Nils Hanke
a34ef8ad29
cli/bootstrapper: remove deprecated master secret & KMS related fields
2023-03-02 15:49:02 +01:00
Daniel Weiße
5eb73706f5
internal: refactor storage credentials ( #1071 )
...
* Move storage clients to separate packages
* Allow setting of client credentials for AWS S3
* Use managed identity client secret or default credentials for Azure Blob Storage
* Use credentials file to authorize GCS client
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-03-02 15:08:31 +01:00
Malte Poll
ab0b881cbf
oid: add alternative string representations for attestation variants ( #1322 )
2023-03-02 10:48:16 +01:00
Nils Hanke
c9ddc93d55
cli: allow existing config for IAM creation without --generate-config
2023-03-01 13:53:34 +01:00
Malte Poll
fc33a74c78
constants: make VersionInfo readonly ( #1316 )
...
The variable VersionInfo is supposed to be set by `go build -X ...` during link time but should not be modified at runtime.
This change ensures the underlying var is private and can only be accessed by a public getter.
2023-03-01 11:55:12 +01:00
Malte Poll
4e202fa483
cli: set constellation uid and role as instance metadata of OpenStack instances ( #1311 )
2023-03-01 08:48:17 +01:00
Otto Bittner
984f0589d2
cli: upgrade errors for microservice ( #1259 )
...
Handle invalid upgrade errors similarly as for images and k8s.
2023-02-28 10:23:09 +01:00
Moritz Sanft
732d15d013
ci: use iam destroy command for resource destruction ( #1272 )
...
* replace tf destruction with new command
* move iam destroy cmd
* fix typos
* exit post test on error
* [remove] test failure on iam destroy
* Revert "[remove] test failure on iam destroy"
This reverts commit 99449c0cc099c45bbc54
2023-02-28 09:52:32 +01:00
Malte Poll
b79f7d0c8c
cli: add basic support for constellation create on OpenStack ( #1283 )
...
* image: support OpenStack image build / upload
* cli: add OpenStack terraform template
* config: add OpenStack as CSP
* versionsapi: add OpenStack as CSP
* cli: add OpenStack as provider for `config generate` and `create`
* disk-mapper: add basic support for boot on OpenStack
* debugd: add placeholder for OpenStack
* image: fix config file sourcing for image upload
2023-02-27 18:19:52 +01:00
Otto Bittner
08ee56911b
cli: overwrite chart versions during install/upgrade
...
* As charts receive information like the container image from
the cli it makes sense to also version the charts based on the cli
version.
* The pseudoversion is recalculated when running cmake.
* When merging changes from release branch to main,
a new commit is introduced to set the PROJECT_VERSION back
to 0.0.0, so that builds include a pseudoversion.
2023-02-27 16:06:35 +01:00
renovate[bot]
83bea18a4f
deps: update fedora:37 Docker digest ( #1274 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-24 17:46:17 +01:00
renovate[bot]
66022fa441
deps: update Terraform aws to v4.55.0 ( #1195 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-24 17:27:11 +01:00
Nils Hanke
6ae2bc9772
cli: fix force flag debug print in init
2023-02-24 12:11:09 +01:00
miampf
5137e9fa57
cli: iam destroy ( #946 )
2023-02-24 11:36:41 +01:00
Otto Bittner
c4fd70684f
Revert "deps: update Terraform azurerm to v3.44.1 ( #1197 )" ( #1255 )
...
This reverts commit 253f833f6c
2023-02-22 11:16:05 +01:00
Otto Bittner
d78d22f95a
cli: add config kubernetes-versions subcommand ( #1224 )
...
Allows users to learn which k8s versions are supported by the
current CLI.
Extend respective docs section.
2023-02-22 09:52:47 +01:00
3u13r
ce09b9dae5
iam: assign uami role to base resource group ( #1247 )
...
* iam: assign uami role to base resource group
* fixup: also change app registration
2023-02-22 09:29:24 +01:00
leongross
51eef675a2
cli: refer to --force and --config flags ( #1205 )
...
