Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-27 00:19:36 -05:00
Code Issues Packages Projects Releases Wiki Activity
2,268 Commits 138 Branches 49 Tags 92 MiB
79395ddd20
Commit Graph

490 Commits

Author SHA1 Message Date
renovate[bot]
806f6b70dd
Update module github.com/talos-systems/talos/pkg/machinery to v1.3.1 (#844) 
* Update module github.com/talos-systems/talos/pkg/machinery to v1.3.1
* Rename talos-systems/talos to siderolabs/talos

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2023-01-02 13:33:56 +01:00
3u13r
47fb9f7cc8
gcp: unofficial support for internal LBs (#826) 2022-12-28 13:30:39 +01:00
Moritz Sanft
9859b30c4d
AB#2544 add upgrade agent for automatic version updates (#745) 2022-12-25 18:49:45 +01:00
Paul Meyer
8b39d3d368 versionsapi: fix cache invalidation 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-23 10:15:42 +01:00
Otto Bittner
efcd0337b4
Microservice upgrades (#729) 
Run with: constellation upgrade execute --helm.
This will only upgrade the helm charts. No config is needed.

Upgrades are implemented via helm's upgrade action, i.e. they
automatically roll back if something goes wrong. Releases could 
still be managed via helm, even after an upgrade with constellation
has been done.

