3u13r
a2c98eb1d5
Correctly deploy the AWS CCM ( #1853 )
...
* aws: stop using the imds api for tags
* aws: disable tags in imds api
* aws: only tag instances with non-lecagy tag
* bootstrapper: always let coredns run before cilium
* debugd: make debugd less noisy
* fixup fix aws imds test
* fixup unsued context
* move getting instance id to readInstanceTag
2023-06-13 09:58:39 +02:00
Adrian Stobbe
4f63481b7d
config: fix fetcher parse azure sev-snp version ( #1911 )
2023-06-12 16:04:54 +02:00
Daniel Weiße
ab74730fd7
Update go-tpm-tools fork ( #1910 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-06-12 15:59:40 +02:00
Adrian Stobbe
e738f15f0f
cdbg: make endpoint deployment failure more transparent ( #1883 )
...
* add retry + timeout + intercept grpc logs
* LogStateChanges inside grplog pkg
* remove retry and tj/assert
* rename nit
* Update debugd/internal/cdbg/cmd/deploy.go
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
* Update debugd/internal/cdbg/cmd/deploy.go
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
* paul feedback
* return waitFn instead of WaitGroup
* Revert "return waitFn instead of WaitGroup"
This reverts commit 45700f30e341ce3af509b687febbc0125f7ddb38.
* log routine inside debugd constructor
* test doubles names
* Update debugd/internal/cdbg/cmd/deploy.go
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
* fix newDebugClient closeFn
---------
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-06-12 13:45:34 +02:00
renovate[bot]
167052d443
deps: update dependency hermetic_cc_toolchain to v2.0.0 ( #1860 )
...
* deps: update dependency hermetic_cc_toolchain to v2.0.0
* deps: tidy all modules
* bazel: target glibc 2.23 to enable rbe
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-06-09 17:39:30 +02:00
3u13r
b71b5103ae
ci: migrate e2e lb test to bazel ( #1892 )
...
* ci: migrate lb e2e test to bazel
* ci: disable shared bazel cache on github runners
2023-06-09 16:59:19 +02:00
Otto Bittner
8f21972aec
attestation: add awsSEVSNP as new variant ( #1900 )
...
* variant: move into internal/attestation
* attesation: move aws attesation into subfolder nitrotpm
* config: add aws-sev-snp variant
* cli: add tf option to enable AWS SNP
For now the implementations in aws/nitrotpm and aws/snp
are identical. They both contain the aws/nitrotpm impl.
A separate commit will add the actual attestation logic.
2023-06-09 15:41:02 +02:00
Thomas Tendyck
947d0cb20a
cli: hide --insecure of config fetch-measurements
2023-06-09 15:07:31 +02:00
Adrian Stobbe
3fde118b33
config: enable azure snp version fetcher again + minimum age for latest version ( #1899 )
...
* fetch latest version when older than 2 weeks
* extend hack upload tool to pass an upload date
* Revert "config: disable user-facing version Azure SEV SNP fetch for v2.8 (#1882 )"
This reverts commit c7b22d314a
2023-06-09 12:48:12 +02:00
Moritz Sanft
72e168e653
bazel: pseudo version tool freshness check ( #1869 )
...
* switch to darwin compatible shasum
* add bazel rule
* update shellscript for in-place updates
* Revert "update shellscript for in-place updates"
This reverts commit 87d39b06f7
2023-06-09 11:50:51 +02:00
Moritz Sanft
892752a1f8
add necessary permissions ( #1905 )
2023-06-09 11:50:39 +02:00
Moritz Eckert
9463d6fb27
cli: fix azure config warning message ( #1902 )
2023-06-09 11:16:54 +02:00
Otto Bittner
3a54ca91a7
deps: bump go patch version ( #1903 )
2023-06-09 10:53:17 +02:00
Adrian Stobbe
d9c604ed2c
terraform: update aws to v5.1.0 ( #1891 )
2023-06-09 10:37:25 +02:00
Adrian Stobbe
e0fe8e6ca0
local: fix mac issues in bazel ( #1893 )
2023-06-09 10:35:52 +02:00
renovate[bot]
7c345f4503
deps: update github.com/gophercloud/utils digest to de873b9 ( #1843 )
...