* add reference to --config and --force
2023-02-21 16:46:47 +01:00
Otto Bittner
da7a870f54
cli: add --kubernetes flag ( #1226 )
...
The flag can be used to specify a Kubernetes version
in format MAJOR.MINOR and let the CLI extend the
value with the patch version.
2023-02-21 14:05:41 +01:00
renovate[bot]
477d667360
deps: update Terraform azuread to v2.34.1 ( #1196 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-21 13:53:18 +01:00
Moritz Sanft
0ba810240f
ci: integrate automatic iam creation in e2e test ( #1158 )
...
* integrate automatic iam creation in e2e test
* fix typo
* break long line comments
* fix semvers
* correct bracing
2023-02-21 12:47:14 +01:00
renovate[bot]
253f833f6c
deps: update Terraform azurerm to v3.44.1 ( #1197 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-21 10:41:04 +01:00
renovate[bot]
3a1e75837f
deps: update Terraform google-beta to v4.53.1 ( #1199 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-21 09:22:16 +01:00
renovate[bot]
9a5a7d6852
deps: update Terraform google to v4.53.1 ( #1198 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-21 09:21:12 +01:00
Paul Meyer
deea806d9c
Improve code sequences with multiple errs
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Paul Meyer
12c866bcb9
deps: replace multierr with native errors.Join
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-20 12:08:24 -05:00
Otto Bittner
87fdb47caa
cli: upgrade apply uses correct measurements key ( #1223 )
...
Apply still used the obsolete upgrade key's measurements.
The new, desired behavior is to use the Provider's measurements
key
2023-02-20 10:32:33 +01:00
Daniel Weiße
d90828cb3c
Fix incorrect output for single worker/control-plane clusters ( #1209 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-17 08:15:17 +01:00
Fabian Kammel
5e7dc0d7db
Option to disable spinner via environment variable. ( #1207 )
...
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2023-02-16 15:43:19 +01:00
Otto Bittner
50646b2a10
cli: refactor upgrade apply cmd to match name
...
* `upgrade apply` will try to make the locally configured and
actual version in the cluster match by appling necessary
upgrades.
* Skip image or kubernetes upgrades if one is already
in progress.
* Skip downgrades/equal-as-running versions
* Move NodeVersionResourceName constant from operators
to internal as its needed in the CLI.
2023-02-15 16:44:47 +01:00
Otto Bittner
7db584a88e
cli: move upgradeApply logic into separate functions
...
* introduce handleImageUpgrade & handleServiceUpgrade
* rename cloudUpgrader.Upgrade to UpgradeImage
* remove helm flag
* remove hint about development status
2023-02-15 16:44:47 +01:00
Otto Bittner
91e27ac186
cli: rename upgrade execute to upgrade apply
2023-02-15 16:44:47 +01:00
Moritz Sanft
84359063fc
cli: add missing gcp values to config ( #1149 )
...
* improve iam value output
* remove duplicate prints
2023-02-15 14:24:52 +01:00
Otto Bittner
33a884d4e4
cli: prefix "v" to cli version in versionCollector
...
No new images will be found unless this is set
2023-02-15 13:36:16 +01:00
renovate[bot]
1732795345
deps: update fedora:37 Docker digest ( #1192 )
...
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-02-15 13:28:53 +01:00
Otto Bittner
7454b69f13
cli: helm: prepare values for upgrade correctly
...
Previously the chart's values were not set, relying on the
values that are already present in the cluster and reusing
those. This does not work as e.g. the image values
are only set while loading the charts. Also, the templates
are not rendered correctly without all values set.
2023-02-15 11:41:54 +01:00
Otto Bittner
4855b20093
cli: helm: move csp into ChartLoader object
2023-02-15 11:41:54 +01:00
Otto Bittner
1728633646
cli: helm: separate user input from static loading
...
Because values in the charts might change in the future and
some values (like the image) are part of a valid upgrade we
need to load all values for an upgrade.
However, during upgrades we don't want to reapply user
input like the masterSecret. Therefore this patch splits the
application of user input and the static loading of chart values.