Currently not user facing as CRD/CR backups are still in progress.
These backups should be automatically created and saved to the 
user's disk as updates may delete CRs. This happens implicitly 
through CRD upgrades, which are part of microservice upgrades.
 2022-12-19 16:52:15 +01:00
renovate[bot]
8ddc8cdb65 Update dependency kubernetes-sigs/cri-tools to v1.26.0 2022-12-16 10:43:33 +01:00
renovate[bot]
7ffbad12be
Update Constellation containers to v2.3.0-pre.0.20221212170906-a77f38efbb31 (#779) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-14 10:46:15 +01:00
Paul Meyer
c741ccfb4b kubernetes: use new registry 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-13 16:08:19 +01:00
Paul Meyer
6862c2587f kubernetes: add v1.26, default to v1.25 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-13 16:08:19 +01:00
Malte Poll
cf0b04291a Embed measurements for v2.3.0 2022-12-12 17:45:35 +01:00
Malte Poll
d6b2e9ea9a Expand PCR selection on AWS 2022-12-12 17:45:35 +01:00
Malte Poll
c3b657de01 Bump version to v2.3.0 2022-12-12 17:45:35 +01:00
renovate[bot]
5eae12778a
Update Constellation containers (#777) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-12-09 18:45:09 +01:00
renovate[bot]
012f739c67
Update Constellation containers (#759) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-09 16:32:58 +01:00
Malte Poll
4a8ebfd921 OS images: use "ref", "stream" and "version" 
Switch azure default region to west us
Update find-image script to work with new API spec
Add version for every os image build
generate measurements: Use new API paths
CLI: config fetch measurements: Use image short versions to fetch measurements
CLI: allows shortnames to specify image in config
Image build pipeline: Change paths to contain "ref" and "stream"
 2022-12-09 13:37:43 +01:00
Paul Meyer
4795fe9695 hack: create latest endpoint in add-version script 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-09 13:37:43 +01:00
Paul Meyer
f23a2fe073 hack: implement new api for add-version script 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-09 13:37:43 +01:00
renovate[bot]
72ba97efcc
Update K8s constrained versions (#762) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-09 13:17:55 +01:00
Paul Meyer
9b1551e76a dependencies: migrate go-genproto to google-cloud-go 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-08 13:27:15 +01:00
renovate[bot]
3435ac216f
Update Constellation containers (#748) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-12-08 11:38:05 +01:00
Leonard Cohnen
a1161ae05d k8supdates: label nodes with k8s component hash 2022-12-08 11:19:22 +01:00
renovate[bot]
bb9122f115
Update Constellation containers to v2.3.0-pre.0.20221207104854-286803fb97a0 (#747) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-12-07 15:12:04 +01:00
Moritz Sanft
286803fb97
AB#2579 Add constellation iam create command (#624) 2022-12-07 11:48:54 +01:00
renovate[bot]
be01cf7129
Update Constellation containers to v2.3.0-pre.0.20221206170532-a9ed8c0191ac (#733) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-07 10:44:45 +01:00
Paul Meyer
cb734a2e66 debugd: pin logcollector container digest 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-06 18:05:32 +01:00
renovate[bot]
1766f0e4b3
Update Constellation containers to v2.3.0-pre.0.20221205155634-0981ab6fa45b (#725) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-06 13:29:54 +01:00
renovate[bot]
0981ab6fa4
Update Constellation containers to v2.3.0-pre.0.20221205121645-176dae317f6c (#719) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-05 16:56:34 +01:00
Paul Meyer
176dae317f debugd: fix logcollector container image naming 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-05 13:16:45 +01:00
Paul Meyer
226a6b6626 debugd: let renovate manage logcollector images 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-02 18:54:24 +01:00
Paul Meyer
8c5fc7a890 versionsapi: allow debug stream 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-02 18:49:17 +01:00
Paul Meyer
9c9c8e3d46 versionsapi: rename package 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-02 18:49:17 +01:00
renovate[bot]
3c62b841ed
Update Constellation containers (#705) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-02 18:48:03 +01:00
Leonard Cohnen
0c71cc77f6 joinservice: use configmap for k8s components 2022-12-02 14:34:38 +01:00
renovate[bot]
de77f1d9be
Update ghcr.io/edgelesssys/constellation/qemu-metadata-api Docker tag to v2.3.0-pre.0.20221201105133-8004edcc144d (#700) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-01 18:49:02 +01:00
Paul Meyer
8004edcc14
image: add version and debug field to lookup table (#682) 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-01 11:51:33 +01:00
Malte Poll
e67f65709f
Prepare release checklist for v2.3 (#690) 2022-12-01 10:46:04 +01:00
renovate[bot]
da114519ca
Update Constellation containers (#693) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-12-01 08:07:09 +01:00
Leonard Cohnen
7e57944cc0 versions: bump qemu metadata image 2022-11-30 18:58:22 +01:00
renovate[bot]
016f7a67c2
Update Constellation containers to v2.3.0-pre.0.20221130104839-9537fb73c015 (#684) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-11-30 16:53:58 +01:00
Malte Poll
85d723ccbd Change path for version API: 
- Rename "updates" -> "versions"
- Add explicit "stream" in path to make API self-describing
 2022-11-30 16:36:12 +01:00
Paul Meyer
b93b24e058 debugd: add logcollector 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-11-30 16:26:25 +01:00
Malte Poll
9537fb73c0 use constants for default CDN paths 2022-11-30 12:35:12 +01:00
Malte Poll
3aa51df74d Add release trigger to make image versions available via CDN 2022-11-30 12:35:12 +01:00
Malte Poll
9bccf26ccf move update api 2022-11-30 12:35:12 +01:00
Malte Poll
ebf852b3ba Add image update API and use for "upgrade plan" 2022-11-30 12:35:12 +01:00
Thomas Tendyck
21529d0e9e don't promote Trusted Launch for now 2022-11-30 12:24:37 +01:00
renovate[bot]
8fbc4b9b19
Update ghcr.io/edgelesssys/constellation/node-operator Docker tag to v2.3.0-pre.0.20221129130129-a32f9ae75290 (#671) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-30 11:34:57 +01:00
renovate[bot]
e2673cac29
Update Constellation containers (#663) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-11-29 13:46:13 +01:00
Leonard Cohnen
3b6bc3b28f initserver: add client verification 2022-11-28 19:34:02 +01:00
Thomas Tendyck
64f03cf675
config: sort measurements numerically (#654) 
* config: sort measurements numerically

* add comment to swap
 2022-11-28 11:09:39 +01:00
Daniel Weiße
d52f3db2a3
AB#2644 Fetch measurements from CDN (#653) 
* Fetch measurements from CDN

* Perform metadata validation on fetched measurements

* Remove deprecated public bucket

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-28 10:27:33 +01:00
Leonard Cohnen
c978329839 helm: fix expected helm charts 2022-11-27 16:43:50 +01:00
Nils Hanke
878d66dcda
Remove SSHUsers and UserKey from config v2 (#650) 
* Remove SSHUsers and UserKey as part of configVersion v2

