Leonard Cohnen
477a06789f
update grpc
2022-10-21 13:28:03 +02:00
Otto Bittner
07f02a442c
Refactor Helm deployments ( #341 )
...
* Wrap KMS deployment in one main chart that
deploys all other services. Other services will follow.
* Use .tgz via helm-package as serialization format
* Change Release type to carry chart as byte slice
* Remove KMSConfig
* Use json-schema to validate values
* Extend release.md to mention updating helm charts
2022-10-21 12:01:28 +02:00
Malte Poll
743f5fa627
Remove all traces of CoreOS from the codebase
2022-10-21 11:04:25 +02:00
Malte Poll
9b57f2a91c
Cilium: avoid requirements for jq on Constellation OS
2022-10-21 11:04:25 +02:00
Malte Poll
981796574c
Disable access manager
2022-10-21 11:04:25 +02:00
Malte Poll
34367ea3cc
Create mkosi image build pipeline
2022-10-21 11:04:25 +02:00
Otto Bittner
c6ccee1250
AB#2490: deploy KMS via Helm
...
* Bundle helm-install related code in speparate package
* Move cilium installation to new helm package
2022-10-18 13:33:37 +02:00
Fabian Kammel
552fb8f9b1
double CRD timeout to 30 seconds ( #230 )
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-10-12 17:07:18 +02:00
katexochen
e3e7fddf76
Use unified version constant in bootstrapper
2022-10-12 11:04:07 +02:00
Leonard Cohnen
2e3176f87c
enable konnectivity
2022-10-07 03:38:05 +02:00
katexochen
4ccd96bf64
Pin container image hashes
2022-10-06 19:16:20 +02:00
Fabian Kammel
369480a50b
Feat/revive ( #212 )
...
* enable revive as linter
* fix var-naming revive issues
* fix blank-imports revive issues
* fix receiver-naming revive issues
* fix exported revive issues
* fix indent-error-flow revive issues
* fix unexported-return revive issues
* fix indent-error-flow revive issues
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-10-05 15:02:46 +02:00
katexochen
42f273611a
Use uid from metadata instead of name
2022-09-30 16:50:52 +02:00
katexochen
53c8c9e9a6
Update proto files to v2
2022-09-22 09:10:19 +02:00
katexochen
ba6e41ed5c
Upgrade go module to v2
2022-09-22 09:10:19 +02:00
katexochen
88d200232a
Remove autoscaling from CLI and bootstrapper
2022-09-20 13:41:23 +02:00
3u13r
774e300a32
Constellation conformance mode ( #161 )
...
* add conformance mode
2022-09-20 10:07:55 +02:00
Leonard Cohnen
4a6b99d2f4
disable konnectivity
2022-09-12 19:03:01 +02:00
Leonard Cohnen
4c41da4b50
allow default routing in konnectivity
2022-09-12 14:56:40 +02:00
Leonard Cohnen
7163c161b6
Deploy Konnectivity
2022-09-09 17:26:02 +02:00
Daniel Weiße
8cb155d5c5
AB#2260 Refactor disk-mapper recovery ( #82 )
...
* Refactor disk-mapper recovery
* Adapt constellation recover command to use new disk-mapper recovery API
* Fix Cilium connectivity on rebooting nodes (#89 )
* Lower CoreDNS reschedule timeout to 10 seconds (#93 )
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-09-08 14:45:27 +02:00
Malte Poll
57e77ee53f
kubernetes version: rename latest -> default
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-09-05 16:57:28 +02:00
Malte Poll
d995558ffd
kubernetes server side apply: start counting resources at 1 ( #74 )
2022-09-05 16:50:22 +02:00
Leonard Cohnen
7b00005ed6
fix qemu initialization
2022-09-05 16:35:59 +02:00
Otto Bittner
405db3286e
AB#2386: TrustedLaunch support for azure attestation
...
* There are now two attestation packages on azure.
The issuer on the server side is created base on successfully
querying the idkeydigest from the TPM. Fallback on err: Trusted Launch.
* The bootstrapper's issuer choice is validated by the CLI's validator,
which is created based on the local config.
* Add "azureCVM" field to new "internal-config" cm.
This field is populated by the bootstrapper.
* Group attestation OIDs by CSP (#42 )
* Bootstrapper now uses IssuerWrapper type to pass
the issuer (and some context info) to the initserver.
* Introduce VMType package akin to cloudprovider. Used by
IssuerWrapper.
* Extend unittests.