2023-02-15 11:41:54 +01:00
Otto Bittner
1c977b3105
cli: add missing logger to versionCollector object ( #1183 )
...
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-02-14 14:46:30 +01:00
Paul Meyer
84a787b538
cli: add name of build type to version cmd output ( #1179 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-02-14 14:30:10 +01:00
Otto Bittner
8a72df89ad
cli: fix init with k8s version without v prefix ( #1174 )
2023-02-13 11:54:38 +01:00
Moritz Sanft
7410cf8038
cli: fix iam rollback ( #1148 )
...
* AB#2897 rename DestroyCluster
* #AB2897 error if terraform dir exists
* AB#2897 reword DestroyResources
2023-02-13 08:42:54 +01:00
Thomas Tendyck
a076587956
cli: adapt "upgrade check" reference to conventions
2023-02-13 08:34:34 +01:00
Daniel Weiße
90ce320bf5
cli: add option to automatically merge kubeconfig file on init ( #1136 )
...
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-10 14:59:44 +01:00
Daniel Weiße
c29107f5be
init: create kubeconfig file with unique user/cluster name ( #1133 )
...
* Generate kubeconfig with unique name
* Move create name flag to config
* Add name validation to config
* Move name flag in e2e tests to config generation
* Remove name flag from create
* Update ascii cinema flow
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-10 13:27:22 +01:00
Moritz Sanft
e01ddc08c2
cli: add debug logging to iam create command ( #1127 )
...
* AB#2787 add debug logging to iam create command
* AB#2787 add test logger
* AB#2787 reword log
* separate debug output with empty line
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
---------
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
2023-02-09 10:37:22 +01:00
Otto Bittner
c275464634
cli: change upgrade-plan to upgrade-check
...
Upgrade check is used to find updates for the current cluster.
Optionally the found upgrades can be persisted to the config
for consumption by the upgrade-execute cmd.
The old `upgrade execute` in this commit does not work with
the new `upgrade plan`.
The current versions are read from the cluster.
Supported versions are read from the cli and the versionsapi.
Adds a new config field MicroserviceVersion that will be used
by `upgrade execute` to update the service versions.
The field is optional until 2.7
A deprecation warning for the upgrade key is printed during
config validation.
Kubernetes versions now specify the patch version to make it
explicit for users if an upgrade changes the k8s version.
2023-02-08 12:30:01 +01:00
Otto Bittner
f204c24174
cli: add version validation and force flag
...
Version validation checks that the configured versions
are not more than one minor version below the CLI's version.
The validation can be disabled using --force.
This is necessary for now during development as the CLI
does not have a prerelease version, as our images do.
2023-02-08 12:30:01 +01:00
Nils Hanke
0331e2dc78
cli: enable jumbo frames for GCP VPCs
2023-02-06 11:07:45 +01:00
Daniel Weiße
f74f589605
ci: add containerized libvirt build workflow ( #1130 )
...
* Add libvirt container build workflow
* Update release workflow
* Update image libvirt base image
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-02-02 14:40:05 +01:00
Moritz Sanft
6166b52f5d
cli: refactor iam create command ( #1034 )
...
* AB#2788 refactor iam create
* AB#2788 go mod tidy
* AB#2788 encode b64 at runtime
* AB#2788 rename receiver
2023-02-01 11:32:01 +01:00
Otto Bittner
3038b374da
cli: update helm chart render expectations
...
testdata is now expecting the charts to render for ko images.
2023-01-31 11:36:49 +01:00
Otto Bittner
9fc88797d1
cli: use /manager as binary path
...
The change to /ko-app/v2 is incorrect as we are
currently not building ko images for this operator.
2023-01-31 10:35:26 +01:00
leongross
2187aa6cb0
ci: reproducible builds integration ( #1108 )
...