* Add migration nodes to docs

* Update CHANGELOG.md
 2022-11-25 15:27:34 +01:00
renovate[bot]
a3661d6c07
Update Constellation containers to v2.3.0-pre.0.20221125110824-89b25f8ebbd7 (#652) 
* Update Constellation containers to v2.3.0-pre.0.20221125110824-89b25f8ebbd7
* Update node operator and add hashes back for every container image

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
 2022-11-25 15:17:58 +01:00
Nils Hanke
89b25f8ebb
Add new generate measurements matrix CI/CD action (now with AWS support) (#641) 2022-11-25 12:08:24 +01:00
Daniel Weiße
c2ea937fb5
Fix potential data race when accessing a validators OID (#640) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-24 15:50:59 +01:00
renovate[bot]
0b85709dd2 Update Constellation containers to v2.3.0-pre.0.20221124095758-f8001efbc0d0 2022-11-24 13:52:44 +01:00
Daniel Weiße
f8001efbc0
Refactor enforced/expected PCRs (#553) 
* Merge enforced and expected measurements

* Update measurement generation to new format

* Write expected measurements hex encoded by default

* Allow hex or base64 encoded expected measurements

* Allow hex or base64 encoded clusterID

* Allow security upgrades to warnOnly flag

* Upload signed measurements in JSON format

* Fetch measurements either from JSON or YAML

* Use yaml.v3 instead of yaml.v2

* Error on invalid enforced selection

* Add placeholder measurements to config

* Update e2e test to new measurement format

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-24 10:57:58 +01:00
renovate[bot]
8ce954e012
Update Constellation containers to v2.3.0-pre.0.20221123084142-3dc9c6086469 (#636) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-24 09:22:49 +01:00
Malte Poll
1331c171c3 Upgrade config to v2 2022-11-23 15:47:46 +01:00
Malte Poll
575b6e93f6 CLI: use global image version field 
- Restructure config by removing CSP-specific image references
- Add global image field
- Download image lookup table on create
- Download QEMU image on QEMU create
 2022-11-23 15:47:46 +01:00
Leonard Cohnen
1e98b686b6 kubernetes: verify Kubernetes components 2022-11-23 10:48:03 +01:00
Otto Bittner
6b2d9d16f8 Remove obsolote revive comments 2022-11-23 08:35:12 +01:00
renovate[bot]
bc346805aa
Update Constellation containers to v2.3.0-pre.0.20221121163101-1362e40f53ad (#615) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-11-22 12:39:50 +01:00
Otto Bittner
1362e40f53
Surpress argument-limit errors and add TODO. (#603) 2022-11-21 17:31:01 +01:00
renovate[bot]
a5aa820d8c
Update Constellation containers (#602) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-21 11:23:06 +01:00
Otto Bittner
bdd9dd922b
AB#2589: Deploy operators via Helm (#575) 
* Only deploy operators on GCP/Azure.
* cert-manager is now deployed by default (GCP/Azure)
* remove OLM
 2022-11-21 10:35:40 +01:00
Malte Poll
74aabe86fa Move PCR[8] -> PCR[12] 2022-11-18 10:37:45 +01:00
Fabian Kammel
56dccb77b4
Merge back changes from v2.2.2 release (#580) 
* prepare v2.2.2 release and update release.md
* Updated QEMU measurements
* Terraform GCP: Always use the local account for resource creation (#571)
* CoreOS is no longer used, change docs to OS.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
 2022-11-18 10:24:45 +01:00
Daniel Weiße
b966f57a2f
AB#2554 GCP CSI driver deployment (#532) 
* Allow enabling/disabling of CSI driver through config

* Fix inconsistent namespace parsing

* Deploy GCP CSI driver on init

* Update invalid pod tolerations

* Add generate script for CSI charts

* Update generateCilium script

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-18 10:05:02 +01:00
Nils Hanke
4a2cba988c Create separate Terraform workspace directory 2022-11-17 13:49:34 +01:00
Fabian Kammel
ca4764c466
Merge v2.2.1 changes back to main (#563) 
* Bump version to v2.2.0

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Fix release detection in pipeline

