Commit Graph

840 Commits

Author SHA1 Message Date
edgelessci
37288deacf
image: update measurements and image version (#2019)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-07-05 08:32:25 +02:00
renovate[bot]
ba410186f6
deps: update ghcr.io/edgelesssys/gcp-guest-agent Docker tag to v20230628 (#2002)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-07-04 14:17:05 +02:00
Adrian Stobbe
e72ec60d13
config: iam create aws check zone contains availability zone (#1913)
* init

* make zone flag mandatory again

* add info about zone update + refactor

* add comment in docs about zone update

* Update cli/internal/cmd/iamcreate_test.go

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* thomas feedback

* add format check to config validation

* remove TODO

* Update docs/docs/workflows/config.md

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* thomas nit

---------

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
2023-07-04 13:55:52 +02:00
Paul Meyer
25a038dfad versions: update gcp-guest-agent version format
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-07-04 13:23:33 +02:00
Malte Poll
66f1333c31
terraform: use single zone loadbalancer frontend on AWS (#1983)
This change is required to ensure we have not tls handshake errors when connecting to the kubernetes api.
Currently, the certificates used by kube-apiserver pods contain a SAN field with the (single) public ip of the loadbalancer.
If we would allow multiple loadbalancer frontend ips, we could encounter cases where the certificate is only valid for one public ip,
while we try to connect to a different ip.
To prevent this, we consciously disable support for the multi-zone loadbalancer frontend on AWS for now.
This will be re-enabled in the future.
2023-06-30 16:56:31 +02:00
Daniel Weiße
d95ddd01d3
helm: fix upgrade command unintentionally skipping all service upgrades (#1992)
* Fix usage of errors.As in upgrade command implementation

* Use struct pointers when working with custom errors

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-06-30 16:46:05 +02:00
Daniel Weiße
5a9f9c0a52
bootstraper: delete helm chart on installation failure before retrying installation (#1977)
* Delete helm chart on failure before retrying installation

* Add chart name to debug output

* Remove now unused wait flag from helm Release struct

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-06-30 15:13:29 +02:00
edgelessci
05c43137e4
image: update measurements and image version (#1988)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-06-30 08:48:38 +02:00
Moritz Sanft
7ad284d672
cli: deploy aws csi driver per default (#1981)
* add aws csi driver helm chart

* update chart

* add CSI driver to Constellation default deployment

* generate config doc

* update buildfiles

* use upstream chart

* update buildfile

* set `DeployCSIDriver` in default config

* fix helm test

* whitespace
2023-06-30 08:46:32 +02:00
Malte Poll
f64e44a438 aws: support LBs in multiple zones when retrieving metadata 2023-06-28 18:13:01 +02:00
Adrian Stobbe
161bb37cba
config: improve usage and meaning of validate (#1975)
* discuss miniup config.Default() usage + discourage usage for Default() in comment

* Update internal/config/config_test.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* add enterprise version check for config.Default

* split config comment lines

* daniel feedback

* featureset.CanUseEmbeddedMeasurmentsAndImage

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-06-28 10:28:48 +02:00
Adrian Stobbe
1edbe962c1
cli: fail fast when CLI and Constellation versions don't match (#1972)
* fail on version mismatch

* rename to validateCLIandConstellationVersionAreEqual

* fix test

* image version must only be major,minor patch equal (ignore suffix)

* add version support doc

* fix: do not check patch version equality for image and cli

* skip validate on force
2023-06-27 18:24:35 +02:00
Otto Bittner
0a36ce6171
config: validate instance type for aws SNP based on attestation variant (#1963)
* config: validate instance type for aws SNP

* apply suggestions
2023-06-26 17:05:12 +02:00
Thomas Tendyck
46e144d19b Use term "attestation variant" consistently 2023-06-26 08:54:11 +02:00
Daniel Weiße
e139eff552
fix: small formating/spelling issues (#1965)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-06-26 08:34:37 +02:00
Otto Bittner
3a7bb52560
attestation: docs and config changes for SNP attestation (#1959)
* docs: describe SEV-SNP support on AWS
* config: remove launchMeasurement

awsSEVSNP attestation config should not have this value.
It doesn't have a function yet.
2023-06-23 15:38:24 +02:00
Otto Bittner
7388240943
Revert "attestation: add SNP-based attestation for aws-sev-snp (#1916)" (#1957)
This reverts commit c7d12055d1.
2023-06-22 17:08:44 +02:00
Adrian Stobbe
487fa1e397
terraform: azure node groups (#1955)
* init

* migration working

* make tf variables with default value optional in go through ptr type

* fix CI build

* pr feedback

* add azure targets tf

* skip migration for empty targets

* make instance_count optional

* change role naming to dashed + add validation

* make node_group.zones optional

* Update cli/internal/terraform/terraform/azure/main.tf

Co-authored-by: Malte Poll <1780588+malt3@users.noreply.github.com>

* malte feedback

---------

Co-authored-by: Malte Poll <1780588+malt3@users.noreply.github.com>
2023-06-22 16:53:40 +02:00
Otto Bittner
c7d12055d1
attestation: add SNP-based attestation for aws-sev-snp (#1916)
* config: move AMD root key to global constant
* attestation: add SNP based attestation for aws
* Always enable SNP, regardless of attestation type.
* Make AWSNitroTPM default again

There exists a bug in AWS SNP implementation where sometimes
a host might not be able to produce valid SNP reports.
Since we have to wait for AWS to fix this we are merging SNP
attestation as opt-in feature.
2023-06-21 14:19:55 +02:00
renovate[bot]
e5bcd36a23
deps: update K8s constrained Azure versions (#1907)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-06-20 12:55:47 +02:00
Malte Poll
0b262a08bc
cloud: fix discovery of GCP nodes across multiple zones (#1943) 2023-06-20 12:02:31 +02:00
Adrian Stobbe
be4a636361
cli: improve user warning / information (#1933)
* print success

* warn when debug img but !debugCluster

* malte feedback

* rename to IsNamedLikeDebugImage
2023-06-19 16:51:39 +02:00
renovate[bot]
4908b5f63c
deps: update golangci/golangci-lint to v1.53.2 (#1924)
* deps: update golangci/golangci-lint to v1.53.2
* deps: tidy all modules
* attestation: silence linter warning


---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-06-16 09:40:08 +02:00
edgelessci
a717cefc26
image: update measurements and image version (#1939)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-06-16 08:27:45 +02:00
Adrian Stobbe
07de6482b2
config: drop support for deprecated Azure's service principal authentication (#1906)
* invalidate app client id field for azure and provide info