* remove `-ko` suffix from workflows
* integrate into `release.yaml`
* adjust helm charts to use hard coded `ko` binary path
2023-01-30 16:58:49 +01:00
renovate[bot]
a85ba96ac4
deps: update Terraform azurerm to v3.41.0 ( #1097 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 16:33:32 +01:00
renovate[bot]
38e9ab8254
deps: update Terraform aws to v4.52.0 ( #1096 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 16:14:17 +01:00
renovate[bot]
b47a2f81a2
deps: update Terraform google to v4.50.0 ( #1098 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-27 16:13:44 +01:00
3u13r
6ea6e42519
terraform: make control-planes stateful on gcp ( #1087 )
...
* terraform: make control-planes stateful on gcp
* terraform: lock google-beta provider
2023-01-27 12:59:25 +01:00
Malte Poll
2d326ea3f0
cli: set placeholder uid for QEMU / MiniConstellation ( #1069 )
2023-01-25 14:42:52 +01:00
3u13r
e6ac8e2a91
config: fix digest naming ( #1064 )
...
* config: fix digest naming
2023-01-24 22:20:10 +01:00
github-actions[bot]
9567cc09ce
release: bring back changes from v2.5.0 ( #1061 )
...
* deps: update version to v2.5.0
* attestation: hardcode measurements for v2.5.0
* bump operator versions
Co-authored-by: release[bot] <release[bot]@users.noreply.github.com>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
2023-01-24 11:35:26 +01:00
3u13r
03154c6e64
docs: document terraform support ( #1037 )
2023-01-23 10:37:28 +01:00
Moritz Sanft
2f2e793810
AB#2834 add go package doc to iamid ( #1054 )
2023-01-23 08:53:25 +01:00
Moritz Sanft
b8648261e3
cli: fix Terraform resource group dependencies ( #1048 )
2023-01-20 18:59:59 +01:00
Paul Meyer
a8cbfd848f
keyservice: use dash in container name ( #1016 )
...
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-01-20 18:51:06 +01:00
renovate[bot]
d4722b434e
Update Terraform aws to v4.50.0 ( #1015 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-19 17:09:01 +01:00
Daniel Weiße
690b50b29d
dev-docs: Go package docs ( #958 )
...
* Remove unused package
* Add Go package docs to most packages
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Fabian Kammel <fk@edgeless.systems>
2023-01-19 15:57:50 +01:00
Otto Bittner
9a1f52e94e
Refactor init/recovery to use kms URI
...
So far the masterSecret was sent to the initial bootstrapper
on init/recovery. With this commit this information is encoded
in the kmsURI that is sent during init.
For recover, the communication with the recoveryserver is
changed. Before a streaming gRPC call was used to
exchanges UUID for measurementSecret and state disk key.
Now a standard gRPC is made that includes the same kmsURI &
storageURI that are sent during init.
2023-01-19 13:14:55 +01:00
Otto Bittner
0e71322e2e
keyservice: move kms code to internal/kms
...
Recovery (disk-mapper) and init (bootstrapper)
will have to work with multiple external KMSes
in the future.
2023-01-19 13:14:55 +01:00
Moritz Sanft
ae2db08f3a
ci: add e2e test for constellation recover ( #845 )
...
* AB#2256 Add recover e2e test
* AB#2256 move test & fix minor objections
* AB#2256 fix path
* AB#2256 rename hacky filename
2023-01-19 10:41:07 +01:00
3u13r
632090c21b
azure: allow a set of idkeydigest values ( #991 )
2023-01-18 16:49:55 +01:00
Nils Hanke
a3db3c8424
cli: debug: various improvements ( #995 )
2023-01-18 13:10:24 +01:00
Thomas Tendyck
f0f109a1ea
verify: use fixed user data
2023-01-17 16:14:00 +01:00
renovate[bot]
4577a5886f
Update Terraform google to v4.48.0 ( #929 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-17 16:01:02 +01:00
Moritz Sanft
e844ceb2b1
cli: adopt Cobra cli reference style ( #997 )
...
* adapt to Cobra CLI ref style
* linting
* change multi-line reference style
* lowercase short descriptions
* Revert "lowercase short descriptions"
This reverts commit 499dc3577a
2023-01-17 14:01:56 +01:00
Malte Poll
7902dc470f
cli: use non-authoritative methods to manage iam policy memberships ( #989 )
...