* Remove CSP specific attestation integration tests
Co-authored-by: <dw@edgeless.systems>
Signed-off-by: Otto Bittner <cobittner@posteo.net>
2022-09-05 12:03:48 +02:00
Daniel Weiße
f8c01a0298
AB#2394 Change KMS to be deployed as DaemonSet ( #69 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-09-05 10:22:40 +02:00
Thomas Tendyck
bd63aa3c6b
add license headers
...
sed -i '1i/*\nCopyright (c) Edgeless Systems GmbH\n\nSPDX-License-Identifier: AGPL-3.0-only\n*/\n' `grep -rL --include='*.go' 'DO NOT EDIT'`
gofumpt -w .
2022-09-05 09:17:25 +02:00
Leonard Cohnen
26f5aec853
add verify load balancer
2022-09-01 16:45:18 +02:00
3u13r
f649219cbf
Feat/cilium strict mode2.0 ( #25 )
...
* bump cilium helm charts
* integrate cilium strict mode v2
2022-08-31 15:37:07 +02:00
Otto Bittner
4adc19b7f5
AB#2350: Configurably enforce idkeydigest on Azure
...
* Add join-config entry for "enforceIdKeyDigest" bool
* Add join-config entry for "idkeydigest"
* Initially filled with TPM value from bootstrapper
* Add config entries for idkeydigest and enforceIdKeyDigest
* Extend azure attestation validator to check idkeydigest,
if configured.
* Update unittests
* Add logger to NewValidator for all CSPs
* Add csp to Updateable type
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2022-08-31 15:26:04 +02:00
Malte Poll
c84e44913b
Fork node maintenance operator and deploy it on all supported k8s versions
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-08-31 14:53:06 +02:00
Daniel Weiße
7c832273fd
AB#2309 constellation upgrade execute ( #2 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-08-29 16:49:44 +02:00
Otto Bittner
7c5556864b
AB#2333: Add AMD SNP-based attestation
...
Currently only available on Azure CVMs.
* Get the public attestation key from the TPM.
* Get the snp report from the TPM.
* Get the VCEK and ASK certificate from the metadata api.
* Verify VCEK using hardcoded root key (ARK)
* Verify SNP report using VCEK
* Verify HCLAkPub using SNP report by comparing
AK with runtimeData
* Extend unittest
Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2022-08-29 16:29:33 +02:00
Fabian Kammel
0a3a4e9c7f
move util
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-08-29 16:07:55 +02:00
Fabian Kammel
22c912a56d
move nodestate and role
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-08-29 16:07:55 +02:00
Malte Poll
26e9c67a00
Move cloud metadata packages and kubernetes resources marshaling to internal
...
Decouples cloud provider metadata packages from kubernetes related code
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-08-29 16:07:55 +02:00
Thomas Tendyck
6b8a2a0063
remove image pull secret
2022-08-28 15:57:08 +02:00
katexochen
e57c3991f7
Don't add loadbalancer IP routing rule on workers
2022-08-23 18:11:20 +02:00
katexochen
a02a46e454
Use multiple loadbalancers on GCP
2022-08-23 18:11:20 +02:00
3u13r
29a1b5de42
increase helm install timeout ( #381 )
2022-08-19 13:28:16 +02:00
Malte Poll
abb4fb4f0f
Build GCP guest agent from github actions in constellation repo
2022-08-16 08:47:58 +02:00
Daniel Weiße
ba4471a228
AB#2316 Configurable enforced PCRs ( #361 )
...
* Add warnings for non enforced, untrusted PCRs
* Fix global state in Config PCR map
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-08-12 15:59:45 +02:00
3u13r
9478303f80
deploy cilium via helmchart ( #321 )
2022-08-12 10:20:19 +02:00
Malte Poll
2c7129987a
Deploy operator-lifecycle-manager (OLM), node-maintenance-operator (NMO) and constellation-node-operator
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-08-11 10:48:50 +02:00
Malte Poll
18a89d2881
Add constellation UID retrieval to cloudprovider metadata APIs
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-08-11 10:48:50 +02:00
Malte Poll
081dfb5037
Upgrade Azure SDK
...
Signed-off-by: Malte Poll <mp@edgeless.systems>
2022-08-05 10:35:38 +02:00
Daniel Weiße
4151d365fb
AB#2286 Return only primary IPs for instance metadata operations ( #335 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-08-04 11:08:20 +02:00
Fabian Kammel
985585f578
fix linter issues ( #329 )
...
* fix linter issues
* replace fmt with logger
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2022-08-02 16:25:47 +02:00
Fabian Kammel
19b731b5f7
Add node name to early boot logging ( #323 )
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-08-01 12:32:28 +02:00
Daniel Weiße
7baf98f014
Add test vectors for key derivation functions ( #320 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-08-01 09:11:13 +02:00