* remove TestNewWithDefaultOptions case

* fix test

* remove appClientID field

* remove client secret + rename err

* remove from docs

* otto feedback

* update docs

* delete env test in cfg since no envs set anymore

* Update dev-docs/workflows/github-actions.md

Co-authored-by: Otto Bittner <cobittner@posteo.net>

* WARNING to stderr

* fix check

---------

Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-06-14 17:50:57 +02:00
Adrian Stobbe
c5f75513b1
fix: Azure SEV-SNP version always gets overwritten by latest API versions (#1930)
* fix that manual version gets overwritten by latest

* put azure in seperate config file

* otto feedback
2023-06-14 14:17:52 +02:00
edgelessci
8910e9bac4
image: update measurements and image version (#1927)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-06-14 08:31:30 +02:00
3u13r
a2c98eb1d5
Correctly deploy the AWS CCM (#1853)
* aws: stop using the imds api for tags

* aws: disable tags in imds api

* aws: only tag instances with non-lecagy tag

* bootstrapper: always let coredns run before cilium

* debugd: make debugd less noisy

* fixup fix aws imds test

* fixup unsued context

* move getting instance id to readInstanceTag
2023-06-13 09:58:39 +02:00
Adrian Stobbe
4f63481b7d
config: fix fetcher parse azure sev-snp version (#1911) 2023-06-12 16:04:54 +02:00
Adrian Stobbe
e738f15f0f
cdbg: make endpoint deployment failure more transparent (#1883)
* add retry + timeout + intercept grpc logs

* LogStateChanges inside grplog pkg

* remove retry and tj/assert

* rename nit

* Update debugd/internal/cdbg/cmd/deploy.go

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

* Update debugd/internal/cdbg/cmd/deploy.go

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

* paul feedback

* return waitFn instead of WaitGroup

* Revert "return waitFn instead of WaitGroup"

This reverts commit 45700f30e341ce3af509b687febbc0125f7ddb38.

* log routine inside debugd constructor

* test doubles names

* Update debugd/internal/cdbg/cmd/deploy.go

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

* fix newDebugClient closeFn

---------

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-06-12 13:45:34 +02:00
Otto Bittner
8f21972aec
attestation: add awsSEVSNP as new variant (#1900)
* variant: move into internal/attestation
* attesation: move aws attesation into subfolder nitrotpm
* config: add aws-sev-snp variant
* cli: add tf option to enable AWS SNP

For now the implementations in aws/nitrotpm and aws/snp
are identical. They both contain the aws/nitrotpm impl.
A separate commit will add the actual attestation logic.
2023-06-09 15:41:02 +02:00
Adrian Stobbe
3fde118b33
config: enable azure snp version fetcher again + minimum age for latest version (#1899)
* fetch latest version when older than 2 weeks

* extend hack upload tool to pass an upload date

* Revert "config: disable user-facing version Azure SEV SNP fetch for v2.8  (#1882)"

This reverts commit c7b22d314a.

* fix tests

* use NewAzureSEVSNPVersionList for type guarantees

* Revert "use NewAzureSEVSNPVersionList for type guarantees"

This reverts commit 942566453f4b4a2b6dc16f8689248abf1dc47db4.

* assure list is sorted

* improve root.go style

* daniel feedback
2023-06-09 12:48:12 +02:00
Moritz Eckert
9463d6fb27
cli: fix azure config warning message (#1902) 2023-06-09 11:16:54 +02:00
Adrian Stobbe
4284f892ce
api: rename /api/versions to versionsapi and /api/attestationcfig to attestationconfigapi (#1876)
* rename to attestationconfigapi + put client and fetcher inside pkg

* rename api/version to versionsapi and put fetcher + client inside pkg

* rename AttestationConfigAPIFetcher to Fetcher
2023-06-07 16:16:32 +02:00
Adrian Stobbe
c7b22d314a
config: disable user-facing version Azure SEV SNP fetch for v2.8 (#1882)
* config: disable user-facing version fetch for Azure SEV SNP

don't allow "latest" value and disable user-facing version fetcher for Azure SEV SNP

Co-authored-by: @derpsteb

* fix unittests

* attestation: getTrustedKey

---------

Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-06-06 10:44:13 +02:00
Malte Poll
f7f11c32f8
image: choose unique AWS image names based on the attestation variant (#1868) 2023-06-06 08:35:26 +02:00
Adrian Stobbe
99a88c033c
api: use new signature JSON format (#1872)
* use new impl for client.UploadAzureSEVSNP

* fix: fetcher must parse new signature format

* version-file is not persistentflag

* fix fetcher tests
2023-06-05 16:10:44 +02:00
Otto Bittner
fa01569cc6
staticupload: don't request empty invalidation (#1870)
If no files have been touched, do not initiate an invalidation.
2023-06-05 15:47:33 +02:00
Otto Bittner
06cd750345
config: move all config types into file config.go (#1878)
docgen only includes doc comments from one single file in
it's output. Therefore all config types need to be located in config.go
2023-06-05 15:46:55 +02:00
Adrian Stobbe
c446f36b0f
config: Azure SNP tool can delete specific version from attestation API (#1863)
* client supports delete version

* rename to new attestation / fetcher naming

* add delete command to upload tool

* test client delete

* bazel update

* use general client in attestation client

* Update hack/configapi/cmd/delete.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* daniel feedback

* unit test azure sev upload

* Update hack/configapi/cmd/delete.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* add client integration test

* new client cmds use apiObject

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-06-05 12:33:22 +02:00
Otto Bittner
315b6c2f01
api: use correct error types in versions/cli (#1867)
Imported wrong error types during refactoring.
2023-06-05 10:51:05 +02:00
Otto Bittner
6bda62d397
cli: skip k8s upgrade in case of outdated version (#1864)
If an unsupported, outdated k8s patch version is used,
the user should still be able to run upgrade apply.
2023-06-05 09:13:02 +02:00
edgelessci
b2527d314e
image: update measurements and image version (#1861)
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2023-06-02 16:06:34 +02:00
Adrian Stobbe
a813760f96
config: automatically upload new Azure SNP versions to API + sign version with release key (#1854)
* sign version with release key and remove version from fetcher interface
* extend azure-reporter GH action to upload updated version values to the Attestation API
2023-06-02 12:10:22 +02:00
Malte Poll
e1d3afe8d4
ci: use aws s3 client that invalidates cloudfront cache for places that modify Constellation api (#1839) 2023-06-02 11:20:01 +02:00
edgelessci
7ef7f09dda
image: update measurements and image version (#1855)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-06-02 10:13:22 +02:00
Otto Bittner
30f2b332b3
api: restructure api pkg (#1851)
* api: rename AttestationVersionRepo to Client
* api: move client into separate subpkg for
clearer import paths.
* api: rename configapi -> attestationconfig
* api: rename versionsapi -> versions
* api: rename sut to client
* api: split versionsapi client and make it public
* api: split versionapi fetcher and make it public
* config: move attestationversion type to config
* api: fix attestationconfig client test

Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
2023-06-02 09:19:23 +02:00
Adrian Stobbe
b51cc52945
config: sign Azure versions on upload & verify on fetch (#1836)
* add SignContent() + integrate into configAPI

* use static client for upload versions tool; fix staticupload calleeReference bug

* use version to get proper cosign pub key.