- google_project_iam_binding -> google_project_iam_member
2023-01-16 18:08:57 +01:00
Otto Bittner
90b88e1cf9
kms: rename kms to keyservice
...
In the light of extending our eKMS support it will be helpful
to have a tighter use of the word "KMS".
KMS should refer to the actual component that manages keys.
The keyservice, also called KMS in the constellation code,
does not manage keys itself. It talks to a KMS backend,
which in turn does the actual key management.
2023-01-16 11:56:34 +01:00
Malte Poll
7bf7286242
cli: include search paths for image info json in error message printed to user ( #963 )
2023-01-13 10:15:49 +01:00
Nils Hanke
b3c3c2fa8c
qemu: remove registry_auth for Docker Terraform module ( #957 )
2023-01-12 15:47:50 +01:00
Moritz Sanft
64ec0408da
cli: automatically add iam values to config ( #782 )
...
* AB#2706 Automatically add IAM values to config
2023-01-12 11:35:26 +01:00
Fabian Kammel
82a0fcbb9d
upgrade: fix broken reference from constellation-os to constellation-version ( #939 )
...
* update constellation-os to constellation-version references
* update nodeimage to nodeversion in CRD type name
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-01-11 16:07:07 +01:00
release[bot]
e8fad4b7f9
Update version to v2.4.0
2023-01-11 11:10:44 +01:00
Leonard Cohnen
2700d5182b
operator: reconcile kubernetesClusterVersion
2023-01-09 12:16:54 +01:00
Paul Meyer
fa85150f3e
hack: move terraform readmes into cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-09 11:49:00 +01:00
renovate[bot]
3d6b11e7cb
Update Terraform azurerm to v3.38.0 ( #895 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 16:28:04 +01:00
renovate[bot]
19b3d68c8a
Update Terraform aws to v4.49.0 ( #894 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 16:27:40 +01:00
renovate[bot]
ab626ca311
Update Terraform docker to v2.25.0 ( #880 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 15:18:38 +01:00
Paul Meyer
66f2c446a4
versionsapi: replace shortname pkg
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-06 10:15:27 +01:00
Otto Bittner
075a0e0ad6
cli: ask user to confirm cert-manager upgrades
2023-01-05 17:19:05 +01:00
Otto Bittner
e7c7e35f51
cli: create backups for CRDs and their resources
...
These backups could be used in case an upgrade
misbehaves after helm declared it as successful.
The manual backups are required as helm-rollback
won't touch custom resources and changes to CRDs
delete resources of the old version.
2023-01-05 16:52:06 +01:00
Leonard Cohnen
620436626b
operator: add cluster version to nodeversion
2023-01-05 14:52:09 +01:00
Leonard Cohnen
9bfe2a81ed
cli: fix nodeversion crd name
2023-01-05 14:52:09 +01:00
Leonard Cohnen
25c3a8a1f3
init: add cluster version to kubernetes components
2023-01-05 14:52:09 +01:00
Paul Meyer
f9458950cb
versionsapi: change image path ( #856 )
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 17:07:16 +01:00
Paul Meyer
35d720e657
cli: deactivate spinner for debug logging
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 12:17:08 +01:00
Paul Meyer
3c24e3fa01
cli: move image package into cli
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
22f43d32dd
versionsapi: use new fetcher in upgrade-plan cmd
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Paul Meyer
f43b653231
versionsapi: backup old API
...
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-04 11:39:19 +01:00
Alex Darby
97c72f5f32
cli: add verbose debug logging ( #809 )
...
* feat: add debug logging for init command
* feat: add debug logging to recover command
* feat: add debug logging for configfetchmeasurements
* feat: add debug logging for config generate
* feat: added debug logging for miniup command
* feat: add debug logging for upgrade command
* feat: add debug logging for create command
2023-01-04 10:46:29 +01:00
renovate[bot]
7c017e2b67
Update Terraform azurerm to v3.37.0 ( #849 )
...
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-01-03 14:47:44 +01:00
