Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-25 15:39:37 -05:00
Code Issues Packages Projects Releases Wiki Activity
1,056 Commits 137 Branches 49 Tags 92 MiB
743f5fa627
Commit Graph

77 Commits

Author SHA1 Message Date
Malte Poll
743f5fa627 Remove all traces of CoreOS from the codebase 2022-10-21 11:04:25 +02:00
Malte Poll
9b57f2a91c Cilium: avoid requirements for jq on Constellation OS 2022-10-21 11:04:25 +02:00
Malte Poll
981796574c Disable access manager 2022-10-21 11:04:25 +02:00
Malte Poll
34367ea3cc Create mkosi image build pipeline 2022-10-21 11:04:25 +02:00
Otto Bittner
c6ccee1250 AB#2490: deploy KMS via Helm 
* Bundle helm-install related code in speparate package
* Move cilium installation to new helm package
 2022-10-18 13:33:37 +02:00
Fabian Kammel
552fb8f9b1
double CRD timeout to 30 seconds (#230) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-12 17:07:18 +02:00
katexochen
e3e7fddf76 Use unified version constant in bootstrapper 2022-10-12 11:04:07 +02:00
Leonard Cohnen
2e3176f87c enable konnectivity 2022-10-07 03:38:05 +02:00
katexochen
4ccd96bf64 Pin container image hashes 2022-10-06 19:16:20 +02:00
Fabian Kammel
369480a50b
Feat/revive (#212) 
* enable revive as linter
* fix var-naming revive issues
* fix blank-imports revive issues
* fix receiver-naming revive issues
* fix exported revive issues
* fix indent-error-flow revive issues
* fix unexported-return revive issues
* fix indent-error-flow revive issues
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-05 15:02:46 +02:00
katexochen
42f273611a Use uid from metadata instead of name 2022-09-30 16:50:52 +02:00
katexochen
53c8c9e9a6 Update proto files to v2 2022-09-22 09:10:19 +02:00
katexochen
ba6e41ed5c Upgrade go module to v2 2022-09-22 09:10:19 +02:00
katexochen
88d200232a Remove autoscaling from CLI and bootstrapper 2022-09-20 13:41:23 +02:00
3u13r
774e300a32
Constellation conformance mode (#161) 
* add conformance mode
 2022-09-20 10:07:55 +02:00
Leonard Cohnen
4a6b99d2f4 disable konnectivity 2022-09-12 19:03:01 +02:00
Leonard Cohnen
4c41da4b50 allow default routing in konnectivity 2022-09-12 14:56:40 +02:00
Leonard Cohnen
7163c161b6 Deploy Konnectivity 2022-09-09 17:26:02 +02:00
Daniel Weiße
8cb155d5c5
AB#2260 Refactor disk-mapper recovery (#82) 
* Refactor disk-mapper recovery

* Adapt constellation recover command to use new disk-mapper recovery API

* Fix Cilium connectivity on rebooting nodes (#89)

* Lower CoreDNS reschedule timeout to 10 seconds (#93)

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-08 14:45:27 +02:00
Malte Poll
57e77ee53f kubernetes version: rename latest -> default 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
d995558ffd
kubernetes server side apply: start counting resources at 1 (#74) 2022-09-05 16:50:22 +02:00
Leonard Cohnen
7b00005ed6 fix qemu initialization 2022-09-05 16:35:59 +02:00
Otto Bittner
405db3286e AB#2386: TrustedLaunch support for azure attestation 
* There are now two attestation packages on azure.
The issuer on the server side is created base on successfully
querying the idkeydigest from the TPM. Fallback on err: Trusted Launch.
* The bootstrapper's issuer choice is validated by the CLI's validator,
which is created based on the local config.
* Add "azureCVM" field to new "internal-config" cm.
This field is populated by the bootstrapper.
* Group attestation OIDs by CSP (#42)
* Bootstrapper now uses IssuerWrapper type to pass
the issuer (and some context info) to the initserver.
* Introduce VMType package akin to cloudprovider. Used by
IssuerWrapper.
* Extend unittests.
* Remove CSP specific attestation integration tests

