Moritz Sanft
a5021c52d3
joinservice: cache certificates for Azure SEV-SNP attestation ( #2336 )
...
* add ASK caching in joinservice
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* use cached ASK in Azure SEV-SNP attestation
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* update test charts
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix linter
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix typ
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* make caching mechanism less provider-specific
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* update buildfiles
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* add `omitempty` flag
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
* frontload certificate getter
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
* rename frontloaded function
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* pass cached certificates to constructor
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix race condition
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix marshalling of empty certs
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix validator usage
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* [wip] add certcache tests
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* add certcache tests
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* tidy
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix validator test
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* remove unused fields in validator
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix certificate precedence
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* use separate context
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* tidy
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* linter fixes
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* linter fixes
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* Remove unnecessary comment
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
* use background context
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* Use error format directive
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
* `azure` -> `Azure`
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
* improve error messages
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* add x509 -> PEM util function
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* use crypto util functions
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix certificate replacement logic
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* only require ASK from certcache
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* tidy
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
* fix comment typo
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
---------
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
2023-09-29 14:29:50 +02:00
Daniel Weiße
053aa60e47
cli: remove helm management from join-config ( #2251 )
...
* Replace UpdateAttestationConfig with ApplyJoinConfig
* Dont set up join-config over Helm, it is now only managed by our CLI directly during init and upgrade
* Remove measurementSalt and attestationConfig parsing from helm, they were only needed for the JoinConfig
* Add migration step to remove join-config from Helm management
* Update attestation config trouble shooting tip
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-08-23 08:14:39 +02:00
Adrian Stobbe
70861ee8ad
cli: declare mastersecret as immutable and print attestationCfg diff in warning ( #2167 )
2023-08-08 13:03:23 +02:00
renovate[bot]
ec33530c38
deps: update gcr.io/kubebuilder/kube-rbac-proxy Docker tag to v0.14.1 ( #2063 )
...
* deps: update gcr.io/kubebuilder/kube-rbac-proxy Docker tag to v0.14.1
* deps: use gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-08-04 13:49:38 +02:00
Malte Poll
56635c3993
cli: deploy yawol as OpenStack loadbalancer
2023-05-03 21:45:59 +02:00
Daniel Weiße
d7a2ddd939
config: add separate option for handling attestation parameters ( #1623 )
...
* Add attestation options to config
* Add join-config migration path for clusters with old measurement format
* Always create MAA provider for Azure SNP clusters
* Remove confidential VM option from provider in favor of attestation options
* cli: add config migrate command to handle config migration (#1678 )
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-05-03 11:11:53 +02:00
Malte Poll
9dfad32e33
cli: use Bazel container images
2023-04-18 15:35:15 +02:00
Malte Poll
69de06dd1f
image: OpenStack vTPM ( #1616 )
...
* cli: allow vpc traffic between nodes on OpenStack
* image: enable vTPM on OpenStack
* cli: add create tests for OpenStack
2023-04-05 16:49:03 +02:00
Malte Poll
7d4ab07163
helm: add tests for AWS and OpenStack
2023-03-21 10:51:09 +01:00