* mock fetcher in CLI tests

* only provide config.New constructor with fetcher

Co-authored-by: Otto Bittner <cobittner@posteo.net>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-06-01 13:55:46 +02:00
3u13r
e0285c122e
todo responsibilities and cleanup (#1837)
* chore: add TODO responsibilities

* chore: remove not needed TODOs

* chore: remove outdated migrations

* chore: remove resolved goleak exception

* chore: remove not needed cosign env

* config: add link to our Azure snp docs
2023-06-01 12:33:06 +02:00
edgelessci
13ffb93ad8
image: update measurements and image version (#1840)
Co-authored-by: malt3 <malt3@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-06-01 10:45:25 +02:00
Malte Poll
c5e016a8e2 attestation: allow measurement generator to work regardless of build tags 2023-05-31 14:00:00 +02:00
Malte Poll
8a851c8f39 cli: dynamically select signature validation pubkey for release and pre-release artifacts 2023-05-31 14:00:00 +02:00
renovate[bot]
ada66a64a1
deps: update Kubernetes versions (#1807)
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-05-30 16:36:07 +02:00
renovate[bot]
b041344331
deps: update registry.k8s.io/autoscaling/cluster-autoscaler Docker tag to v1.27.2 (#1831)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-05-30 15:10:51 +02:00
renovate[bot]
c50c5e69d9
deps: update K8s constrained Azure versions (#1787)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-05-30 14:36:37 +02:00
Malte Poll
29b93065b3
ci: static file uploader with automatic cache invalidation (#1833) 2023-05-30 13:48:29 +02:00
miampf
8686c5e7e2
bootstrapper: collect journald logs on failure (#1618) 2023-05-30 11:47:36 +00:00
Moritz Sanft
6d5e7e1f7c
cli: support StackIT provider on config generate (#1803)
* support stackit provider on config generate

* update cli reference

* default config values

* deploy csi driver

Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>

---------

Co-authored-by: Moritz Eckert <m1gh7ym0@gmail.com>
2023-05-30 09:02:50 +02:00
Moritz Sanft
a0dea7e69b
make imagefetcher visible to all subpackages (#1832) 2023-05-26 12:05:02 +02:00
3u13r
661f084ffa
cli: use uami for in-cluter authentication (#1820) 2023-05-26 11:45:03 +02:00
renovate[bot]
9502bc8ff4
deps: update K8s constrained GCP versions (#1829)
* deps: update K8s constrained GCP versions

* deps: bump autoscaler image to 1.27

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-05-26 11:24:12 +02:00
Adrian Stobbe
0a6e5ec02e
config: dynamic attestation configuration through S3 backed API (#1808) 2023-05-25 17:43:44 +01:00
Malte Poll
217a744606 image: add go code to upload image info and measurements 2023-05-25 15:01:15 +02:00
Malte Poll
b8751f35f9 image: add intermediate "image" verb to upload tool 2023-05-25 15:01:15 +02:00
Malte Poll
0a7349ca41 attestation: merging of ImageMeasurementsV2 2023-05-25 15:01:15 +02:00
Malte Poll
874c4b76cf versionsapi: merging of ImageInfo 2023-05-25 15:01:15 +02:00
Malte Poll
d0e53cbb59 cli: image info (v2) 2023-05-25 15:01:15 +02:00
Malte Poll
cd7b116794 cli: image measurements (v2) 2023-05-25 15:01:15 +02:00
Malte Poll
e5b394db87 cli: image measurements (v2) 2023-05-25 15:01:15 +02:00
Malte Poll
9a1ee8697e osimage: advertise SEV SNP support for gcp images 2023-05-25 15:01:15 +02:00
Leonard Cohnen
c98644df2b ci: use bazel for unittests 2023-05-23 15:11:10 +02:00
Malte Poll
c1dbbf34c3 cryptsetup: Provide implementation without cgo 2023-05-23 13:44:56 +02:00
renovate[bot]
66ff0b0b78
deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.27.1 (#1754)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-05-23 13:30:38 +02:00
3u13r
6062b10035
cli: split image into oss and enterprise (#1788) 2023-05-23 10:49:47 +02:00
Adrian Stobbe
cfef384f36
config: support latest as version value for Azure SEVSNP (#1786)
* support latest as version value
2023-05-23 08:55:49 +01:00
Moritz Sanft
c69e6777bd
cli: Terraform migrations on upgrade (#1685)
* add terraform planning

* overwrite terraform files in upgrade workspace

* Revert "overwrite terraform files in upgrade workspace"

This reverts commit 8bdacfb8bef23ef2cdbdb06bad0855b3bbc42df0.

