Commit Graph

3529 Commits

Author SHA1 Message Date
Adrian Stobbe
9af514d08e
fix panic in status cmd (#2625) 2023-11-22 08:31:37 +01:00
Adrian Stobbe
0c1e6e97e4
fix unsupported qemu in tests on mac (#2627) 2023-11-22 08:30:52 +01:00
Daniel Weiße
a6cf387a24
docs: update screencasts to use apply command (#2624)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-21 16:03:11 +01:00
renovate[bot]
71dc5170a7
deps: update golang Docker tag to v1.21.4 (#2587)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-11-21 13:43:26 +01:00
renovate[bot]
6b2e41fcde
deps: update Terraform aws to v5.26.0 (#2579)
* deps: update Terraform aws to v5.26.0
* deps: tidy all modules

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
2023-11-21 11:24:31 +01:00
Malte Poll
73eba88c70
Revert "deps: update rules_oci to 1.4.2 (#2616)" (#2618)
This reverts commit 52f7afe6e5.
2023-11-20 16:18:15 +01:00
Daniel Weiße
807824bf79
ci: remove dash from create action (#2617)
* remove dash
* fix flags parsing

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-20 15:19:45 +01:00
edgelessci
60921fcc14
image: update locked rpms (#2614)
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2023-11-20 14:19:26 +01:00
Malte Poll
52f7afe6e5
deps: update rules_oci to 1.4.2 (#2616) 2023-11-20 14:19:05 +01:00
Daniel Weiße
35abc3c354
cli: use apply command to start mini cluster (#2551)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-20 12:10:16 +01:00
Daniel Weiße
4c8ce55e5a
cli: enable constellation apply to create new clusters (#2549)
* Allow creation of Constellation clusters using `apply` command
* Add auto-completion for `--skip-phases` flag
* Deprecate create command
* Replace all doc references to create command with apply

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-20 11:17:16 +01:00
Thomas Tendyck
82b68df92a docs: add release v2.13.0 2023-11-19 18:57:31 +01:00
Thomas Tendyck
5f249eedcb docs: minor 2023-11-19 18:57:31 +01:00
Markus Rudy
69c64d6c69
docs: improve developer documentation for folks new to the codebase
* Correct example invocation of aws cli

* Add warning to Helm Intellisense recommendation

* Link code conventions in PR guidelines

* Tighten debugd README

* cmake is not used for building debugd anymore, remove references to it

* make the debug-cluster workflow the authoritative source for cdbg usage - don't replicate the same instructions in different places

* Document that Bazel eats a lot of RAM
2023-11-17 19:16:52 +01:00
edgelessci
e51513985a
image: update measurements and image version (#2612)
Co-authored-by: daniel-weisse <daniel-weisse@users.noreply.github.com>
2023-11-17 12:49:54 +01:00
Moritz Sanft
ce518486e5
dev-docs: fix instructions in release docs (#2611) 2023-11-17 10:46:45 +01:00
Daniel Weiße
5e9e3de1a1
ci: start v2.14-pre window (#2610)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-17 10:34:35 +01:00
Adrian Stobbe
a88a731576
docs: add Terraform module (#2560)
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com
2023-11-16 17:03:24 +01:00
Malte Poll
ac8aac0e34
ci: allow jobs to install tools from pinned nixpkgs (#2605) 2023-11-16 14:41:34 +01:00
3u13r
183ce7a45a image: update measurements and image version 2023-11-16 13:50:40 +01:00
Leonard Cohnen
cb88c7a5f3 kubernetes: remove unused struct 2023-11-15 19:27:33 +01:00
Leonard Cohnen
cfcc0898b2 helm: remove konnectivity from control-planes
This is the first step in our migration off of
konnectivity. Before node-to-node encryption
we used konnectivity to route some KubeAPI
to kubelet traffic over the pod network which then
would be encrypted.

Since we enabled node-to-node encryption this has no
security upsides anymore. Note that we still deploy
the konnectivity agents via helm and still have the
load balancer for konnectivity.

In the following releases we will remove both.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
79f562374a bootstrapper: remove cilium restart fix
Tests concluded that restating the Cilium agent after the
first boot is not needed anymore to regain connectivity for
pods.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
1972b635b4 cilium: don't allow remote node identities
The Cilium strict mode has a special mode which
loosens the security a slight bit. For compatability this
mode is enabled by default. But we don't need it for strict
node-to-node encryption. Therefore, we disable it.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
e8840d5fdc terraform: fix azure node cidr
Use the local variable instead of inlining the
node CIDR value.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
aae85f0c3c kubernetes: always use lb for joining
The token given out by control-planes contains the node IP
as an endpoint. Since during this stage the joining node is
not connected to the WireGuard network, we cannot
communicate node-to-node. Therefore, we need to hop over the
load balancer again to have a src IP outside of the strict
range.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
4f32eefe90 cilium: use strict cidrs from state file
For the strict modes we need to dynamically use
the CIDR used in the Terraform files. Therefore,
we write them to our statefile and use them when
installing Cilium.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
7318f605e1 cilium: also encryption control-planes
When enabling node-to-node encryption, Cilium does not
encrypt control-plane to control-plane traffic by
default since they say that they cannot gurantee that
the generated private key for a node is persisted across
reboots.