Co-authored-by: <dw@edgeless.systems>
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-05 12:03:48 +02:00
Daniel Weiße
f8c01a0298
AB#2394 Change KMS to be deployed as DaemonSet (#69) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-05 10:22:40 +02:00
Thomas Tendyck
bd63aa3c6b add license headers 
sed -i '1i/*\nCopyright (c) Edgeless Systems GmbH\n\nSPDX-License-Identifier: AGPL-3.0-only\n*/\n' `grep -rL --include='*.go' 'DO NOT EDIT'`
gofumpt -w .
 2022-09-05 09:17:25 +02:00
Leonard Cohnen
26f5aec853 add verify load balancer 2022-09-01 16:45:18 +02:00
3u13r
f649219cbf
Feat/cilium strict mode2.0 (#25) 
* bump cilium helm charts

* integrate cilium strict mode v2
 2022-08-31 15:37:07 +02:00
Otto Bittner
4adc19b7f5 AB#2350: Configurably enforce idkeydigest on Azure 
* Add join-config entry for "enforceIdKeyDigest" bool
* Add join-config entry for "idkeydigest"
* Initially filled with TPM value from bootstrapper
* Add config entries for idkeydigest and enforceIdKeyDigest
* Extend azure attestation validator to check idkeydigest,
if configured.
* Update unittests
* Add logger to NewValidator for all CSPs
* Add csp to Updateable type

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 15:26:04 +02:00
Malte Poll
c84e44913b Fork node maintenance operator and deploy it on all supported k8s versions 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-31 14:53:06 +02:00
Daniel Weiße
7c832273fd
AB#2309 constellation upgrade execute (#2) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:49:44 +02:00
Otto Bittner
7c5556864b AB#2333: Add AMD SNP-based attestation 
Currently only available on Azure CVMs.

* Get the public attestation key from the TPM.
* Get the snp report from the TPM.
* Get the VCEK and ASK certificate from the metadata api.
* Verify VCEK using hardcoded root key (ARK)
* Verify SNP report using VCEK
* Verify HCLAkPub using SNP report by comparing
AK with runtimeData
* Extend unittest

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:29:33 +02:00
Fabian Kammel
0a3a4e9c7f move util 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Fabian Kammel
22c912a56d move nodestate and role 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Malte Poll
26e9c67a00 Move cloud metadata packages and kubernetes resources marshaling to internal 
Decouples cloud provider metadata packages from kubernetes related code

Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-29 16:07:55 +02:00
Thomas Tendyck
6b8a2a0063 remove image pull secret 2022-08-28 15:57:08 +02:00
katexochen
e57c3991f7 Don't add loadbalancer IP routing rule on workers 2022-08-23 18:11:20 +02:00
katexochen
a02a46e454 Use multiple loadbalancers on GCP 2022-08-23 18:11:20 +02:00
3u13r
29a1b5de42 increase helm install timeout (#381) 2022-08-19 13:28:16 +02:00
Malte Poll
abb4fb4f0f Build GCP guest agent from github actions in constellation repo 2022-08-16 08:47:58 +02:00
Daniel Weiße
ba4471a228 AB#2316 Configurable enforced PCRs (#361) 
* Add warnings for non enforced, untrusted PCRs

* Fix global state in Config PCR map

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-12 15:59:45 +02:00
3u13r
9478303f80 deploy cilium via helmchart (#321) 2022-08-12 10:20:19 +02:00
Malte Poll
2c7129987a Deploy operator-lifecycle-manager (OLM), node-maintenance-operator (NMO) and constellation-node-operator 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-11 10:48:50 +02:00
Malte Poll
18a89d2881 Add constellation UID retrieval to cloudprovider metadata APIs 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-11 10:48:50 +02:00
Malte Poll
081dfb5037 Upgrade Azure SDK 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-05 10:35:38 +02:00
Daniel Weiße
4151d365fb AB#2286 Return only primary IPs for instance metadata operations (#335) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-04 11:08:20 +02:00
Fabian Kammel
985585f578 fix linter issues (#329) 
* fix linter issues
* replace fmt with logger
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
 2022-08-02 16:25:47 +02:00
Fabian Kammel
19b731b5f7 Add node name to early boot logging (#323) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-01 12:32:28 +02:00
Daniel Weiße
7baf98f014 Add test vectors for key derivation functions (#320) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-01 09:11:13 +02:00
Daniel Weiße
9a3bd38912 Generate random salt for key derivation on init (#309) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-07-29 09:52:47 +02:00
3u13r
e0ce2e8a51 add namespace to kubectl requests (#315) 
* add namespace to kubectl requests

* Add tests for missing/wrong namespace

Co-authored-by: Otto Bittner <cobittner@posteo.net>
 2022-07-28 16:07:29 +02:00