Constellation is the first Confidential Kubernetes. Constellation shields entire Kubernetes clusters from the (cloud) infrastructure using confidential computing.
Go to file
2022-07-05 14:41:58 +02:00
.github Sign CLI & create release on v* tag (#241) 2022-07-04 12:16:11 +02:00
access_manager Add verbosity flag to all services (#244) 2022-07-01 16:17:06 +02:00
activation Add verbosity flag to all services (#244) 2022-07-01 16:17:06 +02:00
cli IDsFilename -> ClusterIDsFilename 2022-07-05 14:41:58 +02:00
conformance Add cis benchmark to conformance test (#165) 2022-05-19 14:57:21 +02:00
coordinator AB#1915 Local PCR calculation (#243) 2022-07-04 12:59:43 +02:00
debugd Add verbosity flag to all services (#244) 2022-07-01 16:17:06 +02:00
docs terraform libvirt: document usage 2022-05-25 10:30:58 +02:00
hack AB#1915 Local PCR calculation (#243) 2022-07-04 12:59:43 +02:00
image Always pull newest image version of COSA (#182) 2022-05-31 10:36:29 +02:00
internal IDsFilename -> ClusterIDsFilename 2022-07-05 14:41:58 +02:00
kms Add verbosity flag to all services (#244) 2022-07-01 16:17:06 +02:00
mount Use Constellation KMS instead of deprecated vpn API for requesting keys (#248) 2022-07-05 09:48:47 +02:00
proto Add aTLS endpoint to KMS (#236) 2022-06-29 16:13:01 +02:00
state AB#1915 Local PCR calculation (#243) 2022-07-04 12:59:43 +02:00
terraform/libvirt AB#1915 Local PCR calculation (#243) 2022-07-04 12:59:43 +02:00
test Add aTLS endpoint to KMS (#236) 2022-06-29 16:13:01 +02:00
verify Add verbosity flag to all services (#244) 2022-07-01 16:17:06 +02:00
.dockerignore Implement activation service 2022-06-08 17:17:06 +02:00
.gitignore AB#2190 Verification service (#232) 2022-06-28 17:03:28 +02:00
.golangci.yml monorepo 2022-03-22 16:09:39 +01:00
CHANGELOG.md AB#2032 Write IDs to disk and read when verifying (#212) 2022-07-01 10:57:29 +02:00
CMakeLists.txt Invoke tests through ctest (#230) 2022-06-30 13:26:21 +02:00
CONTRIBUTING.md Inform about Go workspaces in CONTRIBUTING.md 2022-06-01 12:15:02 +02:00
Dockerfile.build fix build coordinator workflow (#190) 2022-06-01 17:17:37 +02:00
go.mod Use Constellation KMS instead of deprecated vpn API for requesting keys (#248) 2022-07-05 09:48:47 +02:00
go.sum Use Constellation KMS instead of deprecated vpn API for requesting keys (#248) 2022-07-05 09:48:47 +02:00
README.md Invoke tests through ctest (#230) 2022-06-30 13:26:21 +02:00

Constellation

This is the main repository of Constellation.

Core components:

  • access_manager: Contains the access-manager pod used to persist SSH users based on a K8s ConfigMap
  • cli: The CLI is used to manage a Constellation cluster
  • coordinator: The Coordinator is a node agent whose most important task is to bootstrap a node
  • image: Build files for the Constellation disk image
  • kms: Constellation's key management client and server
  • mount: Package used by CSI plugins to create and mount encrypted block devices
  • state: Contains the disk-mapper that maps the encrypted node data disk during boot

Development components:

  • conformance: Kubernetes conformance tests
  • debugd: Debug daemon and client
  • hack: Development tools
  • proto: Proto files generator
  • terraform: Infrastructure management using terraform (instead of constellation create/destroy)
    • libvirt: Deploy local cluster using terraform, libvirt and QEMU
  • test: Integration test

Additional repositories:

Build

Prerequisites:

  • Go 1.18

  • Docker

  • Packages on Ubuntu:

    sudo apt install build-essential cmake libssl-dev pkg-config libcryptsetup12 libcryptsetup-dev
    
  • Packages on Fedora:

    sudo dnf install @development-tools pkg-config cmake openssl-devel cryptsetup-libs cryptsetup-devel
    
mkdir build
cd build
cmake ..
make -j`nproc`

Testing

You can run all integration and unitttests like this:

ctest -j `nproc`

Cloud credentials

Using the CLI requires the user to make authorized API calls to the CSP API. See the docs for configuration.

Deploying a locally compiled coordinator binary

By default, constellation create ... will spawn cloud provider instances with a pre-baked coordinator binary. For testing, you can use the constellation debug daemon (debugd) to upload your local coordinator binary to running instances and to obtain SSH access. Follow this introduction on how to install and setup cdbg

Development Guides

Deployment Guides