Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-12-25 07:29:38 -05:00
Code Issues Packages Projects Releases Wiki Activity
04c4cff9f6
constellation/bootstrapper
History
Otto Bittner 07f02a442c
Refactor Helm deployments (#341) 
* Wrap KMS deployment in one main chart that
deploys all other services. Other services will follow.
* Use .tgz via helm-package as serialization format
* Change Release type to carry chart as byte slice
* Remove KMSConfig
* Use json-schema to validate values
* Extend release.md to mention updating helm charts
2022-10-21 12:01:28 +02:00
..
cmd/bootstrapper Refactor Helm deployments (#341) 2022-10-21 12:01:28 +02:00
initproto Update proto files to v2 2022-09-22 09:10:19 +02:00
internal Refactor Helm deployments (#341) 2022-10-21 12:01:28 +02:00
bootstrapping_arch.svg Bootstrapper 2022-07-14 17:25:18 +02:00
README.md Simplify node lock and various small changes 2022-07-14 17:25:18 +02:00

README.md

Bootstrapper

The bootstrapper integrates the instance it is running on as node into the Kubernetes cluster. It is running on every new instance that is created.

bootstrapper architecture

The bootstrapper has two active components:

Init Flow

The InitServer is a gRPC server that is listining for initialization requests. The first instance needs to be initialized by the user, see the initproto for a description of the initialization protocol. The client that talks to this server is part of Constellation's CLI.

On an initialization request, the InitServer initializes a new Kubernetes cluster, essentially calling the InitCluster function of our Kubernetes library, which does a kubeadm init.

Join Flow

The JoinClient is a gRPC client that tries to connect to a JoinService of an already existing cluster. The JoinService validates the instance using aTLS. For details on the used protocol, see the joinservice package.

If the JoinService successfully verifies the instance, it issues a join ticket. The JoinClient then joins the cluster by calling the kubeadm join command, using the token and other needed information from the join ticket.

Synchronization, state machine, lifetime

The bootstrapper is automatically started on every new instance. Both InitServer and JoinClient are started and running in parallel. At some point during either the initialization or the join, a shared lock between the two components is acquired. This lock is used as point of no return. It is a state machine with two states (unlocked, locked) and a single transition from unlocked to locked. There is no way to unlock the node afterward (see nodelock package).

After the bootstrapping, the bootstrapper is stopped.