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Update CHANGELOG for 2.2.1

Signed-off-by: Fabian Kammel <fk@edgeless.systems>

* bump constellation versions to 2.2.1

Signed-off-by: Fabian Kammel <fk@edgeless.systems>

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-16 11:13:10 +01:00
Fabian Kammel
bb76a4e4c8
AB#2512 Config secrets via env var & config refactoring (#544) 
* refactor measurements to use consistent types and less byte pushing
* refactor: only rely on a single multierr dependency
* extend config creation with envar support
* document changes
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-11-15 15:40:49 +01:00
Leonard Cohnen
c51694a51a kubernetes: add hashes to components 2022-11-15 11:07:46 +01:00
Daniel Weiße
5efe05d933
AB#2525 clean up unused code (#504) 
* Rename Metadata->Cloud

* Remove unused methods, functions, and variables

* More privacy for testing stubs

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-15 10:31:55 +01:00
Daniel Weiße
f41c54e837
AB#2524 Refactor Azure metadata/cloud API (#477) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-15 09:08:18 +01:00
renovate[bot]
df0c6159db Update K8s constrained versions 2022-11-14 09:33:42 +01:00
Daniel Weiße
a07cab4b97
Update go-tpm dependency (#533) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-14 09:02:56 +01:00
Fabian Kammel
b92b3772ca
Remove access manager (#470) 
* remove access manager from code base
* document new node ssh workflow
* keep config backwards compatible
* slow down link checking to prevent http 429
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-11-11 08:44:36 +01:00
renovate[bot]
c6f4b2e1a0
Update Constellation containers to v2.3.0-pre.0.20221109145754-0d12e37c9699 (#497) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-11-09 18:17:31 +01:00
Fabian Kammel
0d12e37c96
Document exported funcs,types,interfaces and enable check. (#475) 
* Include EXC0014 and fix issues.
* Include EXC0012 and fix issues.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Otto Bittner <cobittner@posteo.net>
 2022-11-09 15:57:54 +01:00
Daniel Weiße
c9873f2bfb
AB#2523 Refactor GCP metadata/cloud API (#387) 
* Refactor GCP metadata/cloud API

* Remove cloud controller manager from metadata package

* Remove PublicIP

* Move shared cloud packages

* Remove dead code

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-09 14:43:48 +01:00
Leonard Cohnen
3c6d59ce7e aws: don't flag release as debug images 2022-11-09 11:20:58 +01:00
Leonard Cohnen
97acdfa297 config: align pre-filled AWS measurements 2022-11-09 11:20:58 +01:00
Daniel Weiße
011f9c597d
Bring in changes from release branch (#479) 
* Bump version to v2.2.0

* Update changelog

* Fix release detection in pipeline

* Fix PKI selection in pipeline

* Set enforced measurements for AWS

* Update default images

* Fix release docs

* Update mini-con defaults

* Fix measurements action

* Fix syft env variable naming

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-08 18:32:59 +01:00
renovate[bot]
9ecc92e35f
Update dependency kubernetes-sigs/cri-tools to v1.25.0 (#458) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-04 17:38:52 +01:00
3u13r
4f4cd4cc67
bump verify image 20221104 (#459) 2022-11-04 13:56:19 +01:00
Leonard Cohnen
6fce8f77d3 join-service: bump image for AWS support 2022-11-03 16:44:54 +01:00
Otto Bittner
f164af29cf
AB#2583: deploy autoscaler via helm (#438) 2022-11-03 16:42:19 +01:00
Otto Bittner
0887bc540f
Fix invalid slice access in validateAk (#437) 2022-11-03 09:57:59 +01:00
Leonard Cohnen
1f9a788c21 aws: name instances for CCM 2022-11-02 23:29:04 +01:00
Leonard Cohnen
3aa0177333 join-service: add AWS attestation 2022-11-02 23:29:04 +01:00
Leonard Cohnen
b69d19c3d6 metadata: clarify networking variables 2022-11-02 23:29:04 +01:00
Leonard Cohnen
0430336fdf metadata: implement GetLoadBalancerEndpoint for AWS 2022-11-02 23:29:04 +01:00
Leonard Cohnen
dd007f4772 metadata: move subnetCIDR to InstanceMetadata 2022-11-02 23:29:04 +01:00
Leonard Cohnen
d59dc82e56 qemu attestation: fix typos 2022-11-02 23:29:04 +01:00
Leonard Cohnen
f199b08068 attestation: make AWS TPM check use the correct region 2022-11-02 23:29:04 +01:00
renovate[bot]
302303f2ea
Update K8s constrained versions (#428) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-11-02 13:28:41 +01:00
Daniel Weiße
55cfff034a
Remove PublicIP from QEMU metadata (#396) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-11-02 12:56:16 +01:00
Leonard Cohnen
8f8236a491 bump verification service 2022-10-31 17:00:14 +01:00
renovate[bot]
116736a7b9
Update Constellation containers (#402) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-31 11:00:36 +01:00
renovate[bot]
fd74ef754e
Update K8s version constrained containers (missing v1 prefix) (#399) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2022-10-31 10:34:12 +01:00
Daniel Weiße
79f52e67cb
Update go-tpm-tools to fix AWS PCR selection (#390) 
* Update go-tpm-tools to fix AWS PCR selection