* prepare terraform workspace

* test upgrade integration

* print upgrade abort

* rename plan file

* write output to file

* add show plan test

* add upgrade tf workdir

* fix workspace preparing

* squash to 1 command

* test

* bazel build

* plan test

* register flag manually

* bazel tidy

* fix linter

* remove MAA variable

* fix workdir

* accept tf variables

* variable fetching

* fix resource indices

* accept Terraform targets

* refactor upgrade command

* Terraform migration apply unit test

* pass down image fetcher to test

* use new flags in e2e test

* move file name to constant

* update buildfiles

* fix version constant

* conditionally create MAA

* move interface down

* upgrade dir

* update buildfiles

* fix interface

* fix createMAA check

* fix imports

* update buildfiles

* wip: workspace backup

* copy utils

* backup upgrade workspace

* remove debug print

* replace old state after upgrade

* check if flag exists

* prepare test workspace

* remove prefix

Co-authored-by: Otto Bittner <cobittner@posteo.net>

* respect file permissions

* refactor tf upgrader

* check workspace before upgrades

* remove temp upgrade dir after completion

* clean up workspace after abortion

* fix upgrade apply test

* fix linter

---------

Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-05-22 13:31:20 +02:00
edgelessci
87b9d85669
image: update measurements and image version (#1798)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-05-19 18:17:53 +02:00
edgelessci
2754d7817d
image: update measurements and image version (#1795)
Co-authored-by: 3u13r <3u13r@users.noreply.github.com>
2023-05-17 19:39:32 +02:00
Adrian Stobbe
f99e06b63b
cli: new flag to set the attestation type for config generate (#1769)
* add attestation flag to specify type in config
2023-05-17 16:53:56 +02:00
Moritz Eckert
6252193879 cli: deploy cinder as OpenStack CSI plugin 2023-05-17 15:20:39 +02:00
Daniel Weiße
1d5af5f0f4 Rebase fixes
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-05-17 11:37:26 +02:00
Nils Hanke
e80474ff7f oid: add missing String() for QEMUTDX 2023-05-17 11:37:26 +02:00
Daniel Weiße
c478df36fa Add TDX bazel files
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-05-17 11:37:26 +02:00
Nils Hanke
9e987778e0 measurements: Add length field for WithAllBytes 2023-05-17 11:37:26 +02:00
Nils Hanke
fe3622d982 cli/attestation: use const for PCR/TDX lengths 2023-05-17 11:37:26 +02:00
Daniel Weiße
dd2da25ebe attestation: tdx issuer/validator (#1265)
* Add TDX validator

* Add TDX issuer

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-05-17 11:37:26 +02:00
renovate[bot]
230ea79bcc
deps: update Google SDK (#1748)
* deps: update Google SDK

* deps: fix grpc_testing import

* deps: update pseudo version tool hashes

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-05-16 18:13:17 +02:00
Malte Poll
f596a13188
image: include stream in gcp image name (#1768) 2023-05-16 12:38:38 +02:00
Daniel Weiße
c834911be1
config: fix migration for v2.7 idkeydigest enforcement format (#1770)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-05-16 10:32:01 +02:00
edgelessci
f30e0c9bdd
image: update measurements and image version (#1756)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-05-12 18:51:47 +02:00
renovate[bot]
a1fddd312c
deps: update K8s constrained GCP versions (#1565)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-05-05 14:30:48 +02:00
renovate[bot]
5301534aee
deps: update K8s constrained Azure versions (#1687)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-05-05 13:58:50 +02:00
Paul Meyer
30cd024076
deps: add Kubernetes v1.27, remove Kubernetes v1.24 (#1669)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-05-05 13:22:53 +02:00
Paul Meyer
b48866a756
ci: fix measurement generation on scheduled build (#1741)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-05-05 13:13:51 +02:00
Malte Poll
653bf3621d image: replicate AWS images to eu-west-1 and eu-west-3 2023-05-05 12:06:44 +02:00
Malte Poll
ad8a3eec4a versionsapi: increase cloudfront cache invalidation timeout 2023-05-05 12:06:44 +02:00
Malte Poll
ee91d8b1cc image: implement idempotent upload of os images 2023-05-05 12:06:44 +02:00
Malte Poll
56635c3993 cli: deploy yawol as OpenStack loadbalancer 2023-05-03 21:45:59 +02:00
Daniel Weiße
d7a2ddd939
config: add separate option for handling attestation parameters (#1623)
* Add attestation options to config

* Add join-config migration path for clusters with old measurement format

* Always create MAA provider for Azure SNP clusters

* Remove confidential VM option from provider in favor of attestation options

* cli: add config migrate command to handle config migration (#1678)

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-05-03 11:11:53 +02:00
renovate[bot]
e9103cad0a
deps: update Constellation containers to v2.7.0-pre.0.20230405123345-6bf3c63115a5 (#1563)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-05-02 15:04:31 +02:00
edgelessci
1ea060e873
image: update measurements and image version (#1700)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-04-28 08:02:19 +02:00
renovate[bot]
84c7550f37
deps: update Kubernetes versions (#1688)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-04-27 18:04:01 +02:00
3u13r
1bdf410b52
bazel: allow custom container_prefix (#1693)
* build: allow custom container registry

* build: fix .bazeloverwriterc import
2023-04-27 11:52:02 +02:00
Paul Meyer
bf051174f6 ci: update measurements and image version
on scheduled build

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-04-27 10:20:27 +02:00
Malte Poll
c11a3f4460
cli: configurable state disk type on OpenStack (#1686) 2023-04-27 09:08:43 +02:00
Malte Poll
9dfad32e33 cli: use Bazel container images 2023-04-18 15:35:15 +02:00
Moritz Sanft
1d0ee796e8
cli: add Terraform log support (#1620)
* add Terraform logging

* add TF logging to CLI

* fix path

* only create file if logging is enabled

* update bazel files

* register persistent flags manually

* clidocgen

* move logging code to separate file

* reword yes flag parsing error

* update bazel buildfile

* factor out log level setting
2023-04-14 14:15:07 +02:00
Daniel Weiße
ec01c57661
internal: use config to create attestation validators (#1561)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-04-06 17:00:56 +02:00
Malte Poll
69de06dd1f
image: OpenStack vTPM (#1616)
* cli: allow vpc traffic between nodes on OpenStack
* image: enable vTPM on OpenStack
* cli: add create tests for OpenStack
2023-04-05 16:49:03 +02:00
renovate[bot]
a2ae53d229
deps: update dependency kubernetes-sigs/cri-tools to v1.26.1 (#1600)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-04-05 11:37:15 +02:00
Malte Poll
2ca2dbae22
versionsapi: fix list command by allowing empty set of patch versions for a given minor version (#1609) 2023-04-04 12:10:07 +02:00
Paul Meyer
58b405d04c
license: remove check for Azure.ConfidentialVM (#1602)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-04-03 19:19:54 +02:00
Malte Poll
d15968bed7
bootstrapper: make Azure auth method configurable on cluster init (#1346)
* bootstrapper: make Azure auth method configurable on cluster init
* azure: convert uami resource ID to clientID


Co-authored-by: 3u13r <lc@edgeless.systems>
2023-04-03 15:01:25 +02:00
Moritz Sanft
46f5b1734e
cli: show available cli upgrades on upgrade check command (#1394)
* cli: upgrade check show cli upgrades

* only check compatibility for valid upgrades

* use semver.Sort

* extend unit tests

* add unit test for new compatible cli versions

* adapt to feedback

* fix rebase

* rework output

* minor -> major

Co-authored-by: Otto Bittner <cobittner@posteo.net>

* minor -> major

Co-authored-by: Otto Bittner <cobittner@posteo.net>

* dynamic major version

Co-authored-by: Otto Bittner <cobittner@posteo.net>

* remove currentK8sVer argument

* bazel gen & tidy

* bazel update

---------

Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-04-03 14:31:17 +02:00
Otto Bittner
c8c2953d7b cli: add status cmd
The new command allows checking the status of an upgrade
and which versions are installed.
Also remove the unused restclient.
And make GetConstellationVersion a function.
2023-04-03 12:03:41 +02:00
Moritz Sanft
2d41a19fbf
internal: semver support for pseudoversions (#1564)
* support for prerelease tag / pseudoversion

