943 Commits

Author SHA1 Message Date
miampf
f8f2490011
remove dot 2025-01-30 12:21:09 +01:00
miampf
8577d23e5c
use cobra.Command 2025-01-30 12:21:08 +01:00
miampf
21c9cd6a26
implement small changes 2025-01-30 12:21:08 +01:00
miampf
19181af13d
implemented suggestions 2025-01-30 12:21:07 +01:00
miampf
ea94ebd236
check return value of fh.Write in ssh_test.go 2025-01-30 12:21:07 +01:00
miampf
b5fddcd254
wrote test for ssh subcommand 2025-01-30 12:21:07 +01:00
miampf
bee3f6c159
added test for CA generation + use SeedSize constant
Previously, I just hard coded 256 as the key length that seeds the key
generation since it worked. Now, it uses ed25519.SeedSize (32) instead.
2025-01-30 12:21:07 +01:00
miampf
0be301fa3a
please CI 2025-01-30 12:21:06 +01:00
miampf
241d0cd88d
refactoring 2025-01-30 12:21:06 +01:00
miampf
9363206662
use suffix for emergency ssh DEK key 2025-01-30 12:21:05 +01:00
miampf
2a7408bc16
check if directory constellation-terraform exists 2025-01-30 12:21:04 +01:00
miampf
52792e2cde
use existing MasterSecret type + fix autoformatting 2025-01-30 12:21:04 +01:00
miampf
53b84d8398
add sensible error messages to CLI 2025-01-30 12:21:04 +01:00
miampf
5a357eb454
added clarifying comment in ssh command code 2025-01-30 12:21:04 +01:00
miampf
53a9af82e0
adjusted client side key derivation 2025-01-30 12:21:03 +01:00
miampf
1850d4b327
add ssh subcommand 2025-01-30 12:21:02 +01:00
3u13r
2cd5b05b51
cli: also log applier debug messages to debug log file (#3457)
* cli: also log applier debug messages to debug log file

* cli: use debug logger instead of cliLogger
2024-10-24 15:00:51 +02:00
Markus Rudy
dd1763a36d
helm: manage CoreDNS addon as Helm chart (#3388)
* Reapply "helm: manage CoreDNS addon as Helm chart (#3236)"

This reverts commit 4a9422d288ef42f5ebf0dd878dc9aff26ed082dd.

* Reapply "helm: fix kubeadm bugs caused by CoreDNS installation (#3353)"

This reverts commit 9ecfc3fa19780b8b4972872b0a505d377ec70601.
2024-10-07 10:51:37 +02:00
Markus Rudy
850b460002
helm: revert parts of CoreDNS Helm chart packaging (#3366)
* Revert "helm: fix kubeadm bugs caused by CoreDNS installation (#3353)"

This reverts commit 8ef5ea2efe48f44bc5cbdacc5bcd15511cc7440a.

* Revert "helm: manage CoreDNS addon as Helm chart (#3236)"

This reverts commit 97c77e2a78793a5519da7712ea87ef1475f7dc0c.

* upgrade-agent: ignore CoreDNS preflight errors
2024-09-19 10:55:21 +02:00
renovate[bot]
a295ecaffb
cli: add --subscriptionID flag for iam create azure command (#3328)
* deps: update Terraform azurerm to v4
* Set Azure subscription ID when applying Terraform files
* Upgrade azurerm to v4.1.0
* Mark subscriptionID flag as not required
* deps: tidy all modules

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
2024-09-17 12:30:22 +02:00
Markus Rudy
8ef5ea2efe
helm: fix kubeadm bugs caused by CoreDNS installation (#3353)
* helm: rename CoreDNS configmap

* upgrade-agent: ignore CoreDNS preflight errors

* fixup! helm: rename CoreDNS configmap
2024-09-13 09:47:33 +02:00
Thomas Tendyck
399376d3e3
Make SEV-SNP the default attestation variant on GCP (#3267)
* Make SNP the default on GCP

* fixup! Make SNP

* fixup! Make SNP
2024-07-22 13:29:27 +02:00
Markus Rudy
97c77e2a78 helm: manage CoreDNS addon as Helm chart (#3236)
* helm: generate CoreDNS Helm chart
* helm: load CoreDNS Helm chart
* bootstrapper: don't install coredns addon
2024-07-12 12:01:49 +02:00
Markus Rudy
807bbbfd16 cli: annotate CoreDNS resources for Helm (#3236) 2024-07-12 12:01:49 +02:00
Daniel Weiße
d67d0ac9df Enable upload of TDX reports to Constellation CDN
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-27 09:09:13 +02:00
Daniel Weiße
a34493caa6 Enable versions API to handle TDX versions
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-27 09:09:13 +02:00
Daniel Weiße
cd4c90af7e Rename apifetcher methods
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-27 09:09:13 +02:00
Daniel Weiße
09d19fec22
cli: fix constellation verify depending on an initialized constellation-state.yaml file (#3184)
* Ignore missing state file if flags are provided
* Update verify docs to include requirement for config file