In Constellation we use stateful VMs which when rebooted
still have the cilium_wg0 interface containing the
private key.

Therefore, we can enable this type of encryption.
2023-11-15 19:27:33 +01:00
Leonard Cohnen
e9694d40b9 deps: update cilium
Bumping Cilium to also enable node-to-node encryption and
node-to-node strict mode. Since the second is not upstream
we use our fork.
2023-11-15 19:27:33 +01:00
katexochen
648eebab24 image: update measurements and image version 2023-11-15 11:10:40 +01:00
Moritz Sanft
2ccc2212c8
add missing runner value (#2602)
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2023-11-15 08:49:10 +01:00
Daniel Weiße
6d6ef66a31
ci: refactor teams notification action (#2600)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-15 08:48:13 +01:00
edgelessci
02b4ba8413 deps: update dependency bazel_skylib to v1.5.0 2023-11-14 14:04:16 +01:00
edgelessci
b7ed4347d5 deps: update dependency hermetic_cc_toolchain to v2.1.3 2023-11-14 14:04:16 +01:00
renovate[bot]
f1edce0413 deps: update bazel (core) 2023-11-14 14:04:16 +01:00
Moritz Sanft
fd72952738
checkout before selecting image (#2598)
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2023-11-14 10:33:59 +01:00
renovate[bot]
1ad995e637
deps: update bufbuild/buf to v1.28.0 (#2589)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-11-14 09:08:12 +01:00
renovate[bot]
afed1b2330
deps: update golangci/golangci-lint to v1.55.2 (#2593)
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-11-14 09:07:05 +01:00
edgelessci
246b9ce069
image: update measurements and image version (#2594)
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2023-11-13 21:10:15 +01:00
3u13r
6f195c6f2c
state: add migration (#2580) 2023-11-13 20:49:54 +01:00
3u13r
56ab3e9e04
Revert "operator: always delete terminated pending nodes (#2545)" (#2596)
This reverts commit 5267ad0f08.
2023-11-13 20:25:34 +01:00
Moritz Sanft
8f2f8bdbbd
terraform: allow image to be empty (#2595)
* make image optional in the high level modules

* align azure variable description

* set defaults in convenience modules

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
2023-11-13 20:13:24 +01:00
Moritz Sanft
8e4feb7e2a
terraform: add Terraform module for Azure (#2566)
* add Azure Terraform module

* add maa-patching command to cli

* refactor release process

* factor out image fetching to own action

* add CI

* generate

* fix some unnecessary changes

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* use `constellation maa-patch` in ci

* insecure flag when using debug image

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* only update maa url if existing

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* make node group zone optional on aws and gcp

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* [remove] register updated workflow

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* Revert "[remove] register updated workflow"

This reverts commit e70b9515b7eabbcbe0d41fa1296c48750cd02ace.

* create MAA

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* make maa-patching only run on azure

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* add comment

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* require node group zone for GCP and AWS

* remove unnecessary bazel action

* stamp version to correct file

* refer to `maa-patch` command in docs

* run Azure test in weekly e2e

* comment / naming improvements

* remove sa_account resource

* disable spellcheck ot use "URL"

* `create_maa` variable

* don't write maa url to config

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* default to nightly image

* use input ref and stream

* fix command check

* don't set region in weekly e2e call

* patch maa if url is not empty

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* remove `create_maa` variable

* remove binaries

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* remove undefined input

* replace invalid attestation URL error message

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* fix punctuation

Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>

* skip hidden commands in clidocgen

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* enable spellcheck before code block

* move spellcheck trigger out of info block

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* fix workflow dependencies

* let image default to CLI version

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
2023-11-13 18:46:20 +01:00
Daniel Weiße
e8f0c58558
ci: fix maa-patch action for self-managed create (#2578)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-11-13 16:29:33 +01:00
Malte Poll
f79d5e8b08
deps: update linux kernel to 6.1.62 (#2582) 2023-11-13 14:54:53 +01:00
renovate[bot]
5af6ee058c
deps: update module k8s.io/kubernetes to v1.27.5 [SECURITY] (#2548)
* deps: update module k8s.io/kubernetes to v1.27.5 [SECURITY]

* deps: tidy all modules

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
2023-11-13 10:43:12 +01:00
Moritz Sanft
ae8025cd16
ci: fix path in self managed create test (#2574)
* fix path

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* fix path in doc

---------

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
2023-11-13 08:34:54 +01:00
edgelessci
e918a7af90
image: update measurements and image version (#2571)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-11-13 06:54:09 +01:00
edgelessci
285b7bc47d
image: update locked rpms (#2575)
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2023-11-12 11:20:48 +01:00
edgelessci
e29d32af7f
image: update locked rpms (#2555)
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2023-11-10 19:50:38 +01:00