* build version first

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* use strings.Cut

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-04-03 10:48:28 +02:00
Daniel Weiße
62c165750f
config: remove deprecated upgradeConfig and require name and microserviceVersion fields (#1541)
* Remove deprecated fields

* Remove warning for not setting attestationVariant

* Dont write attestationVariant to config

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-31 19:19:10 +02:00
3u13r
efe4681214
add version.txt step to release pipeline (#1493)
* add version.txt step to release pipeline

* refresh git status

* make minicon e2e test less flaky
2023-03-31 12:41:32 +02:00
renovate[bot]
8ffd1dcf3f
deps: update bazel_gazelle digest to 4dfcb75 (#1516)
* deps: update gazelle and rules_go
* variant: remove renamed go_library label
* deps: tidy all modules

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
2023-03-31 10:43:07 +02:00
renovate[bot]
786d9c86ad
deps: update Constellation containers (#1543)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-30 18:43:28 +02:00
Paul Meyer
d7fafb92b7 bazel: improve script template resilience
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-29 12:51:40 -04:00
Paul Meyer
909bfb9274 bazel: add go generate to //:generate target
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-29 12:51:40 -04:00
Nils Hanke
eaa5949e31 versionsapi: Split GCP image URI to extract the image name 2023-03-29 17:26:03 +02:00
Daniel Weiße
fc0efb6309
config: deprecate confidentialVM option for Azure clusters in favor of using attestationVariant option (#1539)
* Remove confidentialVM option from azure provider config

* Fix cloudcmd creator test

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-29 14:04:37 +02:00
Nils Hanke
1b832ac959
atls: fix link in README.md (#1545)
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-03-29 13:33:19 +02:00
Thomas Tendyck
091fe3e2d7 measurements: compare to constants for clarity 2023-03-29 12:03:29 +02:00
renovate[bot]
83e6b4d64d
deps: update Constellation containers (#1504)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-29 11:31:26 +02:00
Daniel Weiße
b57413cfa7
cli: set cluster's initial measurements from user's config using Helm (#1540)
* Remove using measurements from the initial control-plane node for the cluster's initial measurements

* Add using measurements from the user's config for the cluster's initial measurements to align behavior with upgrade command

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-29 11:16:56 +02:00
Daniel Weiße
99b12e4035
internal: refactor oid package to variant package (#1538)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-29 09:30:13 +02:00
Daniel Weiße
db5660e3d6
attestation: add context to Issue and Validate methods (#1532)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-29 09:06:10 +02:00
3u13r
c21b32d440
fix measurement generator (#1510) 2023-03-23 17:44:30 +01:00
Otto Bittner
cac43a1dd0 ci: add e2e-upgrade test
The test is implemented as a go test.
It can be executed as a bazel target.
The general workflow is to setup a cluster,
point the test to the workspace in which to
find the kubeconfig and the constellation config
and specify a target image, k8s and
service version. The test will succeed
if it detects all target versions in the cluster
within the configured timeout.
The CI automates the above steps.
A separate workflow is introduced as there
are multiple input fields to the test.
Adding all of these to the manual e2e test
seemed confusing.

Co-authored-by: Fabian Kammel <fk@edgeless.systems>
2023-03-23 14:57:38 +01:00
Leonard Cohnen
b2df6ba07a bump enterprise miniconstellation image 2023-03-23 14:55:29 +01:00
renovate[bot]
090d071993
deps: update Constellation containers to v2.7.0-pre.0.20230322165747-0a190c2bf672 (#1491)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-03-22 18:30:59 +01:00
renovate[bot]
57f1c8f139
deps: update Kubernetes versions (#1473)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-22 14:27:07 +01:00
Paul Meyer
02fc3dc635
measurements: refactor validation option (#1462)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-22 11:47:39 +01:00
renovate[bot]
2d1ffaea4f
deps: update K8s constrained Azure versions (#1408)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-22 10:23:44 +01:00
renovate[bot]
7a0cbe39f4
deps: update Constellation containers to v2.7.0-pre.0.20230321165012-cab6044f6910 (#1484)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-21 20:21:42 +01:00
renovate[bot]
248dbb5927
deps: update Constellation containers (#1464)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-21 17:37:06 +01:00
Daniel Weiße
5a0234b3f2
attestation: add option for MAA fallback to verify azure's snp-sev id key digest (#1257)
* Convert enforceIDKeyDigest setting to enum

* Use MAA fallback in Azure SNP attestation

* Only create MAA provider if MAA fallback is enabled

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Thomas Tendyck <tt@edgeless.systems>
2023-03-21 12:46:49 +01:00
Malte Poll
67f5625f99 versions: add OpenStack CCM image 2023-03-21 10:51:09 +01:00
Malte Poll
071628c6a0 config: add OpenStack in-cluster authentication settings 2023-03-21 10:51:09 +01:00
Malte Poll
f785ae560b openstack: implement account key for cluster-internal authentication 2023-03-21 10:51:09 +01:00
Malte Poll
1b2a927b84 openstack: implement api client UID, InitSecretHash and GetLoadBalancerEndpoint 2023-03-21 10:51:09 +01:00
Otto Bittner
1b12147d83
cli: minor restructuring for loading helm charts (#1441)
Use one loadRelease function instead of one function for each
release.
2023-03-20 17:05:58 +01:00
renovate[bot]
b3b1809251
deps: update K8s version independent containers to v0.1.2 (#1376)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-20 16:35:26 +01:00
Daniel Weiße
1a0e05c3fb
Set Azure-SEV-SNP as default azure attestation variant (#1461)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-20 14:40:27 +01:00
Paul Meyer
bad05321a0 go: remove redefinitions of builtins
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-20 08:41:01 -04:00
Paul Meyer
0036b24266 go: remove unused parameters
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-20 08:41:01 -04:00
Moritz Sanft
f2ce9518a3
cli: support custom attestation policies for maa (#1375)
* create and update maa attestation policy

* use interface to allow unit testing

* fix test csp

* http request for policy patch

* go mod tidy

* remove hyphen

* go mod tidy

* wip: adapt to feedback

* linting fixes

* remove csp from tf call

* fix type assertion

* Add MAA URL to instance tags (#1409)

