mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
Constellation is the first Confidential Kubernetes. Constellation shields entire Kubernetes clusters from the (cloud) infrastructure using confidential computing.
6dc97590fe
* Enable and configure k8s audit-log * Update coordinator/kubernetes/k8sapi/kubeadm_config.go Co-authored-by: Malte Poll <mp@edgeless.systems> * add mount point for audit log dir in kubeadm conf * Mount audit policy into kube-apiserver static pod * Write default auditpolicy on cluster init / cluster join Co-authored-by: Malte Poll <mp@edgeless.systems> |
||
|---|---|---|
| .github | ||
| cli | ||
| conformance | ||
| coordinator | ||
| debugd | ||
| docs | ||
| hack | ||
| image | ||
| internal | ||
| kms | ||
| mount | ||
| proto | ||
| state | ||
| test | ||
| .dockerignore | ||
| .gitignore | ||
| .golangci.yml | ||
| CMakeLists.txt | ||
| CONTRIBUTING.md | ||
| Dockerfile.build | ||
| Dockerfile.e2e | ||
| go.mod | ||
| go.sum | ||
| go.work | ||
| go.work.sum | ||
| README.md | ||
Constellation
This is the main repository of Constellation.
Core components:
- cli: The CLI is used to manage a Constellation cluster
- coordinator: The Coordinator is a node agent whose most important task is to bootstrap a node
- image: Build files for the Constellation disk image
- kms: Constellation's key management client and server
- mount: Package used by CSI plugins to create and mount encrypted block devices
- state: Contains the disk-mapper that maps the encrypted node data disk during boot
Development components:
- conformance: Kubernetes conformance tests
- debugd: Debug daemon and client
- hack: Development tools
- proto: Proto files generator
- test: Integration test
Additional repositories:
- constellation-docs: End-user documentation
- constellation-coreos-assembler: Build environment for CoreOS images with changes for Constellation
- constellation-fedora-coreos-config: CoreOS build configuration with changes for Constellation
- edg-azuredisk-csi-driver: Azure CSI driver with encryption on node
- edg-gcp-compute-persistent-disk-csi-driver: GCP CSI driver with encryption on node
Build
Prerequisites:
- Go 1.18
- Packages on Ubuntu:
sudo apt install build-essential cmake libssl-dev pkg-config libcryptsetup12 libcryptsetup-dev
mkdir build
cd build
cmake ..
make -j`nproc`
Cloud credentials
Using the CLI requires the user to make authorized API calls to the CSP API. See the docs for configuration.
Deploying a locally compiled coordinator binary
By default, constellation create ... will spawn cloud provider instances with a pre-baked coordinator binary.
For testing, you can use the constellation debug daemon (debugd) to upload your local coordinator binary to running instances and to obtain SSH access.
Follow this introduction on how to install and setup cdbg