* deps: update github.com/gophercloud/utils digest to de873b9
* deps: tidy all modules
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
Co-authored-by: malt3 <mp@edgeless.systems>
2023-06-09 10:02:59 +02:00
Malte Poll
8c3617faf0
ci: do not manually clear measurements on verify e2e ( #1889 )
2023-06-09 09:25:30 +02:00
Otto Bittner
3e583946a1
rfc: specify how to handle launchmeasurements ( #1894 )
...
* Describes how to keep the values in the API up-to-date.
* Describes API object structure.
* Describe user config options.
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2023-06-09 08:45:27 +02:00
Malte Poll
17b583ddc5
misc: start v2.9.0-pre ( #1895 )
2023-06-08 15:31:47 +02:00
Adrian Stobbe
e9f9337cb9
Revert "ci: fix versionsapi cli container Dockerfile ( #1856 )" ( #1896 )
...
This reverts commit 0fac6a03cc
2023-06-07 17:18:59 +02:00
Adrian Stobbe
4284f892ce
api: rename /api/versions to versionsapi and /api/attestationcfig to attestationconfigapi ( #1876 )
...
* rename to attestationconfigapi + put client and fetcher inside pkg
* rename api/version to versionsapi and put fetcher + client inside pkg
* rename AttestationConfigAPIFetcher to Fetcher
2023-06-07 16:16:32 +02:00
renovate[bot]
25037026e1
deps: update Python dependencies ( #1887 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-06-07 10:36:52 +02:00
edgelessci
f43366ed89
docs: add release v2.8.0 ( #1884 )
...
* docs: add release v2.8.0
* docs: mention required AWS IAM permissions for upgrades
---------
Co-authored-by: malt3 <malt3@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-06-07 10:34:07 +02:00
Adrian Stobbe
51d66b2609
doc: vs code linter issue ( #1880 )
2023-06-07 10:32:06 +02:00
3u13r
3ad9258a57
deps: bump ginkgo version ( #1885 )
2023-06-06 18:15:48 +02:00
renovate[bot]
6f7c8999f3
deps: update dependency cryptography to v41 [SECURITY] ( #1875 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-06-06 18:15:26 +02:00
Malte Poll
b3c052e299
operators: cleanup placeholder nodeversion ( #1881 )
...
* operators: cleanup placeholder nodeversion
* e2e: improve upgrade test portability
2023-06-06 15:22:06 +02:00
Malte Poll
025d34a259
ci: fix docker-login on macOS runner ( #1877 )
2023-06-06 12:20:09 +02:00
Adrian Stobbe
c7b22d314a
config: disable user-facing version Azure SEV SNP fetch for v2.8 ( #1882 )
...
* config: disable user-facing version fetch for Azure SEV SNP
don't allow "latest" value and disable user-facing version fetcher for Azure SEV SNP
Co-authored-by: @derpsteb
* fix unittests
* attestation: getTrustedKey
---------
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-06-06 10:44:13 +02:00
3u13r
7c07e3be18
Add --insecure to config fetch-measurement ( #1879 )
...
* cli: add --insecure to fetch-measurements
* cli: rename fake to stub
* ci: upload measurements for debug images
* fix cli docs
2023-06-06 10:32:22 +02:00
Malte Poll
f7f11c32f8
image: choose unique AWS image names based on the attestation variant ( #1868 )
2023-06-06 08:35:26 +02:00
Adrian Stobbe
99a88c033c
api: use new signature JSON format ( #1872 )
...
* use new impl for client.UploadAzureSEVSNP
* fix: fetcher must parse new signature format
* version-file is not persistentflag
* fix fetcher tests
2023-06-05 16:10:44 +02:00
Otto Bittner
fa01569cc6
staticupload: don't request empty invalidation ( #1870 )
...
If no files have been touched, do not initiate an invalidation.
2023-06-05 15:47:33 +02:00
Otto Bittner
06cd750345
config: move all config types into file config.go ( #1878 )
...
docgen only includes doc comments from one single file in
it's output. Therefore all config types need to be located in config.go
2023-06-05 15:46:55 +02:00
Malte Poll
439359ffbc
cli: prevent terraform apply drift when patching and re-applying existing terraform deployment ( #1873 )
...
The implementation would recreate the gcp instance template (including all instances and state disks) whenever the image tfvar changes.
