constellation/docs/versioned_docs/version-2.0/getting-started/install.md

Installation and Setup

Constellation runs entirely in your cloud environment and can be easily controlled via a dedicated Command Line Interface (CLI).

The installation process will guide you through the steps of installing the CLI on your machine, verifying it, and connecting it to your Cloud Service Provider (CSP).

Prerequisites

Before we start, make sure the following requirements are fulfilled:

• Your machine is running Ubuntu or macOS
• You have admin rights on your machine
• kubectl is installed
• Your cloud provider is Microsoft Azure or Google Cloud

Install the Constellation CLI

The Constellation CLI can be downloaded from our release page. Therefore, navigate to a release and download the constellation binary for your operating system and architecture. Move the downloaded file to a directory in your PATH (default: /usr/local/bin) and make it executable by entering chmod u+x constellation in your terminal.

Running constellation should then give you:

$ constellation
Manage your Constellation cluster.

Usage:
  constellation [command]

...

Optional: Enable shell autocompletion

The Constellation CLI supports autocompletion for various shells. To set it up, run constellation completion and follow the steps.

Verify the CLI

For extra security, make sure to verify your CLI. Therefore, install cosign. Then, head to our release page again and, from the same release as before, download the following files:

• cosign.pub (Edgeless System's cosign public key)
• constellation-*.sig (the CLI's signature)

You can then verify your CLI before launching a cluster using the paths to the public key, signature, and CLI executable:

cosign verify-blob --key cosign.pub --signature constellation.sig constellation

For more detailed information read our installation, update and verification documentation.

Set up cloud credentials

The CLI makes authenticated calls to the CSP API. Therefore, you need to set up Constellation with the credentials for your CSP.

Authentication

In the following, we provide you with different ways to authenticate with your CSP.

:::danger

Don't use the testing methods for setting up a production-grade Constellation cluster. In those methods, secrets are stored on disk during installation which would be exposed to the CSP.

:::

Testing

To try out Constellation, using a cloud environment such as Azure Cloud Shell is the quickest way to get started.

Production

For production clusters, use the latest version of the Azure CLI on a trusted machine:

az login

Other options are described in Azure's authentication guide.

Enable the following cloud APIs first:

• Compute Engine API
• Cloud Resource Manager API
• Identity and Access Management (IAM) API

Testing

• If you are running from within a Google VM, and the VM is allowed to access the necessary APIs, no further configuration is needed.

• If you are using the Google Cloud Shell, make sure your session is authorized. For example, execute gsutil and accept the authorization prompt.

Production

For production clusters, use one of the following options on a trusted machine:

• Use the gcloud CLI

  gcloud auth application-default login
  

  This will ask you to log in to your Google account, and then create your credentials. The Constellation CLI will automatically load these credentials when needed.

• Set up a service account and pass the credentials manually

  Follow Google's guide for setting up your credentials.

Authorization

Your user account needs the following permissions to set up a Constellation cluster:

• Contributor
• User Access Administrator

Your user account needs the following permissions to set up a Constellation:

• compute.* (or the subset defined by roles/compute.instanceAdmin.v1)
• iam.serviceAccountUser

Follow Google's guide on understanding and assigning roles.

Next Steps

Once you have followed all previous steps, you can proceed to deploy your first confidential Kubernetes cluster and application.