mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
4adc19b7f5
* Add join-config entry for "enforceIdKeyDigest" bool * Add join-config entry for "idkeydigest" * Initially filled with TPM value from bootstrapper * Add config entries for idkeydigest and enforceIdKeyDigest * Extend azure attestation validator to check idkeydigest, if configured. * Update unittests * Add logger to NewValidator for all CSPs * Add csp to Updateable type Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems>
120 lines
3.9 KiB
Go
120 lines
3.9 KiB
Go
/*
|
|
Package constants contains the constants used by Constellation.
|
|
Constants should never be overwritable by command line flags or configuration files.
|
|
*/
|
|
package constants
|
|
|
|
import "time"
|
|
|
|
const (
|
|
//
|
|
// Constellation.
|
|
//
|
|
|
|
// ConstellationNameLength is the maximum length of a Constellation's name.
|
|
ConstellationNameLength = 37
|
|
// ConstellationMasterSecretStoreName is the name for the Constellation secrets in Kubernetes.
|
|
ConstellationMasterSecretStoreName = "constellation-mastersecret"
|
|
// ConstellationMasterSecretKey is the name of the key for master secret in the master secret store secret.
|
|
ConstellationMasterSecretKey = "mastersecret"
|
|
// ConstellationMasterSecretSalt is the name of the key for salt in the master secret store secret.
|
|
ConstellationMasterSecretSalt = "salt"
|
|
|
|
//
|
|
// Ports.
|
|
//
|
|
|
|
// JoinServicePort is the port for reaching the join service within Kubernetes.
|
|
JoinServicePort = 9090
|
|
// JoinServiceNodePort is the port for reaching the join service outside of Kubernetes.
|
|
JoinServiceNodePort = 30090
|
|
VerifyServicePortHTTP = 8080
|
|
VerifyServicePortGRPC = 9090
|
|
VerifyServiceNodePortHTTP = 30080
|
|
VerifyServiceNodePortGRPC = 30081
|
|
// KMSPort is the port the KMS server listens on.
|
|
KMSPort = 9000
|
|
BootstrapperPort = 9000
|
|
KubernetesPort = 6443
|
|
RecoveryPort = 9000
|
|
EnclaveSSHPort = 2222
|
|
SSHPort = 22
|
|
NVMEOverTCPPort = 8009
|
|
DebugdPort = 4000
|
|
// Default NodePort Range
|
|
// https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
|
NodePortFrom = 30000
|
|
NodePortTo = 32767
|
|
|
|
//
|
|
// Filenames.
|
|
//
|
|
StateFilename = "constellation-state.json"
|
|
ClusterIDsFileName = "constellation-id.json"
|
|
ConfigFilename = "constellation-conf.yaml"
|
|
LicenseFilename = "constellation.license"
|
|
DebugdConfigFilename = "cdbg-conf.yaml"
|
|
AdminConfFilename = "constellation-admin.conf"
|
|
MasterSecretFilename = "constellation-mastersecret.json"
|
|
WGQuickConfigFilename = "wg0.conf"
|
|
CoreOSAdminConfFilename = "/etc/kubernetes/admin.conf"
|
|
KubeadmCertificateDir = "/etc/kubernetes/pki"
|
|
|
|
//
|
|
// Filenames for Constellation's micro services.
|
|
//
|
|
|
|
// ServiceBasePath is the base path for the mounted micro service's files.
|
|
ServiceBasePath = "/var/config"
|
|
// MeasurementsFilename is the filename of CC measurements.
|
|
MeasurementsFilename = "measurements"
|
|
// EnforcedPCRsFilename is the filename for a list PCRs that are required to pass attestation.
|
|
EnforcedPCRsFilename = "enforcedPCRs"
|
|
// MeasurementSaltFilename is the filename of the salt used in creation of the clusterID.
|
|
MeasurementSaltFilename = "measurementSalt"
|
|
// MeasurementSecretFilename is the filename of the secret used in creation of the clusterID.
|
|
MeasurementSecretFilename = "measurementSecret"
|
|
// IdKeyDigestFilename is the name of the file holding the currently enforced idkeydigest.
|
|
IdKeyDigestFilename = "idkeydigest"
|
|
// EnforceIdKeyDigestFilename is the name of the file configuring whether idkeydigest is enforced or not.
|
|
EnforceIdKeyDigestFilename = "enforceIdKeyDigest"
|
|
// K8sVersion is the filename of the mapped "k8s-version" configMap file.
|
|
K8sVersion = "k8s-version"
|
|
|
|
//
|
|
// CLI.
|
|
//
|
|
|
|
MinControllerCount = 1
|
|
MinWorkerCount = 1
|
|
|
|
//
|
|
// Kubernetes.
|
|
//
|
|
|
|
KubernetesJoinTokenTTL = 15 * time.Minute
|
|
ConstellationNamespace = "kube-system"
|
|
JoinConfigMap = "join-config"
|
|
|
|
//
|
|
// Helm.
|
|
//
|
|
|
|
HelmNamespace = "kube-system"
|
|
|
|
//
|
|
// Releases.
|
|
//
|
|
|
|
// S3PublicBucket contains measurements & releases.
|
|
S3PublicBucket = "https://public-edgeless-constellation.s3.us-east-2.amazonaws.com/"
|
|
// CosignPublicKey signs all our releases.
|
|
CosignPublicKey = `-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Iv15myTjpa1KznlGFe+dBEjN91q
|
|
oGhQf4z+3TgFjv+Z+6ATPA1OPANf0//6p+goKifNZD5+Cq/VEAP7xOhlYw==
|
|
-----END PUBLIC KEY-----`
|
|
)
|
|
|
|
// VersionInfo is the version of a binary. Left as a separate variable to allow override during build.
|
|
var VersionInfo = "0.0.0"
|