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Ignore leaking glog go routine

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-28 17:57:24 +02:00
Malte Poll
caadd50056
Use renovate to update versions.go (#388) 
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-28 15:01:58 +02:00
Nils Hanke
34f729ccd2 Case insensitive replace for every user input that could break azurerm 2022-10-27 11:35:14 +02:00
leongross
d457620941
AB#2458 AWS NitroTPM attestation (#339) 
* add aws tpm attestation
* fix typos
* Fix return value issue

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-27 11:04:23 +02:00
Malte Poll
447f0bbf39 Add AWS CCM versions 2022-10-26 15:07:34 +02:00
Paul Meyer
c05b22f1dc
Remove dead code (#373) 
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 2022-10-26 10:29:28 +02:00
Malte Poll
c1e3231848
Preinstall kubelet systemd unit in OS images (#365) 2022-10-25 16:36:03 +02:00
Malte Poll
2d121d9243
Replace interface{} -> any (#370) 2022-10-25 15:51:23 +02:00
Daniel Weiße
6fe750f21b Update operator image 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-25 08:41:42 +02:00
Daniel Weiße
b35b74b772
Use tags for UID and role parsing (#242) 
* Apply tags to all applicable GCP resources

* Move GCP UID and role from VM metadata to labels

* Adjust Azure tags to be in line with GCP and AWS

* Dont rely on resource name to find resources

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-24 16:58:21 +02:00
Malte Poll
8ef1400810
Upgrade libvirt container image (#348) 2022-10-24 10:32:37 +02:00
Daniel Weiße
3ccde25584
Implement minimal feature support for bootstrapper on AWS (#333) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-24 09:12:01 +02:00
Daniel Weiße
252a7226a9 Fix ordering of QEMU config values 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-21 16:19:00 +02:00
Nils Hanke
04c4cff9f6
AB#2436: Initial support for create/terminate AWS NitroTPM instances 
* Add .DS_Store to .gitignore

* Add AWS to config / supported instance types

* Move AWS terraform skeleton to cli/internal/terraform

* Move currently unused IAM to hack/terraform/aws

* Print supported AWS instance types when AWS dev flag is set

* Block everything aTLS related (e.g. init, verify) until AWS attestation is available

* Create/Terminate AWS dev cluster when dev flag is set

* Restrict Nitro instances to NitroTPM supported specifically

* Pin zone for subnets

This is not great for HA, but for now we need to avoid the two subnets
ending up in different zones, causing the load balancer to not be able
to connect to the targets.

Should be replaced later with a better implementation that just uses
multiple subnets within the same region dynamically
based on # of nodes or similar.

* Add AWS/GCP to Terraform TestLoader unit test

* Add uid tag and create log group

Co-authored-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
 2022-10-21 12:24:18 +02:00
Otto Bittner
07f02a442c
Refactor Helm deployments (#341) 
* Wrap KMS deployment in one main chart that
deploys all other services. Other services will follow.
* Use .tgz via helm-package as serialization format
* Change Release type to carry chart as byte slice
* Remove KMSConfig
* Use json-schema to validate values
* Extend release.md to mention updating helm charts
 2022-10-21 12:01:28 +02:00
Malte Poll
743f5fa627 Remove all traces of CoreOS from the codebase 2022-10-21 11:04:25 +02:00
Malte Poll
3b6ee703f5 Move PCR indices for owner ID and cluster ID 2022-10-21 11:04:25 +02:00
Malte Poll
34367ea3cc Create mkosi image build pipeline 2022-10-21 11:04:25 +02:00
renovate[bot]
8cf6189cf0
Update module github.com/fsnotify/fsnotify to v1.6.0 (#325) 
* Update module github.com/fsnotify/fsnotify to v1.6.0

