Commit Graph

3085 Commits

Author SHA1 Message Date
Paul Meyer
2d3999440d bazel: use cache path to execute cli
This way it also works within the bazel container, where the symlinks
that are created won't work, as they are linking to host paths.

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-07-25 11:44:23 +02:00
Paul Meyer
3796122cdb bazel: check for docker config at container start
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-07-25 11:44:23 +02:00
Adrian Stobbe
04dc6256e6
cli: only install aws-lb and csi charts conditionally (#2131)
* init

* upgrade csi chart conditionally
2023-07-25 10:54:47 +02:00
Daniel Weiße
7152633255
bootstrapper: refactor coredns and cilium setup (#2129)
* Decouple CoreDNS installation from Cilium

* Align cilium helm installation with other charts

* Remove unused functions
---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-25 09:57:35 +02:00
Adrian Stobbe
39cea48741
aws: fix get version error (#2127)
* init

* only add awsLB to versions if installed
2023-07-24 14:25:11 +02:00
Adrian Stobbe
92abb890ef
upgrade: retry when node image update fails due to conflict error (#2123)
* retry when node image update fails due to conflict error

* improve test
2023-07-24 12:15:11 +02:00
Adrian Stobbe
a87b7894db
aws: use new LB controller to fix SecurityGroup cleanup on K8s service deletion (#2090)
* add current chart

add current helm chart

* disable service controller for aws ccm

* add new iam roles

* doc AWS internet LB + add to LB test

* pass clusterName to helm for AWS LB

* fix update-aws-lb chart to also include .helmignore

* move chart outside services

* working state

* add subnet tags for AWS subnet discovery

* fix .helmignore load rule with file in subdirectory

* upgrade iam profile

* revert new loader impl since cilium is not correctly loaded

* install chart if not already present during `upgrade apply`

* cleanup PR + fix build + add todos

cleanup PR + add todos

* shared helm pkg for cli install and bootstrapper

* add link to eks docs

* refactor iamMigrationCmd

* delete unused helm.symwallk

* move iammigrate to upgrade pkg

* fixup! delete unused helm.symwallk

* add to upgradecheck

* remove nodeSelector from go code (Otto)

* update iam docs and sort permission + remove duplicate roles

* fix bug in `upgrade check`

* better upgrade check output when svc version upgrade not possible

* pr feedback

* remove force flag in upgrade_test

* use upgrader.GetUpgradeID instead of extra type

* remove todos + fix check

* update doc lb (leo)

* remove bootstrapper helm package

* Update cli/internal/cmd/upgradecheck.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* final nits

* add docs for e2e upgrade test setup

* Apply suggestions from code review

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update cli/internal/helm/loader.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update cli/internal/cmd/tfmigrationclient.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* fix daniel review

* link to the iam permissions instead of manually updating them (agreed with leo)

* disable iam upgrade in upgrade apply

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Malte Poll
2023-07-24 10:30:53 +02:00
Malte Poll
8da6a23aa5
bootstrapper: add fallback endpoint and custom endpoint to SAN field (#2108)
terraform: collect apiserver cert SANs and support custom endpoint

constants: add new constants for cluster configuration and custom endpoint

cloud: support apiserver cert sans and prepare for endpoint migration on AWS

config: add customEndpoint field

bootstrapper: use per-CSP apiserver cert SANs

cli: route customEndpoint to terraform and add migration for apiserver cert SANs

bootstrapper: change interface of GetLoadBalancerEndpoint to return host and port separately
2023-07-21 16:43:51 +02:00
edgelessci
3324a4eba2
image: update measurements and image version (#2124)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-07-21 16:20:41 +02:00
Otto Bittner
cf822f7eee
cli: unify terraform variable creation (#2119)
Before we defined the variables twice.
Once for upgrades, once for create.
Also move default node group names into a constant
2023-07-21 10:04:29 +02:00
3u13r
f9391ed903
cli: print supported k8s versions on error (#2121) 2023-07-20 16:09:23 +02:00
Daniel Weiße
845253373d Add check to cilium vals loading
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
cf0ac148f3 Move control-plane tolerations var
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
e0ad836fdc Fix README
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
f61b05ad0b Ignore updates to CSI containers in renovate
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
9d8e2043a2 Add upgrade path for new/not-installed charts
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
ea5c83587c Move CSI charts to separate chart and cleanup loader code
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Malte Poll
cb22a25144 bazel: add yq to PATH in go generate 2023-07-20 15:47:12 +02:00
Daniel Weiße
aa00c43156 Add missing validating webhook configuration
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
8619a90149 Deploy CSI snapshotter on init
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:47:12 +02:00
Daniel Weiße
2c8c86a0cb
ci: remove Azure portal internal links from docs (#2122)
* Remove Azure internal links from docs

* Ignore Azure internal link in dev-docs

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-20 15:04:34 +02:00
Otto Bittner
c58d03a7b8
ci: fix ahead-check for working branch (#2120)
Also list remote branches during on-release
2023-07-19 17:48:29 +02:00
renovate[bot]
ac575c9a2c
deps: update quay.io/medik8s/node-maintenance-operator Docker tag to v0.15.0 (#2064)
* deps: update quay.io/medik8s/node-maintenance-operator Docker tag to v0.15.0