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* conditionally create maa provider

* only set instance tag when maa is created

* fix azure unit test

* bazel tidy

* remove AzureCVM const

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* encode policy at runtime

* remove policy arg

* fix unit test

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
2023-03-20 13:33:04 +01:00
renovate[bot]
540978bc98
deps: update Constellation containers (#1417)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-03-17 07:48:19 +01:00
Daniel Weiße
6ea5588bdc
config: add attestation variant (#1413)
* Add attestation type to config (optional for now)

* Get attestation variant from config in CLI

* Set attestation variant for Constellation services in helm deployments

* Remove AzureCVM variable from helm deployments

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-14 11:46:27 +01:00
renovate[bot]
fb83c1dbc4
deps: update Constellation containers to v2.7.0-pre.0.20230313143044-114ac53872c6 (#1333)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 18:49:59 +01:00
Paul Meyer
bab76e8a9a
deps: update containers to v2.7.0-pre (#1407)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 13:19:36 +01:00
renovate[bot]
e2ad11320a
deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.26.1 (#1383)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 11:12:50 +01:00
Paul Meyer
a658368d40
deps: update GCP guest agent image (#1400)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-13 10:35:57 +01:00
Paul Meyer
50c4ea9be6 deps: update libvirt container to v2.7.0-pre
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-10 10:46:46 -05:00
Thomas Tendyck
64e1f553d1 cli: remove Edition in version command, which contains duplicate info 2023-03-10 11:36:44 +01:00
Moritz Sanft
01705feb51
ci: upload cli version list (#1377)
* upload cli version list

* fix flag

* name

* allow cli kind for listing

* [remove] update vapi cli

* allow cli kind

* use latest versionsapi image version

* fix kind parsing

* use workflow calls in on_release action

* [remove] update container tag

* change back to latest tag
2023-03-10 10:21:58 +01:00
Nils Hanke
dc4769d0a0 constants: use "Enterprise" for enterprise build 2023-03-09 17:32:50 +01:00
Malte Poll
bdba9d8ba6
bazel: add build files for go (#1186)
* build: correct toolchain order
* build: gazelle-update-repos
* build: use pregenerated proto for dependencies
* update bazeldnf
* deps: tpm simulator
* Update Google trillian module
* cli: add stamping as alternative build info source
* bazel: add go_test wrappers, mark special tests and select testing deps
* deps: add libvirt deps
* deps: go-libvirt patches
* deps: cloudflare circl patches
* bazel: add go_test wrappers, mark special tests and select testing deps
* bazel: keep gazelle overrides
* bazel: cleanup bazelrc
* bazel: switch CMakeLists.txt to use bazel
* bazel: fix injection of version information via stamping
* bazel: commit all build files
* dev-docs: document bazel usage
* deps: upgrade zig-cc for go 1.20
* bazel: update Perl for macOS arm64 & Linux arm64 support
* bazel: use static perl toolchain for OpenSSL
* bazel: use static protobuf (protoc) toolchain
* deps: add git and go to nix deps

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-09 15:23:42 +01:00
Daniel Weiße
8c87bba755
Add measurement reader (#1381)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-09 11:22:58 +01:00
Daniel Weiße
5bad5f768b
attestation: create issuer based on kernel cmd line (#1355)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-09 09:47:28 +01:00
Paul Meyer
acbd70c741 openstack: implement api client and metadata list
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 09:04:57 -05:00
Paul Meyer
418f08bf40 openstack: implement imds and metadata self
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 09:04:57 -05:00
Paul Meyer
630016d1b3 openstack: use password to authenticate in cluster
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 09:04:57 -05:00
Paul Meyer
64fc43f276
use any instead of interface{} (#1354)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-03-08 10:31:20 +01:00
Malte Poll
62ea224d36
attestation: remove PCR[0] and PCR[10] from enterprise measurements (#1348)
This will help the measurement generation done as part of internal/attestation/measurements/measurement-generator.
It can currently replace measurements but not reformat the code (in cases where the number of measurements differs).
2023-03-06 17:11:14 +01:00
Thomas Tendyck
c94d1db76d attestation: remove PCR 0 and 10 on GCP 2023-03-06 13:09:57 +01:00
Thomas Tendyck
0a344e4cf6 attestation: validate GCP machine state 2023-03-06 13:09:57 +01:00
Thomas Tendyck
2535073df8 attestation: add MachineState to ValidateCVM 2023-03-06 13:09:57 +01:00
Malte Poll
aae326d430
deps: manually upgrade libvirt container for upcoming release (#1339)
The libvirt container is currently not automatically upgraded (it still has version v2.2.0 before this change).
To ensure we update libvirt for this release, we manually upgrade the libvirt container image.
2023-03-03 16:05:29 +01:00
Malte Poll
8aa42e30ad
cli: set OpenStack service account credentials (#1328) 2023-03-03 10:10:36 +01:00
Otto Bittner
f0db5d0395
cli: restructure upgrade apply (#1319)
Applies the updated NodeVersion object with one request
instead of two. This makes sure that the first request does
not accidentially put the cluster into a "updgrade in progress"
status. Which would lead users to having to run apply twice.
2023-03-03 09:38:23 +01:00
Daniel Weiße
5eb73706f5
internal: refactor storage credentials (#1071)
* Move storage clients to separate packages

* Allow setting of client credentials for AWS S3

* Use managed identity client secret or default credentials for Azure Blob Storage

* Use credentials file to authorize GCS client

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-02 15:08:31 +01:00
Malte Poll
ab0b881cbf
oid: add alternative string representations for attestation variants (#1322) 2023-03-02 10:48:16 +01:00
Malte Poll
fc33a74c78
constants: make VersionInfo readonly (#1316)
The variable VersionInfo is supposed to be set by `go build -X ...` during link time but should not be modified at runtime.
This change ensures the underlying var is private and can only be accessed by a public getter.
2023-03-01 11:55:12 +01:00
renovate[bot]
0157537852
deps: update Kubernetes versions (#1313)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-03-01 11:41:11 +01:00
Paul Meyer
060faae528
config: use toPtr func to get pointers (#1287)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-28 18:44:21 +01:00
renovate[bot]
2f52091326
deps: update Constellation containers to v2.6.0-pre.0.20230228093604-90ed4701788f (#1288)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-28 17:32:02 +01:00
Daniel Weiße
b3486fc32b
intenal: add logging to attestation issuer (#1264)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-28 16:34:18 +01:00
Moritz Sanft
90ed470178
internal: add custom version type (#1256)
* add custom version type

