-08 11:53:55 +02:00
katexochen
21127a4cdc Remove azure instances 2022-06-08 11:53:55 +02:00
katexochen
3562345da4 Remove gcp instances 2022-06-08 11:53:55 +02:00
katexochen
4b30dd21c8 Remove cli/qemu, use cloudtypes instead 2022-06-08 11:53:55 +02:00
katexochen
f9b471e3c0 Create general cloudtypes instances 2022-06-08 11:53:55 +02:00
katexochen
4912ab0195 Move command sorting setting into cli/cmd 2022-06-08 11:53:55 +02:00
katexochen
67b25d2771 Move cli/cloudprovider into internal/cloud 2022-06-08 11:53:55 +02:00
katexochen
aee4d44b45 Create cli/internal package 2022-06-08 11:53:55 +02:00
Leonard Cohnen
791d5564ba replace flannel with cilium 2022-06-02 13:08:25 +02:00
katexochen
aaa5d2ab66 Replace deprecated strings.Title 2022-06-01 12:12:33 +02:00
Christoph Meyer
db5468a886 Deploy KMS server image in Constellation 
Add image pull secret for ghcr.io
 2022-05-31 11:13:26 +02:00
Thomas Tendyck
42fc497477 cli: fix and tweak config file wording 2022-05-27 16:53:04 +02:00
Thomas Tendyck
9f0c751f1b cli: fix command order and minor wording tweaks in config cmd 2022-05-27 16:53:04 +02:00
Daniel Weiße
869448c3e1 Add mutual aTLS support (#176) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-05-24 16:33:44 +02:00
Malte Poll
5d7bf86b30 GCP create: Embed constellation role in instance templates to allow role detection prior to node activation 2022-05-24 10:37:02 +02:00
Thomas Tendyck
2ba3c153de AB#2117 cli: validate config (#170) 
* AB#2117 cli: validate config

* update hack/go.mod
 2022-05-23 15:01:39 +02:00
Fabian Kammel
daf356d88e fixed wording (#162) 2022-05-18 19:01:11 +02:00
Fabian Kammel
7c2d1c3490 AB#2094 cloud provider specific configs (#151) 
add argument to generate cloud specific configuration file
 2022-05-18 11:39:14 +02:00
Fabian Kammel
cfad36720b Cloned UserKey struct to config so it can be documented. Added examples. (#149) 2022-05-17 10:52:37 +02:00
Fabian Kammel
b905c28515 AB#2061 Self Documenting Config File (#143) 
Move firewall up into root config, remove VPC config & autogenerate comments in config file.
 2022-05-16 18:54:25 +02:00
Nils Hanke
68092f27dd AB#2046 : Add option to create SSH users for the first coordinator upon initialization (#133) 
* Move `file`, `ssh` and `user` packages to internal
* Rename `SSHKey` to `(ssh.)UserKey`
* Rename KeyValue / Publickey to PublicKey
* Rename SSH key file from "debugd" to "ssh-keys"
* Add CreateSSHUsers function to Core
* Call CreateSSHUsers users on first control-plane node, when defined in config

Tests:
* Make StubUserCreator add entries to /etc/passwd
* Add NewLinuxUserManagerFake for unit tests
* Add unit tests & adjust existing ones to changes
 2022-05-16 17:32:00 +02:00
Malte Poll
3b30291360 QEMU CSP Config: PCRs -> Measurements 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-13 13:36:03 +02:00
Malte Poll
c679526bae Remove ConstellationPort from config file 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-05-13 13:36:03 +02:00
Fabian Kammel
83857b142c AB#2064 Feat/config/dev config to config (#139) 
Renamed dev-config to config, additionally changed cdbg config to yaml.
 2022-05-13 11:56:43 +02:00
Thomas Tendyck
fde7304d78 Update validargs.go 2022-05-13 11:43:48 +02:00
Fabian Kammel
094a8b7659 Feat/config/generate (#136) 
Implement config command & generate verb to write default configuration to file or stdout.
 2022-05-12 15:14:52 +02:00