* [bot] Tidy all modules

* Use event.Has function

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
 2022-10-20 10:16:20 +02:00
Otto Bittner
c6ccee1250 AB#2490: deploy KMS via Helm 
* Bundle helm-install related code in speparate package
* Move cilium installation to new helm package
 2022-10-18 13:33:37 +02:00
Daniel Weiße
623cb6cdb5
AB#2479 Implement AWS cloud logging (#232) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-17 09:05:45 +02:00
Malte Poll
c16f5a976d
AB#2365 Upgrade k8s base deployments (add full support for k8s 1.25) (#277) 
* Add container image release for CCM GCP v25.2.0
* Upgrade versions of kubernetes base components
 2022-10-17 08:58:13 +02:00
Daniel Weiße
f068e50dee
Attestation logging (#275) 
* Add section for checking joinservice logs

* Add logging for attestation validation

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-14 16:29:21 +02:00
katexochen
263c700e73 Update operator version 2022-10-13 16:38:35 +02:00
katexochen
4b2dd1317a Normalize URIs for azurerm Terraform provider 2022-10-13 15:29:29 +02:00
katexochen
1556e239ca Remove state file 2022-10-13 15:29:29 +02:00
katexochen
0d1fd8fb2a Remove Azure client from CLI 2022-10-13 15:29:29 +02:00
katexochen
dbe9bf381c Get instance role from tags on Azure 2022-10-13 15:29:29 +02:00
katexochen
75888e986e Add role.FromString and more tolerance 2022-10-13 15:29:29 +02:00
Daniel Weiße
23afccb975
AB#2474 Implement List and Self method for AWS (#229) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-12 13:40:38 +02:00
Fabian Kammel
57b8efd1ec
Improve measurements verification with Rekor (#206) 
Fetched measurements are now verified using Rekor in addition to a signature check.
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-11 13:57:52 +02:00
katexochen
6577ca6600 Bump enterprise image version 2022-10-10 13:43:15 +02:00
katexochen
87adf66708 Update qemu image 2022-10-10 13:43:15 +02:00
katexochen
eb340c1e1f Build microservices on release branch 2022-10-10 13:43:15 +02:00
Daniel Weiße
0edae36e43
AB#2426 Mini Constellation (#198) 
* Mini Constellation commands to quickly deploy a local Constellation cluster

* Download libvirt container image if not present locally

* Fix libvirt KVM permission issues by creating kvm group using host GID inside container

* Remove QEMU specific values from state file

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Nils Hanke <nils.hanke@outlook.com>
 2022-10-07 09:38:43 +02:00
katexochen
4ccd96bf64 Pin container image hashes 2022-10-06 19:16:20 +02:00
katexochen
884c46179a Bump konnectivity version 2022-10-06 19:16:20 +02:00
katexochen
bede530de7 Bump k8s versions 2022-10-06 19:16:20 +02:00
katexochen
9edfc2f6ba Move k8s version window up 2022-10-06 19:16:20 +02:00
Fabian Kammel
369480a50b
Feat/revive (#212) 
* enable revive as linter
* fix var-naming revive issues
* fix blank-imports revive issues
* fix receiver-naming revive issues
* fix exported revive issues
* fix indent-error-flow revive issues
* fix unexported-return revive issues
* fix indent-error-flow revive issues
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-10-05 15:02:46 +02:00
Daniel Weiße
2ea695896f
AB#2439 Containerized libvirt (#191) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-05 09:11:30 +02:00
Daniel Weiße
acdcb535c0
AB#2444 Verify Azure trusted launch attestation keys (#203) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-10-04 16:44:44 +02:00
katexochen
a60e76e91f Upgrade operator version 2022-09-30 17:51:49 +02:00
katexochen
ccbc3d9123 Remove exposure of qemu ip_range_start value 2022-09-30 16:50:52 +02:00
katexochen
feffe40987 Remove GCP client from CLI 2022-09-30 16:50:52 +02:00
katexochen
42f273611a Use uid from metadata instead of name 2022-09-30 16:50:52 +02:00
Felix Schuster
eabc433b68 Fix typo 2022-09-29 16:37:52 +02:00
Fabian Kammel
dfa4dd9b85
delete unused config test (#202) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-28 16:31:00 +02:00
Felix Schuster
a6d201b761 Make wording around license less verbose 2022-09-27 11:24:01 +02:00
Daniel Weiße
804c173d52
Use terraform in CLI to create QEMU cluster (#172) 
* Use terraform in CLI to create QEMU cluster