Fixed by ignoring lifecycle changes on the instance templates.
Fixes 8c3b963
2023-06-05 14:52:39 +02:00
Malte Poll
900d51d49f
ci: select correct target version for upgrade e2e test in release pipeline ( #1874 )
2023-06-05 13:56:16 +02:00
Adrian Stobbe
c446f36b0f
config: Azure SNP tool can delete specific version from attestation API ( #1863 )
...
* client supports delete version
* rename to new attestation / fetcher naming
* add delete command to upload tool
* test client delete
* bazel update
* use general client in attestation client
* Update hack/configapi/cmd/delete.go
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
* daniel feedback
* unit test azure sev upload
* Update hack/configapi/cmd/delete.go
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
* add client integration test
* new client cmds use apiObject
---------
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-06-05 12:33:22 +02:00
Otto Bittner
315b6c2f01
api: use correct error types in versions/cli ( #1867 )
...
Imported wrong error types during refactoring.
2023-06-05 10:51:05 +02:00
Otto Bittner
6bda62d397
cli: skip k8s upgrade in case of outdated version ( #1864 )
...
If an unsupported, outdated k8s patch version is used,
the user should still be able to run upgrade apply.
2023-06-05 09:13:02 +02:00
Malte Poll
eb9bea1cff
docs: refine instructions for upgrade process ( #1865 )
...
Incorporate customer feedback regarding the recommended commands when upgrading a Constellation cluster.
Showing the full command "constellation upgrade check --write-config" is important to ensure only valid, safe upgrades are applied.
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-06-05 09:10:20 +02:00
Otto Bittner
620bb45330
e2e: asynchronously check constellation status ( #1780 )
...
status may fail early on, if the control plane starts upgrading quickly
and becomes unavailable.
In that case we will have to retry a few times.
2023-06-05 08:15:17 +02:00
Malte Poll
7c34aef263
cli: write target k8s version to config if new version is found on upgrade check ( #1862 )
2023-06-02 17:19:41 +02:00
edgelessci
b2527d314e
image: update measurements and image version ( #1861 )
...
Co-authored-by: malt3 <malt3@users.noreply.github.com>
2023-06-02 16:06:34 +02:00
Adrian Stobbe
a813760f96
config: automatically upload new Azure SNP versions to API + sign version with release key ( #1854 )
...
* sign version with release key and remove version from fetcher interface
* extend azure-reporter GH action to upload updated version values to the Attestation API
2023-06-02 12:10:22 +02:00
renovate[bot]
18da9b8128
deps: update dependency com_github_bazelbuild_buildtools to v4.2.5 ( #1858 )
...
* deps: update dependency com_github_bazelbuild_buildtools to v4.2.5
* deps: tidy all modules
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
Co-authored-by: malt3 <mp@edgeless.systems>
2023-06-02 11:56:14 +02:00
Otto Bittner
0fac6a03cc
ci: fix versionsapi cli container Dockerfile ( #1856 )
...
paths were not updated during refactoring
2023-06-02 11:29:46 +02:00
renovate[bot]
a31c3dbbcd
deps: update ubuntu:22.04 Docker digest to 2fdb1cf ( #1857 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: malt3 <mp@edgeless.systems>
2023-06-02 11:20:59 +02:00
Malte Poll
e1d3afe8d4
ci: use aws s3 client that invalidates cloudfront cache for places that modify Constellation api ( #1839 )
2023-06-02 11:20:01 +02:00
renovate[bot]
93569ff54c
deps: update golang.org/x/exp digest to 2e198f4 ( #1844 )
...
* deps: update golang.org/x/exp digest to 2e198f4
* deps: tidy all modules
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
Co-authored-by: malt3 <mp@edgeless.systems>
2023-06-02 11:03:33 +02:00
Moritz Sanft
8c3b963a3f
cli: Terraform upgrades maa patching ( #1821 )
...
* patch maa after upgrade
* buildfiles
* reword comment
* remove whitespace
* temp: log measurements URL
* temp: update import
* ignore changes to attestation policies
* add issue URL
* separate output in e2e upgrade test
* use enterprise CLI for e2e test
* remove measurements print
* add license headers
2023-06-02 10:47:44 +02:00
