Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-15 10:54:29 -05:00
Code Issues Packages Projects Releases Wiki Activity
3,920 Commits 136 Branches 49 Tags 108 MiB
8b41bcaecc
Commit Graph

3920 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
renovate[bot]
6c5170da79
deps: update module golang.org/x/crypto to v0.17.0 [SECURITY] (#2736) 
* deps: update module golang.org/x/crypto to v0.17.0 [SECURITY]
* deps: tidy all modules

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
 2023-12-19 08:53:15 +01:00
Markus Rudy
1d05f438ff ci: remove Windows Terraform provider 2023-12-18 17:57:00 +01:00
Moritz Sanft
9414f29b51
terraform-provider: lock-step microservice version (#2733) 2023-12-18 14:21:19 +01:00
Markus Rudy
615e731855 upgrade-agent: pass patches to kubeadm 2023-12-18 14:17:35 +01:00
Markus Rudy
ce9e25c150 bootstrapper: pass patches to kubeadm 2023-12-18 14:17:35 +01:00
Markus Rudy
070c23f876 operators: pass additional components to upgrade-agent 2023-12-18 14:17:35 +01:00
Markus Rudy
6f1b6b532f upgrade-agent: allow more than one KubernetesComponent 2023-12-18 14:17:35 +01:00
Markus Rudy
4ba483ec0e versions: add Kubernetes image patches to components 2023-12-18 14:17:35 +01:00
Markus Rudy
b740a1a75b versions: designate components for upgrades 2023-12-18 14:17:35 +01:00
Moritz Sanft
7c5b95bbcc
terraform-provider: warn about microservice version changes (#2730) 
* terraform-provider: update data source examples

* terraform-provider: warn about destructive microservice changes

* terraform-provider: use `name` variable

* terraform-provider: only perform pre-apply checks on upgrades

* terraform-provider: fix conditional

* terraform-provider: remove obsolete version checks
 2023-12-18 13:55:44 +01:00
Daniel Weiße
f2c1bdbf82
ci: remove conditional from AWS login in e2e verify test (#2727) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-18 11:51:50 +01:00
edgelessci
086b42b08f
image: update locked rpms (#2726) 
Co-authored-by: malt3 <malt3@users.noreply.github.com>
 2023-12-18 11:02:42 +01:00
Moritz Sanft
af791bd221
terraform-provider: add usage examples (#2713) 
* terraform-provider: add usage example for Azure

* terraform-provider: add usage example for AWS

* terraform-provider: add usage example for GCP

* terraform-provider: update usage example for Azure

* terraform-provider: update generated documentation

* docs: adjust creation on Azure and link to examples

* terraform-provider: unify image in-/output (#2725)

* terraform-provider: check for returned error when converting microservices

* terraform-provider: use state values for outputs after creation

* terraform-provider: ignore invalid upgrades (#2728)

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
 2023-12-18 10:15:54 +01:00
Adrian Stobbe
88d626d302
feat: pin cert-manager image to sha256 checksum (#2721) 2023-12-18 09:28:50 +01:00
3u13r
183c564483
cilium: enable bpf masquerading (#2723) 
* cilium: enable bpf masquerading

* cilium: also enable ipMasqAgent

* cilium: remove custom Azure masqing
 2023-12-15 23:07:03 +01:00
3u13r
0111b6d718
deps: Update cert manager to 1.12.6 (#2700) 
* deps: bump cert manager to 1.13.2

* helm: allow minor jump for cert-manager
 2023-12-15 17:44:00 +01:00
Daniel Weiße
a1f67d0884
cli: fix upgrades when using outdated Kubernetes patch version (#2718) 
* Fix missing image for Constellation operators in our Helm charts if the desired Kubernetes patch version is no longer supported (but Kubernetes upgrades are skipped)
* Correctly unmarshal Kubernetes Components list if the list uses an old format

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-15 15:45:52 +01:00
Daniel Weiße
724ee44466
ci: Terraform provider e2e tests (#2712) 
* Refactor selfManagedInfra input to clusterCreation in e2e tests
* Run e2e test using terraform provider
* Allow insecure measurement fetching in Terraform provider
* Run Terraform provider test instead of module test in weekly runs

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-15 10:37:29 +01:00
Adrian Stobbe
9667dfff58
terraform: align infrastructure module attributes (#2703) 
* all vars have snail_case

