2.7 KiB
Activation
Implementation for Constellation's node activation flow.
The activation service runs on each control-plane node of the Kubernetes cluster. New nodes (at cluster start, or later through autoscaling) send an activation request to the service over aTLS. The activation service verifies the new nodes certificate and attestation statement. If attestation is successful, the new node is supplied with a disk encryption key for its state disk, and a Kubernetes bootstrap token, so it may join the cluster.
The activation service uses klog v2 for logging.
Use the -v flag to set the log verbosity level.
Use different verbosity levels during development depending on the information:
-
2 for information that should always be logged. Examples: server starting, new gRPC request.
-
4 for general logging. If you are unsure what log level to use, use 4.
-
6 for low level information logging. Example: values of new expected measurements
-
Potentially sensitive information, such as return values of functions should never be logged.
Packages
activationproto
Proto definitions for the activation service.
server
The server implements gRPC endpoints for joining the cluster and holds the main application logic.
Connections between the activation service and joining nodes are secured using aTLS
Worker nodes call the ActivateNode endpoint.
sequenceDiagram
participant New Node
participant Activation Service
New Node-->>Activation Service: aTLS Handshake (server side verification)
Activation Service-->>New Node:
New Node->>+Activation Service: grpc::ActivateNode(DiskUUID)
Activation Service->>+KMS: grpc::GetDataKey(DiskUUID)
KMS->>-Activation Service: DiskEncryptionKey
Activation Service->>-New Node: [DiskEncryptionKey, KubernetesJoinToken]
Control-plane nodes call the ActivateCoordinator endpoint.
kms
Implements interaction with Constellation's key management service. This is needed for fetching data encryption keys for joining nodes.
kubeadm
Implements interaction with the Kubernetes API to create join tokens for new nodes.
validator
A wrapper for the more generic atls.Validator, allowing for updates to the underlying validator without having to restart the service.
watcher
Uses fsnotify to wait for expected measurement updates, and updates the validator if any occur.
Dockerfile
DOCKER_BUILDKIT=1 docker build --build-arg PROJECT_VERSION="v1.0.0" -t ghcr.io/edgelesssys/activation-service:v1.0.0 -f activation/Dockerfile .