* upgrade vendored nmo api folder

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-07-19 15:37:17 +02:00
Malte Poll
6098ff3612
image: synchronize time via ntp (#2118) 2023-07-19 14:11:24 +02:00
Otto Bittner
c2849f4bbe
cli: ignore name changes on lb public ip resource (#2117)
Changing the name forces a recreate, which would break existing clusters.
The name change seems to be "only" about having clearer names.
2023-07-19 10:15:23 +02:00
edgelessci
2660c1aa87
image: update measurements and image version (#2116)
Co-authored-by: katexochen <katexochen@users.noreply.github.com>
2023-07-19 08:35:56 +02:00
Daniel Weiße
6a40c73ff7
disk-mapper: set LUKS2 token to allow reusing unintialized state disks (#2083)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-18 16:20:03 +02:00
renovate[bot]
dc373971b2
deps: update dependency cryptography to v41.0.2 [SECURITY] (#2106)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-07-18 15:33:23 +02:00
Daniel Weiße
d03f8c7d78
image: use AWS linux kernel for AWS images to fix deadlock (#2115)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-18 15:08:34 +02:00
Malte Poll
bae9dc9a36
image: always copy amazon ena driver into initrd (#2112) 2023-07-18 11:23:30 +02:00
Malte Poll
f597c12bca
cli: set Azure ConfidentialVM option in terraform vars when migrating (#2113) 2023-07-18 10:30:55 +02:00
Adrian Stobbe
320fd4b726
doc: add iam:DeletePolicyVersion (#2111)
* document iam:DeletePolicyVersion

* add in all doc versions
2023-07-18 10:24:52 +02:00
Moritz Sanft
9bc143ea7f
remove unused file.Handler (#2114) 2023-07-18 10:17:01 +02:00
Moritz Sanft
5f71934f56
cli: write Terraform migration output directly to constellation-id.json (#2107)
* backup `constellation-id.json` before upgrade

* remove superfluous `file.Handler` arguments

* merge `constellation-id.json` on upgrade

* fix typo
2023-07-18 09:33:42 +02:00
Malte Poll
5cbdb3a519
terraform: allows cluster name length of 10 characters on AWS (#2110) 2023-07-17 17:45:41 +02:00
Daniel Weiße
ac1128d07f
cryptsetup: unify code (#2043)
* Add common backend for interacting with cryptsetup

* Use common cryptsetup backend in bootstrapper

* Use common cryptsetup backend in disk-mapper

* Use common cryptsetup backend in csi lib

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-17 13:55:31 +02:00
Daniel Weiße
f52c6752e2
ci: update failure tasks (#2087)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-17 13:46:20 +02:00
Daniel Weiße
484b6c5c24
ci: combine node count inputs into one (#2084)
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2023-07-17 13:45:53 +02:00
Otto Bittner
4f1ed669d4
ci: increase autoscaling timeout to 25m (#2103)
During testing on AWS SNP we can sometimes observe the scaling
take longer than 15 mins due to slow setup times of SNP machines.
Eventually the scaling works as expected.
2023-07-17 10:30:14 +02:00
Otto Bittner
08e790b8fd
docs: mention need to delete variants (#2096) 2023-07-17 10:29:59 +02:00
Otto Bittner
c1c48f19bf chore: bump e2e-upgrade fromVersion 2023-07-17 10:29:43 +02:00
Otto Bittner
65cdaf0a23 chore: bump version.txt 2023-07-17 10:29:43 +02:00
edgelessci
a300b453f3
docs: add release v2.9.0 (#2102) 2023-07-14 16:24:05 +02:00
Moritz Sanft
43076e96a6
ci: fix resource selection for serial log downloading (#2101)
Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Otto Bittner <cobittner@posteo.net>
2023-07-13 16:28:33 +02:00
Otto Bittner
6ed8fce6b0
ci: separate PCR0 value for aws-sev-snp variant (#2100)
Co-authored-by: Malte Poll <mp@edgeless.systems>
2023-07-13 11:37:47 +02:00
Malte Poll
e4a6d4b4fa
ci: replicate Azure images to Southeast Asia (#2099) 2023-07-13 11:26:03 +02:00
Malte Poll
e536ff6df1
operators: correctly update launch template default version on AWS image upgrade (#2097)
Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
2023-07-12 16:50:36 +02:00
Otto Bittner
ff4b5db74c
config: make deployCSIDriver backwards compatible (#2088)
We added the field in 2.9 but can only require it in 2.10.
2023-07-12 15:08:37 +02:00
Malte Poll
26f4a13934
cli: allow helm upgrades with old k8s patch version (#2095) 2023-07-12 12:42:51 +02:00
Malte Poll
37af5f5f50
cli: allow upgrade to succeed if desired attestation config == actual config (#2094) 2023-07-12 11:53:00 +02:00