* make iam schema consistent

* infrastructure schema

* terraform: update AWS infrastructure module

* fix ci

* terraform: update AWS infrastructure module

* terraform: update AWS IAM module

* terraform: update Azure Infrastructure module inputs

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: update Azure IAM module

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: update GCP infrastructure module

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: update GCP IAM module

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: update OpenStack Infrastructure module

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: update QEMU Infrastructure module

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform-module: fix input name

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: tidy

* cli: ignore whitespace in Terraform variable tests

* terraform-module: fix AWS output names

* terraform-module: fix output references

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: rename `api_server_cert_sans`

* Update terraform/infrastructure/aws/modules/public_private_subnet/variables.tf

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* fix self-managed

* terraform: revert AWS modules output file renaming

* terraform: remove duplicate varable declaration

* terraform: rename Azure location field

* ci: adjust output name in self-managed e2e test

* e2e: continuously print output in upgrade test

* e2e: write to output variables

* cli: migrate IAM variable names

* cli: make `location` field optional

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
 2023-12-15 10:36:58 +01:00
edgelessci
6f6f28b8cc
image: update measurements and image version (#2722) 
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
 2023-12-15 08:18:25 +01:00
edgelessci
2c50abcc91
image: update measurements and image version (#2720) 
Co-authored-by: malt3 <malt3@users.noreply.github.com>
 2023-12-14 19:35:40 +01:00
Malte Poll
b3601fcf32 nix: update mkosi to work around tar unpacking issue 2023-12-14 18:18:07 +01:00
Malte Poll
f487c2a6d0 image: update Linux to 6.1.68 
Changelogs:

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.65
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.66
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.67
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.68
 2023-12-14 18:18:07 +01:00
Adrian Stobbe
37580009fe
terraform-provider: cleanup and improve docs (#2685) 
Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
 2023-12-14 15:47:55 +01:00
Daniel Weiße
9a4e96905f
bazel: place Terraform provider binaries in local registry path on devbuild (#2714) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-14 08:18:48 +01:00
Malte Poll
fecb1f3e6c ci: reproducibility test for OS images 2023-12-13 18:19:59 +01:00
Malte Poll
58e7af5364 image: create package manifest in chroot 
rpm doesn't work properly when run on the host.
 2023-12-13 18:19:59 +01:00
Malte Poll
23e456a265 nix: update flake and use mkosi with sorted cpio 2023-12-13 18:19:59 +01:00
Malte Poll
1209d597d8 ci: test reproducible builds on different Linux systems 
macOS is not working reliably at the moment.
 2023-12-13 18:19:59 +01:00
3u13r
1d6e5ca3ea
terraform: use correct security group option for jump host (#2715) 2023-12-13 18:05:25 +01:00
Markus Rudy
ae00b0a198 installer: add support for data URLs 
RFC 015 proposes the introduction of data URLs to materialize static
content to files on disk. This commit adds support for data URLs to the
installer. The corresponding content will be added to versions.go in a
subsequent commit.
 2023-12-13 09:35:19 +01:00
edgelessci
8d8853ef31
image: update measurements and image version (#2711) 
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
 2023-12-13 09:23:38 +01:00
3u13r
53516c105b
Revert "helm: deprioritize Cilium tc filters" (#2709) 
This reverts commit a3de1d95d9.
 2023-12-12 16:56:41 +01:00
3u13r
1e63ce8bb1
deps: tidy terraform-provider (#2710) 2023-12-12 16:40:08 +01:00
Moritz Sanft
0a593bec18
terraform: upgrade random provider to v3.6.0 (#2704) 
* terraform: upgrade `random` provider to `v3.6.0`

* terraform: update lockfiles

* ci: fix Terraform lock exclude directories
 2023-12-12 16:00:16 +01:00
Moritz Sanft
367136add2
terraform-provider: support importing Constellation clusters (#2702) 
* terraform-provider: support importing Constellation clusters

* bazel: shfmt exclusion for import script

* ci: fix godot check

* bazel: shellcheck exclusion for import script

* Update dev-docs/workflows/terraform-provider.md

Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>

* ci: fix Terraform lock exclude directories

---------

Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
 2023-12-12 16:00:03 +01:00
Daniel Weiße
d08e75bf9c
constellation-lib: fix incorrect encoding and ordering of Init response (#2708) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-12 15:01:56 +01:00
Daniel Weiße
0512cfccd7
ci: add v prefix to packaged Terraform provider binary (#2705) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-12 15:01:37 +01:00
Adrian Stobbe
4c8041d2cf
bazel: used sed from nixpkgs (#2706) 
This is required since sed on macos has different flags and may behave differently.

