mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-16 19:34:37 -05:00
913b09aeb8
* terraform: enable creation of SEV-SNP VMs on GCP * variant: add SEV-SNP attestation variant * config: add SEV-SNP config options for GCP * measurements: add GCP SEV-SNP measurements * gcp: separate package for SEV-ES * attestation: add GCP SEV-SNP attestation logic * gcp: factor out common logic * choose: add GCP SEV-SNP * cli: add TF variable passthrough for GCP SEV-SNP variables * cli: support GCP SEV-SNP for `constellation verify` * Adjust usage of GCP SEV-SNP throughout codebase * ci: add GCP SEV-SNP * terraform-provider: support GCP SEV-SNP * docs: add GCP SEV-SNP reference * linter fixes * gcp: only run test with TPM simulator * gcp: remove nonsense test * Update cli/internal/cmd/verify.go Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * Update docs/docs/overview/clouds.md Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> * Update terraform-provider-constellation/internal/provider/attestation_data_source_test.go Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com> * linter fixes * terraform_provider: correctly pass down CC technology * config: mark attestationconfigapi as unimplemented * gcp: fix comments and typos * snp: use nonce and PK hash in SNP report * snp: ensure we never use ARK supplied by Issuer (#3025) * Make sure SNP ARK is always loaded from config, or fetched from AMD KDS * GCP: Set validator `reportData` correctly --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * attestationconfigapi: add GCP to uploading * snp: use correct cert Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * terraform-provider: enable fetching of attestation config values for GCP SEV-SNP * linter fixes --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com> Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
266 lines
8.4 KiB
Go
266 lines
8.4 KiB
Go
/*
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package provider
|
|
|
|
import (
|
|
"regexp"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
|
|
)
|
|
|
|
func TestAccImageDataSource(t *testing.T) {
|
|
// Set the path to the Terraform binary for acceptance testing when running under Bazel.
|
|
bazelPreCheck := func() { bazelSetTerraformBinaryPath(t) }
|
|
|
|
testCases := map[string]resource.TestCase{
|
|
"no version succeeds": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactoriesWithVersion("v2.13.0"),
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
attestation_variant = "aws-sev-snp"
|
|
csp = "aws"
|
|
region = "eu-west-1"
|
|
}
|
|
`,
|
|
Check: resource.ComposeTestCheckFunc(
|
|
resource.TestCheckResourceAttrSet("data.constellation_image.test", "image.reference"),
|
|
resource.TestCheckResourceAttrSet("data.constellation_image.test", "image.version"),
|
|
resource.TestCheckResourceAttrSet("data.constellation_image.test", "image.short_path"),
|
|
),
|
|
},
|
|
},
|
|
},
|
|
"aws succcess": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "aws-sev-snp"
|
|
csp = "aws"
|
|
region = "eu-west-1"
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "ami-04f8d522b113b73bf"), // should be immutable
|
|
|
|
},
|
|
},
|
|
},
|
|
"aws without region fails": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "aws-sev-snp"
|
|
csp = "aws"
|
|
}
|
|
`,
|
|
ExpectError: regexp.MustCompile(".*Region must be set for AWS.*"),
|
|
},
|
|
},
|
|
},
|
|
"aws marketplace success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "aws-sev-snp"
|
|
csp = "aws"
|
|
marketplace_image = true
|
|
region = "eu-west-1"
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "resolve:ssm:/aws/service/marketplace/prod-77ylkenlkgufs/v2.13.0"), // should be immutable,
|
|
},
|
|
},
|
|
},
|
|
"azure success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "azure-sev-snp"
|
|
csp = "azure"
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "/communityGalleries/ConstellationCVM-b3782fa0-0df7-4f2f-963e-fc7fc42663df/images/constellation/versions/2.13.0"), // should be immutable
|
|
|
|
},
|
|
},
|
|
},
|
|
"azure marketplace success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "azure-sev-snp"
|
|
csp = "azure"
|
|
marketplace_image = true
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "constellation-marketplace-image://Azure?offer=constellation&publisher=edgelesssystems&sku=constellation&version=2.13.0"), // should be immutable
|
|
|
|
},
|
|
},
|
|
},
|
|
"gcp sev-es success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "gcp-sev-es"
|
|
csp = "gcp"
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "projects/constellation-images/global/images/v2-13-0-gcp-sev-es-stable"), // should be immutable,
|
|
},
|
|
},
|
|
},
|
|
// TODO(msanft): Enable once v2.17.0 is available
|
|
// "gcp sev-snp success": {
|
|
// ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
// PreCheck: bazelPreCheck,
|
|
// Steps: []resource.TestStep{
|
|
// {
|
|
// Config: testingConfig + `
|
|
// data "constellation_image" "test" {
|
|
// version = "v2.17.0"
|
|
// attestation_variant = "gcp-sev-snp"
|
|
// csp = "gcp"
|
|
// }
|
|
// `,
|
|
// Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "projects/constellation-images/global/images/v2-13-0-gcp-sev-es-stable"), // should be immutable,
|
|
// },
|
|
// },
|
|
// },
|
|
"stackit success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.16.0"
|
|
attestation_variant = "qemu-vtpm"
|
|
csp = "stackit"
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "8ffc1740-1e41-4281-b872-f8088ffd7692"), // should be immutable,
|
|
},
|
|
},
|
|
},
|
|
"openstack success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.16.0"
|
|
attestation_variant = "qemu-vtpm"
|
|
csp = "openstack"
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "8ffc1740-1e41-4281-b872-f8088ffd7692"), // should be immutable,
|
|
},
|
|
},
|
|
},
|
|
"unknown attestation variant": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "unknown"
|
|
csp = "azure"
|
|
}
|
|
`,
|
|
ExpectError: regexp.MustCompile(".*Attribute attestation_variant value must be one of.*"),
|
|
},
|
|
},
|
|
},
|
|
"unknown csp": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "azure-sev-snp"
|
|
csp = "unknown"
|
|
}
|
|
`,
|
|
ExpectError: regexp.MustCompile(".*Attribute csp value must be one of.*"),
|
|
},
|
|
},
|
|
},
|
|
"invalid version": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "xxx"
|
|
attestation_variant = "azure-sev-snp"
|
|
csp = "azure"
|
|
}
|
|
`,
|
|
ExpectError: regexp.MustCompile(".*Invalid Version.*"),
|
|
},
|
|
},
|
|
},
|
|
"gcp marketplace success": {
|
|
ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
|
|
PreCheck: bazelPreCheck,
|
|
Steps: []resource.TestStep{
|
|
{
|
|
Config: testingConfig + `
|
|
data "constellation_image" "test" {
|
|
version = "v2.13.0"
|
|
attestation_variant = "gcp-sev-es"
|
|
csp = "gcp"
|
|
marketplace_image = true
|
|
}
|
|
`,
|
|
Check: resource.TestCheckResourceAttr("data.constellation_image.test", "image.reference", "projects/mpi-edgeless-systems-public/global/images/v2-13-0-gcp-sev-es-stable"), // should be immutable,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
for name, tc := range testCases {
|
|
t.Run(name, func(t *testing.T) {
|
|
resource.Test(t, tc)
|
|
})
|
|
}
|
|
}
|