Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-10-01 01:36:09 -04:00
Code Issues Packages Projects Releases Wiki Activity
71b5a0c6c0
constellation/cli
History
Daniel Weiße eb3411f2c1 Allow waiting for multiple states (#11) 
* Simplify `fetch_pcrs.sh` script

* Allow waiting for multiple states

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2022-03-29 09:10:22 +02:00
..
azure Cloud provider Azure: adopt changes to CCM / CNM for Azure 2022-03-28 13:35:21 +02:00
cloud/cloudtypes monorepo 2022-03-22 16:09:39 +01:00
cloudprovider monorepo 2022-03-22 16:09:39 +01:00
cmd Allow waiting for multiple states (#11) 2022-03-29 09:10:22 +02:00
ec2 monorepo 2022-03-22 16:09:39 +01:00
file monorepo 2022-03-22 16:09:39 +01:00
gcp monorepo 2022-03-22 16:09:39 +01:00
proto monorepo 2022-03-22 16:09:39 +01:00
status Allow waiting for multiple states (#11) 2022-03-29 09:10:22 +02:00
vpn monorepo 2022-03-22 16:09:39 +01:00
main.go monorepo 2022-03-22 16:09:39 +01:00
README.md monorepo 2022-03-22 16:09:39 +01:00

README.md

CLI to spawn a confidential kubernetes cluster

Usage

  1. (optional) replace the responsible in cli/cmd/defaults.go with yourself.
  2. Build the CLI and authenticate with <AWS/Azure/GCP> according to the README.md.
  3. Execute constellation create <aws/azure/gcp> 2 <4xlarge|n2d-standard-2>.
  4. Execute wg genkey | tee privatekey | wg pubkey > publickey to generate a WireGuard keypair.
  5. Execute constellation init --publickey publickey. Since the CLI waits for all nodes to be ready, this step can take up to 5 minutes.
  6. Use the output from constellation init and the wireguard template below to create /etc/wireguard/wg0.conf, then execute wg-quick up wg0.
  7. Execute export KUBECONFIG=<path/to/admin.conf>.
  8. Use kubectl get nodes to inspect your cluster.
  9. Execute constellation terminate to terminate your Constellation.
[Interface]
Address = <address from the init output>
PrivateKey = <your base64 encoded private key>
ListenPort = 51820

[Peer]
PublicKey = <public key from the init output>
AllowedIPs = 10.118.0.1/32 # IP set on the peer's wg interface
Endpoint = <public IPv4 address from the activated coordinator>:51820  # address where the peer listens on
PersistentKeepalive = 10

Note: Skip the manual configuration of WireGuard by executing Step 2 as root. Then, replace steps 4 and 5 with sudo constellation init --privatekey <path/to/your/privatekey>. This will automatically configure a new WireGuard interface named wg0 with the coordinator as peer.