mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-09-20 08:15:56 +00:00
102 lines
3.4 KiB
YAML
102 lines
3.4 KiB
YAML
name: Constellation verify
|
|
description: "Verify a Constellation cluster."
|
|
|
|
inputs:
|
|
osImage:
|
|
description: "The OS image used in the cluster."
|
|
required: true
|
|
cloudProvider:
|
|
description: "The cloud provider used in the cluster."
|
|
required: true
|
|
kubeconfig:
|
|
description: "The kubeconfig file for the cluster."
|
|
required: true
|
|
cosignPassword:
|
|
required: true
|
|
description: "The password for the cosign private key."
|
|
cosignPrivateKey:
|
|
required: true
|
|
description: "The cosign private key."
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Expand version path
|
|
id: expand-version
|
|
uses: ./.github/actions/shortname
|
|
with:
|
|
shortname: ${{ inputs.osImage }}
|
|
|
|
- name: Constellation fetch measurements
|
|
shell: bash
|
|
run: |
|
|
if [[ ${{ steps.expand-version.outputs.stream }} == "debug" ]]
|
|
then
|
|
constellation config fetch-measurements --insecure
|
|
else
|
|
constellation config fetch-measurements
|
|
fi
|
|
|
|
- name: Constellation verify
|
|
shell: bash
|
|
run: constellation verify --cluster-id $(jq -r ".clusterID" constellation-id.json) --force
|
|
|
|
- name: Verify all nodes
|
|
shell: bash
|
|
env:
|
|
KUBECONFIG: ${{ inputs.kubeconfig }}
|
|
run: |
|
|
clusterID=$(jq -r ".clusterID" constellation-id.json)
|
|
nodes=$(kubectl get nodes -o json | jq -r ".items[].metadata.name")
|
|
|
|
for node in $nodes ; do
|
|
verificationPod=$(kubectl get pods --field-selector spec.nodeName=${node} -n kube-system | grep "verification-service" | cut -d' ' -f1)
|
|
|
|
mapfile -t verificationPod <<< "$verificationPod"
|
|
|
|
if [[ ${#verificationPod[@]} -ne 1 ]]; then
|
|
echo "Expected 1 verification pod for node ${node}, found ${#verificationPodArray[@]}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Verifying pod ${verificationPod} on node ${node}"
|
|
|
|
kubectl wait -n kube-system "pod/${verificationPod}" --for=condition=ready --timeout=5m
|
|
kubectl port-forward -n kube-system "pods/${verificationPod}" 9090:9090 &
|
|
forwarderPID=$!
|
|
sleep 5
|
|
|
|
verifyOut=$(constellation verify --cluster-id "${clusterID}" --force --node-endpoint localhost:9090)
|
|
|
|
kill $forwarderPID
|
|
|
|
if [[ ${{ inputs.cloudProvider }} != "azure" ]]; then
|
|
continue
|
|
fi
|
|
|
|
echo "Extracting TCB versions for API update"
|
|
startMAAToken="Microsoft Azure Attestation Token:"
|
|
endMAAToken="Verification OK"
|
|
sed -n "/${startMAAToken}/,/${endMAAToken}/ { /${startMAAToken}/d; /${endMAAToken}/d; p }" <<< "${verifyOut}" > "maa-claims-${node}.json"
|
|
done
|
|
|
|
- name: Login to AWS
|
|
if: github.ref_name == 'main' && inputs.cloudProvider == 'azure'
|
|
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
|
|
with:
|
|
role-to-assume: arn:aws:iam::795746500882:role/GitHubConstellationImagePipeline
|
|
aws-region: eu-central-1
|
|
|
|
- name: Upload extracted TCBs
|
|
if: github.ref_name == 'main' && inputs.cloudProvider == 'azure'
|
|
shell: bash
|
|
env:
|
|
COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
|
|
COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
|
|
run: |
|
|
for file in $(ls maa-claims-*.json); do
|
|
path=$(realpath "${file}")
|
|
cat "${path}"
|
|
bazel run //internal/api/attestationconfigapi/cli -- --maa-claims-path "${path}"
|
|
done
|