* Dont allow qemu creation on os/arch other than linux/amd64

* Allow usage of --name flag for QEMU resources

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-26 15:52:31 +02:00
Daniel Weiße
30f0554168
AB#2262 Automatic recovery (#158) 
* Update `constellation recover` to be fully automated

* Update recovery docs

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-26 09:57:40 +02:00
katexochen
ba6e41ed5c Upgrade go module to v2 2022-09-22 09:10:19 +02:00
katexochen
6401c345f0 Upgrade node operator 2022-09-20 14:41:54 +02:00
katexochen
88d200232a Remove autoscaling from CLI and bootstrapper 2022-09-20 13:41:23 +02:00
Thomas Tendyck
3d50869ed6 only use test action in license integration test 2022-09-19 12:22:06 +02:00
Daniel Weiße
e367e1a68b
AB#2261 Add loadbalancer for control-plane recovery (#151) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-09-14 13:25:42 +02:00
Leonard Cohnen
2a6c5df7cc fix waiting on gcp load balancer 2022-09-13 11:06:44 +02:00
Leonard Cohnen
2d8f2af91b prepare release v2.0.0 2022-09-12 19:03:01 +02:00
Nils Hanke
25b769d1e2 Remove obsolete tpmPath passed to OpenTPM 2022-09-12 14:38:10 +02:00
Thomas Tendyck
c41018ed32
license messages (#118) 
* license: tell the user whether file couldn't be found or there was another error

* license: print correct info for community license
 2022-09-12 13:38:50 +02:00
Thomas Tendyck
ab45d5fbfe tidy config 2022-09-12 08:49:51 +02:00
Nils Hanke
c51dec6d00 Use distroless images for JoinService & KMS 2022-09-09 18:11:33 +02:00
Malte Poll
b8b169c93d
Bump node-operator (#114) 2022-09-09 17:33:55 +02:00
Leonard Cohnen
7163c161b6 Deploy Konnectivity 2022-09-09 17:26:02 +02:00
Thomas Tendyck
a85777fd02 enforce pcr4 2022-09-08 17:34:12 +02:00
Nils Hanke
7aded65ea8 Add validation for zero or more than one provider 2022-09-08 13:38:24 +02:00
Moritz Eckert
fb5faa681c
Add provider to license check (#88) 2022-09-08 11:02:04 +02:00
Otto Bittner
611ec25f22 AB#2380: Add unittest for validateAk 
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-07 13:59:09 +02:00
Nils Hanke
fe70231f2a Rename IsImageDebug -> IsDebugImage for consistency 2022-09-07 13:27:15 +02:00
Nils Hanke
1a4b4f564a Remove firewall configuration and make it static with a debug flag 2022-09-07 13:27:15 +02:00
Otto Bittner
23bf4aa665
AB#2379: Validate version in SNP report (#80) 
* AB#2379: Validate version in SNP report

* Check that TCB version in VCEK matches COMMITTED_TCB
* Check that LAUNCH, CURRENT and REPORTED TCB are at least
at the same security level as we are currently.
* Rename variables in snpReport struct
* Use default values in validator_test.go

Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-07 10:39:38 +02:00
Malte Poll
50acded80b
Bump join service (#79) 2022-09-05 17:23:11 +02:00
Malte Poll
c1185241bb temporarily upgrade join-service 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
c38a142d64 Kubernetes 1.25 preview 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
571b4ff36f Switch default Kubernetes version 1.24 -> 1.23 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Malte Poll
57e77ee53f kubernetes version: rename latest -> default 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-09-05 16:57:28 +02:00
Otto Bittner
1b810da331 Bump service versions. 
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-05 12:46:40 +02:00
Otto Bittner
405db3286e AB#2386: TrustedLaunch support for azure attestation 
* There are now two attestation packages on azure.
The issuer on the server side is created base on successfully
querying the idkeydigest from the TPM. Fallback on err: Trusted Launch.
* The bootstrapper's issuer choice is validated by the CLI's validator,
which is created based on the local config.
* Add "azureCVM" field to new "internal-config" cm.
This field is populated by the bootstrapper.
* Group attestation OIDs by CSP (#42)
* Bootstrapper now uses IssuerWrapper type to pass
the issuer (and some context info) to the initserver.
* Introduce VMType package akin to cloudprovider. Used by
IssuerWrapper.
* Extend unittests.
* Remove CSP specific attestation integration tests