* extend functionality

* adapt to requested changes

* move to own package

* remove duplicate tests, rename package

* not handle err
2023-02-28 10:36:04 +01:00
Otto Bittner
984f0589d2
cli: upgrade errors for microservice (#1259)
Handle invalid upgrade errors similarly as for images and k8s.
2023-02-28 10:23:09 +01:00
Malte Poll
b79f7d0c8c
cli: add basic support for constellation create on OpenStack (#1283)
* image: support OpenStack image build / upload

* cli: add OpenStack terraform template

* config: add OpenStack as CSP

* versionsapi: add OpenStack as CSP

* cli: add OpenStack as provider for `config generate` and `create`

* disk-mapper: add basic support for boot on OpenStack

* debugd: add placeholder for OpenStack

* image: fix config file sourcing for image upload
2023-02-27 18:19:52 +01:00
Otto Bittner
d98f86686d versions: let renovate update valid k8s versions
Also update lagging v1_24
2023-02-27 16:33:47 +01:00
renovate[bot]
b1d9ede767
deps: update Constellation containers (#1234)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-24 17:00:50 +01:00
renovate[bot]
7bcd0650a9
deps: update ghcr.io/edgelesssys/cloud-provider-gcp:v26.0.1 Docker digest to db2b15a (#1267)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-24 15:57:53 +01:00
Moritz Sanft
a274ac8a7c
ci: add cli k8s compatibility table artifact upload to ci (#1218)
* add cli k8s compatibility api to ci

* extend versionsapi package

* rework cli info upload via ci

* join errors natively

* fix semver

* upload from hack file

* fix ci checks

* add distributionid

* setup go before running hack file

* setup go after repo checkout

* use logger instead of panic, invalidate cache

* use provided ctx

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

---------

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-24 12:00:04 +01:00
Nils Hanke
28bdeb2427 cli: add support for GCP C2D VMs 2023-02-22 15:25:51 +01:00
Nils Hanke
7360e89182 cli: fix n2d-standard-224 support 2023-02-22 15:25:51 +01:00
Otto Bittner
d78d22f95a
cli: add config kubernetes-versions subcommand (#1224)
Allows users to learn which k8s versions are supported by the
current CLI.
Extend respective docs section.
2023-02-22 09:52:47 +01:00
leongross
51eef675a2
cli: refer to --force and --config flags (#1205)
* add reference to --config and --force
2023-02-21 16:46:47 +01:00
Otto Bittner
da7a870f54
cli: add --kubernetes flag (#1226)
The flag can be used to specify a Kubernetes version
in format MAJOR.MINOR and let the CLI extend the
value with the patch version.
2023-02-21 14:05:41 +01:00
Paul Meyer
6d6d7d4b6e kms: replace deprecated rand.Seed
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Paul Meyer
deea806d9c Improve code sequences with multiple errs
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Paul Meyer
12c866bcb9 deps: replace multierr with native errors.Join
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Otto Bittner
c0a62a52d1
config: allow k8s version MAJOR.MINOR for v2.6 (#1222)
To adhere to our compatibility goal of not breaking
old configs, the kubernetes patch version is automatically
extended for configs in the transistional version v2.6.
2023-02-20 10:50:55 +01:00
Otto Bittner
87fdb47caa
cli: upgrade apply uses correct measurements key (#1223)
Apply still used the obsolete upgrade key's measurements.
The new, desired behavior is to use the Provider's measurements
key
2023-02-20 10:32:33 +01:00
renovate[bot]
93f97cb320
deps: update Constellation containers (#1211)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-02-17 11:41:48 +01:00
Daniel Weiße
f70447bf7d
Allow unset 'name' key but print warning if unset (#1208)
* Allow unset name key in config but print warning if unset

* Print deprecation warnings for config to os.Stderr

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-17 09:05:42 +01:00
Thomas Tendyck
292f8eef21 attestation: remove VerifyUserData 2023-02-16 16:29:20 +01:00
Thomas Tendyck
dd7d6334ba attestation: bind user data to PCR state 2023-02-16 16:29:20 +01:00
Fabian Kammel
5e7dc0d7db
Option to disable spinner via environment variable. (#1207)
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2023-02-16 15:43:19 +01:00
Otto Bittner
50646b2a10 cli: refactor upgrade apply cmd to match name
* `upgrade apply` will try to make the locally configured and
actual version in the cluster match by appling necessary
upgrades.
* Skip image or kubernetes upgrades if one is already
in progress.
* Skip downgrades/equal-as-running versions
* Move NodeVersionResourceName constant from operators
to internal as its needed in the CLI.
2023-02-15 16:44:47 +01:00
Otto Bittner
3cebd68c24 kubernetes: move k8s-components creation to internal
The CLI will have to create similar objects for k8s upgrades.
2023-02-15 16:44:47 +01:00
Otto Bittner
b4ef4ec370 config: conditionally set default microserviceVersion 2023-02-15 13:36:16 +01:00
Otto Bittner
6f9d76dd6e compatibility: allow newer patch versions for images
Validation incorrectly prevented newer patch versions for images.
2023-02-15 13:36:16 +01:00
Otto Bittner
2a0b56f7b8 config: improve error message for outdated CLIs 2023-02-15 13:36:16 +01:00
renovate[bot]
a7b3a9876b
deps: update Constellation containers to v2.6.0-pre.0.20230215104228-2042e6b3382f (#1185)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-15 13:13:54 +01:00
Otto Bittner
2042e6b338 config: only print upgrade deprecation msg if key is set 2023-02-15 11:42:28 +01:00
Otto Bittner
69a384d978 compatibility: error message wording
The new description represents the error condition more accurately.
2023-02-15 11:41:54 +01:00
renovate[bot]
241d667758
deps: update K8s constrained Azure versions (#1129)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-14 15:18:55 +01:00
Paul Meyer
84a787b538
cli: add name of build type to version cmd output (#1179)
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-14 14:30:10 +01:00
renovate[bot]
f60f967bd8
deps: update Constellation containers to v2.6.0-pre.0.20230210122722-c29107f5be7b (#1126)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-10 16:06:46 +01:00
Daniel Weiße
c29107f5be
init: create kubeconfig file with unique user/cluster name (#1133)
* Generate kubeconfig with unique name