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-21 10:09:01 +02:00
renovate[bot]
e71819eb62
deps: update Go dependencies (#3185)
* deps: update Go dependencies
* deps: tidy all modules
* Replace deprecated `grpc.DialContext` with `grpc.NewClient`

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
2024-06-21 10:05:57 +02:00
Daniel Weiße
9d99d05826
cli: fix unmarshalling of sev-snp attestation documents in constellation verify (#3171)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-17 13:38:59 +02:00
Daniel Weiße
daaa7755a7
cli: enable JSON output for constellation verify on Azure TDX (#3164)
* Remove formatter factory
* Enable `constellation verify` with JSON output for Azure TDX

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-06-12 13:18:27 +02:00
Malte Poll
d960121cba bazel: update BUILD files for rules_go bzlmod migration 2024-05-23 09:48:04 +02:00
Daniel Weiße
9def35ed06
deps: update all Go dependencies (#3071)
* Upgrade Go dependencies

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Group Go dependency upgrades

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Remove usage of deprecated docker types

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Fix usage of invalid validation tags

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Regenerate bazel files

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

* Keep github.com/bazelbuild/buildtools at old version to not break other dependencies

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2024-05-08 17:31:47 +02:00
miampf
b187966581
cli: allow tagging cloud resources with custom tags (#3033) 2024-04-19 09:07:57 +00:00
Moritz Sanft
913b09aeb8
Support SEV-SNP on GCP (#3011)
* terraform: enable creation of SEV-SNP VMs on GCP

* variant: add SEV-SNP attestation variant

* config: add SEV-SNP config options for GCP

* measurements: add GCP SEV-SNP measurements

* gcp: separate package for SEV-ES

* attestation: add GCP SEV-SNP attestation logic

* gcp: factor out common logic

* choose: add GCP SEV-SNP

* cli: add TF variable passthrough for GCP SEV-SNP variables

* cli: support GCP SEV-SNP for `constellation verify`

* Adjust usage of GCP SEV-SNP throughout codebase

* ci: add GCP SEV-SNP

* terraform-provider: support GCP SEV-SNP

* docs: add GCP SEV-SNP reference

* linter fixes

* gcp: only run test with TPM simulator

* gcp: remove nonsense test

* Update cli/internal/cmd/verify.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update docs/docs/overview/clouds.md

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update terraform-provider-constellation/internal/provider/attestation_data_source_test.go

Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>

* linter fixes

* terraform_provider: correctly pass down CC technology

* config: mark attestationconfigapi as unimplemented

* gcp: fix comments and typos

* snp: use nonce and PK hash in SNP report

* snp: ensure we never use ARK supplied by Issuer (#3025)

* Make sure SNP ARK is always loaded from config, or fetched from AMD KDS
* GCP: Set validator `reportData` correctly

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* attestationconfigapi: add GCP to uploading

* snp: use correct cert

Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>

* terraform-provider: enable fetching of attestation config values for GCP SEV-SNP

* linter fixes

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
2024-04-16 18:13:47 +02:00
miampf
840f460bac
logging: unify debug log message format (#2997) 2024-04-03 13:49:03 +00:00
Malte Poll
c23f17de41 openstack: read credentials from clouds.yaml 2024-03-11 15:59:23 +01:00
Malte Poll
d69673fab7 terraform-provider: Add support for STACKIT / OpenStack 2024-03-11 15:59:23 +01:00
Malte Poll
8b41bcaecc cli: correct measurements in config generate stackit 2024-03-04 18:17:26 +01:00
Malte Poll
f94c6ca0d4 misc: skip message about community license with marketplace image 2024-03-04 18:17:26 +01:00
Malte Poll
1c8a7e4c22 cli: add STACKIT to constellation config instance-types 2024-03-04 18:17:26 +01:00
3u13r
2a61861a1c
stackit: add k8s api load balancer (#2925) 2024-02-22 17:39:34 +01:00
Malte Poll
1e987f6a85 terraform: add subnet for OpenStack LBs 2024-02-22 12:43:04 +01:00
Malte Poll
ffdf23e3f2 libvirt: replace use of deprecated types 2024-02-21 18:40:16 +01:00
Malte Poll
65903459a0 chore: fix unused parameter lint in new golangcilint version 2024-02-21 17:54:07 +01:00
miampf
96c5980651
cli: collect debug logs in file (#2906) 2024-02-21 15:39:12 +00:00
Malte Poll
6f9020d527 cli: use pre-uploaded image on OpenStack
Before, the terraform infrastructure code would upload an image on the fly.
Now, we upload images in advance and specify the image ID instead.
2024-02-19 18:16:45 +01:00
Malte Poll
b5e848a87e terraform: provide required configuration for yawol on OpenStack 2024-02-12 13:13:48 +01:00
Malte Poll
dba835bdf4
openstack: prepare for normal users (#2899)
* image: disable serial console autologin on OpenStack
* cli: remove requirement for CONSTELLATION_OPENSTACK_DEV env var
2024-02-09 14:48:41 +01:00
miampf
54cce77bab
deps: convert zap to slog (#2825) 2024-02-08 14:20:01 +00:00