Co-authored-by: <dw@edgeless.systems>
Signed-off-by: Otto Bittner <cobittner@posteo.net>
 2022-09-05 12:03:48 +02:00
Thomas Tendyck
bd63aa3c6b add license headers 
sed -i '1i/*\nCopyright (c) Edgeless Systems GmbH\n\nSPDX-License-Identifier: AGPL-3.0-only\n*/\n' `grep -rL --include='*.go' 'DO NOT EDIT'`
gofumpt -w .
 2022-09-05 09:17:25 +02:00
Fabian Kammel
106635a9ee
Restructure config docs (#44) 
* more guided UX when generating and filling in config
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-02 17:11:06 +02:00
Nils Hanke
0aefe2c0ba Move instanceType from CLI to config 2022-09-02 07:04:11 -07:00
Otto Bittner
50d3f3ca7f GetIdKeyDigest: Cut HCL header from raw report 2022-09-02 11:21:35 +02:00
Fabian Kammel
6440904865
Ref/update cosign key (#31) 
* use new cosign keypair
* use community images for production image heuristic
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-09-01 12:58:31 +02:00
Moritz Eckert
db942ee4b5
Update references to docs (#36) 2022-09-01 09:27:25 +02:00
Otto Bittner
4adc19b7f5 AB#2350: Configurably enforce idkeydigest on Azure 
* Add join-config entry for "enforceIdKeyDigest" bool
* Add join-config entry for "idkeydigest"
* Initially filled with TPM value from bootstrapper
* Add config entries for idkeydigest and enforceIdKeyDigest
* Extend azure attestation validator to check idkeydigest,
if configured.
* Update unittests
* Add logger to NewValidator for all CSPs
* Add csp to Updateable type

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 15:26:04 +02:00
Malte Poll
c84e44913b Fork node maintenance operator and deploy it on all supported k8s versions 
Signed-off-by: Malte Poll <mp@edgeless.systems>
 2022-08-31 14:53:06 +02:00
katexochen
10e5249631 Manual client secrets on azure 2022-08-31 14:10:08 +02:00
katexochen
69abe17c96 Refactor Azure IMDS client and metadata 2022-08-31 14:10:08 +02:00
katexochen
f15605cb45 Manually manage resource group on Azure 2022-08-31 14:10:08 +02:00
Daniel Weiße
ce02878019
AB#2308 / AB#2317 constellation upgrade plan (#3) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 11:59:07 +02:00
Daniel Weiße
b27e205399
Use 4 vCPU instances by default (#24) 
* Use 4 vcpu instances by default

* Remove 2 vcpu instance type option

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-31 10:33:33 +02:00
Fabian Kammel
66d8c8037b
Release/v0.0.1 (#20) 
* bump images to 0.0.1
* add gh cli commands
* varibale with default value should not be required
* update release docs
* build and upload version manifest as part of release
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 15:54:35 +02:00
Thomas Tendyck
650ab76fe7 Update measurements.go 2022-08-30 15:50:40 +02:00
Fabian Kammel
778952e07c
AB#2287 support community image IDs (#9) 
* support community image IDs
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 15:15:51 +02:00
Fabian Kammel
e0a457b6ff
change default image to new format of public images for next release (#19) 
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
 2022-08-30 13:42:22 +02:00
Otto Bittner
2343c91bc7 Update service image versions 2022-08-30 09:42:18 +02:00
Daniel Weiße
7c832273fd
AB#2309 constellation upgrade execute (#2) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:49:44 +02:00
Otto Bittner
7c5556864b AB#2333: Add AMD SNP-based attestation 
Currently only available on Azure CVMs.

* Get the public attestation key from the TPM.
* Get the snp report from the TPM.
* Get the VCEK and ASK certificate from the metadata api.
* Verify VCEK using hardcoded root key (ARK)
* Verify SNP report using VCEK
* Verify HCLAkPub using SNP report by comparing
AK with runtimeData
* Extend unittest

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
 2022-08-29 16:29:33 +02:00