* Move create name flag to config

* Add name validation to config

* Move name flag in e2e tests to config generation

* Remove name flag from create

* Update ascii cinema flow

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-10 13:27:22 +01:00
Otto Bittner
fd860ddb91
config: fix incorrect kubernetes version validation (#1155)
Fix incorrect string comparison by replacing it with
call to semver.Compare.
Also add handling to check for missing v prefix.
2023-02-09 17:38:02 +01:00
Otto Bittner
c275464634 cli: change upgrade-plan to upgrade-check
Upgrade check is used to find updates for the current cluster.
Optionally the found upgrades can be persisted to the config
for consumption by the upgrade-execute cmd.
The old `upgrade execute` in this commit does not work with
the new `upgrade plan`.
The current versions are read from the cluster.
Supported versions are read from the cli and the versionsapi.
Adds a new config field MicroserviceVersion that will be used
by `upgrade execute` to update the service versions.
The field is optional until 2.7
A deprecation warning for the upgrade key is printed during
config validation.
Kubernetes versions now specify the patch version to make it
explicit for users if an upgrade changes the k8s version.
2023-02-08 12:30:01 +01:00
Otto Bittner
f204c24174 cli: add version validation and force flag
Version validation checks that the configured versions
are not more than one minor version below the CLI's version.
The validation can be disabled using --force.
This is necessary for now during development as the CLI
does not have a prerelease version, as our images do.
2023-02-08 12:30:01 +01:00
Daniel Weiße
3a7b829107
internal: use go-kms-wrapping for KMS backends (#1012)
* Replace external KMS backend logic for AWS, Azure, and GCP with go-kms-wrapping

* Move kms client setup config into its own package for easier parsing

* Update kms integration flag naming

* Error if nil storage is passed to external KMS

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-08 12:03:54 +01:00
Daniel Weiße
68ce23b909
Enable cryptsetup read/write workqueue bypass (#1150)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-08 12:01:14 +01:00
renovate[bot]
535c359ee7
deps: update Constellation containers to v2.6.0-pre.0.20230131161703-e0354826e058 (#1105)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-31 18:08:40 +01:00
Otto Bittner
6415d80ee4 versions: update constellation operator image 2023-01-31 11:36:49 +01:00
renovate[bot]
11e233e4be
deps: update ghcr.io/edgelesssys/cloud-provider-gcp:v26.0.1 Docker digest to 8708a33 (#1110)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-30 16:54:11 +01:00
renovate[bot]
dcde73b4c4
deps: update Constellation containers to v2.6.0-pre.0.20230127131021-e174146e0c93 (#1091)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 16:01:08 +01:00
renovate[bot]
fb1b1f50fd
deps: update K8s version independent containers to v0.1.1 (#1020)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 15:25:05 +01:00
3u13r
e174146e0c
azure: add new idkeydigest (#1094) 2023-01-27 14:10:21 +01:00
Paul Meyer
8364856d55 versions: remove Kubernetes v1.23
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 13:32:20 +01:00
renovate[bot]
c758aef1ff
deps: update registry.k8s.io/provider-aws/cloud-controller-manager Docker tag to v1.25.3 (#1082)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 11:30:43 +01:00
renovate[bot]
dd1140868e
deps: update Constellation containers to v2.6.0-pre (#1074)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-26 14:58:51 +01:00
Daniel Weiße
aa3ac82408
Add a bit more logging to attestation and join-service on error (#1076)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-01-26 11:24:29 +01:00
Malte Poll
2d326ea3f0
cli: set placeholder uid for QEMU / MiniConstellation (#1069) 2023-01-25 14:42:52 +01:00
3u13r
e6ac8e2a91
config: fix digest naming (#1064)
* config: fix digest naming
2023-01-24 22:20:10 +01:00
github-actions[bot]
9567cc09ce
release: bring back changes from v2.5.0 (#1061)
* deps: update version to v2.5.0

* attestation: hardcode measurements for v2.5.0

* bump operator versions

Co-authored-by: release[bot] <release[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-01-24 11:35:26 +01:00
renovate[bot]
5142497a3d
deps: update dependency containernetworking/plugins to v1.2.0 (#1022)
* Update dependency containernetworking/plugins to v1.2.0

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-23 14:56:28 +01:00
renovate[bot]
f688afff3f
Update K8s constrained Azure versions (#1009)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-23 14:32:21 +01:00
Paul Meyer
4f9ed08061 versionsapi: fix single version deletion in cli
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-23 14:15:05 +01:00
Otto Bittner
3b59ebfd53
config: detailed validation errors for k8s version (#1018)
These extended error messages help users in understanding
what is wrong with the current configuration and how to
remediate the issue.
2023-01-23 11:21:06 +01:00
renovate[bot]
9f05631afd
deps: update Constellation containers (#1052)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-21 20:17:07 +01:00
Paul Meyer
c4d68d1c28 versions: update key-service name
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-21 19:55:14 +01:00
renovate[bot]
6708aff984
deps: update dependency kubernetes/kubernetes to v1.24.10 (#1043)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-20 18:54:10 +01:00
Paul Meyer
a8cbfd848f
keyservice: use dash in container name (#1016)
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-01-20 18:51:06 +01:00
Fabian Kammel
8482d26eef
deps: update cloud provider gcp image for k8s v1.26 (#1051)
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2023-01-20 15:54:24 +01:00
renovate[bot]
9b4dc9b478
Update Constellation containers to v2.5.0-pre.0.20230119145750-690b50b29de5 (#1039)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-20 09:51:29 +01:00
renovate[bot]
99496c3c33
Update Kubernetes versions (#1019)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-19 17:16:00 +01:00
Daniel Weiße
690b50b29d
dev-docs: Go package docs (#958)
* Remove unused package

* Add Go package docs to most packages

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Fabian Kammel <fk@edgeless.systems>
2023-01-19 15:57:50 +01:00
Otto Bittner
a0ac957227 versions: update join- & keyservice images 2023-01-19 13:14:55 +01:00
Otto Bittner
9a1f52e94e Refactor init/recovery to use kms URI
So far the masterSecret was sent to the initial bootstrapper
on init/recovery. With this commit this information is encoded
in the kmsURI that is sent during init.
For recover, the communication with the recoveryserver is
changed. Before a streaming gRPC call was used to
exchanges UUID for measurementSecret and state disk key.
Now a standard gRPC is made that includes the same kmsURI &
storageURI that are sent during init.
2023-01-19 13:14:55 +01:00
Otto Bittner
0e71322e2e keyservice: move kms code to internal/kms
Recovery (disk-mapper) and init (bootstrapper)
will have to work with multiple external KMSes
in the future.
2023-01-19 13:14:55 +01:00
renovate[bot]
90ea35ae35
Update Constellation containers to v2.5.0-pre.0.20230118154955-632090c21b93 (#1014)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-01-18 17:28:04 +01:00
3u13r
632090c21b
azure: allow a set of idkeydigest values (#991) 2023-01-18 16:49:55 +01:00