Co-authored-by: Malte Poll <mp@edgeless.systems>
 2023-12-12 14:46:11 +01:00
renovate[bot]
6db0318b2f
deps: update module github.com/docker/docker to v24.0.7+incompatible [SECURITY] (#2541) 
* deps: update module github.com/docker/docker to v24.0.7+incompatible [SECURITY]

* deps: tidy all modules

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
 2023-12-12 13:34:28 +01:00
Markus Rudy
a53017ecc4 upgrade-agent: set explicit k8s version 
`kubeadm upgrade plan` takes an optional positional argument for the
target Kubernetes version [1], which is documented as

> To skip the internet check, pass in the optional [version] parameter

In light of RFC 015, we should not do an "internet check" for latest
versions, but stick to the version we're actually targeting with the
upgrade. Thus, we explicitly pass the version as an argument.

[1]: https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/#cmd-upgrade-plan
 2023-12-11 20:11:26 +01:00
Moritz Sanft
60fc73e0e7
terraform-provider: implement constellation_cluster resource (#2691) 
* terraform: move module to legacy-directory

* constellation-lib: refactor service account marshalling

* terraform-provider: normalize Azure image URIs

* constellation-lib: refactor Kubeconfig endpoint rewriting

* terraform-provider: add conversion functions for AWS and GCP

* terraform-provider: implement `constellation_cluster` resource

* terraform-provider: refactor conversion

* terraform-provider: implement image and k8s upgrades

* terraform-provider: fix linter checks

* terraform-provider: refactor to bundle init & upgrade method

* constellation-lib: rewrite Kubeconfig endpoint in init

* terraform-provider: bind logger and dialer constructors to struct

* terraform-provider: move applier to function pointer

* terraform-provider: gcp conversion fixes

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform-provider: fix Azure UAMI input

* terraform-provider: rename Kubeconfig variable

* terraform-provider: tidy

* terraform-provider: regenerate docs

* constellation-lib: provide Kubeconfig in testing initserver

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
 2023-12-11 15:55:44 +01:00
Markus Rudy
767bac4766 installer: fix old-style Components references 2023-12-11 15:13:00 +01:00
Daniel Weiße
22dcde86af
terraform-provider: create release in provider repo on Constellation release (#2686) 
* Create release in Terraform provider repo with provider binaries
* Set target_commitish to input ref for easier release workflow
* Rename release-cli workflow to draft-release
* Update release guide

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-11 15:00:08 +01:00
Markus Rudy
138057a2ee installer: make hash checking optional 2023-12-11 14:28:19 +01:00
Markus Rudy
dac4bb04f2 ci: disable curses support 
Comparison of output for a failed build. Old setup produces >3k lines of
unhelpful messages:

https://github.com/edgelesssys/constellation/actions/runs/7165242775/job/19506817413

Without curses support, we get <400 lines with relevant details:

https://github.com/edgelesssys/constellation/actions/runs/7166031624/job/19509201790
 2023-12-11 14:27:31 +01:00
Markus Rudy
a1dbd13f95 versions: consolidate various types of Components 
There used to be three definitions of a Component type, and conversion
routines between the three. Since the use case is always the same, and
the Component semantics are defined by versions.go and the installer, it
seems appropriate to define the Component type there and import it in
the necessary places.
 2023-12-11 14:26:54 +01:00
Daniel Weiße
a8fb6c5af0
ci: remove invalid input for recover action (#2695) 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
 2023-12-11 09:34:17 +01:00
Moritz Sanft
6ff321364d
terraform: fix Azure marketplace image defaults (#2692) 
* config: default to false instead of null for Azure marketplace image

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform: make Azure marketplace image default to null

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
 2023-12-11 08:15:47 +01:00
edgelessci
acba9c4c60
image: update locked rpms (#2693) 
Co-authored-by: malt3 <malt3@users.noreply.github.com>
 2023-12-10 16:03:03 +01:00